Medborgarskapskursen1. Data controller
Znoff AB, corporate ID number 559422-8479, Nordgårdsgatan 6J, 412 85 Göteborg, Sweden, is the data controller for the processing of your personal data on Medborgarskapskursen. You can reach us at info@medborgarskapskursen.se. Write "Personal data" in the subject line so that we find your email faster.
We only process data that is needed to reply to you, give you access to the course and comply with the law. We never sell your data and we make no automated decisions about you. Only if you accept marketing cookies does Meta receive information about your visit to measure and target our ads (section 6).
2. What data we process
- When you email us or use the contact form: your name, your email address, the topic and the content of the message. Form messages are stored with our database provider Supabase (EU, Ireland) together with a hashed IP address and which browser you used (user agent). These are used only to stop mass submissions, and the messages are deleted no later than twelve months after the matter is closed.
- When you create an account: email address and password. The password is stored encrypted with our login provider, never in plain text with us.
- When you log in with Google: your email address and your name from the Google account. We never receive your Google password.
- When you buy the course without an account: we create an account for you with the email address and name you enter at checkout, so that the course can be opened. You log in with the link we email you, and can then choose a password.
- When you buy a subscription: the payment is handled by Stripe. We do not store your card details. From Stripe we receive what is needed to confirm the purchase and give you access: email address, payment status, amount, date and the subscription's validity period.
- When you ask us to notify you about the next test: your email address, the language, the page you were on, the text you accepted, when you confirmed and a hashed IP address. We email you when the date and registration are published, and the email may also be about the course.
- Emails we send: an order confirmation when you buy and a reminder 14 days before a yearly subscription renews. The order confirmation is also sent as a blind copy to Trustpilot, which emails you seven days later to ask whether you want to leave a review. Trustpilot then receives your email address and the order confirmation, which includes your name.
- When you cancel a purchase: which purchase it concerns, when you cancelled it, what you paid and what you get back. The data is the basis for the refund and the accounts.
- When you leave a review in the course portal: the rating, the text and the name you write yourself. We read the review before it is published, and a published review is shown on the site with that name.
- Your progress in the course: which lessons you have read, which questions you have answered, your results on exercises and mock tests, and when you were last logged in. The data is used to show where you are in the course and what you need to revise.
- When you accept marketing cookies: the Meta Pixel sends Meta which pages you visit, whether you go to the checkout and whether you buy (which plan and the amount), together with a random ID in the _fbp cookie, your IP address and details about your browser. If you came from an ad on Facebook or Instagram, the ad's ID is included. We never send your name or email address to Meta.
- Technical data: our hosting provider logs IP address, time, requested page and response code in operational and security logs. We only use the logs for troubleshooting and security.
3. Why we process it
- To fulfil our agreement with you (Article 6(1)(b) of the GDPR): create and manage your account, give you access to the course, save your progress and manage your subscription.
- To reply to your email and keep the site secure (legitimate interest, Article 6(1)(f)): answer questions, correct errors, troubleshoot, prevent abuse and protect our systems. This also covers asking for reviews through Trustpilot and showing reviews on the site.
- To comply with the law (legal obligation, Article 6(1)(c)): keep records for accounting and tax purposes.
- To email you about the test and the course (your consent, Article 6(1)(a)): only if you have left your email and confirmed it in the message. You can withdraw your consent at any time with the link in our emails or by writing to us.
- To measure and target our ads on Facebook and Instagram (your consent, Article 6(1)(a)): only if you have accepted marketing cookies. You can withdraw your consent at any time.
4. How long we keep the data
- Account and progress: as long as the account exists. When you close the account, the data is deleted.
- Purchase data: as long as the account exists and thereafter under the Swedish Accounting Act, 7 years after the end of the financial year in which the purchase was made.
- Cancelled purchases: under the Swedish Bookkeeping Act, 7 years after the end of the financial year in which the purchase was made.
- Reviews: as long as the account exists, or until you ask us to remove the review.
- Emails: as long as the matter is ongoing, and thereafter for at most 12 months so that we can follow up if you contact us again. Emails about factual errors may be kept longer as a record of the correction, without your personal data.
- Test notifications: until you stop them, and at most 24 months after you confirmed. If you do not confirm, the address is deleted after 30 days.
- Technical logs: according to the hosting provider's standard period, normally at most 30 days.
- Meta Pixel: the _fbp and _fbc cookies stay in your browser for at most three months and are removed if you withdraw your consent. Meta keeps the data according to its own terms.
5. Suppliers and sharing
We only share data with suppliers who process it on our behalf, under data processing agreements, and with authorities when the law requires it.
- Vercel (hosting of the website): technical logs.
- Supabase (database and login, servers in the EU, Ireland): account, password, progress in the course and addresses for test notifications.
- Stripe (payment): payment data. Stripe is an independent data controller for its own processing of card details.
- Hostinger (email): emails to and from info@medborgarskapskursen.se, including order confirmations and reminders.
- Google: handles the login when you choose to log in with Google.
- Trustpilot (reviews): the email address and the order confirmation, to ask you for a review. A review you leave on Trustpilot is processed by Trustpilot as an independent controller.
- Meta Platforms Ireland (ads on Facebook and Instagram, only with your consent): the data from the Meta Pixel. We and Meta are joint controllers for collecting the data and sending it to Meta. Meta alone is responsible for what it then does with it, under Meta's privacy policy.
- Hostinger (the consent log): keeps your cookie choice for at most two years as proof of consent, with a random ID, the time and the address of the page where you chose. Your IP address is not stored.
Some of the suppliers may process data outside the EU/EEA, for example in the USA. In that case the transfer is based on the European Commission's adequacy decision (the EU-US Data Privacy Framework) or standard contractual clauses.
7. Security
All traffic to the site is encrypted (HTTPS). Access to the data is limited to the people who need it to run the service. Passwords are stored with one-way encryption by the login provider. In the event of a personal data breach that poses a risk to you, we notify you and the Swedish Authority for Privacy Protection (IMY) in accordance with the GDPR.
8. Your rights
Under the General Data Protection Regulation (GDPR) you have the right to:
- access the data we hold about you (a copy of your data);
- have incorrect data corrected;
- have data deleted, except when we must keep it by law, for example accounting records;
- restrict processing in certain situations;
- receive your data in a machine-readable format (data portability);
- object to processing based on legitimate interest;
- withdraw consent at any time, without affecting the processing before then.
To exercise your rights, email info@medborgarskapskursen.se. We reply as soon as we can and at the latest within one month. If you are dissatisfied with how we process your data, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, 104 20 Stockholm, imy.se.
9. Changes to the policy
We update the policy when the service changes, or when the law requires it. The current version is always on this page with the date at the top. For major changes that affect you as an account holder, we notify you by email.
10. Contact
Questions about this policy or about your personal data: info@medborgarskapskursen.se, Znoff AB, corporate ID number 559422-8479, Nordgårdsgatan 6J, 412 85 Göteborg, Sweden. The terms for the subscription are on the page terms and conditions.