Contrast

Privacy Policy

Our privacy policy ensures that our customers' personal data is handled responsibly and in accordance with the law.

Personal data policy  

General  

You should always feel safe when you provide your personal data to Contrast AB (“Contrast”), org. nr 556405-5266. With this privacy policy, Contrast wants to show how it ensures that your personal data is processed in accordance with EU Data Protection Regulation 2016/679/EG (”GDPR”) when you register for or participate in one of Contrast’s events, have a customer or supplier relationship with Contrast, or work for Contrast. Contrast cares about your personal integrity and considers personal integrity to be of the utmost importance. Contrast therefore takes your privacy very seriously. 

What is a personal data? 

In this privacy policy, ”personal data” refers to any information relating to an identified or identifiable natural person, whereby an identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person. Sensitive data under GDPR Article 9 consists of personal data such as health, biometric data, etc.  

If you do not share personal data  

In the event that you do not share personal data, Contrast may, in some cases, not be able to provide its services to you, either in full or in part.  

 In this privacy policy: 

  1. GENERAL 
  2. PERSONAL DATA CONTROLLER 
  3. PERSONAL DATA STORED AND FOR WHAT REASONS 
  4. STORAGE TIME 
  5. PROTECTION AND DISCLOSURE OF YOUR PERSONAL DATA 
  6. RIGHTS  

  7. GENERAL 

This privacy policy explains how Contrast processes, stores, and shares your personal data. This privacy policy also describes your rights and how you can exercise your rights against Contrast.  

Contrast may from time to time change this privacy policy in response to changes in the legal, technical or operational reasons and developments of Contrast. If this happens, Contrast will publish the revised privacy policy on www.contrast.se with information about when the changes take effect. If Contrast makes significant changes, Contrast will notify you by changing the date at the top of this privacy policy and, depending on the specific changes, Contrast may provide you with additional notice of this.  

Contrast encourages you to stay updated on the changes.  

  1. PERSONAL DATA CONTROLLER

 Contrast is the data controller for the processing of personal data and is therefore responsible for ensuring that the data is processed correctly and securely in accordance with applicable legislation.  

 For any questions about how Contrast processes personal data or regarding the exercise of the data subject's rights, you can contact Contrast most easily in one of the following ways: 

By email to: info@contrast.se  

or by post to: 

Contrast AB 
Honnörsgatan 22 
352 36 Växjö 

  1. PERSONAL DATA THAT IS PROCESSED AND FOR WHAT REASONS 

 Contrasts policy means that Contrasts saves and processes as little personal data as possible, for as short a period as possible.  

 The following personal data may be collected by Contrast when registering for or participating in any of Contrast’s events, from customers or suppliers, as well as from those who work at Contrast.  

 3.1 Participants 

 Collected data  

 When registering for or participating in any of Contrast’s events, Contrast may collect and process the following personal data: 

  • Name 
  • Email 
  • Mobile number 
  • Gender  
  • Companies 
  • Address 
  • Billing information  
  • Names and contact information of the closest relatives  
  • Passport details  
  • Size of clothes/shoes 
  • Food preferences and possible food allergies  
  • Short information  
  • Pictures  
  • Video material 
  • Other personal data that is necessary for the specific event  

Purposes and legal basis 
 
Performance of contracts: We collect and process personal data that is necessary to fulfill a contract in which the data subject is a party, such as registration for events, billing, and communication. Passport information is needed to arrange international travel and to comply with safety regulations; size information is collected to ensure that you receive the correct equipment or clothing at events, and card information is collected to enable payment transactions in connection with registrations and participation in events. 

Legitimate interest: We process personal data for purposes related to our legitimate interests, such as developing business relationships and conducting direct marketing. Contrast has conducted an interest balancing exercise for direct marketing and ensured that our interest in informing you about our services outweighs your fundamental rights and freedoms. You always have the right to object to such processing. For example, we may use your contact information to inform you about similar services, and you always have the right to object to such processing.  

Legal obligations: We process personal data to fulfill legal obligations, such as accounting, tax reporting, and compliance with labor law regulations. 

Consent: For the collection of certain data, your explicit consent is required. This consent is voluntary, specific, informed and unambiguous. You can withdraw your consent at any time by contacting us at info@contrast.se. The withdrawal does not affect the legality of processing that took place before the withdrawal. 

At Contrast, we use photos and video footage from our events and activities to promote our services and the company’s business on various platforms, including social media, our website, and printed materials. These photos and videos may also be used for future marketing purposes, including anniversary campaigns (e.g., the company’s 40th anniversary). 

The processing of images and videos is based on: 

Consent: We obtain your explicit consent to use photos and videos in which you can be identified for marketing purposes. The consent is voluntary, specific, informed, and unambiguous. You have the right to withdraw your consent at any time by contacting us at info@contrast.se. The withdrawal does not affect the legality of processing that took place before the withdrawal. 

Legitimate interest: In some cases, we may also process images and videos based on our legitimate interest to market our services and strengthen our brand. We have conducted an interest balancing exercise to ensure that our legitimate interest outweighs your rights and freedoms. You always have the right to object to this processing by contacting us at info@contrast.se. 

3.2 Customers  

Collected data 

  • Name  
  • Company name 
  • Address  
  • Email 
  • Phone number  
  • Billing information  

Purposes and legal basis 
 
Name, company name, address, email and phone number: Collected and processed to fulfill the agreement (for example, to provide services, customer support, and communication). 

Billing information: Collected and processed to manage payments and fulfill legal obligations (e.g., accounting laws). 

Marketing: Contact information may be used for direct marketing based on our legitimate interest in informing you about our services, provided that this does not conflict with your rights and freedoms. You always have the right to object to such processing by contacting us. 

We sometimes process your personal data to inform you about our services and activities, as well as to develop and maintain business relationships. This processing is carried out based on our legitimate interest in marketing our services and strengthening our business operations. 

To ensure that our treatment does not weigh heavier than your rights and freedoms, we have conducted a thorough balancing of interests. In this balancing, we have taken into account that: 

  • The processing is limited to necessary information (e.g. name and contact details) and is used only to send relevant information about our services. 
  • The information is sent to a reasonable extent and frequency so that it is not perceived as intrusive or disturbing. 
  • You always have the right to object to us using your data for marketing purposes. If you object, we will stop processing your personal data for marketing purposes. 

You may exercise your right to object at any time by contacting us at info@contrast.se or by following the instructions in the marketing messages we send out. 
 

3.3 Suppliers

Collected data 

  • Name  
  • Companies 
  • Address  
  • Email 
  • Phone number  
  • Billing information   

Purposes and legal basis 
 
Name, company, address, email and phone number: Processed to maintain a business relationship, communication, and to fulfill contractual obligations. 

Billing information: Processed to manage payments and fulfill legal obligations under the Accounting Act. 

Data about suppliers may also be processed to comply with other legal obligations, such as tax legislation. 

We sometimes process your personal data to inform you about our services and activities, as well as to develop and maintain business relationships. This processing is carried out based on our legitimate interest in marketing our services and strengthening our business operations. 

To ensure that our treatment does not weigh heavier than your rights and freedoms, we have conducted a thorough balancing of interests. In this balancing, we have taken into account that: 

  • The processing is limited to necessary information (e.g. name and contact details) and is used only to send relevant information about our services. 
  • The information is sent to a reasonable extent and frequency so that it is not perceived as intrusive or disturbing. 
  • You always have the right to object to us using your data for marketing purposes. If you object, we will stop processing your personal data for marketing purposes. 

You can exercise your right to object at any time by contacting us at info@contrast.se or by following the instructions in the marketing messages we send out. 

3.4 Employees & consultants 
 

Collected data  
 

  • Name  
  • Personal ID number  
  • Address 
  • Email 
  • Phone number  
  • Bank details   
  • Salary information  

 

Purposes and legal basis 
 
Contrast processes personal data about employees and consultants for various purposes that are necessary to manage employment relationships and comply with legal requirements. 

  1. Performance of Employment Contracts or Assignment Contracts 
    We process personal data to fulfill our obligations under the employment or engagement agreement. This includes, but is not limited to: 
  • Payroll Management and Benefits: Data such as name, social security number, bank details and salary information are processed to be able to manage salary payments, taxes, pensions and other benefits. 
  • Management and Communication: Contact information such as email and phone numbers are used to ensure internal communication, assign work tasks, and coordinate operations. 
  • Workplace Environment and Health: Personal data may be processed to fulfill our obligations under the occupational health and safety laws, such as documentation of sick leave and workplace health and safety measures. 
  1. Legal Obligations 
    We process personal data to fulfill our legal obligations under laws and regulations, including: 
  • Accounting and Tax Reporting: Payroll data, tax information and other relevant data are processed and stored in accordance with the accounting laws and tax regulations. 
  • Employment Law Regulations: We process data to fulfill employment law obligations such as employment protection, occupational health and safety laws, and requirements related to sick leave and rehabilitation. 
  1. Legitimate Interests 
    We also process personal data based on our legitimate interests, for example to: 
  • Ensure Effective Operations: Manage the company’s human resources, handle recruitment, and plan for future needs. 
  • Defend Legal Claims: Retain necessary personal data to be able to defend ourselves in any legal claims or disputes. 

  1. STORAGE TIME 

Contrast stores personal data only for as long as is necessary to fulfill the purposes for which the data was collected or as long as Contrast is required to store personal data in accordance with the law.  

 

4.1 Participants 

Participant data for events, such as name, contact information, and food preferences, is stored for up to one (1) year after the project concludes to enable event management, billing, and follow-up. 

For the personal data used for billing and payment, the data is stored for up to seven (7) years after the end of the respective fiscal year, in accordance with Chapter 7, Section 2 of the Accounting Act.  

Images and videos collected for marketing purposes will be stored: 

  • Consent-based storage: Photos and videos where you have given consent are stored for the time required for the marketing purpose or until you revoke your consent. 
  • Storage based on legitimate interest: Images and videos stored based on our legitimate interest may be stored for as long as Contrast as a company exists. We will regularly review whether the storage is still necessary for the stated purposes and if not, we will delete the material. 

 

4.2 Customers 

  • Contact information and business communication: We operate within business cycles that can be long-term, and we need to retain customer and supplier information in order to effectively maintain, develop, and resume business relationships over time. Contact information and business communications are therefore stored for up to ten (10) years to enable business development and long-term customer relationships. 
  • Billing information and financial transactions: These are stored for up to seven (7) years after the end of the respective fiscal year, in accordance with the Accounting Act (Chapter 7, Section 2).” 
  • Other factorsIn certain specific cases, such as in ongoing business relationships or to ensure that we can maintain necessary contact and history for future business opportunities, it may be necessary to store information for the specified period of time. 

4.3 Suppliers 

  • Contact information and business communication: We operate within business cycles that can be long-term, and we need to retain customer and supplier information in order to effectively maintain, develop, and resume business relationships over time. Contact information and business communications are therefore stored for up to ten (10) years to enable business development and long-term customer relationships. 
  • Billing information and financial transactions: These are stored for up to seven (7) years after the end of the respective fiscal year, in accordance with the Accounting Act (Chapter 7, Section 2).” 
  • Other factorsIn certain specific cases, such as in ongoing business relationships or to ensure that we can maintain necessary contact and history for future business opportunities, it may be necessary to store information for the specified period of time. 

 

4.4 Employees & consultants 

Personal data related to employment is stored for up to seven (7) years after the end of the respective fiscal year from the termination of the employment, in accordance with Chapter 7, Section 2 of the Accounting Act, and in some cases until the individual reaches retirement age in order to meet the requirements for the right to reinstatement as well as to be able to provide evidence in cases where someone objects to the pension basis. However, most personal data, such as medical certificates and warnings, are deleted during the employment relationship when they no longer have a legitimate reason.  

Some personal data related to accounting must be stored longer, and information related to wages must be stored for ten (10) years. Wage-related documents are stored for ten (10) years, based on the fact that a wage claim, as a starting point, is statute barred after ten (10) years under Section 2 of the statute of limitations law. To keep track of saved vacation days, documents related to these two (2) years are stored from the end of the vacation year in which the employee would have received the benefit in accordance with the law, according to Section 33 of the vacation law. 

According to the Working Environment Act, certain medical examinations and the results of those examinations must be kept for ten (10) years. From the date on which certain exposure has ceased, records of employees exposed to certain substances must be kept for forty (40) years. This is stated in Section 3 of the Working Environment Ordinance.  

During ongoing employment, we store data on rehabilitation during the rehabilitation period and subsequently in order to ensure that the rehabilitation is completed but also to be able to take relevant measures in the event of a new need for rehabilitation. However, a review is made in each individual case based on the purpose of the rehabilitation. See, for example, AFS 1994:1, § 11 (with § 9).  

 

  1. PROTECTION AND DISCLOSURE OF PERSONAL DATA

Contrast has taken appropriate technical and organizational measures to protect your personal data from unauthorized access, loss, alteration, or disclosure. Examples of security measures include the use of encryption, backup, authorization controls, and regular review of our security procedures. We conduct regular risk assessments and update our security measures to ensure that we comply with the latest security standards and protect your data in the best possible way. 

Contrast may share personal data with third parties in cases where you have consented, but primarily if there is another legal basis for such handling. Contrast, however, allows this to be done only in a restrictive manner. Examples of sharing may include to a subcontractor or partner. In such cases, Contrast always takes the necessary measures to ensure that your data is handled securely, for example through relevant agreements. 

Contrast may also share your personal data with authorities if such legal obligation exists or if, for example, a legal dispute arises where Contrast needs to protect its interests.

Contrast may need to transfer personal data to recipients outside the EU/EEA. Before such a transfer takes place, we conduct a risk assessment and implement necessary protective measures, such as the use of the EU Commission’s standard contractual clauses, legal review, and agreements with the recipient to ensure that your data is handled with an adequate level of protection. We will nevertheless notify you in cases where such transfer is planned or has taken place.  

You can read more about the standard contract clauses and obtain a copy of them at: 

https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_sv    

 

  1. RIGHTS 

Free extract from the register 

Provided that Contrast is the data controller, you have the right, at any time, to obtain a free of charge record extract containing information about which personal data is registered about you, the purposes of the processing of this personal data and information about where this personal data has been obtained, as well as to whom the data has been disclosed or will be disclosed. You also have the right to obtain information in the record extract about the anticipated period during which the data will be stored or the criteria used to determine this period. You also have the right to obtain information about the existence of automated decision-making (including profiling). The request to obtain such information must be in writing and sent to Contrast at the address specified under the heading ”Data Controller”. 

Data portability 

You have the right to request that your personal data be transferred to another data controller (data portability), to correct inaccurate data or to request the deletion of data. Data portability only applies to data processed with consent or agreement and processed automatically. However, Contrast may need to continue processing your data if there are legal reasons to do so, such as statutory requirements. 

Correct and delete 

At your request or on our own initiative, Contrast will correct, de-identify, complete, or delete data that is found to be inaccurate, incomplete, or misleading. In some cases, Contrast is obliged to process your personal data even if you have requested that it be deleted, for example in the context of the right to freedom of expression and information, to comply with a legal obligation, or to perform a task of general interest. 

Limit use 

In some cases, you have the right to request that the processing of personal data be restricted. By restriction, we mean that the data is marked so that it can only be processed for certain limited purposes in the future. 

Withdraw consent 

In cases where you have previously given consent to the processing of your personal data, you have the right to withdraw that consent, both verbally and in writing. The withdrawal of your consent does not affect the legality of the processing before it is withdrawn. 

Automated decision-making 

You have the right to object to processing that is solely based on automated decision-making (which includes profiling), when that decision-making has a legal effect on you or otherwise significantly affects you. 

Contrast does not use automated decision-making that has a legal or significant effect on you. Automated decision-making means that decisions are made without human intervention, based on personal data provided, and that may have a legal or similar significant effect on the individual. 

Exercise rights, ask questions or make complaints 

If you wish to exercise any of the above rights, have any questions about this privacy policy or regarding the personal data held by Contrast, or if you are dissatisfied with Contrast’s processing of your personal data, please do not hesitate to contact Contrast, whose contact details are provided under point 2 of this policy. 

Please note that even if you object to certain processing of personal data, Contrast may still carry out the relevant processing if it is permitted or required by law, for example to comply with legal or contractual requirements. 

You always have the right to file a complaint with the relevant regulatory authority where you live, work, or where an alleged GDPR violation has occurred. You can find information about which authority you can contact here:  

http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm 

In Sweden, you contact the Data Protection Authority, for example by email to imy@imy.se.