Privacy Notice

Svenska

1. Introduction

This Privacy Notice explains how Kalmar Nation handles your personal data. It covers what we collect, why, how long we keep it, who we share it with and what rights you have under the GDPR and Swedish data-protection law.

This notice applies to everyone whose data Kalmar Nation controls, including:

  • prospective, current and former members of Kalmar Nation;

  • people who apply for, book, pay for or attend our events;

  • visitors to kalmarnation.nu and people who contact us;

  • newsletter and other optional communication subscribers;

  • people shown or heard in photographs or video;

  • volunteers, elected office-holders and committee participants;

  • suppliers, contractors, collaborators and payees;

  • housing applicants, queue members and tenants, where Kalmar Nation is the controller; and

  • people who make, are named in, witness or otherwise participate in a Social Affairs Committee matter.

Where a specific process has its own controller, purpose or risk profile, a shorter notice is provided at the point of collection of the data. This applies to housing, the Social Affairs Committee reports, and other activities that differ materially from the processing described here.

2. Who We Are

Controller: Kalmar Nation, organisation number 262000-0931, Biskopsgatan 12, 223 62 Lund, Sweden. We are the controller for all processing described here, unless we say otherwise.

Website: kalmarnation.nu

Contact: q@kalmarnation.nu for general questions; gdpr@kalmarnation.nu for privacy questions and requests about your data. Kalmar Nation has not appointed a Data Protection Officer under Article 37 GDPR. The privacy coordinator designated by the board is the first point of contact for all data-protection matters.

We do not sell personal data.

3. What Data We Collect, Why and for How Long

The table below shows our main processing activities, legal bases and how long we normally keep data. We delete or anonymise data sooner when we can. An active complaint, incident, audit, legal duty or claim may extend a retention period under a documented legal hold.

3.1 Membership-Service Roles

Terminsräkningsföreningen (TRF) is a separate controller for processing through its membership service. We are responsible for how we use data we receive from TRF and will answer requests about our own processing.

Studentkortet i Sverige AB (org.nr 556491-5287), trading as STUK.CO, provides the digital student card. TRF shares the data needed for this (name, student status, membership and contact details) with Studentkortet, which is a separate controller under its own privacy policy at studentkortet.se/integritetspolicy. Questions about Studentkortet’s own processing should go to them.

When we get your personal data from TRF, Studentlund, STUK.CO or another source instead of directly from you, we give you the information required by Article 14 GDPR within the applicable time limit — normally within one month, at first contact or before we share the data — unless a lawful exception applies.

3.2 Special Categories, Personal Identity Numbers and Photographs

Dietary or accessibility information is optional. If it reveals health, religious belief or another sensitive category, we rely on your consent under Article 6(1)(a) and your explicit consent under Article 9(2)(a). We only ask for what we need, limit access to authorised event or kitchen staff, and delete the information shortly after the event.

We do not collect personal identity numbers just because it is convenient. If reliable identification genuinely requires one, we explain the purpose, legal basis, necessity under Swedish law, who receives it and how long we keep it before we collect it.

For posed or prominent promotional images, consent must be specific to the purpose and channels. General crowd or documentary images may rely on a documented legitimate-interest assessment. Attending an event or agreeing to general terms does not count as consent for photography. We tell you how to avoid being photographed and how to ask us to remove images from channels we control.

4. Legal Bases for Processing

We use a specific legal basis for each purpose:

  1. Contract or pre-contractual steps (Art. 6(1)(b)): processing that is genuinely necessary to set up or run your membership, a booking, a contract or a service you asked for.

  2. Legal obligation (Art. 6(1)(c)): records that the law requires us to keep, such as accounting and tax records.

  3. Legitimate interests (Art. 6(1)(f)): proportionate processing for governance, accurate administration, safety, fraud prevention, IT security, service continuity, ordinary organisational contacts, documentary photography and legal claims, after weighing those interests against your rights.

  4. Consent (Art. Consent (Art. 6(1)(a)): optional newsletters, non-essential cookies and similar technologies, prominent promotional photography, and other genuinely optional processing.

  5. Special-category or offence data: we also need a separate condition under Article 9(2) or Article 10 authority, on top of an Article 6 basis. Note: a reporter’s consent does not allow us to process sensitive data about someone else.

You can withdraw consent at any time through the same channel you used to give it — for example, an unsubscribe link, the cookie-settings control or gdpr@kalmarnation.nu. Withdrawal only affects future processing and does not make earlier processing unlawful.

5. How We Collect Data and Whether It Is Required

We collect personal data from the following sources:

  • Membership: directly from you and, where applicable, from TRF, Studentlund and the verified student-card provider.

  • Website and contact: from website forms, email and other communications, plus technical logs and device technologies as described in Section 9.

  • Events: directly from the applicant, purchaser or attendee and from payment or registration services. Ordinary event forms do not request personal identity numbers; dietary or accessibility details are optional and separated from ordinary booking fields.

  • Photography/video: from event photography or material you submit, with advance information and the legal basis appropriate to the image and use.

  • Housing: from the applicant or tenant and, only where lawful and disclosed, references, public registers, payment services or other sources identified by the verified housing controller.

  • Social Affairs Committee: from the reporter, the person concerned, witnesses, relevant Nation records, professional advisers or authorities where lawful.

  • Roles and suppliers: directly from the individual, the organisation they represent, role records, access systems, payment records and relevant public business sources.

Fields marked as required are needed for the stated contract, service, legal duty, eligibility or security purpose. If you do not provide required information, we may not be able to register your membership, accept a booking, enter a contract, check eligibility or provide the service. Optional fields are clearly marked and do not affect unrelated services. Our membership and events are for university students. We do not knowingly collect personal data from children under 16. If we learn that a child under 16 has given us personal data without appropriate parental or guardian consent, we take steps to delete it.

6. Who Receives Personal Data?

Internal access: authorised officeholders, employees, volunteers and committee members only see the data they need for their current role. Access is personal, reviewed when responsibilities change and removed promptly when a role ends.

Depending on the processing, recipients may include:

•         TRF as a separate controller for its membership service; the verified STUK.CO entity and role; payment, event-registration, email, cloud-storage, IT-Support, accounting and security providers.

•         Squarespace or another verified website provider; Meta, Instagram, Facebook, Discord or another platform when information is intentionally published or an integration is activated; and the housing controller or administrators where relevant. Where a joint controller relationship exists (for example, with Meta for the operation of Facebook or Instagram pages), the essence of the Article 26 arrangement is available on request from gdpr@kalmarnation.nu.

•         Accountants, auditors, insurers, banks, legal advisers and other professional advisers; and public authorities, courts, emergency services or law-enforcement bodies where disclosure is required or otherwise lawful and necessary.

A provider acting as our processor may only use personal data as we instruct, under a written data-processing agreement (Article 28 GDPR). A provider that uses data for its own purposes is a separate controller, with its own notice and its own responsibility for your rights. We only share the data that the provider needs for its stated purpose.

7. Security and Personal Data Breaches

We use technical and organisational security measures suited to the nature and risk of each processing activity. Depending on the system, these include:

•         encryption in transit and at rest where appropriate and verified for the relevant system;

•         role-based access, personal accounts, multi-factor authentication where supported, logging and timely access removal;

•         confidentiality requirements, training and supplier security assessment; and

•         documented retention, legal-hold and secure-deletion procedures.

No system is completely secure. If we suspect a personal data breach, we document and assess it, contain it, preserve relevant evidence and, where GDPR requires, notify IMY and the people affected.

8. Your Rights Under GDPR

Under GDPR, and subject to certain conditions, you have the following rights:

To exercise a right, email gdpr@kalmarnation.nu or contact us through another appropriate channel. We may ask you to confirm your identity. Requests are normally free and answered within one month. If a request is complex, GDPR allows us up to two extra months; we will explain why within the first month. If we cannot fully grant a request, we will explain the reason and tell you about your right to complain.

TRF, social-media platforms, a separate housing controller and other independent controllers handle requests about their own processing. We handle requests about processing that we control and will work with other providers where needed.

You may lodge a complaint with Integritetsskyddsmyndigheten (IMY), the Swedish Authority for Privacy Protection: www.imy.se.

9. Cookies and Similar Technologies

9.1 Categories

We use cookies and similar technologies, including local storage, pixels, tags and embedded content. Strictly necessary technologies are used only to send a communication, secure the website or provide something you asked for. All other technologies — including analytics, preferences and marketing — are off until you actively consent.

9.2 Exact Technology Inventory

  • The live cookie list must identify every technology actually in use by name, provider, purpose, category, first- or third-party status, duration, recipients and any international transfer.

  • The verified live list is available at kalmarnation.nu/cookies. It must be regenerated and the consent configuration retested whenever Squarespace settings, analytics, Meta integrations, advertising, embeds, tags or custom code change.

9.3 Your Choices

  • Choose ‘Accept all’, ‘Reject all’ or ‘Manage choices’ from the first view, with equally accessible and visually equivalent accept and reject options.

  • Change or withdraw consent at any time through a permanent ‘Cookie settings’ control available on every page.

  • Use browser settings or provider opt-out tools as additional controls; they do not replace the website’s duty to obtain valid prior consent.

No non-essential option is pre-selected. The website records your consent choice (including the version, the date and the categories you accepted or rejected) and keeps that record for up to 3 years or as long as the technology is in use, whichever is longer. Withdrawing consent stops future use of the relevant technology but does not affect earlier lawful processing.

9.4 Contact

For questions about cookies or other personal-data processing, contact gdpr@kalmarnation.nu.

10. Automated Decision-Making

We do not make decisions about you solely by automated means that have legal or similarly significant effects. If you enable analytics or advertising through your consent choices, the relevant platform providers may carry out analytics or personalisation under their own notices. If this changes, we will tell you before introducing any relevant automated decision-making.

11. Changes to This Notice

We review this notice regularly and update it when our processing, providers or legal requirements change. The current version and effective date appear at the top. We communicate important changes through a suitable channel and, where required, get fresh consent before using data for a materially different purpose.