We ) processing of your personal data. We are the controller for processing of your personal data as described in this policy. We want to explain, in a transparent and clear way, how we handle personal data within our organization and what activates require us to collect personal data as well as what is optional. You are most welcome to contact us with any questions. You will find our contact details further down.
We work actively with the protection of your personal data and value your privacy highly!
These guidelines aim to inform you about how, why and when we process your personal data, in accordance with what you are entitled to in accordance with Article 12-14 of the EU General Data Protection Regulation ("GDPR"). We have included information about the processing of your personal data that is most invasive, most surprising, and most common. So that you will understand our processing of your data in the very best way possible without risking information fatigue. If you are interested in knowing more, you are most welcome to contact us via our contact details below.
How we process your personal data
Registration to our events
- When you register to attend any of our courses, seminars, or other events that we arrange we will collect the following information: name, e-mail address, title/role and company and, if applicable, telephone number, invoice reference and invoice address.
- The personal data we collect for seminars, courses and other events are needed in order for us to be able to administrate the event, and sometimes to send information or handouts before or after the event, as well as inform you about other events in the same research area.
- For events that is free of charge we base our processing on your consent.
- If the event is subject to a fee, we will process your personal data to administrate your participation, collect payment and inform you about the event and other events in the same research area, based on our legitimate interest in fulfilling our contractual commitment with your organisation (see more in our booking conditions).
- For events that are co-organised we may share the information with the co-organiser(s).
Participation in our events
- We photograph and film during our events. These photographs may be considered personal data. We sometimes publish photographs on our website or in social media channels, from events we arrange or participate in.
- Before publishing photographs and films, we always examine them and assess if publishing may be sensitive to anyone’s privacy. If we find that this is not the case, we publish the photograph, for the purpose of informing about the event or other circumstances under which the photograph was taken.
- We base our processing of the photographs and films on our legitimate interest in informing about our operations and research projects that are being carried out.
- IVL collects your e-mail address and organisation (optional) when you register for our newsletters.
- The processing is based on your consent.
- If you no longer want to receive our newsletters, the easiest way to unsubscribe is by following the link in the email.
Whom do we share your personal data with
External suppliers and systems are a natural part of and an important support for our business. We may share your personal data within the processing described above, with the following recipients:
- Suppliers of analytic tools for our website, and
- IT- and system suppliers.
Suppliers then process your personal data under our instruction and management, whose terms and limits are regulated and secured through data processing agreements. Through these agreements we require that the suppliers, as a minimum, meet the same strict requirements that we place on ourselves in our processing of your personal data.
IVL is part of a Company group, in which IVL is the parent company. The group also consists of BASTAonline AB External link, opens in new window. (”BASTA”), EDP International External link, opens in new window. ("EPD") and eBVD i Norden AB External link. (”eBVD”) . IVL, BASTA, EDP and eBVD may in some cases be joint controllers for the processing of personal data conducted within the company group. This means that in the specific cases when this is relevant, your personal data will be shared and stored jointly. Note, this does not apply to newsletters and other mailings that you have signed up for. You can enforce your rights (described below) against any of the companies within the group. You can assert your rights listed below against all companies. You can find information about each group company's processing of personal data on their website (linked above).
2.3. If you want to know what personal data IVL processes about you, you have the right to request access to these personal data. You also have the right to request rectification or erasure of incorrect personal data. If you are of the opinion that IVL’s processing of your personal data is incorrect, you may request restriction of our processing of the personal data or object to the processing. You may also have the right to so called ‘data portability’. If you want to use any of your granted rights, please contact us on the information given below in section 2.5.
Transfer or personal data to a third country
We always strive for your personal data to be processed within the EU/EEA, but sometimes this is not possible. For certain IT services, the data may be transferred to a country outside the EU/EES (third country). In cases where the data is transferred to third countries, we have taken additional protective measures to ensure that the EU level of protection for personal data is maintained, e.g. by including the European Commission's standard contractual clauses (SCCs) for data transfer (which are available on the European Commission's website) in the agreement with the parties accessing personal data.
Please note that IVL will always check your identity to ensure that information about you is provided to you and no one else.
Not all rights listed below are absolute. There are exceptions and we have tried to describe them as well as possible. If your request can not be fully met, we will clearly inform you of why.
- Right of access. You are upon your request entitled to receive confirmation about whether IVL process your personal data, and if that is the case you have the right to receive a copy of your personal data as well as to obtain supplementary information about IVL’s processing of your personal data.
- Right to rectification. You have the right to have your personal data corrected and/or completed if it is inaccurate and/or incomplete.
- Right to erasure. In some cases, you have the right to request that IVL delete your personal data, without undue delay. It is possible for us to meet such a request in full or in part in the following situations:
- the personal data is no longer necessary in relation to the purposes for which they were collected or otherwise processed;
- you make a valid objection to the processing of your personal data
- the personal data has to be erased for compliance with a legal obligation.
- the personal data has been unlawfully processed; or
- you withdraw your consent to a processing activity and there is no other legal basis for the processing
- Right to restrict processing. You have the right to request restriction of the processing of your personal data under the following circumstances:
- the accuracy of the personal data is under examination
- IVL no longer needs the personal data but you need the personal data for the establishment, exercise or defence of legal claims; or
- you have objected to the processing of your personal data and such objection is under verification.
- the processing is unlawful or is no longer needed for the purposes of the processing but you oppose the erasure of personal data and request restriction instead;
- Right to data portability. If the personal data is received from you, our processing is based upon your consent or the performance of a contract, and the information is processed digitally, you have the right to receive this personal information from us in a machine-readable format and transmit the data to another data controller.
- General right to object. You have the general right to, at any time, object to the processing of your personal data that is based on IVL’s legitimate interest. If you object, we have to demonstrate that we have compelling legitimate grounds for such processing or that we need the personal data for the establishment, exercise or defence of legal claims. Otherwise, we will cease to process your personal data for that purpose.
- Right to object to direct marketing. You have a right to, at any time, object to the processing of your personal data for direct marketing purposes. If you do this, IVL may no longer process your personal data for such purposes.
Right to lodge a complaint with a Supervisory Authority. You have the right to contact the supervisory authority, which in Sweden is The Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten). Their contact information is found on their website, https://www.imy.se/en/. External link, opens in new window. Each EU and EEA Member State has its own supervisory authority, and you can find all supervisory authorities and their contact information here External link, opens in new window.. However, if you have comments or questions about our processings, we would like you to contact us first, so that we have a chance to help you and answer your questions.
IVL Svenska Miljöinstitutet AB
Swedish company, reg. no 556116-2446
100 31 Stockholm
Tel. 010-788 65 00
We may make changes to our protection of personal data. The latest version of our guidelines is always available on our website ivl.se.
Current version: 2023:01
Thank you for taking the time to read our information about how we process your personal data!