Privacy Policy for Nawa Studio

We may process:

• name
• Diversia Nick or another chosen display name
• email address
• telephone number where needed
• user ID
• preferred language
• account status
• user role and permissions

A legal name may be needed for payments, insurance matters, contact with authorities, accounting or secure identification, for example.

A Diversia Nick can be used as a display name in the system. A legal name should only be available to people who need it.

We may process:

• which events you have booked or applied for
• booking number and event number
• booking status
• participant status
• waiting list status
• dates and times
• participant roles
• answers to the event's questions
• cancellations and changes
• past and upcoming bookings
• practical information ahead of the event
• information about the main booker
• information about other people included in the booking

When you create a booking profile we may process:

• verified email address
• name or Diversia Nick
• telephone number
• language
• profile settings
• active and previous bookings
• pre-filled basic details for future bookings

Event-specific answers, health information and other privacy-sensitive data must not be reused automatically in new bookings.

We may process:

• booking number
• event number
• the main booker responsible for payment
• participant fee
• donation to Ropefund
• amount paid
• payment status
• payment date
• payment method
• payment reference
• Swish transaction identifier
• refund details
• information about who administratively registered or changed a payment

We do not store complete BankID information, card details or login credentials for your bank.

We may process:

• volunteer application
• name or Diversia Nick
• contact details
• previous experience
• stated skills
• motivation for the volunteer application
• dates of application and approval
• volunteer status
• requests sent
• accepted and declined shifts
• shifts, functions and times
• availability
• introductions and safety briefings
• calendar invitations
• responses to calendar invitations
• administrative notes
• withdrawals and changes

We may process:

• account details
• user role
• event ownership
• editing permissions
• requests for access to events
• administrative actions
• audit history
• login history
• security logs

We may process content and metadata from:

• contact forms
• email
• booking messages
• support cases
• newsletters
• event messages
• volunteer requests
• communication about payments and refunds
• communication about cancellations
• communication about safety and incidents

When you use the website or the event platform we may process:

• IP address
• date and time
• browser
• operating system
• device type
• language and display settings
• login events
• security logs
• error reports
• information about the use of personal links
• necessary cookies and local storage

Where photography, filming or audio recording takes place we may process:

• photographs
• video recordings
• audio recordings
• a name or Diversia Nick linked to the material
• information about consent given or withdrawn

Booking, attending or working at an event does not automatically mean that you consent to being photographed or published.

In the case of an accident, conflict, personal injury, safety incident or other serious event we may process:

• date, time and place
• a description of the event
• people involved
• witness statements
• measures taken
• photographs or other documentation from the event
• contact with insurance companies
• contact with legal advisers
• contact with authorities, emergency services or healthcare

We process personal data in order to:

• answer questions
• handle contact enquiries
• handle venue and event enquiries
• provide requested information
• follow up a case

Legal basis: legitimate interest, or steps taken at your request prior to a possible contract.

We process personal data in order to:

• create and verify accounts
• enable login
• administer roles and permissions
• reset passwords
• protect accounts against unauthorised use
• show the user's own bookings, assignments and settings

Legal basis: performance of the user agreement and legitimate interest in secure account administration.

We process personal data in order to:

• receive bookings and applications
• administer participants
• carry out event selection
• administer waiting lists
• send confirmations
• communicate booking status
• send practical information
• handle changes and cancellations
• run the event

Legal basis: performance of a contract, steps prior to a contract and legitimate interest.

We process personal data in order to:

• create and verify the booking profile
• pre-fill future bookings
• show your own bookings
• manage profile settings
• protect the profile against unauthorised access

Legal basis: performance of the user agreement and legitimate interest.

Creating a booking profile is voluntary.

We process personal data in order to:

• calculate participant fees
• receive and register payments
• process Swish payments
• register manual payments
• send payment confirmations
• carry out refunds
• administer donations to Ropefund
• meet bookkeeping and accounting requirements

Legal basis: performance of a contract and legal obligation.

We process personal data in order to:

• receive and assess volunteer applications
• approve or decline applications
• administer the volunteer register
• send voluntary requests about shifts
• plan staffing
• register responses and withdrawals
• send calendar invitations
• organise safety information
• administer staff functions

Legal basis: steps at the person's request, performance of the volunteer agreement and legitimate interest.

Event administrators can decide the order in which volunteers receive requests for a particular event.

The prioritisation may be based on, for example:

• relevant experience
• skills for the task
• previous experience of the event type
• familiarity with the venue
• the need for continuity
• availability
• a suitable distribution of experience within the team

Declining a request must not automatically lower a volunteer's priority or affect the chance of receiving future requests.

Legal basis: legitimate interest in organising suitable and safe staffing.

We process personal data in order to:

• create administrator accounts
• give access to the right events and functions
• process requests for editing permissions
• log administrative actions
• prevent unauthorised access

Legal basis: legitimate interest in protecting the systems and organising the business.

We process personal data in order to:

• prevent accidents
• protect participants, volunteers and staff
• investigate safety incidents
• handle insurance matters
• establish, exercise or defend legal claims
• provide information to authorities where required
• protect a person's life or health in an emergency

Legal basis: legitimate interest, legal obligation or protection of vital interests.

We process personal data in order to:

• send newsletters
• provide information about upcoming events
• manage subscriptions
• manage unsubscriptions
• document when and how consent was given

Legal basis: consent or another applicable legal basis for existing customer relationships.

You can unsubscribe from marketing mailings at any time.

Identifiable photographs and films from privacy-sensitive events are normally published only after clear and separate consent.

Consent to photography or publication must:

• be voluntary
• be separate from the booking terms
• not be pre-ticked
• be possible to withdraw
• be possible to refuse without affecting the ability to take part or to volunteer

Legal basis: normally consent.

We process technical data in order to:

• enable login
• protect user accounts
• protect personal response links
• detect intrusion and misuse
• troubleshoot the system
• carry out backups
• document administrative changes

Legal basis: legitimate interest in maintaining a secure and functioning system.

Main administrators may have access to the personal data needed to administer the business and the system.

Event administrators only have access to data needed for events they own or have approved editing permissions for.

Access to an event must not automatically give access to all participant data, payment data, volunteer history or internal notes.

Volunteers and staff only have access to information needed for their specific tasks.

They should normally not have access to:

• complete participant lists
• detailed application answers
• payment details
• sensitive personal data
• internal administrative notes

We may use suppliers for, for example:

• website and system development
• database and storage
• authentication
• email delivery
• calendar functions
• payments
• accounting
• backups
• IT support
• information security
• web statistics

Suppliers who process personal data on our behalf must process the data in accordance with our instructions and are covered by applicable data processing agreements.

Personal data may be disclosed to:

• banks and payment providers
• accounting consultants
• insurance companies
• legal advisers
• emergency services and healthcare
• authorities
• courts

This only happens where necessary or required by law.

We do not sell personal data.

Ordinary contact cases are normally deleted within 12 months after the case is closed.

The data is normally deleted or anonymised within 6–12 months after the event, unless it needs to be kept for a complaint, an incident or a legal claim.

Ordinary booking and participant data is normally kept for a maximum of 24 months after the event.

Detailed event answers and sensitive data must be deleted earlier when they are no longer needed.

A booking profile is kept for as long as it is active.

After closure or long-term inactivity the data is normally deleted or anonymised within 24 months, unless it needs to be kept for an active booking or a legal obligation.

Data that constitutes accounting information is kept for as long as accounting legislation requires.

Declined or withdrawn volunteer applications are normally deleted within six months.

Data about volunteers is kept for as long as the person is active or paused, and normally for a maximum of 24 months after the most recent volunteer shift or after the volunteer status ended.

The email address is used for the newsletter until the person unsubscribes or withdraws consent.

A limited suppression record may then be kept to prevent the person from receiving new mailings against their wishes.

Material is kept for as long as it is used for the stated purpose, or until a withdrawn consent can be acted upon.

Material already printed or publication already carried out cannot always be recalled, but future use must be stopped where possible.

Data is kept until the event has been investigated and any insurance matters or legal claims have been finally resolved.

Ordinary security and access logs are usually kept for a maximum of 12 months.

Logs may be kept longer where they are needed to investigate a specific security incident.

Deleted data may remain for a limited time in backups before it is overwritten in line with our backup routines.

• the pictures themselves and related technical metadata, such as file format, size and time of upload
• your name or the nickname you choose to be shown with
• your email address, used to send the personal consent request and any later reminders or confirmations
• information about the photographer: name or alias, contact details, which pictures were uploaded and which terms and assurances the photographer accepted
• your consent choice for each individual picture and for each individual publication channel, including the time and the exact text and picture version the choice applies to
• how you wish to be credited, that is by name, by nickname or not at all
• technical security and audit information showing when a picture was uploaded, reviewed, approved, downloaded, published, withdrawn or deleted

Pictures of people can be sensitive data. They are therefore processed in the portal only with your explicit consent, and they are kept in a closed state until you have made your choice.

No facial recognition We do not use facial recognition, biometric identification or any other automated technology to recognise people in pictures. The link between a picture and a person is always made manually by the photographer or by an authorised picture administrator, and it can always be corrected.

• to receive pictures from photographers and check the files for safety before anyone else can see them
• to obtain individual and freely given consent from every identifiable person
• to administer which publication channels are approved for each picture
• to document where a picture has actually been published
• to handle withdrawal of consent and to request removal of a picture that has already been published

The pictures are not used to train AI models, to profile you, to build a general marketing database or for any other purpose. If a new purpose ever becomes relevant, it requires a new explicit choice from you.

Publication of pictures in which you are identifiable takes place solely on the basis of your explicit and freely given consent, provided separately for each channel.

A limited security, contractual and audit history may be retained on the basis of our legitimate interest in being able to show what has happened to a picture, or where the law requires it. That history is never used to publish anything.

Saying no, not answering at all or changing your mind later has no negative consequences for you, whether in booking, participation or volunteering.

In a picture with several identifiable people, each person decides for themselves. No one can answer on behalf of anyone else.

A picture may only be published in the channels where every identified person has an active yes at that moment. If someone has not answered, has answered no, or later withdraws their consent, that channel falls away immediately for the whole picture.

• authorised picture administrators and publishers at Nawa Studio, who need the access in order to review and publish
• the publication channels and platforms you have explicitly chosen
• necessary operational suppliers, for example for hosting, storage and email delivery, who process the data as processors on our instructions

We never sell pictures or information about you, and we do not share them with any other recipient.

• original files are held in private storage that is not reachable through open links
• access is governed by roles, and the administrator roles require two-factor sign-in
• uploaded files are checked and processed before they become visible; if the checks are not yet complete the file stays blocked and cannot be shown, approved or downloaded
• metadata in the files, such as location information, is handled during processing so that such information does not travel with a published picture
• every consent is bound to an exact picture version and an exact version of the channel's terms; a new version of the picture requires new consent and old answers do not count
• originals are downloaded through short-lived single-use links tied to a named channel, a stated purpose and one individual administrator; the link cannot be reused or shared
• all significant events are written to an audit log that cannot be altered afterwards

Material that no one has answered for, that has been declined or that has been withdrawn, together with the related original files, is deleted according to the retention documented in the picture portal. Until deletion the material is blocked and cannot be published.

Approved material is kept only for as long as the purpose requires and the consent is active. We review the material regularly and remove what is no longer needed.

A separate minimum history for security and audit is kept apart from the pictures and is erased on the basis of what is legally justified. We deliberately state no exact time limits here that the portal does not yet apply automatically.

You have the right of access, rectification, erasure and restriction, and where relevant also data portability. You may at any time lodge a complaint with the Swedish Authority for Privacy Protection (IMY).

You can withdraw your consent at any time, for a single channel or for everything, without giving a reason. The withdrawal applies going forward and does not affect the lawfulness of publication before you changed your mind. The channel immediately stops being approved, and if the picture has already been published a case is opened to have it removed where that is possible.

If you recognise yourself in a picture you should not be linked to, you can flag this in the portal. The link is then removed and the picture is blocked for the channels concerned.

The picture portal's start page is at nawastudio.se/en/pictures, and in Swedish at nawastudio.se/sv/pictures.

When a picture in which you are identifiable has been uploaded, you receive an email with a personal link to the page for managing your consent. The link contains a unique, time-limited code that only you receive, that is never shown in this policy and that should never be forwarded. Through the same link you can later see your choices and change or withdraw them. If the link has stopped working we will send a new one after contact at hello@nawastudio.se.

The photographer is responsible for uploading pictures only from the event the assignment concerns, for naming every person who is identifiable in the picture and for following the studio's terms and the order that applies during the event.

The photographer retains copyright in their pictures and grants Nawa Studio a limited right to use them in the approved channels. The photographer may limit their own licence.

The photographer's acceptance of the terms covers only the photographer's own undertakings and rights. The photographer can never give consent on behalf of any of the people shown in the picture; every depicted person always consents for themselves.