Medborgarskapskursen1. Data controller
Znoff AB, corporate ID number 559422-8479, is the data controller for the processing of your personal data on Medborgarskapskursen. You can reach us at info@medborgarskapskursen.se. Write "Personal data" in the subject line so that we find your email faster.
We only process data that is needed to reply to you, give you access to the course and comply with the law. We never sell your data, and we do not use it for profiling or automated decisions.
2. What data we process
- When you email us: your email address, your name if you write it, and the content of the message. The site has no contact form.
- When you create an account (when the course opens): email address and password. The password is stored encrypted with our login provider, never in plain text with us.
- When you buy a subscription: the payment is handled by Stripe. We do not store your card details. From Stripe we receive what is needed to confirm the purchase and give you access: email address, payment status, amount, date and the subscription's validity period.
- Your progress in the course: which lessons you have read, which questions you have answered, your results on exercises and mock tests, and when you were last logged in. The data is used to show where you are in the course and what you need to revise.
- Technical data: our hosting provider logs IP address, time, requested page and response code in operational and security logs. We only use the logs for troubleshooting and security.
- Statistics, only with your consent: if you accept statistics in the consent box, Google Analytics measures which pages are visited and how visitors move around the site. Read more in section 6.
3. Why we process it
- To fulfil our agreement with you (Article 6(1)(b) of the GDPR): create and manage your account, give you access to the course, save your progress and manage your subscription.
- To reply to your email and keep the site secure (legitimate interest, Article 6(1)(f)): answer questions, correct errors, troubleshoot, prevent abuse and protect our systems.
- To comply with the law (legal obligation, Article 6(1)(c)): keep records for accounting and tax purposes.
- For statistics (consent, Article 6(1)(a)): understand how the site is used so that we can improve it. You can withdraw your consent at any time.
4. How long we keep the data
- Account and progress: as long as the account exists. When you close the account, the data is deleted.
- Purchase data: as long as the account exists and thereafter under the Swedish Accounting Act, 7 years after the end of the financial year in which the purchase was made.
- Emails: as long as the matter is ongoing, and thereafter for at most 12 months so that we can follow up if you contact us again. Emails about factual errors may be kept longer as a record of the correction, without your personal data.
- Technical logs: according to the hosting provider's standard period, normally at most 30 days.
- Statistics: according to the setting in Google Analytics, at most 14 months.
5. Suppliers and sharing
We only share data with suppliers who process it on our behalf, under data processing agreements, and with authorities when the law requires it.
- Vercel (hosting of the website): technical logs.
- Supabase (database and login): account, password and progress in the course.
- Stripe (payment): payment data. Stripe is an independent data controller for its own processing of card details.
- Google (Google Analytics via Google Tag Manager): visitor statistics, only after your consent.
- Cookiebot (the consent box): stores your choice about cookies.
Some of the suppliers may process data outside the EU/EEA, for example in the USA. In that case the transfer is based on the European Commission's adequacy decision (the EU-US Data Privacy Framework) or standard contractual clauses.
7. Security
All traffic to the site is encrypted (HTTPS). Access to the data is limited to the people who need it to run the service. Passwords are stored with one-way encryption by the login provider. In the event of a personal data breach that poses a risk to you, we notify you and the Swedish Authority for Privacy Protection (IMY) in accordance with the GDPR.
8. Your rights
Under the General Data Protection Regulation (GDPR) you have the right to:
- access the data we hold about you (a copy of your data);
- have incorrect data corrected;
- have data deleted, except when we must keep it by law, for example accounting records;
- restrict processing in certain situations;
- receive your data in a machine-readable format (data portability);
- object to processing based on legitimate interest;
- withdraw consent at any time, without affecting the processing before then.
To exercise your rights, email info@medborgarskapskursen.se. We reply as soon as we can and at the latest within one month. If you are dissatisfied with how we process your data, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, 104 20 Stockholm, imy.se.
9. Changes to the policy
We update the policy when the service changes, for example when accounts and payment open, or when the law requires it. The current version is always on this page with the date at the top. For major changes that affect you as an account holder, we notify you by email.
10. Contact
Questions about this policy or about your personal data: info@medborgarskapskursen.se, Znoff AB, corporate ID number 559422-8479. The terms for the subscription are on the page terms and conditions.