GDPR Notice: This policy complies with the EU General Data Protection Regulation (GDPR, Regulation 2016/679) and Swedish law (Lag 2018:218). You have the right to request access to, rectification of, or erasure of your personal data. The supervisory authority in Sweden is the Swedish Authority for Privacy Protection (IMY).
1. What data we collect
1.1 Account information
When you create an account, we collect:
- Name (first and last)
- Email address
- Phone number (optional)
- Address (when you make a purchase)
- Password (stored as a cryptographic hash — we can never see your password in plain text)
Legal basis: Performance of a contract (GDPR Art. 6(1)(b)) — this data is necessary to provide the service.
1.2 Purchase information
When you buy tickets or book lessons, we store order history, amounts, payment method, and billing address.
Legal basis: Legal obligation (GDPR Art. 6(1)(c)) — Swedish bookkeeping law (Bokföringslagen 1999:1078) requires us to retain records for 7 years.
Note: We never store credit card numbers. Payments are handled by our payment provider (Swish).
1.3 Technical data
- IP address — stored at login for security purposes
- Session cookies — necessary to keep you logged in (see section 6)
Legal basis: Legitimate interest (GDPR Art. 6(1)(f)) — security and fraud prevention.
1.4 Marketing data
If you subscribe to our newsletter or an organizer's mailing list, we collect email address, name, consent status, and delivery statistics.
Legal basis: Consent (GDPR Art. 6(1)(a)) — you must actively confirm your subscription (double opt-in). You can unsubscribe at any time via the link in each email.
2. How we use your data
| Purpose | Data used | Legal basis |
|---|---|---|
| Provide the service | Name, email, address | Contract, Art. 6(1)(b) |
| Order processing | Purchase data | Contract + Bookkeeping law |
| Marketing | Email, name | Consent, Art. 6(1)(a) |
| Transactional emails | Contract, Art. 6(1)(b) | |
| Security | IP address, session data | Legitimate interest, Art. 6(1)(f) |
| Delivery analytics | Email, delivery events | Legitimate interest, Art. 6(1)(f) |
2.1 Consent and marketing
We use double opt-in for all marketing. You must request a subscription and then confirm via a link in the email we send.
You can unsubscribe at any time via the unsubscribe link in every email, one-click unsubscribe in your email client (Gmail, Apple Mail, etc. — via RFC 8058), or by contacting us directly.
If you mark a message as spam, you are automatically unsubscribed and your consent is revoked immediately.
3. How we store and protect your data
3.1 Where data is stored
All data is stored on servers within the EU/EEA. We do not transfer personal data to countries outside the EU without adequate safeguards.
3.2 Security measures
- Encryption in transit — all traffic is protected with HTTPS (TLS) and HSTS
- Password encryption — passwords are stored as cryptographic hashes with individual salts
- Access control — role-based permissions with separate rights for each function
- Vendor isolation — each organizer can only see their own contacts and orders
- PII masking — email addresses in system logs are automatically masked
- Session management — secure cookies with HttpOnly, Secure, and SameSite attributes
- CSRF protection — all forms are protected against cross-site request forgery
3.3 How long we keep your data
| Data type | Retention period | Reason |
|---|---|---|
| Account information | Until you delete your account, or 36 months after last activity | Contract / legitimate interest |
| Order history | 7 years | Swedish Bookkeeping Act |
| Email content (campaigns) | 30 days after sending | Troubleshooting, then deleted |
| Email delivery statistics | 2 years (730 days) | Delivery analytics, then deleted |
| Consent history | Stored permanently | Burden of proof, GDPR Art. 7(1) |
| Application logs | 30 days | Automatically deleted |
| Inactive accounts | 36 months without activity | Account is automatically anonymized |
4. When we share your data
5. Your rights
Under GDPR (Chapter III), you have the following rights. We respond to all requests within 30 days.
| Right | GDPR | How to exercise |
|---|---|---|
| Access — find out what data we hold about you | Art. 15 | Contact us via email |
| Rectification — correct inaccurate data | Art. 16 | Edit in your profile or contact us |
| Erasure — request deletion of your data | Art. 17 | Contact us via email |
| Restriction — request that we restrict processing | Art. 18 | Contact us via email |
| Data portability — receive your data in a machine-readable format | Art. 20 | Contact us via email |
| Objection — object to processing based on legitimate interest | Art. 21 | Contact us or click unsubscribe in emails |
5.1 Erasure — what happens
When you request erasure:
- Your name and email are anonymized
- Addresses, shopping carts, newsletter subscriptions, and external logins are deleted
- Order history is retained in anonymized form for 7 years (Swedish Bookkeeping Act)
- Consent history is retained as proof that we had lawful basis for previous processing (GDPR Art. 7(1))
5.2 Complaints
You always have the right to file a complaint with the supervisory authority:
Swedish Authority for Privacy Protection (IMY)
Email: imy@imy.se
Web: www.imy.se
6. Cookies and tracking
7. Contact us
If you have questions about how we process your personal data or want to exercise your rights:
Stageboxx AB
Email: privacy@stageboxx.com
Web: www.stageboxx.com
We respond to all data protection requests within 30 days in accordance with GDPR Art. 12(3).