Your personal privacy is important to us at Edukatus Alliance. Therefore, we are committed to ensuring that the processing of personal data is carried out correctly and securely in accordance with applicable laws and regulations.
Our core principle is that we do not own personal data; rather, we are merely borrowing it.
We recommend the website of the Swedish Authority for Privacy Protection for in-depth information about what personal data is, your rights, and other information regarding data protection. Going forward, we will explain what information we collect, the purpose of any data processing, how data is protected, and how data is stored.
Personal data that we collect and process.
We process a large amount of personal data every day in order to operate our business and provide education. We also do this to conduct an effective operation and to comply with laws and regulations. The processing of personal data is therefore directly necessary for us.
Personal data that is collected includes, among other things, names, personal identification numbers, addresses, email addresses, photos, videos, bank details, educational documentation, and other study administrative information such as eligibility, qualifications, participation in education and exams, submitted assignments, and study results.
How do we protect your personal data?
We take legal, technical, and organisational measures to protect your personal data against unauthorized or unlawful access and other processing, as well as against loss, destruction, or damage. These measures aim to ensure appropriate protection of personal data considering the risks associated with the processing of the information.
Examples of security measures include actions to ensure that only authorized individuals have access to personal data, encrypting or pseudonymizing the data, meaning making the data unreadable to anyone other than authorized persons, or storing the data in specially protected storage spaces. It may also involve signing legally binding agreements with suppliers that govern how they should process and protect the data.
Who has access to your personal data?
As a general rule, only those employees at our organisation who need your personal data for their work have access to this information. Additionally, our central administrative staff may have access to your data and may need to refer to it as necessary, for example, during troubleshooting, support, and billing.
We may also need to disclose information to municipalities and authorities such as the Swedish Schools Inspectorate, CSN (the Swedish Board of Student Finance), the Swedish Tax Agency, the Social Insurance Agency, and Statistics Sweden (SCB).
They may also be shared with suppliers, partners, and other third parties who need access to them in order to fulfill their tasks on our behalf.
We only share your personal data if it is necessary and if you have consented to it or we are permitted to do so by law. When personal data is shared with another party, we take appropriate measures to protect your personal data.
Where do we process your personal data?
As far as possible, your data is processed within the EU/EEA.
We may transfer your personal data to another country outside the EU/EEA, if, for example, we use a system from a supplier that is established or stores personal data in a country outside the EU/EEA. In such cases, we take all reasonable technical, organisational, and legal measures to ensure that the level of protection is the same as within the EU/EEA.
How long do we retain your personal data?
We never retain your personal data longer than necessary, considering the purpose of the processing and the requirements of law or other regulations.
We have chosen to use guidelines (Retain or Discard) from the Swedish Association of Local Authorities and Regions (SALAR, in Swedish SKR)to determine how long data should be stored. Typically, this means that your personal data is retained for a period of 1 to 10 years with us.
Who is responsible for personal data processing?
We provide education through several different companies, and each company is responsible for its own personal data processing. Coordination of personal data management is carried out by the first-mentioned company:
– Edukatus Alliance AB, 556613-9290
– Lärlingsgymnasiet i Sverige AB, 556762-8176
– Täby Yrkesgymnasium AB, 556262-9179
– Väsby Yrkesgymnasium AB, 556808-9246
– Tekniska Gymnasiet i Sverige AB, 556890-2653
– IEAB International Education AB, 556726-5979
– Skolalliansen i Sverige AB, 556749-7051
– Axona Dendron AB, 556593-7868
– Förskolan Olympen AB, 556418-7309
– Handelsakademin i Göteborg AB, 556509-4405
– NBI i Sverige AB, 556613-4580
Is there a data protection officer?
For each data controller, Antti Liikavainio has been appointed as the data protection officer. You can reach the data protection officer via email at firstname.lastname(a)edukatus.se.
Your rights
If you have a personal data record with us, you also have several rights regarding our processing of your personal data. Here, we have summarized your rights. For more information about your rights, we recommend visiting the website of the Swedish Authority for Privacy Protection (IMY). https://www.imy.se/
– Right of access
You have the right to be informed if we hold personal data about you. If that is the case, you should also receive information on how the data is processed.
You also have the right to receive a copy of the data we process through a so-called register extract.
If you wish to receive a register extract, we request that you send your request to dataskyddsombud(a)edukatus.se.
If you submit your request and are not currently an employee or learner with us, we would greatly appreciate it if you could clarify whether you have previously been, for example, a student/participant and/or an employee, as well as where you were active with us.
We will respond to your request without unnecessary delay and normally within one month. If additional time is required or if we cannot accommodate your request for any reason, we will inform you of this. We may also request additional information from you if necessary to confirm your identity and ensure that it is you, and not someone else, trying to access or control your personal data.
– Right to rectification
If we have incorrect or incomplete personal data about you, you have the right to have it rectified and/or completed. Please first contact the unit you have or had contact with. If you cannot get in touch or receive help, please contact dataskyddsombud(a)edukatus.se.
– Right to erasure
You have the right to contact us to request the deletion of your personal data. However, this right is not absolute. For example, we may be legally obligated to retain your personal data, in which case we cannot fulfill your request to delete the data.
Here are some cases where we delete your data:
– if the data is no longer needed for the purposes for which it was collected
– if the processing is based solely on your consent and you withdraw that consent
– if you object to the processing of personal data based on legitimate interests and there are no overriding legitimate grounds for the processing
– if the processing of your data has not complied with applicable law.
– if deletion is required to fulfill a legal obligation.
If you wish to have your data deleted, please contact dataskyddsombud(a)edukatus.se.
If we delete your data, we will also notify others who have received the information about this.
– Right to restriction of processing
You have the right to contact us and request that the processing of your personal data be restricted, and that the data is only stored by us in the following situations:
– For the duration it takes for us to verify whether the personal data is accurate, if you contest the accuracy of the personal data.
– If the processing is unlawful and you oppose the deletion of the data and instead want us to restrict the use of it.
– If you want us to retain the data even though we no longer need it, so that you can establish, exercise, or defend legal claims.
– While awaiting verification of whose legitimate interests, yours or ours, outweigh the other if you have made an objection to the processing.
In some cases, however, we may not be able to accommodate a request for restriction, e.g., if the data is needed for us to defend our rights or protect the rights of another person. If a restriction is implemented, we will notify those to whom we have disclosed your data that a restriction has occurred. We will also, at your request, inform you of whom the information about the restriction has been disclosed to.
– Data portability
If we process your personal data based on consent or a contractual relationship, you have the right to data portability.
This means that you will receive the data concerning yourself that you have provided to us. The data will be provided electronically. You also have the right to have this data transmitted electronically to another data controller if it is technically feasible.
– Right to object
You have the right to object to our processing of your personal data if we process your personal data to perform a task carried out in the public interest, as part of an official function, or based on a legitimate interest assessment. If we cannot demonstrate that there are compelling legitimate grounds for processing the data that override your reasons/interests, rights, and freedoms, or if the processing is carried out for the establishment, exercise, or defence of legal claims.
If we process your personal data for direct marketing purposes, you always have the right to object to that.
– Automated decision-making (including profiling)
You have the right not to be subject to a decision based solely on any form of automated decision-making if the decision can have legal consequences for you or similarly affect you. If you wish to contest such a decision, you have the right to contact us and have the decision reviewed. Please reach out to the data protection officer at dataskyddsombud(a)edukatus.se for further handling.
– Complaints
If you believe that your personal data is being processed in violation of applicable law, you can submit a complaint directly to us at dataskyddsombud(a)edukatus.se or to the Swedish Authority for Privacy Protection (IMY). For current contact information for IMY, please refer to their own website, https://www.imy.se/om-oss/kontakta-oss/.
Contact
If you are a student or guardian and have questions about how personal data is handled, please contact the principal of the preschool or school first. If the principal answer your questions or if you would like to request a record extract, please contact dataskyddsombud(a)edukatus.se.
If you are an adult participant and have questions about how your personal data is handled, please contact the responsible person/administrator at your location first. If the responsible person/administrator cannot answer your question or if you would like to request a record extract, please contact dataskyddsombud(a)edukatus.se.
If you are an employee and have questions about how your personal data is handled, please contact your immediate supervisor first. If you do not receive answers to your questions or if you would like to request a record extract, please contact dataskyddsombud(a)edukatus.se.
The supervisory authority for matters concerning personal data is the Swedish Data Protection Authority (IMY). For current contact details for IMY, we refer you to their own website. https://www.imy.se/om-oss/kontakta-oss/