Privacy Policy for FOCUS
Last updated: 2022-09-16
You should always feel secure when providing your personal data to the Swedish foundation Stiftelsen Dispurse (the "Foundation" or "Stiftelsen Dispurse") via the FOCUS app (the "App" or "FOCUS"). With this privacy policy, Stiftelsen Dispurse wishes to demonstrate how it ensures that your personal data is processed in accordance with the EU General Data Protection Regulation 2016/679/EC ("GDPR") when you download and use the FOCUS App. Stiftelsen Dispurse values your personal privacy and considers it to be of the utmost importance; the Foundation therefore takes your privacy very seriously.
In this privacy policy, "personal data" refers to personally identifiable information that specifically identifies, or can identify, you as an individual.
If you choose not to share personal data with us, certain services may be limited or unavailable.
In this privacy policy:
1. GENERAL
2. DATA CONTROLLER
3. PERSONAL DATA STORED AND THE GROUNDS FOR PROCESSING
4. STORAGE PERIOD
5. PROTECTION AND SHARING OF YOUR PERSONAL DATA
6. YOUR RIGHTS
1. GENERAL
This privacy policy explains how Stiftelsen Dispurse processes, stores, and shares your personal data when you use the Foundation's FOCUS App. This privacy policy also describes your rights and how you can exercise those rights in relation to the Foundation. Stiftelsen Dispurse may, from time to time, amend this privacy policy in response to changes in legal, technical, or business requirements and developments. Should this occur, the Foundation will publish the updated privacy policy on our website, www.dispurse.org, as well as on the App’s information page in Google Play. If we make material changes, we will notify you by updating the date at the top of this privacy policy and, depending on the nature of the changes, may provide you with additional notice.
We encourage you to stay informed about any changes.
2. DATA CONTROLLER
The Swedish-registered foundation Stiftelsen Dispurse (org. no. 863500-7340) acts as the data controller for the processing of your personal data and is therefore responsible for ensuring that your data is handled correctly and securely in accordance with applicable legislation.
If you have questions regarding how the Foundation handles your personal data, or if you wish to exercise your rights, the easiest way to contact the Foundation is via email at kontakt@dispurse.org (for Swedish speakers) or contact@dispurse.org (for other languages).
3. PERSONAL DATA PROCESSED AND LEGAL BASES
Stiftelsen Dispurse’s policy is to store and process as little of your data as possible. Stiftelsen Dispurse will collect the following personal data from you when you use the Stiftelsen Dispurse app, FOCUS. - First and last name
- Personal identity number
- IP address
- Information regarding your use of the App, including but not limited to how you interact within the App and your results
- Other information you provide to the Foundation, such as messages, photos, or other content.
When you use the FOCUS App
IP address and interaction
When you use FOCUS, the Foundation automatically collects certain information from you and/or your device (which may be considered personal data under applicable data protection laws), such as your IP address or interactions within the App. The Foundation does this based on the legal ground of legitimate interest, as the Foundation has a compelling interest in being able to troubleshoot, implement technical measures, and develop the service as needed or desired. The Foundation has determined that this interest outweighs the data subject's interest in the protection of personal data.
Name and personal identity number
To provide the FOCUS service to you, you must provide us with your first and last name as well as your personal identity number. This is based on the legal grounds of fulfilling the agreement with you—under which we undertake to provide training, follow-up, and statutory certificates—and complying with legal obligations incumbent upon the Foundation.
Interaction and results
When the App is used, the Foundation collects information regarding your interactions and results. This is done based on the legal ground of fulfilling the agreement with you (which, as outlined above, primarily entails providing training, follow-up, and statutory certificates) and complying with legal obligations incumbent upon the Foundation. Other content provided by you
In cases where you upload other content to the App, such as a profile picture, the Foundation processes this based on the legal basis of consent.
4. STORAGE PERIOD
The Dispurse Foundation stores personal data only for as long as is necessary to fulfill the purposes for which the data was collected, or for as long as the organization is required by law to store personal data—such as under the laws governing the provision of the App and the certificates.
We store your first and last name, your personal identity number, and information regarding your use of the App, including but not limited, how you interact with the App and your results while using the service and for five (5) years after you have completed the service or otherwise notified us that you do not wish to continue. This storage takes place in order to fulfill the agreement with you regarding the provision of certificates. After this period, your personal data is deleted or anonymized.
Information regarding your IP address and other technical information about your device is deleted no later than fourteen (14) days after we receive the information.
In certain cases, personal data may be stored for a longer period to protect the Foundation’s legal interests or in accordance with applicable legislation. The personal data is subsequently deleted.
5. PROTECTION AND SHARING OF YOUR PERSONAL DATA
General
To ensure you feel secure when providing your personal data to us, the Foundation has implemented the necessary security measures to protect your personal data against unauthorized access, alteration, and deletion.
The Foundation collects and processes personal data on a voluntary basis; this does not involve selling your personal data to third parties. However, personal data may sometimes be disclosed in accordance with applicable legislation and this Privacy Policy.
The Dispurse Foundation may share personal information with third parties if you have consented to this or if there is another legal basis for such processing. However, the Foundation acknowledges that this should be done sparingly. In such cases, the Foundation always takes the necessary measures to ensure your data is handled securely. Specific sharing
Personal data—specifically your first and last name and personal identity number—will be shared with the Foundation’s subsidiary foundation in Peru to fulfill the agreement with you, as the subsidiary foundation conducts operational activities on the Foundation’s behalf. Other parties may also be engaged for the same purpose, in which case personal data may be shared. Users should be aware that regulations outside the EU/EEA may offer a lower level of protection for personal data.
Personal data may also be shared with IT providers and cloud service providers, which may be based outside the EU/EEA. Personal data may also be shared with public authorities to comply with legal requirements.
Protection regarding sharing outside the EU/EEA
In cases where personal data must be transferred and stored outside the EU/EEA, the Foundation selects providers with the utmost care and with due regard for your privacy. Furthermore, the Foundation ensures that personal data is handled in the most secure manner possible.
The Dispurse Foundation will also take all necessary security measures to ensure that your personal data is handled securely and with an adequate level of protection (for example, through the use of approved standard contractual clauses and other appropriate safeguards). You can read more about the Standard Contractual Clauses and obtain a copy at:
https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_sv
6. YOUR RIGHTS
Free extract from the register
Provided that Stiftelsen Dispurse is the data controller, you have the right, at any time and free of charge, to obtain an extract from the register containing information on the personal data registered about you, the purposes of the processing of such personal data, information on the source from which the personal data was collected, and the recipients to whom the data has been or will be disclosed. You also have the right to receive information in the extract regarding the envisaged period for which the data will be stored or the criteria used to determine this period. You also have the right to be informed of the existence of automated decision-making (including profiling). Requests for such information must be made in writing and sent to Stiftelsen Dispurse at the address specified below under the heading "Data Controller".
Data portability
You have the right to data portability—that is, the right, under certain conditions, to receive and transfer your personal data in a structured, commonly used, and machine-readable format to another data controller.
Correction and deletion
Upon your request or on its own initiative, Stiftelsen Dispurse will correct, de-identify, supplement, or delete data found to be incorrect, incomplete, or misleading. In certain cases, the Foundation is required to process your personal data even if you have requested its deletion—for example, to exercise the right to freedom of expression and information, to comply with a legal obligation, or to perform a task carried out in the public interest.
Restriction of processing
In certain cases, you have the right to demand that the processing of your personal data be restricted. Restriction means that the data is marked so that, in the future, it may only be processed for specific, limited purposes.
Withdrawal of consent
In cases where you have previously given your consent to the processing of your personal data, you have the right to withdraw that consent, either orally or in writing.
Automated decision-making
You have the right to object to processing based solely on automated decision-making (including profiling) where that decision-making has a legal effect on you or otherwise significantly affects you.
We do not engage in fully automated decision-making that has a legal or otherwise significant effect using customer data.
Exercising rights, asking questions, or making complaints
If you wish to exercise any of the above rights, have questions regarding personal data held by the Foundation, have questions about this privacy policy, or are dissatisfied with the Foundation’s processing of your personal data, please do not hesitate to contact Stiftelsen Dispurse; contact details can be found in section 2 of this policy.
Please note that even if you object to certain processing of personal data, we may still carry out the relevant processing if permitted or required by law—for example, to fulfill legal or contractual obligations.
You always have the right to lodge a complaint with the relevant supervisory authority, particularly in the place where you live, work, or where an alleged infringement of the GDPR has occurred. You can find the relevant authority for your country here:
http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm