Privacy Policy - ConductMe

This privacy policy outlines how Move & Walk Sverige AB (“we”, “us” or “our”), process personal data and has been compiled to help our users feel secure in how we process personal data. We are the data controller of your personal data as described below. Please read our policy carefully to get a better understanding of how we collect, use, protect and generally handle your personal data in connection with our services.

We may, at any time and for any reason, make amendments to this privacy policy by publishing the updated version of the privacy policy on our website for ConductMe, ConductHub or Jo jag kan! (collectively the “Services”). The updated privacy policy will be applicable with immediate effect upon publication.

For clarity, the information below only provides information of our processing of your personal data when we are the controller. If you have any questions regarding how we process your personal data, please contact us using the contact information at the end of this privacy policy.

Information concerning ConductHub

We provide a technical platform for the ConductHub to our customers. Our customers are the third parties that have invited you to use the ConductHub. The customers of the ConductHub are the controllers of their processing of your personal data for their purposes of carrying out services and their use of the ConductHub, and we are the processor on their behalf for such purposes. For their processing of your personal data, please see their privacy policy.

Information concerning ConductMe

We have an agreement with our customers allowing our customers to upload content to the ConductMe. Our customers are the third parties that have invited you to use the ConductMe. The customers of the ConductMe are the controllers of the content they upload to the Services, and we are the processor on their behalf for such purposes (to provide the technical assistance with uploading such content). For their processing of your personal data, please see their privacy policy.

How do we process your personal data?

Purpose	Processing activities	Categories of personal data
In order to maintain, facilitate and improve the functions and user experience of our services as well as support our work on detecting and counteracting flaws, breaches and incidents. In addition, in order for us to monitor your compliance with the Acceptable Use Policy.	· Use of analytic tools offered by third parties. The statistics created and analytic activities pursued with support of these services is conducted with use of data in aggregated form and with de-identified or anonymized data. · Collection of statistics and analysis of visitor traffic on the Services as well as analysis of other technical information which is generated upon visiting and use of the Services. · Monitoring of your compliance with the Acceptable Use Policy.	· IP-address. · Other technical information which is generated upon visiting Services, such as what type of device is used. · First name and surname. · Contact details, such as email address, phone number, location and address.
Lawful basis: We have a legitimate interest to provide and improve the Services to you.
Storage period: We process and keep information of how visitors interact with our Services for a period of maximum six (6) months. In most cases, the collected personal data will be transformed into aggregated data (thus anonymized) at an earlier stage, in connection with us creating statistics.

Purpose	Processing activities	Categories of personal data
In order to initiate a business relation with you or the company you represent.	· Communication via email regarding our business, services and current activities.	· First name and surname. · Contact details, such as email address, phone number, location and address. · Professional title as well as information about the company you represent. · Information which you provide us when communicating with you.
Lawful basis: We have a legitimate interest to establish a business relation with you or the company you represent.
Retention period: We process and keep your personal data for a period of six (6) months from the time of gathering the personal data. If a business relation is established between us and you or the company you represent during the mentioned time period, then your personal data will be processed according to the purpose mentioned below.

Purpose	Processing activities	Categories of personal data
In order to maintain and develop our business relation with you or the company you represent.	· Contact and communication with you in the role as contact person of any of our existing customers, partners, suppliers or business contacts in general. · Administration of and communication regarding our customer-, partner- and supplier contracts as well as communication via email about our business, services and current activities.	· First name and surname. · Contact details, such as email address, phone number, location and address. · Professional title as well as information about the company you represent. · Information which you provide us when communicating with you.
Lawful basis: We have a legitimate interest to maintain and develop our business relation with you or the company you represent.
Retention period: We process and keep your personal data as long as we have a business relation with you or the company you represent, however for a maximum of two (2) years from the time we last were in contact because of our business relation.

Purpose	Processing activities	Categories of personal data
Provide, carry out and deliver the Services.	· Processing of your personal data generated from your use of the Services. · Process of your personal data to administer the relationship with you and respond to your inquiries.	· Email address. · First name and surname. · Professional title.
Lawful basis: We have a legitimate interest to provide the Services to you.
Retention period: We will process your personal data as long as it is necessary for us to provide the Services to you and for a maximum of two (2) years thereafter.

Purpose	Processing activities	Categories of personal data
Provide, carry out and deliver the Jo jag kan! Platform.	· We process your personal data to carry out the Services to you by primarily uploading and storing your plans and schedules to the Jo jag kan! Platform.	· Email address. · First name and surname. · Plans and schedules. · Medical records. · Medicine. · Diagnosis. · Journal. · Instructions. · Guidelines. · Other information that you or your group provide to the Services.
Lawful basis: When you register for the Services, we obtain your consent.
Retention period: We will process your personal data as long as it is necessary for us to provide the Services to you and for a maximum of two (2) months thereafter. You may at anytime revoke your consent.

Purpose	Processing activities	Categories of personal data
Provide, carry out and deliver the ConductHub Platform.	· We process your personal data to carry out the Services by primarily uploading and storing your plans.	· Email address. · First name and surname. · Plans and schedules. · Medical records. · Medicine. · Diagnosis. · Journal. · Instructions. · Guidelines. · Other information that you or your group provide to us.
Lawful basis: When you register for the Services, we obtain your consent.
Retention period: We will process your personal data as long as it is necessary for us to provide the Services to you and for a maximum of two (2) months thereafter. You may at anytime revoke your consent.

Purpose	Processing activities	Categories of personal data
In order for us to monitor your compliance with the Acceptable Use Policy.	· We process your personal data in the Services to monitor your compliance with the Acceptable Use Policy.	· Email address. · First name and surname. · Other information that you or your group provide through our Services.
Lawful basis: We have a legitimate interest to ensure that you do not violate our Acceptable Use Policy.
Retention period: We will process your personal data as long as it is necessary for us to provide the Services to you and for a maximum of two (2) years thereafter.

Purpose	Processing activities	Categories of personal data
Direct marketing purposes.	We administer and send mailings, newsletters and reminders to you via email.	· Email address. · First name and surname.
Lawful basis: We will only send you direct marketing mailings via email if you have subscribed and registered for such mailings and thus consented to receiving them or if you are an existing customer of any of our Services.
Retention period: We process and keep your personal data in order to administer and send direct marketing mailings as long as you do not unsubscribe (withdraw your consent) to receiving such mailings. Such unsubscription can be done whenever by using the link for unsubscription which is featured in all our mailings.

Purpose	Processing activities	Categories of personal data
Chat (add-on module)	· We process your personal data to upload and store your communication in the chat function. · We process your personal data to monitor your compliance with the Acceptable Use Policy.	· Email address. · Username. · Other information that you provide to the chat.
Lawful basis: We have a legitimate interest to provide the Services to you.
Retention period: We will process your personal data as long as it is necessary for us to provide the Services to you and for a maximum of two (2) years thereafter.

Purpose	Processing activities	Categories of personal data
Forum (add-on module)	· We process your personal data to upload and store your communication in the chat function. · We process your personal data to monitor your compliance with the Acceptable Use Policy.	· Email address. · Username. · Other information that you provide to the forum.
Lawful basis: We have a legitimate interest to provide the Services to you.
Retention period: We will process your personal data as long as it is necessary for us to provide the Services to you and for a maximum of two (2) years thereafter.

Who do we share your personal data with?

We will not sell, exchange or otherwise transfer your personal data to third parties.

For purposes of carrying out the Services, personal data will be shared within the Services to the persons that are authorized to access the Services within your group (e.g. tutor, assistant, family member).

Your personal data will be shared with our IT service providers to the extent it is necessary for them to perform their service to us for purposes of the Services. We use Devies as our main IT-provider of the Services and we use Sendbird as our provider of the chat function.

We always require that our IT-providers ensure that any transfers of personal data to countries outside the EU/EEA are performed in accordance with all applicable legal requirements including, where required, entering into an agreement with their suppliers based on the EU Commission’s standard contractual clauses.

Here, you can find the standard contract clauses applicable to transfers of personal data to a recipient outside of the EU/EEA.

From where will we obtain your personal data?

We obtain your personal data;

a) interactively over the wireless network in connection with your use of our Services;
b) from you if you have manually entered personal data in connection with your use of the Services or otherwise contact us; or
c) from our customers that have invited you to use the Services (for their processing of your personal data, please see their privacy policy).

Your rights

Right of access. You have the right upon request to get a copy of your personal data which we process and to get complementary information regarding our processing of your personal data.

Right of rectification. You have the right to have your personal data rectified and/or complemented if they are wrong and/or incomplete.

Right to erasure. You have the right to request that we erase your personal data without undue delay in the following circumstances: (i) the personal data is no longer necessary in relation to the purposes for which they were collected or otherwise processed; (ii) you withdraw your consent on which the processing is based (if applicable) and there is no other legal ground for the processing; (iii) you object to our processing of personal data, and we do not have any overriding legitimate grounds for the processing; (iv) the processed personal data is unlawfully processed; or (v) the processed personal data has to be erased for compliance with legal obligations.

Right to restriction. You have the right to restrict the processing of your personal data in the following circumstances: (i) you contest the accuracy of the personal data during a period enabling us to verify the accuracy of such data; (ii) the processing is unlawful, and you oppose erasure of the personal data and request restriction instead; (iii) the personal data is no longer needed for the purposes of the processing, but are necessary for you for the establishment, exercise or defense of legal claims; or (iv) you have objected to the processing of the personal data, pending the verification whether our legitimate grounds for our processing override your interests, rights and freedoms.

Right to data portability. If your personal data has been provided by you and our processing of your personal data is based on your consent or on the performance of a contract with you, you have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format in order to transmit these to another service provider where it would be technically feasible and can be carried out by automated means.

Right to object. You have the general right to object to our processing of your personal data when it is based on our legitimate interest. If you object and we believe that we may still process your personal data, we must demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defense of legal claims.

Right to object to direct marketing. You have the right to at any time object to processing which is done for the purpose of direct marketing. If you object to such processing, we will no longer process your data for such purposes.

Right to withdraw consent. When our processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. Please note that the lawfulness of any processing based on your consent before its withdrawal is not affected by the withdrawal.

Contact details

If there are any questions regarding this privacy policy, you may contact us using the information below:

Lillhagsparken 8, 422 50 Hisings Backa, Sweden, [info@conducthub.com]
+46 31 55 84 20