Co. Society AB’s Privacy Policy

Personal data is any information about a living natural person that can be directly or indirectly linked to that person. This may include names and social security numbers, but also images, e-mail addresses and IP addresses. Processing of personal data means all forms of handling of personal data. It can be an operation or a combination of measures such as collection, registration, structuring, storage, processing and transfer of personal data.

Co. Society AB (org.nr 559325-9012) with address Norrlandsgatan 10, 111 43 Stockholm, is the data controller for the company’s processing of personal data. If you have any questions about the personal data that we process please contact us at privacy@cosociety.co.

In our service we don’t process any data that could be classified as sensitive in accordance with the data protection regulation. If any such data would be communicated with us we immediately make sure that this information is deleted.

We mainly collect information about you when the company where you are employed at chooses to sign an agreement with us for the use of our platform and you as an employee are either appointed as administrator/superuser of the service or use it as part of your daily work. In connection with conducting tests for the development of the platform, the data is collected from the data subject. For marketing and communication about our service, we either collect your data from public sources or from you after initial contact,

Personal data assistants. In cases where it is necessary for us to be able to offer our service/product, we share personal data with companies that are personal data processors for us. A personal data processor is a company that processes personal data on our behalf and in accordance with our instructions. When personal data is shared with data processors, it is only for purposes that are compatible with the purposes for which we initially collected the data. We conduct ongoing checks of all personal data processors to ensure that they can provide sufficient guarantees regarding the security and confidentiality of personal data. We have written agreements with all personal data processors through which they guarantee the security of the personal data processed. More information about which personal data processors we use can be found in the appendix to this privacy policy.

We always strive to process your personal data within the EU/EEA. For system support and maintenance, we may be required to transfer certain personal data to a country outside the EU/EEA. This may be the case if we share your personal data with a personal data processor who is established or stores information in a country outside the EU/EEA through an approved subcontractor. In such a case, the personal data processor may only access information that is relevant to the specific situation. For the transfer of your personal data to a country outside the EU/EEA, these countries may have laws that gives the public authorities the right to request personal data stored in the country for the purpose of fighting crime or defending national security. Regardless of whether it is we or one of our suppliers who process your personal data, we will ensure a high level of protection in the event of a transfer of these and that appropriate safeguards have been taken in accordance with applicable data protection regulations. Such safeguards include, among other things, ensuring: If the EU Commission has decided that the country outside the EU/EEA to which your personal data is transferred achieves an adequate level of protection equivalent to the level of protection provided by the GDPR. That the EU Commission’s standard contractual clauses between us and the company that is the recipient of the personal data outside the EU/EEA. This means that the recipient guarantees that the protection that the personal data receives is the same as the requirements set out in GDPR. Information regarding which countries that are considered to have an adequate level of protection of personal data in their regulation is found on the EU commissions website. More information regarding standard contractual clauses can be found here.

We never save your personal data longer than is necessary for each purpose. The identified necessary storage time for each processing activity are specified in more detail under the respective purposes/processing above.

As a data subject, you have a number of rights under the data protection regulation (GDPR) that give you control over your own personal data, including obtaining information directly from us about how we process your personal data. If you want to know more about your rights or get in touch with us to use any of your rights, the easiest way to do it is to send an email on privacy@cosociety.co. As a data subject, you have the following statutory rights: Right to be forgotten (Right to have information deleted)In some cases, you have the right to have your personal data deleted. This right applies to:in the event that the data processed about you is no longer necessary for the purposes for which it was collected. If the processing is based on your consent and you withdraw it. If the processing takes place for direct marketing and you object to the processing of the data.If you have objected to personal data processing that we based on legitimate interest and your reason for objection outweighs our legitimate interest.  If the personal data must be deleted in order to comply with a legal obligation to which we are subject. If the personal data is processed unlawfully. Keep in mind that we may deny your request to be forgotten if there are legal obligations for us to save your information for a certain statutory period of time. Right to informationYou have the right to receive information about how we process your personal data, both when the data is collected and when you request more information about the processing. We provide this partly by providing this data protection information, but also by answering questions from you. Right to access your personal data – Register extractYou have the right to find out if we process your personal data and to receive a copy of what personal data we handle, a so-called register extract. This information shows what personal data we process, the purpose of the processing of your personal data, which recipients, if any, may receive your personal data, how long we save your personal data, where the information about you was collected and whether there is any automatic decision-making regarding your personal data. Keep in mind that the right to receive a copy of your personal data does not mean that you always have the right to receive the actual document where your personal data exists, but you are provided with a summary of the personal data that exists so that you can check the accuracy and legality of the data. If we receive a request for a register extract we may request additional information to ensure effective handling of your request and to ensure that the information is provided to the right person. Right to access and to move your personal data – Data portabilityYou can request a copy of the data we process about you in a machine-readable format in order to be able to move your personal data to another recipient. You can only request this right if we process your personal data for the purpose of fulfilling a contract or based on your consent. Right to rectificationYou have the right to request that we correct incorrect information that we process about you and that we supplement the information we already have in case it is incomplete. Right to restriction of processingYou have the right to request that our processing of your personal data be restricted. You can do this if you believe that the information we have about you is not correct, that our processing is contrary to law or that we do not need the information for a specific purpose. You also have the right to request that we do not process your personal data while we control this. Right to object to our processing of your personal dataYou have the right to object to our processing of your personal data if it is based on our legitimate interest. In addition, you always have the opportunity to object to direct marketing from our side.