This is how Akademiska Hus processes your personal data

Personal data is any kind of information that can be attributed to you as a natural person, such as name, telephone number and social security number. Personal data also refers to other types of data and information that make it possible to identify you as a natural person, such as pictures of you, descriptions of your personal characteristics and your computer's IP address.

A processing of personal data is any operation or combination of actions that affect personal data. Examples of processing are: collection, registration, organisation, structuring, storage, processing, modification, sharing, use and deletion.

Akademiska Hus Aktiebolag, reg. no. 556459-9156, with address Box 483, 40127 Gothenburg, Sweden, is the data controller for the personal data processing that we describe in this information about how we process personal data.

Akademiska Hus collects personal data from you, for example when you contact us via Customer Service, our social media or e-mail, make a fault report, apply for a job with us, participate in meetings and events organised by us or otherwise use our services. Akademiska Hus may also receive personal data from others than you, such as your employer, the Swedish Companies Registration Office or the Swedish Tax Agency.

Akademiska Hus processes your personal data in order to be able to fulfil our commitments and provide a good service. We also process personal data when it is necessary to conduct our business efficiently and deliver inspiring campus environments and well-functioning services. Below you will find more information about what personal data we process, why we process it and on what legal basis:

• If you live in our student housing

Akademiska Hus may share your personal data with other organisations, companies or authorities within the framework of the processing we do.

Akademiska Hus never sells your personal data.

Your personal data may be shared with the following categories of recipients:

• IT service providers who help us administer our business processes such as administration, finance and customer management. These include, for example, suppliers of our property management systems, ERP systems and other IT systems, as well as suppliers of support, storage services and scanning of, for example, drawings and contracts
• Contractors and subcontractors when they need your information, such as contact details, for construction and renovation projects
• Tenants who wish to access data that constitutes indirect personal data about you who stay in our properties for the tenant's own purposes, such as premises planning purposes or research. In each individual case, Akademiska Hus makes an assessment of the disclosure. The fact that we may in some cases share your indirect personal data with our tenants means the disclosure of data points that, only through combination with other information, enable identification of you, such as ventilation or energy data that can reveal that someone or some people have passed through a door or are in a certain space
• Alarm and security companies that help us with, for example, access control systems, fire alarms, security systems and surveillance cameras
• Credit reference companies that help us with credit checks on, for example, sole proprietorships that rent from us
• Seminar, event and conference organisers
• Marketing and customer research agencies
• Companies that provide banking or payment solutions
• Post offices and providers of digital network and communications services

In some cases, Akademiska Hus may also share your personal data with other recipients. This may happen, for example, if we are obliged to disclose the information according to law or administrative decisions, in order to investigate, monitor or safeguard our legal claims, or if we intend to sell a property or parts of our business. The disclosure of your personal data may then take place to courts, the police, or other authorities, legal representatives and other external advisors as well as potential buyers.

Recipients' responsibilities and location of your personal data

Recipients who process personal data on behalf of Akademiska Hus in their capacity as data processors must always enter into a so-called personal data processing agreement with us. The agreement aims to ensure that your personal data is handled in a correct, secure and legal manner. The Data Processor may only process your personal data in accordance with the instructions we give them and may not process the data for any own purposes. They are also required by law and contract to protect your data with appropriate security measures, such as encryption and access control.

Recipients who themselves determine the purposes and means of the processing of personal data we share with them and thus themselves become data controllers under the GDPR regarding your personal data, such as a public authority or a bank, are responsible for the lawfulness and security of the personal data processing. Akademiska Hus only discloses personal data to recipients we trust.

Akademiska Hus strives to ensure that your personal data is only processed within the EU/EEA and all our own IT systems can be found here. In exceptional cases, your personal data may be processed outside the EU/EEA, for example if we share your personal data with a data processor who is established or stores information in a country outside the EU/EEA through a subcontractor. If a processor processes personal data outside the EU/EEA, we take appropriate measures in accordance with the GDPR to protect your data.

Akademiska Hus only keeps your personal data for as long as it is necessary for us to fulfil the purposes of the processing in each individual case. After that, your data is deleted or de-identified so that it can no longer be linked to you. This is provided that the data is no longer necessary for any other of our processing activities. The same personal data can be processed for several different purposes. This means that information that is no longer needed for one purpose can remain and be processed for another purpose for which the information is still needed.

Personal data about a tenant's contact person is thus deleted as a starting point when the tenancy has ended, provided that the personal data does not need to be saved thereafter for accounting purposes, for example.

If you have registered to receive campus news or other news releases from us, we will process the data necessary to administer this as long as you do not unsubscribe or notify us that you no longer wish to receive such information. You can unsubscribe at any time.

In order for us to be able to defend ourselves against legal claims, such as warranty claims, personal data that may form the basis for claims against us is deleted or de-identified when any claims are time-barred, i.e. we store the data during the limitation period.

When we are obliged to save data, for example under the Swedish Accounting Act, we retain the data for the period prescribed by the applicable legislation.

As a data subject, you have a number of rights under the GDPR. These aim to give you control over your personal data and how it is processed.

If you have given consent to our processing of your personal data, you have the right to withdraw your consent at any time.

You have the right to receive confirmation as to whether we process personal data about you and, if so, to receive information about how the personal data is processed. You also have the right to receive a copy of the personal data we process about you. Your request for access to your personal data must be in writing and signed by you and contain information about your name and social security number. We need this in order to identify with sufficient certainty that we disclose the data to the right person.

If your data is incorrect, incomplete or no longer needed for the purpose for which it was collected, you can request to have it deleted, corrected or supplemented under certain conditions. We cannot delete your data if there is a statutory requirement for storage, such as accounting rules or when there are other legitimate reasons why the data must be kept.

You have the right to receive your personal data in a structured, commonly used and machine-readable format or to have it transferred to another personal data controller (data portability) provided that you have provided Akademiska Hus with the data and that these are processed by us with consent or agreement as a legal basis.

If you have comments, objections or are dissatisfied with our processing of personal data, please contact us. We strive to resolve any complaints in the best possible way. If you object to processing for direct marketing, we will cease the processing immediately. If you object to processing that takes place on the basis of a balancing of interests, we are usually allowed to continue to process the data if we have legitimate purposes for the processing that outweigh your interests, rights and freedoms. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection, which is the supervisory authority for our processing of your personal data.