Privacy policy for Mitt Campus and fault reporting

Akademiska Hus Aktiebolag, company registration number 556459–9156 (“Akademiska Hus”, “we”, “our”, “us”), is the Data Controller for the processing of your personal data and is responsible for ensuring that such processing takes place in a lawful way.

If you have any questions about our processing of your personal data, or if you wish to exercise any of your rights, please contact us by email at info@akademiskahus.se or call us on +46 (0)10 557 24 00. Our postal address is Box 483, 401 27 Gothenburg, Sweden.

We process personal data that you provide directly to us when you create an account, or when you enter your personal data in Mitt Campus or when you make a maintenance report. We use cookies and similar technologies to collect personal data about you when you visit our website via My Pages or use our app. Read more about how we use cookies and similar technologies here.

If you make a maintenance report via www.akademiskahus.se and click on "I am not a robot" we will also receive technical information from Google confirming that you are not a robot

In this section we explain why we process your personal data, what categories of personal data we process and what our legal basis is for processing personal data. Our legal basis for processing your data under the General Data Protection Regulation (GDPR) is to comply with a legal obligation. Below you can also read about how long we retain your personal data.

If you create a Mitt Campus account, in most cases we process your personal data in order to enter into and perform a contract with you. If you do not provide us with your personal data for this purpose, we cannot create and process your account and you cannot use Mitt Campus through your account.

To enable you to create a Mitt Campus account, we process your name, your email address and your chosen password for your account. We also process your email address and password to enable you to log in to Mitt Campus via My Pages at www.akademiskahus.se or in our app. If you report that you have forgotten your password, we process your email address in order to send you information on how to reset your password and create a new one. If your account has been inactive for a long time, we process your email address in order to send you a reminder.

We process your personal data for this purpose on the legal basis that it is necessary in order to enter into and perform our contract with you.

We will process your personal data until you choose to deregister your account with us. If your account has been inactive for a year, we send you a reminder and ask whether you want to keep your Mitt Campus account. If after this you remain inactive for a further three months, we will terminate your account and erase your personal data.

We process your personal data to remember your choices and settings when you log in with and use your Mitt Campus account. If you choose for us to remember your login credentials, we will process your login credentials (email address and password) and technical information about the device you use. To remember which campus and which favourite building you have chosen, your preferred language and the contacts you save in Mitt Campus, we process information about your choices and settings as well as technical information about the device you use.

We process your personal information to remember your choices and settings on the basis of a legitimate interest, where our legitimate interest is to optimize your experience of Mitt Campus.

We save your choices and settings for as long as you maintain your Mitt Campus account. The intervals at which we may delete your account are indicated above.

We send you information about your campus and the buildings you have specified as favourites in your account. This might include information about activities, news, alerts on operational disruptions or safety information, e.g. about fire alarms. We send you this information via push notifications, and in connection with this we process information about your choices and settings for your account as well as technical information about your device. We send important information to your email address and process your email address in connection with this.

We process your personal data for this purpose on the legal basis that it is necessary in order to perform our contract with you.

We process your personal data for as long as you maintain your Mitt Campus account. The intervals at which we may delete your account are indicated above.

When you contact Akademiska Hus or one of our employees using the contact details specified in Mitt Campus, we process your personal data in order to communicate with you and answer your questions. In connection with this, we process your name and email address or phone number, depending on how you choose to contact us. We also process other data that you choose to provide us with.

We process your personal data on the basis of a legitimate interest, where our legitimate interest is to provide you with our customer service.

We process data from our communications with you until the matter is concluded, and thereafter for a period of time that we deem suitable.

When you submit a fault report via Mitt Campus or www.akademiskahus.se, we process your name, telephone number and email address. We also process other personal data that you choose to provide when logging your service request. We process these data about you in order to process your service request, to send you confirmation of your request, and to contact you about the request if we deem it necessary. If you have a Mitt Campus account, we also save your service request in order to keep a history of the service requests you have logged. If you make a fault report on www.akademiskahus.se without being logged in, we will verify that you are not a robot using a service provided by Google. When you click in "I am not a robot" we will process technical information confirming that you are not a robot.

You can choose to make your fault report public to other Mitt Campus users. However, your personal data will not be visible.

We process your personal data on the basis of a legitimate interest, where our legitimate interest is to process service requests concerning the campus areas and buildings that we manage. The verification that you are not a robot that we enable when you make a fault report via our website we do with the support of our legitimate interest in collecting reliable fault reports.

We store the personal data that we process about you to process your service request for as long as you have a Mitt Campus account. If you do not have a Mitt Campus account, we process your data for the time we deem necessary, depending on the nature of the service request.

We process your name and contact details in order to process any complaints or claims from you. If necessary, we also process other personal data about you, for instance from our communications with you regarding your complaint or claim.

We process your personal data for this purpose on the basis of a legitimate interest, where our legitimate interest is to process and defend ourselves against any legal complaints or claims.

We process your personal data relating to a complaint or claim until the matter has been concluded.

Your personal data are primarily processed by Akademiska Hus. We will share your personal data with:

• our IT providers who process personal data on our behalf in the capacity of Data Processors, to enable us to operate our business in an optimal and cost-effective way. For example, we share your personal data with the supplier of the tool that we use to process your service requests; and
• the subcontractors that help us to carry out service requests.

The service we use to verify that you are not a robot when you make a maintenance report at www.akademiskahus.se is provided by Google Ireland Limited. If Google processes personal information about you in addition to verifying you, they are responsible for personal data treatment. For more information about the terms of Google services, read here.

We and the parties that we share your personal data with only process your personal data within the EU/EEA.

Exceptions apply if you use Google's authentication service at the maintenance report on www.akademiskahus.se as your personal information can be transferred to the United States. According to a decision of the 5/6 EU Commission, EU data protection officers are allowed to transfer personal data to recipients who have joined the Privacy Shield in the United States. Privacy Shield is a self-certification mechanism that exists in the United States. Companies in the United States can register with the US Department of Commerce and announce that they meet the requirements of the Privacy Shield. Google is Privacy Shield certified.

If you have any questions about how we share your personal data, e.g. questions about our legal basis for sharing data or who we share your data with, please contact us using the contact details specified above.

As indicated above, we process certain of your personal data on the legal basis of a legitimate interest. This means that after balancing the interests of the data controller against the interests of the data subject, we conclude that we can process your personal data in compliance with the GDPR. Our legitimate interests are listed in the tables above. To request more information about how we made this assessment, or to contest it, please contact us using the contact details specified above.

You have certain rights which you can exercise to control how we use your personal data. These rights are summarised below.
To find out more about your rights, or to exercise any of your rights, please contact us using the contact details specified at the beginning of this Privacy Policy.

You have a right to object, at any time, to your personal data being processed on the basis of legitimate interest. You can read more about legitimate interest above. In certain cases, however, even if you object we will continue to have a right to process your personal data on the basis of legitimate interest (e.g. if we have an obligation to retain your personal data). One such case is if we can demonstrate a compelling legitimate reason for processing your data that outweighs your interests, rights and personal freedoms, or if the processing is necessary for the establishment, exercise or defence of legal claims.

You have the right to know whether or not we process your personal data. If we do process your personal data, you also have a right to request a copy of the data we hold about you and information about how we process them.

You have a right to have any inaccurate or incomplete personal data that we hold about you rectified or completed.
Right to erasure (right to be forgotten) and right to restrict processing

You have a right to request that your personal data be deleted, and to have your personal data deleted under certain circumstances. Such circumstances include, for instance, if your personal data are no longer needed for the purposes for which they were originally collected or processed, or if you revoke your consent which constitutes the legal basis for processing and no other legal basis exists for processing your data.

You also have a right to request that we restrict our processing of your personal data, and under certain circumstances we will restrict our processing of your data after receiving such a request. Such circumstances include, for instance, if you contest the accuracy of the data we process about you, or if our processing is illegal and you object to having your personal data deleted and instead request that processing of the data be restricted.

You always have the right to lodge a complaint with the Swedish Data Protection Authority (or another competent supervisory authority).

A complaint should preferably be lodged with the authority in the member state in the EU/EEA where you reside or work, or where a violation of the applicable data protection laws and regulations allegedly took place. The competent supervisory authority in Sweden is the Swedish Data Protection Authority. This right does not affect any other administrative determination process or judicial remedy.

In certain cases, you have the right to receive your personal data from us in a structured, commonly used and machine-readable format and, where technically possible, to have your personal data transferred to a different company (“data portability”). This applies to personal data that you have supplied to us in a structured, commonly used and machine-readable format, if the processing of your personal data is automated and our legal basis for processing is to perform a contract with you.