Privacy Policy
We care about your privacy and want you to feel secure in how we handle your personal information. In this policy, we explain how Nature Station AB uses the personal data we collect or that is provided to us.
If you fill out our contact form
The personal information you provide is data that we will primarily use to provide you with the material you requested. We also collect this information to send you updates and information about upcoming events. We process your personal data based on our legitimate interest in sending you relevant information about us and our services.
We will keep the information for as long as necessary to handle and document your case and to send you information in accordance with the above. You can object to us using your information by contacting us directly.
If you communicate with us on social media
We are active on social media platforms. If you choose to post content, such as a post or a comment, on any of our public pages, we process the personal data that you publish. We do this based on our legitimate interest in marketing ourselves and communicating with individuals who contact us to ask questions or engage in discussions. In addition to storing your personal data in the service where you posted it, we also process it by reading, possibly responding to, and eventually deleting it. You can delete what you have posted at any time.
Please remember that by posting content on one of our public pages, you also provide the information you publish to the provider of the social service. We have no control over what these providers do with your information; it is entirely governed by their own terms for each service.
If you send an email to us
Incoming emails usually contain personal data. If you send an email to any of us, we will process your personal data by reading, storing, and managing your message, and if necessary, forwarding it to the appropriate recipient within our organization. The personal data processed by us for this purpose are the same as those you provide in your message. Common examples of personal data received by us in this way include name, email address, phone number, and position.
The legal basis for this processing is our legitimate interest in handling and responding to the email. How long we keep your message depends on the type of issue it concerns. For example, if the matter pertains to an existing customer relationship, we may keep it for the duration of the customer relationship and for some time thereafter (to protect our rights under the law).
Think twice before mentioning another person in an email to us. Even such personal data is processed based on legitimate interest, but it may be difficult or even impossible for us to inform the individual that their personal data is being processed in this case. Take care of your fellow human beings and mention only other persons than yourself if you consider it necessary.
If you are an existing or potential customer
Like most other companies, we engage in sales to both existing and potential customers. This means that we may process personal data about contacts within various organizations that are of interest to us, and contact them via email, web, or social media. The personal data we process for this purpose usually includes name, work phone number, work email address, and the organization’s name and address. This processing is motivated by our legitimate interest in marketing our business, finding new collaboration opportunities or customers, and nurturing our existing customers.
If your organization is a customer of ours, we also process your contact details based on our legitimate interest in being able to fulfill our obligations under the agreement and provide customer care. This may include responding to questions related to the agreement, setting up users in our support system, documenting our agreements and work performed, invoicing for work performed, and inviting you to events organized by us or the group we are part of.
Personal data about contacts whose employer does not proceed with signing an agreement with us as a supplier is retained for a maximum of two years after the last contact. Regarding existing customers, data processed for upselling is retained for up to three years after the last transaction, while other personal data about contacts at existing customers may be retained for up to 10 years after the last transaction to protect our legal interests (for example, to assert or defend legal claims related to the agreement).
If you apply for a job with us
We need to process your personal data in order to handle your application, assess whether you are a suitable candidate, and contact you for any questions or to schedule an interview. The specific data we process depends on what you submit to us, but typically includes name, address, email address, phone number, social security number, as well as information about your qualifications and other content in your CV and/or cover letter. This processing is carried out based on our legitimate interest in managing your application. If you wish to withdraw your application, you can do so by contacting us through the channel you used to submit your application, or via info@naturestation.se. If you do, we will delete all your personal data and close your recruitment case, unless we have an obligation to retain some or all of the data according to law.
If you are not offered employment, your application documents will be retained for two years to comply with requirements in anti-discrimination legislation. However, if we choose not to proceed with a spontaneous application you submitted because we do not currently have a need for employment, your documents will be kept for one year unless you request their deletion before then. Even if you are hired, your qualifications will be retained for two years, while other necessary information such as name, social security number, and contact details will be kept throughout your employment and for some time thereafter.
In some cases, we may ask applicants who are not offered employment if we may retain their contact details and qualifications for future recruitments or for organizing events and similar activities in the future. If you consent to this, you always have the right to withdraw your consent at any time by contacting us.
In some cases, existing employees may provide recommendations about you as a potential job applicant. In such cases, you will be promptly informed about the processing unless doing so would require a disproportionate effort or significantly hinder the purpose of processing the personal data. Information about the processing will be provided in any case if contact is made.
We may also collect personal data from references provided by job applicants to assess the suitability of the applicant for the position in question. Reference persons will be informed about the processing of their personal data at the first contact. The personal data of reference persons will be retained for a maximum of two years if the applicant is not hired to comply with requirements in anti-discrimination legislation.
Who accesses the data
If your personal data is processed for any of the purposes mentioned in this Privacy Policy, the data may be shared with our suppliers and/or partners if necessary to achieve the purpose of the processing. We have entered into specific agreements with these parties to ensure that they only process the personal data in the manner we instruct.
Your rights
As a registered individual, you have certain rights according to the General Data Protection Regulation (GDPR). Below, these rights are described along with how we work to fulfill them.
Right to access (”record excerpt”)
You have the right to contact us to find out if we process your personal data and, if so, to access the data and information on how we use it. You also have the right to request a copy of the personal data. The first copy you request is free, but a fee may be charged for additional copies. If you submit your request in electronic format, you will also, if possible, receive the excerpt and information in electronic format. If you do not request a specific electronic format, the excerpt will be provided in a format that is commonly used, such as PDF files.
If disclosure to you would disadvantage other individuals, we may refuse to disclose certain personal data. The right to access also does not mean that you always have the right to obtain the actual document where your personal data appears.
The right to rectification
You have the right to have incorrect personal data corrected without undue delay. If it is appropriate in light of the purposes of our processing, you also have the right to have incomplete personal data completed, for example by providing a supplementary statement.
The right to restriction
A restriction of processing means that the personal data can only be used and handled in certain limited ways, for example, by only storing them and not using them in any other way during the period of restriction. Other uses may only occur with your consent, to protect someone else’s rights, or for an important public interest.
You have the right to request that we restrict the processing of your personal data in four different situations:
- If you dispute the accuracy of the personal data, you have the right to request restriction while we verify whether the personal data is accurate
- If the processing is unlawful and you oppose the erasure of the personal data, you can instead request that its use be restricted
- If we no longer need the personal data for the purposes of the processing, but you need the data to establish, exercise, or defend legal claims
- If you object to the processing of your personal data, you have the right to request that the processing of the personal data be restricted while we balance your interests and ours.
If your personal data is restricted, we are obligated to notify you before the restriction is lifted.
The right to erasure
You have the right to request the erasure of your personal data. We are obliged to promptly erase your personal data in the following cases:
- If the personal data are no longer necessary for the purposes for which they were collected, for example, if you applied for a job but were not hired, and we no longer need your CV
- If you have withdrawn your consent upon which the processing is based, and there is no other legal ground for the processing, for example, if you consented to the publication of a photo but later changed your mind and withdrew your consent
- If the processing is for direct marketing purposes and you object to the processing of the data for that purpose, for example, if you no longer wish to receive a newsletter from us
- If the personal data have been processed unlawfully, for example, if the personal data have not been processed in accordance with the General Data Protection Regulation (GDPR)
- If the personal data must be erased to comply with a legal obligation.
Please note that in some situations, we may not be able to comply with your request for erasure. We may deny your request in whole or in part if our processing is necessary for one of the following reasons:
- To exercise the right of freedom of expression and information
- To comply with a legal obligation
- For the establishment, exercise, or defense of legal claims
- For archiving purposes in the public interest, scientific, historical research, or statistical purposes.
Right to damages
If you have suffered damage due to your personal data being processed in violation of the General Data Protection Regulation (GDPR), you have the right to claim compensation.
The right to lodge a complaint TO Integritetsskyddsmyndigheten (IMy)
If you believe that our processing is unlawful or not carried out correctly, you have the right to lodge a complaint to IMY.
The right to object
You always have the right to object to processing carried out on the basis of legitimate interest, public interest, or as part of official authority, according to the General Data Protection Regulation. In such cases, we will conduct a balancing test based on your specific situation to assess whether it is still justified to process your personal data for the stated purpose.
You also have the right to object to processing conducted for direct marketing purposes. If you exercise this right, we will cease processing without first conducting any balancing test.
The right to withdraw consent
Regarding processing carried out with your consent, you can always withdraw your consent at any time, and then the processing of personal data should cease. However, processing that was performed before the consent was withdrawn is still considered lawful.
The right to move your personal data (”data portability”)
Automated processing (e.g., in an IT system) carried out with consent or under a contract where the personal data has been provided directly by you is covered by the right to data portability. This means that you have the right to request your personal data in a structured, commonly used, and machine-readable format and, if technically feasible, have this personal data transferred directly to another party.
General
If your request is clearly unfounded or excessive, such as if you repeatedly request the same thing, we may charge a fee or refuse your request.
You can learn more about your rights on the Swedish Data Protection Authority’s website: www.imy.se/privatperson/dataskydd/dina-rattigheter/.
Contact
The data controller for all the above processing activities is Nature Station AB, org. no. 559334-2081, located at Sommargatan 101A, 656 37 Karlstad.
If you have any questions about our processing of your personal data or wish to exercise any of your rights, please contact us at info@naturestation.se.