Balancing of interests

For certain purposes, we process your personal data with the support of a balancing of interests as the legal basis for processing. When carrying out such a balancing of interests, we have assessed our legitimate interest in carrying out processing outbalances your interests and your basic rights not to have your personal data processed. What constitutes our legitimate interest is detailed in the tables above. If you would like detailed information about the balancing of interests that we have carried out, you can contact us. Our contact details can be found on the first page of this policy.

Do we share your personal data outside the EU/EEA?

As a general rule, SMGT processes your personal data within the EU/EEA, but may in certain cases use suppliers outside the EU/EEA. When we transfer personal data outside the EU/EEA, this is only done if we have a legal basis for the transfer in accordance with applicable legislation and regulations for data protection. This means that we can transfer personal data to Privacy Shield-certified personal data representatives in the USA. According to a decision by the European Commission, personal data may be transferred to recipients in the USA, provided that the recipient is Privacy Shield-certified. Privacy Shield is an agreement between the EU and the USA which aims to protect Europeans’ basic rights and to guarantee legal security for companies that transfer personal data to the USA. American companies that want to be Privacy Shield-certified can apply to the United States Department of Commerce, which ensures that the company’s privacy policy complies with the high standard of security required by Privacy Shield. Where recipients are not Privacy Shield-certified, we can transfer personal data outside the EU/EEA with the support of standardised data protection provisions that have been adopted by the European Commission. We can also transfer your personal data to a country that the European Commission has assessed as having an adequate level of protection for processing personal data.

If you would like detailed information about transferring data outside the EU/EEA, you can contact us. Our contact details can be found on the first page of this policy. You can also contact us to receive a copy of the appropriate protective measures.

Clearing and updating our database

It is import for us to have an accurate database, and we use resources such as:

• Clearing and updating the database on an ongoing basis.
• Removing e-mail addresses that bounce back and updating registers following postal mailing returns.
• We also have a link to our database supplier to maintain up-to-date information.

What are your rights to influence how we process your personal data?

When we process your personal data, you have certain rights e.g. to access the data we process or to have data deleted. These rights are described in detail below. If you wish to exercise your rights, please do not hesitate to contact us. Our contact details can be found on the first page of this policy.

Revoking your consent

If processing is based on your consent, for example if you have consented to receive marketing from SMGT for a longer period than stated in the tables above, you have the right to revoke this consent in full or in part at any time. However, revoking your consent will have no effect on our processing of your personal data for the period before revocation occurred.

Right to access

You have the right to receive confirmation of whether personal data that relates to you is processed by SMGT and access to information about how this personal information is processed, e.g. the purpose of processing and which categories of personal data this processing relates to. You also have the right to receive a copy of the personal data that is processed. A request can be made by contacting us. Our contact details can be found on the first page of this policy.

Right to correction

You also have the right to have incorrect personal data corrected and supplemented without unnecessary delay.

If you receive newsletters from SMGT, you can edit data, state which newsletters you want to receive and unsubscribe by logging in to your account or via the deregistration link in the newsletter.

Right to deletion (the right to be forgotten)

Under certain circumstances, you have the right to request that your personal data is deleted. Such circumstances exist if:

• The personal data is no longer necessary for the purposes for which it was gathered or processed,
• If you revoke your consent on which the processing is based and there are no other legal grounds for processing,
• If you object to processing and there is no legitimate reason to continue processing that carries greater weight,
• When personal data has been processed illegally, or
• If personal data must be deleted to fulfil a legal obligation by which SMGT is covered.

Right to restriction of processing

Under certain circumstances, you have the right to request that the processing of your personal data is restricted. This right exists if:

• You refute the accuracy of the data (although only during a period that gives us the opportunity to check this),
• Processing is illegal and you oppose the deletion of the personal data, requesting instead that the use of the data should be restricted,
• You need the personal data to assert or defend legal claims despite the fact that we no longer need the personal data for our processing purposes, or
• You have objected to processing and we have not carried out a check of whether our legitimate interest in processing your personal data outweighs your legitimate reason for processing your personal data being restricted.

Right to object to processing

You have the right to object at any time to the processing of your personal data that is based on a balancing of interests. However, this does not apply if we can demonstrate a binding legitimate reason for processing that outweighs this, or if it is processed for establishing, exercising or defending legal claims.

You also have the right to object to your personal data being processed for marketing purposes (e.g. sending out invitations and offers). If you object to marketing, your personal data will no longer be processed for such purposes.

Right to register complaints

You have the right to submit complaints to a competent supervisory authority (without this affecting any other administrative review procedure or legal remedy). Such complaints can ideally be submitted to the authority in the EU/EEA member state where you normally reside, where you work or where it is claimed that applicable data protection legislation and regulations have been breached. The competent supervisory authority in Sweden is the Swedish Data Inspection Board.

Right to data portability

Under certain circumstances, you have the right to receive an extract of the personal data relating to you that you have submitted to us in a structured, widely used and machine-readable format, and have the right to transfer this to another personal data controller (data portability), e.g. if you want to transfer your contact details to a third party. The right to data portability exists when:

• The processing is based on your consent or an agreement, and
• The processing is automated.

You have the right to have personal data transferred direct from us to another personal data controller where this is technically possible.