Privacy Policy for Lundaspelen Summer

1. Introduction – What is Personal Data?

By "personal data" we mean all kinds of information that can directly or indirectly be associated with a living physical person. LUGI HANDBOLLSFÖRENING - LUGI HF is responsible for the personal data that you provide to us as part of Lundaspelen Summer or that we collect from another source. Within LUGI HANDBOLLSFÖRENING - LUGI HF, personal data is always treated with great respect for personal privacy. Below is a description of the guidelines that LUGI HANDBOLLSFÖRENING - LUGI HF applies in connection with Lundaspelen Summer, how we handle and store the information, and what rights you have. The guidelines never restrict the rights that apply according to the General Data Protection Regulation or any other legally binding provision.

2. Collection of Personal Data

We collect personal data in the following ways:

You provide it to us, for example, when you register a team for the tournament, but also in other situations. For example, via our website, on physical forms, in other contact with us, via email, letters, contact forms, and through logged-in services and via social media.
Someone else provides your data with your consent to complete a registration. This applies, for example, to team leaders and players.
Information is created based on your registration and how you use our services, e.g., making payments or participating in the tournament.
Photos and videos taken during the tournament.
We may also collect information about you from our partners, so-called third parties.

Personal data is also recorded when payments are made, for example, both in bank transfers and card payments to manage your registration.

2.1 Websites Belonging to Lundaspelen Summer

Normally, you can visit https://lundaspelensummer.cups.nu without personal data being collected. We then only collect information for statistical purposes and the visitor remains anonymous. Examples of such information are the time of the visit, how long the visit lasts, and which pages are visited. LUGI HANDBOLLSFÖRENING - LUGI HF also uses so-called "cookies" to ensure that functions and services on the website work correctly. When you actively submit a registration, we can, with the help of stored cookies, target so-called polls (surveys) that are displayed to you based on your behavior on the website. For example, these can be used to evaluate what you thought about the registration system or provide you with follow-up questions in connection with a failed card payment. Here you can read more about how we use cookies When you as a customer visit Lundaspelen Summer through our logged-in services, the visit can be linked to the logged-in person's registration and username/email address. This gives LUGI HANDBOLLSFÖRENING - LUGI HF the opportunity to communicate more relevantly to individual teams and contacts.

2.2 Categories of Personal Data

The categories of personal data that we usually collect are:

Customer information, i.e., the data needed to participate in the tournament with us. Examples are name, phone number, and email address.
Participant information, i.e., information about participants during the tournament. This includes contact persons, team leaders, referees, parents, and players registered at the time of registration in our logged-in services. In some cases, login is via a private link and not via username and password.
Purchase information, i.e., purchased products and services and payment history.
Results and statistics, i.e., how the tournament went and in some cases also which player scored goals or assists, or was awarded disciplinary actions, e.g., in the form of green/yellow/red cards and expulsions.
Service information, i.e., correspondence in specific cases, information about registration, and any complaints. Responses to customer surveys and feedback on our goods and services. In applicable cases, information provided in connection with competitions.
Visit information on logged-in services, i.e., purchase- user-generated data, passwords, technical data regarding the device used, interaction data (visit time, response times, how you reach and leave the service, etc.).
Special categories of personal data (defined in Article 9(1) of the General Data Protection Regulation) are only handled in exceptional cases when needed to manage the tournament.
Photos and videos taken during the tournament and presented in our channels.
Information from social media, i.e., information that you post on our website and on third-party social media.

2.3 Information When Data is Collected

When personal data is provided to us, the person providing their personal data receives information about:

for what purpose and on what legal basis the personal data are collected,
contact information for LUGI HANDBOLLSFÖRENING - LUGI HF about Lundaspelen Summer
what rights you have as a customer,
how long the data is stored.

If you find the information unclear or incomplete, we ask you to contact Lundaspelen Summer and LUGI HANDBOLLSFÖRENING - LUGI HF for complete information.

2.4 Purpose and Legal Basis for Processing

We only collect personal data for purposes that are supported by the applicable General Data Protection Regulation. The most common is that the data is collected for processing based on the legal basis performance of a contract. The purposes include, for example:

entering a contract with us/completing a registration
booking additional products through our logged-in services
handling questions and other service cases.
age verification and exemption application for players
to uniquely identify players in insurance matters

With legitimate interest as a basis, we process data for several purposes, for example:

for marketing and profiling, i.e., to communicate relevant offers and information about events that LUGI HANDBOLLSFÖRENING - LUGI HF organizes to those who have registered for Lundaspelen Summer
for communication of our and our partners' offers
to send newsletters
to develop and improve Lundaspelen Summer
for statistics and analyses.

You may also give consent to processing in certain cases where none of the above applies. Given consent is an active action from you and can be revoked in the same place where the consent was given. We will then no longer process your personal data for that purpose. We primarily obtain consent for:

displaying names of players in connection with live results and other match and tournament statistics
displaying names of referees in the schedule and for other referees who want to find partners they want to officiate with

In line with the Swedish Sports Confederation's code of conduct for sports clubs, statistics from the results in the tournament are also stored with public interest as a basis. The same applies to the processing of special categories of personal data performed within the framework of issuing and administering para licenses.

We may also publish photos and videos taken during the tournament with balancing of interests as a basis if they are not published for journalistic purposes.

Other purposes for our processing of personal data may have their legal basis in various legal requirements, i.e., where we must fulfill a legal obligation, examples of such purposes are processing of personal data according to the Accounting Act for invoicing, processing of personal identification numbers to be submitted to the Swedish Tax Agency in connection with control statements for referee salaries, or when we mediate information about changed contract terms. This also applies to the processing of personal data in punishment and disciplinary matters.

We do not process personal data for purposes that are incompatible with the original purpose. More information about what purpose the personal data is used for can also be provided when the personal data is provided, for example, in connection with email forms or in contract terms.

3 Transfer of Personal Data

Under certain circumstances, we may also transfer personal data to data processors, partners, or other third parties. The actors that may process collected personal data are:

IT providers
Sales partners and collaborators
Technical service contractors
Print and digital communication partners
Media agencies and advertising agencies
Sports federations or local/regional part of the same

In some cases, upon request according to law and government decisions, we may be required to disclose personal data to, for example, the police, for crime prevention measures and crime investigations. Personal data is not regularly transferred to companies in countries outside the EU or EEA. In some situations, however, the data may be transferred to, and processed in, a country outside the EU/EEA by LUGI HANDBOLLSFÖRENING - LUGI HF or by another supplier or subcontractor. In these cases, a special investigation is always carried out to ensure that the legal conditions are met and that technical and organizational measures have been taken to ensure that personal data is handled securely and with an adequate level of protection comparable to and at the same level as the protection offered within the EU/EEA.

4 Personal Data Collected from Another Party

From various partners, we receive information about you that you have provided to the partner and to which you have consented to the transfer to Lundaspelen Summer because you are interested in registering for the tournament or participating.

From our bank, we sometimes receive your personal data when you make bank transfers.
From our card payment provider Stripe, in connection with card payments.
From our social media, third-party data will provide us with certain information about you. The information may include your name and email address.
Other partners may also share information with us, e.g., if an end-user has been in direct contact with their support or if they assist us with data collection on our behalf.

5 Access to Personal Data

Only those who need access to the personal data to perform the agreed service have the authority to access and manage these. We have several subcontractors who handle personal data to varying extents, and they have the same requirements for handling as LUGI HANDBOLLSFÖRENING - LUGI HF has internally.

6 Deletion

We do not store personal data longer than necessary. After a tournament has ended, we retain your data for a maximum of 36 months. Some data may, however, be stored for a longer period to fulfill other legal requirements, for example, the Accounting Act where we need to save data for 7 years. There are also reasons to save the data for a longer time if there is a public interest for statistical purposes (see section 2.4 and the Swedish Sports Confederation's code of conduct for sports clubs).

7 Security

We take special physical, technical, and organizational measures to protect the personal data processed so that the data is not lost, destroyed, manipulated, or made available to unauthorized persons. The measures aim to achieve a security level that is sufficiently high with regard to the technical possibilities that exist. Changes in the personal data are continuously recorded to ensure traceability in all changes that occur in the information. Incidents concerning personal data are reported internally and by our subcontractors. These are handled in an internal process and, in relevant cases (if there is a high risk to the individual's rights and freedoms), reported to the Swedish Data Protection Authority within 72 hours, as well as to the person who lost their information according to the rules prescribed by the data protection law. Data breaches are also reported to the police.

8 Your Rights

8.1 Right of Access

Everyone has the right to get information to what extent data about oneself is processed by LUGI HANDBOLLSFÖRENING - LUGI HF in relation to Lundaspelen Summer. If such personal data exists at LUGI HANDBOLLSFÖRENING - LUGI HF, the concerned person can request information about which categories of personal data are processed, from where these have been obtained, for what or which purposes the processing occurs, what legal basis exists, and to whom or which the data is disclosed. The person requesting information must be able to identify themselves. LUGI HANDBOLLSFÖRENING - LUGI HF sends a response within 1 month from the date the request was received.

8.2 Right to Rectification

Everyone has the right to request rectification of their own customer information if it is incorrect or processed in violation of applicable law.

8.3 Right to Erasure

LUGI HANDBOLLSFÖRENING - LUGI HF deletes personal data related to Lundaspelen Summer when there is no legal basis to retain the data. Those who have registered for the tournament have the right to immediately have their personal data erased if any of the following applies:

the data is no longer needed for the purposes for which they were processed
the processing is for direct marketing and you object to the data being processed for this purpose
the information has not been processed according to the regulation
you object to processing that is based on a balancing of interests and the legitimate reasons do not outweigh your interests
erasure is required to fulfill a legal obligation.

8.4 Right to Object to Automated Decision-Making

LUGI HANDBOLLSFÖRENING - LUGI HF does not apply automated decision-making in the administration of Lundaspelen Summer for the registered individual.

8.5 Right to Data Portability

Everyone whose personal data is held by LUGI HANDBOLLSFÖRENING - LUGI HF has the right to receive these data on paper or in a common electronic format.

8.6 Right to Restriction of Processing

In certain cases, you have the right to request that the processing of your personal data be restricted. This applies, among other things, if you believe that the personal data is incorrect and you have requested rectification. While the investigation is ongoing, you can request that the processing of the personal data be restricted.

8.7 Right to Object

If LUGI HANDBOLLSFÖRENING - LUGI HF processes your personal data based on a balancing of interests, you have the right to object to the processing. To do this, you must specify which processing you object to. If we are to be able to continue with such processing, we must demonstrate that there are compelling legitimate reasons for the personal data to be processed that outweigh your interests.

8.7.1 Marketing, Newsletters, and Profiling

When personal data may be processed for direct marketing or newsletters, this is indicated when the personal data is collected. You can at any time notify us that you do not wish to receive marketing from us, by contacting us. Most of our email messages have a link where you can opt out of marketing via email. This does not apply to messages that are a reaction to an action from a customer, e.g., confirmation of registration or receipt of payment. Personal data may also be processed for customer relationship management, for example, by selecting and segmenting to communicate targeted, relevant, and more personal offers. As part of this, profiling may occur, based on the personal data we have received in connection with the registration. The profiling is done to be able to provide offers and information that are tailored to your needs. You can at any time notify us that you do not wish to receive this type of offers.

8.8 Right to Compensation

You may be entitled to compensation in certain cases, for example, if our handling of your personal data has led to damage for you. Claims can be made directly to LUGI HANDBOLLSFÖRENING - LUGI HF.

8.9 Linking

The information on this page applies to Lundaspelen Summer and the tournament's websites. In cases where this webpage contains links to other websites, the information generally does not apply to such websites. LUGI HANDBOLLSFÖRENING - LUGI HF is also not responsible for the content on such websites.

8.10 Changes to the Personal Data Policy

If there are changes in our policy for handling personal data, it will be announced on this page. The policy may, for example, change if the legislation or application changes. If the processing of personal data has been regulated in an agreement with the customer, however, the contractual provisions apply until they are changed, unless it occurs in violation of your rights as mentioned above, is incompatible with the law, or other legally binding provision.

8.11 Contacts

The data controller is LUGI HANDBOLLSFÖRENING - LUGI HF. To contact Lundaspelen Summer in personal data matters, the contact details on the tournament's website (https://lundaspelensummer.cups.nu) can be used. You can also use support@cupmanager.net with GDPR and Lundaspelen Summer in the subject line.