The purpose of this privacy policy (hereinafter ”Privacy Policy”) is to inform you of how Beredskapslyftet Ideell Förening (hereinafter ”Beredskapslyftet”, ”we”, or ”us”) processes and protects your personal data, including your rights in relation to our processing of your personal data in connection with projects organized by Beredskapslyftet. This Privacy Policy provides details regarding what personal data is collected, why the personal data is collected, how the collected personal data is used and your options and rights regarding the processing of your personal data.

Beredskapslyftet is the data controller for the processing of personal data set out in this Privacy Policy.

2. What is ”personal data” and ”processing of personal data”?

The term ”personal data” as used in this Privacy Policy refers to any piece of information that, either on its own or together with any other pieces of information, can be traced back to a living individual, as well as any other data that qualifies as personal data in accordance with the law applicable to Beredskapslyftet.

This Privacy Policy covers all personal data that is in any form considered processed under the relevant law, including personal data that is kept, stored, collected, transferred, disclosed or otherwise processed.

3. What kind of personal data will we process and how?

Contact persons at companies and business partners

In relation to contact persons at companies and business partners, we may process your contact details (i.e. first name, last name, business telephone number and email address) for our legitimate interests to be able to contact you and the organization you represent (such as regarding vacancies or offers to participate in events or projects with us) and to administer and facilitate any project in which the organization you represent participates. We may obtain your contact details from third parties that provide contact lists to different companies and organizations. If we have an agreement with the organization you represent, we will also process your contact details to be able to administer and fulfill such agreement, during the term of the agreement, as required by applicable legislation or otherwise for as long as a claim can be raised against us.

Participants

Notice of interest

If you apply for a project with us, we will process the personal data you submit to us for the purpose of assessing your application against the selection criteria outlined in the notice of interest form, based on our legitimate interest in assessing your application. Such personal data include your first and last name, email address, address, phone number, date of birth, gender, information about your previous work such as previous title/role, current organization you work for, work address (street address, postcode, city and country) and any other information you provide directly to us through the application (e.g. files, URL of a link with information about you, social media link or CV you choose to upload). As some projects are tailored for unemployed people, we may also ask you to indicate your current work status.

If you match the selection criteria

If you have been awarded participation in a project or otherwise match the selection criteria set out in relation to what you have applied for, we will process your personal data (i.e. the personal data set out under ”Notice of interest” including information regarding any previous participation in projects, such as trainings, roles and tasks) to be able to contact you (such as in relation to vacancies and opportunities to participate in events and other projects), and to administer and facilitate any project you are involved in, based on our legitimate interest to be able to contact you and administer such project.

Claims and legal obligations

In addition to the above, personal data may also be stored based on our legitimate interest in defending ourselves against claims for as long as a claim can be invoked against us. Personal data may also be stored based on a legal obligation to enable us to comply with legal obligations, including responding to requests from authorities to access personal data, for as long as required to respond to such request or otherwise fulfill the legal obligation.

4. To what categories of third parties will my personal data be disclosed?

Authorities

We may need to provide personal data to certain authorities (e.g. the police and tax authority) in accordance with mandatory law and in order to fulfill legal obligations, or to establish, exercise or defend legal claims.

Project-related companies and organizations

Your personal data may be transferred to and processed by companies and organizations participating or otherwise being involved in the project in order to facilitate and provide the project. Only personal data necessary to provide the project will be transferred to the project-related companies and organizations. The project-related companies and organizations will act as independent data controllers in respect of your data. We refer to their respective privacy notices for further details.

Companies engaged by us

Your personal data may be transferred to third-party providers and suppliers that perform services for us (acting as data processors or controllers), to enable these companies to perform the services requested by us. Services that may be requested include the provision of email services, cloud services, legal services, services from business partners and training providers. Only the personal data necessary to fulfill the purposes with the relevant processing will be provided to these companies. All third-party providers and suppliers must, when acting as data processors, follow our instructions and the applicable written data processing agreement and any other agreement in place between Beredskapslyftet and its third-party providers and must also implement suitable technical and organizational measures for the protection of the personal data.

Corporate transactions

Your personal data may also be disclosed to a third party based on our legitimate interest as part of a merger, transfer, acquisition or sale of Beredskapslyftet.

5. To what countries will my personal data be transferred?

Personal data may be transferred to legal entities located in a country that offers a lower level of protection for personal data than the country in which you are domiciled. All personal data transferred to a country that offers a lower level of protection for personal data will be transferred in accordance with our current policies regarding the transfer of personal data, as applicable from time to time, to ensure that the transfer of personal data complies with the law. If your personal data is transferred to a country that offers a lower level of protection for personal data, we will take appropriate measures in accordance with applicable law to ensure that your personal data remains protected. Such measures include the use of the European Commission’s standard contractual clauses (art. 46.2(c) GDPR) to protect the transfer of your personal data. The standard contractual clauses are available here. Transfers to the U.S. can also be carried out to third parties that are part of the EU-US Data Privacy Framework (art. 45 GDPR), certifying that they have committed to comply with a detailed set of privacy obligations to ensure an adequate level of protection for the personal data transferred.

6. For how long will my personal data be processed?

We will not store or process personal data for a period longer than necessary to fulfill the purposes in Section 3, or until you withdraw your consent regarding personal data processed based on such consent, or to comply with applicable law.

Accordingly, personal data will be processed until we have evaluated your notice of interest. If your notice of interest has led to participation in a project or otherwise matches the selection criteria, we will process your personal data for one (1) year after your registration with us or your participation in a project for the purposes set out in Section 3, unless you have consented to your personal data being processed for a longer period. You may withdraw your consent at any time by contacting us as the contact details set out in Section 11. Personal data may otherwise be processed for as long as required by applicable legislation, or for as long as a claim can be raised against us. Once the purpose for processing a specific type of personal data has been fulfilled, we will cease using the personal data for that purpose. If such data is not needed for any other purpose, it will be deleted as soon as reasonably possible.

7. What are my rights with regards to my personal data?

As a data subject, you have several rights regarding the processing of your personal data. A description of these rights is set out below.

If you want to make use of your rights you can do so by contacting us, please see Section 11 for further information.

Right to object

You have the right to at any time, on grounds relating to your particular situation, object to the processing of personal data relating to you when the processing is based on the legal basis of data processing in the public interest or when we base the processing on our legitimate interest. You also have the right to object to processing for direct marketing purposes, including profiling.

If you lodge an objection, we will no longer process the personal data related to you that we process based on our legitimate interest unless we can demonstrate compelling and legitimate reasons for such processing that overrides your privacy interests or if we need to establish, exercise or defend legal claims.

Even if you object to certain processing, we may still continue such processing if permitted or obligated to do so under applicable legislation, for example to be able to fulfill legal requirements or to fulfill contractual obligations in relation to a data subject. However, we will always stop processing your personal data for marketing purposes if you require us to do so.

Right to access

You have the right to request access to the personal data that is processed by us, including what personal data Beredskapslyftet is processing in relation to you, the source of the personal data, for what purposes the data has been processed, how long the personal data will be retained, and the identity of the parties that the data has been provided to.

You also have a right, upon request, to access information about how we have concluded that we have a legitimate interest in processing personal data for a specific purpose.

Right to rectification

You have the right to, at any time, request that any inaccurate or incomplete personal data is corrected. As soon as we become aware of any inaccurate personal data being processed, we will always rectify such personal data without undue delay and notify you accordingly.

Right to erasure

You may also request that your personal data should be erased if e.g.:

• the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;

• you object to the processing of your personal data, in accordance with your right to object as set out above and we do not have an overriding legitimate interest;

• the processing is unlawful; or

• the personal data has to be erased to enable us to comply with a legal requirement.

Please note that we may reject your request if the processing is permitted or required according to law or any other relevant legal ground, or if we need to establish, exercise or defend legal claims. If you have any questions about your right to erasure, please contact the responsible contact person stated in Section 11 below.

Right to restriction

You are also entitled to request us to restrict the processing of your personal data, if:

• you contest the accuracy of the personal data, and we must restrict the processing for a certain period to enable us to verify the accuracy of relevant data;

• the processing is unlawful, and you oppose the erasure of the personal data but instead request restriction of the use;

• we no longer need the personal data for the purposes of the processing as stipulated under Section 3 in this Privacy Policy, but the personal data is required by you for the establishment, exercise or defense of a legal claim; or

• you have objected to processing pursuant to what is set out under the Section ”right to object” above, and our verification of the legitimate grounds is pending.

Right to data portability

If you request access to your personal data that you yourself have provided and if such personal data is being processed automatically with your consent and/or in accordance with a contract between you and Beredskapslyftet, you may request that the data is provided in a structured, commonly used and machine-readable format and you may also request that the personal data is transmitted to another controller, if this is technically feasible.

8. How do I make use of my rights and what should I do if I have any complaints?

Please see who you can contact under Section 11 below should you have any requests in relation to the processing of your personal data, or if you want to withdraw any consent provided (for any processing for which we explicitly state to rely on your consent, you can withdraw your consent to our processing of such personal data at any time). Please note that we may contact you and ask you to confirm your identity to ensure that we do not disclose your personal data to any unauthorized person and that we may ask you to specify your request before we perform any actions.

You always have the right to lodge a complaint with the relevant supervisory authority if you are dissatisfied with how we process your personal data, which in Sweden is the Swedish Authority for Privacy Protection (www.imy.se).

9. How will we act when receiving a request?

Once we have confirmed your identity, we will handle your request in accordance with applicable law. Please note that even if you object to certain processing of personal data, we may still continue such processing if permitted or required to do so by law, for example to enable us to fulfill legal requirements, fulfill legal obligations or fulfill obligations under a contract with you.

10. Updates to the Privacy Policy

In order to ensure that we comply with data protection law, this Privacy Policy may be changed by us at any time.

11. Contact information

Beredskapslyftet Ideell Förening (reg. no. 802536-7759), Box 7358, 103 90 Stockholm, Sweden.

GDPR@beredskapslyftet.se

__________________

Latest update on 1 April 2025.