Personal Data and Data Protection within the Swedish Association of Local Authorities and Regions (SALAR)

The Swedish Association of Local Authorities and Regions (SALAR) values personal privacy and always strives for a high level of data protection for the personal data processed by SALAR. This text describes how we at SALAR work with data protection. It also outlines the rights you have as a registered individual and how you can exercise them. It is important that you review this information and feel secure in our handling of your personal data. You are always welcome to contact us with any questions.

What is personal data and what does processing of personal data entail? Personal data is any kind of information that can directly or indirectly be linked to a living individual. For example, images and sound recordings processed on a computer are personal data even if no names are mentioned. Encrypted data and various types of electronic identities (e.g., IP addresses) are personal data if they can be linked to a person. Processing of personal data refers to any action taken with the personal data. Every action involving personal data constitutes processing, regardless of whether it is automated or not. Examples of common processing activities include collection, registration, organization, structuring, storage, processing, transfer, and deletion.

Who is responsible for the personal data we collect? SALAR (/International) is the data controller for the processing of personal data on this website and for the processing carried out within the various areas of SALAR's operations. Information on how to contact us can be found under the "Contact us" heading at the top of the page.

What rights do you have as a registered individual? Right to access (i.e., right to obtain a registry extract) We are always open and transparent about how we process your personal data. If you wish to gain a deeper insight into the personal data we process about you, you can request access to the data (the information is provided in the form of a registry extract, specifying the purpose, categories of personal data, categories of recipients, storage periods, information on where the data was collected from, and the existence of automated decision-making). If you make an access request, we may need to ask for additional information to ensure efficient handling of your request and that the information is provided to the correct person.

Right to rectification - If your personal data is incorrect, you can request to have it corrected. Within the scope of the specified purpose, you also have the right to complement any incomplete personal data.

Right to erasure - You can request the erasure of personal data we process about you if:
• The data is no longer necessary for the purposes for which it was collected or processed.
• You object to a balancing of interests we have made based on legitimate interest, and your reason for objection outweighs our legitimate interest.
• The personal data is processed unlawfully.
• The personal data must be erased to comply with a legal obligation that applies to us.
Please note that we may have the right to refuse your request if there are legal obligations that prevent us from immediately erasing certain personal data. It may also be that the processing is necessary for establishing, exercising, or defending legal claims. If we are unable to comply with a request for erasure, we will instead block the personal data from being used for purposes other than the purpose that prevents the requested erasure.

Right to restriction - You have the right to request that our processing of your personal data be restricted.

Right to object to certain types of processing You always have the right to object to any processing of personal data based on a balancing of interests.

How are your personal data protected? We use IT systems to protect the confidentiality, integrity, and access to personal data. We have implemented specific security measures to protect your personal data against illegal or unauthorized processing (such as illegal access, loss, destruction, or damage). Only employees who need to process your personal data for us to fulfill our specified purposes have access to it.

How long do we keep your personal data? We never keep your personal data longer than necessary for the respective purpose.