Privacy policy
We want you to feel safe when you provide us with your personal data and we care about your privacy. This privacy policy explains how we collect and use your personal data. It also describes your rights vis-à-vis us and how you can enforce your rights.
The data controller is Leve bageri och konditori AB, corporate identity number 559097-6030, Östra Rönneholmsvägen 6, 211 47, Malmö (hereinafter referred to as the "Company"). The Company operates the website https://bagerileve.se.
As a data controller, it is our responsibility to ensure that your data is handled correctly and securely in accordance with applicable legislation.
In this privacy policy, we use the term "personal data" to describe information that can directly or indirectly identify a natural person. You have the right to object to our processing of personal data in certain respects, read more below under each purpose. It is important that you read and understand our privacy policy before using our Service.
1. What information we collect and why
1.1 Bageri Leves courses
Purpose: To be able to provide Bageri Leve's courses (hereinafter referred to as the "Service").
Categories of personal data
We collect and process the following categories of personal data in connection with your use of our Service: name, phone number and email address.
Personal data processing operations carried out
We process personal data in the following ways: collection, registration, contact by email, contact by phone and contact by SMS.
From which sources do we get your personal data?
The personal data we process has been provided by you.
Who else may have access to your personal data?
The following companies may have access to your personal data in the context of the Service: Fienta (booking system for courses) and Kassacentralen (TrueORDER cash register system for orders).
Legal basis
The legal basis for the processing of personal data is the performance of a contract with you as a user of the Service.
Your right to object to processing
This processing of your personal data is necessary for us to provide the Service. If you wish to object to this type of processing, we are unfortunately unable to provide the Service.
Storage period
We process and store your personal data for this purpose for 3 years after the customer relationship is considered terminated.
1.2 Ordering goods
Purpose: To be able to provide pre-ordering of, inter alia, Friday doughnuts (hereinafter referred to as "Pre-ordering").
Categories of personal data
We collect and process the following categories of personal data in connection with your use of our Pre-Order: email address.
Personal data processing operations carried out
We process personal data in the following ways: contact by email.
From which sources do we get your personal data?
The personal data we process has been provided by you.
Who else may have access to your personal data?
The following companies may have access to your personal data in the context of Pre-Order: Kassacentralen (TrueORDER cash register system when ordering).
Legal basis
The legal basis for the processing of personal data is the performance of a contract with you using Pre-Order.
Your right to object to processing
This processing of your personal data is necessary for us to fulfill the Pre-Order. If you wish to object to this type of processing, we are unfortunately unable to offer Pre-Order.
Storage period
We process and store your personal data for this purpose for up to 3 years after the customer relationship is considered terminated.
1.3 Marketing
Purpose: To promote Bageri Leves courses.
Categories of personal data
We process the following categories of personal data for marketing purposes: name and email address.
Personal data processing carried out for marketing purposes
We process your personal data for marketing purposes in the following ways: e-mail.
From which sources do we get your personal data?
The personal data we process for marketing purposes has been provided by you.
Who else may have access to your personal data?
The following companies may have access to your personal data in the context of our marketing: MailerLite (email management system)
Legal basis
The legal basis for processing personal data is consent. We will only process your data for this purpose if you have previously given us your active consent.
Your right to object to processing
You can withdraw your consent by emailing your request to [email protected].
Storage period
We process and therefore store your personal data for this purpose for 3 years after the customer relationship is considered terminated.
1.4 Product development
Purpose: To develop the Company's products.
Categories of personal data:
We process the following categories of personal data for product development purposes: images.
Personal data processing operations carried out
Analysis for product development purposes.
From which sources do we get your personal data?
The personal data we process has been provided by you.
Who else may have access to your personal data?
None. We never disclose your data without your permission.
Legal basis:
The legal basis for the processing of personal data is our legitimate interest in developing our services. This processing is based on a so-called balancing of interests where we assess that the processing does not significantly violate your privacy.
Your right to object to processing
We care about your privacy and promise not to process your personal data for this purpose if you no longer want us to. You can object to the processing by emailing your request to [email protected]
Storage period:
We will process your personal data for this purpose for 10 years from the moment the customer relationship is considered terminated.
1.5 Statistics
Purpose: For statistical purposes.
Categories of personal data:
We process the following categories of personal data for statistical purposes: IP address and cookie data.
Personal data processing operations carried out
Analysis for statistical purposes.
From which sources do we get your personal data?
The personal data we process has been provided by you.
Who else may have access to your personal data?
The following companies may have access to your personal data for statistical purposes
- Google (Web analytics)
Legal basis:
The legal basis for the processing of personal data is our legitimate interest in keeping statistics. We carry out this processing on the basis of a so-called balancing of interests, where we assess that the processing does not significantly infringe your privacy.
Your right to object to processing
We care about your privacy and promise not to process your personal data for this purpose if you no longer want us to. You can object to the processing by emailing your request to [email protected]
Storage period:
We will process your personal data for this purpose for 3 years from your first visit to the website.
2. Sensitive personal data
Some types of personal data are particularly sensitive and we only collect and process such personal data if absolutely necessary.
We process the following categories of sensitive personal data: health.
The legal basis for processing sensitive personal data is consent. We will only process your data if you have given us your active consent beforehand.
You can withdraw your consent by emailing your request to [email protected]
3. Where do we process your data?
We always aim for your personal data to be processed within the EU/EEA and all our own IT systems are located within the EU/EEA.
4. your rights
You have the right to access (register extract)
We are always open and transparent about how we process your personal data and if you want to get a better overview of what personal data we process about you, you can request access to that data.
Please note that if we receive a request for access, we may ask for additional information to ensure that your request is handled effectively and that the information is provided to the right person.
Right to rectification
You have the right to have inaccurate personal data concerning you rectified. Depending on the purpose of the processing, you also have the right to complete incomplete personal data.
Right to erasure
You can request the erasure of personal data we process about you if
- the data are no longer necessary for the purposes for which they were collected or processed
- You object to a balance of interests we have made based on legitimate interest and your reason for objection outweighs our legitimate interest.
- You object to processing for direct marketing purposes.
- Personal data is processed unlawfully.
- The personal data must be deleted to comply with a legal obligation to which we are subject.
Please note that we may have the right to refuse your request if there are legal obligations that prevent us from immediately deleting certain personal data, such as accounting legislation. It may also be that the processing is necessary for the establishment, exercise or defense of legal claims. Should we be prevented from complying with a request for erasure, we will instead block the personal data from being used for purposes other than the purpose preventing the requested erasure.
Right to restriction
You have the right to request that our processing of your personal data be restricted. If you contest the accuracy of the personal data we process, you can request a restriction of processing for the time necessary for us to verify the accuracy of the personal data. If we no longer need the personal data for the identified purposes, but you need it to establish, exercise or defend legal claims, you can request restricted processing of the data by us. This means that you can request that we do not delete your data.
If you have objected to a legitimate interest assessment that we have made as a lawful basis for a purpose, you can request restriction of processing for the time we need to verify whether our legitimate interests outweigh your interests in having the data erased. If processing has been restricted under any of the situations above, we may only, in addition to the storage itself, process the data for the establishment, exercise or defense of legal claims, to protect the rights of another person or if you have given your consent.
Right to object to certain types of processing
You always have the right to opt out of marketing and to object to any processing of personal data based on a balance of interests. See more about the specific legal bases under each purpose. If you object to direct marketing, we will cease processing your personal data for that purpose as well as cease all types of direct marketing.
Right to data portability
In certain cases, you have the right to request that the data concerning you that you have provided to us be transferred to another controller (so-called data portability). A prerequisite for data portability is that the transfer is technically feasible and can be automated.
Exercise your rights
You exercise your rights by emailing your request to [email protected].
5. How we protect your data
We use IT systems to protect the confidentiality, integrity and availability of personal data. Only those people who actually need to process your personal data in order for us to fulfill our stated purposes have access to it.
We have put in place specific security measures to protect your personal data. This means that your personal data is stored in systems with restricted access and that encryption is used when transferring data.
6. IMY
The Authority for the Protection of Privacy (IMY) is the authority responsible for monitoring the application of the personal data legislation/GDPR. If you believe that we are handling personal data incorrectly, you can lodge a complaint with this authority. You can contact them by calling 08-6576100 or emailing [email protected]
7. contact details
If you have any questions about our processing of personal data, please send an e-mail to [email protected].
8. Amendments to this policy
If we change our privacy policy, we will post the updated policy here, with the date of the change. For significant changes to our policy that materially alter our privacy principles, we may also notify you by other means, such as by email or by posting a notice on our website that the change is effective.
This privacy policy came into force on 2024-08-24.