Personal data and data protection

The purpose of this privacy policy is to let you know how we process your personal data and what we use it for, who can access it and how you can exercise your rights.

The policy is aimed at you who are:

• Member or former member

• Potential member

• A shop steward

• Member of another Saco union

• Member of professional associations

• Jobseeker with us

• Employer representative

• Partners of Naturvetarna

• People who contact us via e-mail, social media or other channels

• Visitors to our website

• Relatives of our employees

• Witness or expert

• Person who may appear in a case with us

Personal data responsibility rests with the party that decides what personal data is collected and why, as well as the ways in which the personal data is to be processed.

Naturvetarna as a union is the data controller for all personal data that we collect directly from you when you are in contact with us in various ways. Naturvetarna is also the data controller for data that we collect about you via your employer, elected representative or in some other way.

Being a data controller means that we are responsible for ensuring that your personal data is processed correctly and securely in accordance with applicable legislation. It also means that we must ensure that you can exercise your rights under the GDPR.

Naturvetarna has an external data protection officer from Secify by Sweden. If you want to get in touch with the DPO, you can send us an email or a letter. Contact details can be found at the bottom of this policy.

Personal data is information that can be linked in some way to you as an individual. If the information can identify a living person, directly or indirectly, individually or in combination with other data, it is considered personal data. Examples include name, address, IP address, social security number, membership number, photographs and audio recordings.

Some personal data is classified as sensitive and should be protected with extra care. Membership of a trade union is considered sensitive personal data, which means that much of the personal data handled by Naturvetarna is of a sensitive nature. We therefore take data protection very seriously.

Processing of personal data means everything that happens with the personal data. Any action taken with personal data constitutes processing, regardless of whether it is carried out automatically or not. Examples of common processing operations are collection, recording, organization, structuring, storage, processing, transfer and erasure.

We access your personal data in the following ways:

• You provide us with data directly.

• Data is recorded when you visit our website, through tracking technologies.

• We obtain data from public registers or from authorities, companies or organizations when we represent you in a trade union matter.

• When one of our employees or elected representatives collects data about you in a trade union matter.

• when you register for one of our courses or seminars

• When you respond to questionnaires and surveys we send out.

• When you apply for employment with us.

• When you contact us in any other way.

• When you take advantage of membership benefits such as insurance offers, income insurance or other offers.

• A professional association passes on data to us, if you are a member of such an association.

• Data transmitted via Akademikernas a-kassa

• Data transmitted within the framework of SACO cooperation

• Via social media, in accordance with your own privacy settings for these channels

• From insurance companies and other partners

We share your personal data with third parties provided that it is necessary to comply with our legal obligations, if you have consented to it or if we consider it acceptable on the basis of a balance of interests.

We may share your personal data with the following trusted recipients, among others:

• Akademikernas a-kassa, when you are a member of the unemployment fund

• Other organizations within Saco collaborations, such as Saco-P, Saco-S and Akademikeralliansen

• SACO, when producing salary statistics and a central membership register

• Parties to a negotiation case including law firms

• Professional associations

• Employers, when collaborating, deliberating or negotiating

• IT service providers

• Career service providers, such as career interviews and CV review

• Social media platforms, subject to your consent to participate

• Insurance companies, when enrolling members in income and group insurance included in the membership

• Printers and distributors, if you have chosen to participate in external mailings

• TAM archives, who manage our archive material

• Public authorities, courts and arbitration tribunals

In cases where we disclose personal data, we draw up special agreements where necessary and ensure that the personal data is processed in a satisfactory manner.

Under no circumstances will Naturvetarna sell your personal data to third parties.

If you have specific questions about the parties with whom your personal data is shared, you are welcome to contact us.

We aim to process your personal data within the EU/EEA, but in certain situations your personal data may be transferred to a supplier or subcontractor operating outside the EU/EEA. This is called a third country transfer.

Countries outside the EU/EEA may have laws that mean that public authorities may have the right to request personal data for the purpose of fighting crime and defending national security. An example of this is when personal data is sent via one of Microsoft's applications such as Outlook or Teams. Although Microsoft has servers in the EU and must comply with the GDPR, there are laws in the United States that may require Microsoft to disclose information to US intelligence agencies in certain cases.

Where third country transfers are made, we strive to ensure the highest level of protection for your personal data. Such safeguards include, among others:

• Choosing providers that adhere to a standard that the European Commission has decided meets an "adequate level of protection" equivalent to the protection provided by the GDPR. This means, for example, that the data continues to be protected from unauthorized access and that you can exercise your rights in relation to your personal data and lodge complaints.

• Enter into contracts with suppliers in third countries that include the European Commission's standard clauses. This means that the recipient guarantees that the protection of your personal data provided by the GDPR will still apply. In these cases, we also assess whether there is legislation in the recipient country that affects the protection of your personal data. If necessary, we will take specific technical and organizational measures to ensure that the protection of your data is maintained during the transfer to the relevant country outside the EU/EEA.

Data about you and your membership that we are responsible for is handled in various IT systems located on US servers and where there is an adequacy decision from the European Commission. Thus, there is a legal basis for third country transfers and we also put in place adequate security measures to keep your data safe and ensure that you can exercise your rights under the GDPR.

Naturvetarna works continuously and systematically with data protection to constantly improve our security around personal data management. We put in place adequate organizational and technical security measures to keep your personal data safe. In the event of any mishandling of personal data, we will report it to the Data Protection Authority and contact you in accordance with our statutory obligations under the GDPR.

The starting point is that only those within Naturvetarna who need to access your personal data to perform their duties should be authorized to access it.

Our IT systems are developed in an integrity-friendly manner and taking into account the sensitivity of the data being processed.

We ensure that agreements are in place with external parties (such as IT system providers) who process your data on our behalf. We provide them with instructions on how personal data may be processed and require a high level of security.

Our employees and elected representatives are aware that they are subject to a duty of confidentiality regarding personal data they receive in the course of their work.

Personal data shall be stored and used for specific purposes. In general, Naturvetarna only saves your personal data for as long as it is needed to fulfill the purpose for which we collected it and which we communicated with you. In some cases, data may need to be stored for a certain period of time because it is required by law.

When personal data is no longer needed for the given purpose, it will be deleted, de-identified or archived in TAM archives.

Specific retention periods for personal data, in certain cases, are set out below:

• All data related to your membership will be kept for 10 years after your withdrawal as a member in order to handle any claims.

• Data related to advice cases are kept for 10 years after the advice case is closed in order to manage any claims.

• Data on payments is stored for 7 years to comply with the Accounting Act (1999:1078).

• Data we collect for our annual salary survey is saved as a backup for 5 years after the data has been added to the statistics.

• Data on participation in events is saved for 3 months after the event has taken place to send out information and offers to you.

• The files of deceased individuals are stored for 1 year in order to be able to fulfill the obligations of the executor of the deceased.

• Information on the warning or exclusion of a member is kept for 10 years from the date of the exclusion decision in order to deal with any claims. Basic information on the grounds for exclusion is kept for the lifetime of the data subject.

• Extracts from the register are kept for 1 year for the purpose of dealing with any claims relating to the disclosed material.

• Application documents are stored for 2 years after a decision on employment to be able to handle any claims related to discrimination.

When you send us an email, we will either put your message into a case management system if the information is required to fulfill the assignment and the original message in Outlook will be deleted. Otherwise, your email and any other conversation will be deleted after the case officer has dealt with the issues.

Naturvetarna does not take any decisions based on fully automated processing, without human intervention, that could legally or significantly affect you.

As a data subject, you have several rights in relation to your personal data. If you wish to exercise a right, please use our form: Personal Data Action.

You can also contact us by other means, in which case we will forward your request to our Data Protection Officer.

In short, you have the following rights:

• Right to have your personal data erased

• The right to have your personal data rectified if it is inaccurate. As a member, you can check on My Pages whether we have the right information about you and update certain information yourself.

• The right to receive information about what personal data is processed about you, for what purposes it is processed, which parties it is shared with, how long it will be stored, where it was collected, etc.

• Right to receive a copy of all personal data processed about you

• Right to object to personal data processing. We will then cease processing unless we can demonstrate compelling reasons that override your interests, rights and freedoms or if the processing is necessary for the establishment, exercise or defense of legal claims.

• Right to restriction of personal data processing

• Right to have your personal data transferred from one controller to another controller

• The right not to be subject to automated decision-making in a way that could affect you legally or otherwise in a significant way

• Right to lodge a complaint with the Data Protection Authority

We will, at your request or on our own initiative, correct or complete personal data that we discover to be inaccurate, incomplete or misleading.

Depending on the legal basis on which the processing of your personal data is based, you may have the right to have your personal data erased. This means that you have the right to request that we delete your personal data if it is no longer needed for the purposes for which it was collected. However, there may be legal requirements that do not allow us to delete your personal data immediately.

You always have the right to withdraw any consent you have given for a particular processing operation. If processing is based on consent, the processing will then cease. The withdrawal of consent does not affect the lawfulness of the processing based on consent before its withdrawal.

If your personal data is processed for direct marketing purposes, you can object to the processing at any time and we will stop the processing immediately. Emails must always contain a link that you can click on to opt out of future mailings.

The naturvetarna.se website is under a voluntary publishing agreement. This means that personal data published on the website is exempt from the rules of the GDPR, which includes your right to request deletion, object to processing and the like.

Once a year, you have the right to request, free of charge, information about the personal data we process about you. We will respond to your request within thirty (30) days of receiving it.

If you wish to exercise one of your rights, we will ask you to identify yourself with Bank ID or by other appropriate means.

You can find out more about your rights on the website of the Data Protection Authority: https://www.imy.se/privatperson/dataskydd/dina-rattigheter/ External link.

If you are not satisfied with how we process your personal data, we would like you to contact us by email or letter using the contact details at the bottom of this policy so that we have the chance to correct any errors. You also have the right to lodge a complaint with the Data Protection Authority if you believe we have processed your personal data incorrectly. See External link. www.imy.se for more information.

In the tables below, you can read about what we will use your personal data for (the purpose), what types of personal data we use for each purpose and whether we received the information directly from you or from another source, as well as what legal basis we have under applicable data protection legislation to process your personal data.

To the data controller

The non-profit organization Naturvetarna with the company name Naturvetarna (802002-4264)

Planiavägen 13, 131 54 Nacka

Box 760, 131 24 Nacka

08-466 24 80

To the Data Protection Officer

Naturvetarna has appointed a data protection officer who monitors Naturvetarna's compliance with applicable data protection legislation. You can reach the Data Protection Officer at the following email address: dataskyddsombud@naturvetarna.se

We will update this privacy policy as necessary. If significant changes are made, we will inform you about it. The latest version is always available on our website.

This policy is last updated: 2025-05-14.