1. Purpose
The purpose of this policy is to clearly and transparently inform you about the types of personal data we process, how we process them and how you can exercise your rights. The policy follows the provisions of the EU General Data Protection Regulation (GDPR) and the guidance of our industry organisation PRECIS on applying the GDPR. It is also supplemented by internal guidelines on handling personal data.
2. What personal data do we process?
Collecting and processing personal data is not a core activity for us at Tale. However, like almost all companies, we process personal data in our internal administration and for marketing purposes. In addition, some personal data processing takes place in the work we carry out on behalf of our clients.
Personal data processed on behalf of our clients
We provide a wide range of marketing communication services to our clients. In almost all types of client assignments, personal data processing may be relevant. Examples of personal data we process in client assignments are contact details, CVs, photos, films, audio recordings, quotes and statements of various kinds. Further personal data processing in client assignments may involve developing, running and monitoring social media platforms or other platforms for marketing and opinion-building, as well as tools for monitoring visitor and activity flows on these. Where applicable, the privacy policy of the respective platform or tool applies. In general, we are responsible for the content, including published personal data, in the channel. On behalf of our clients we use a range of tools for web publishing, distribution, analysis, mailings, mapping, media production and more. Where applicable, we are responsible for personal data processing linked to these tools as well; otherwise (or in parallel) the privacy policy of the respective tool applies.
Personal data processed in our internal administration and in our own channels
Social media
We are responsible for the content, including personal data, published in social media channels run in Tale's own name. This means that, in social media channels where we can control the content, we are responsible for regularly monitoring publications and moderating content so that the channel does not contain, for example, offensive personal data. In addition, the respective platform's own privacy policy applies.
Marketing and mailings
We store contact information for current clients, former clients, potential clients and other relevant parties we are in contact with in order to market our business. We do this primarily through email mailings with marketing for our services, invitations to events and so on. Mailings always include an opt-out option for those who no longer wish to receive such information from us.
Media production and photography
We also carry out media production (film and audio recording) and photography for our own use. Typically this involves documenting events held in Tale's name and marketing and documentation of our own business.
Contracts
We process personal data that appears in the contracts we sign. These may be contracts with clients, subcontractors, collaboration partners and employees. The data typically concerns basic contact information that is necessary to fulfil the contract.
Recruitment
If you contact us to apply for a job with us, you automatically consent to us processing your personal data when you submit it to us in the form of letters, CVs and other documentation. If you apply for employment with us, we store your data for two years before it is deleted.
Talecontent.se
We use Google Analytics to monitor visitor flows on our own website. The tool's own privacy policy applies for this purpose.
Email
We process personal data that appears in the email correspondence we have, both with our clients and with employees, subcontractors, other types of collaboration partners and external parties.
3. How is your personal data processed?
Lawfulness of processing
Our processing of personal data, whether carried out on behalf of our clients or for our internal administration or marketing, is based on the basic principles for personal data processing set out in the GDPR. We only process personal data after we have ensured that we have a legal basis under the GDPR for doing so. For personal data processing within client assignments, this is typically based on the so-called legitimate interests assessment. Otherwise, we have the right to process personal data where it is necessary to fulfil a contract, for example with a client, a collaboration partner, a subcontractor or an employee, as well as to comply with legal obligations, for example towards authorities. This may involve processing data because laws or other regulations require it. In some cases an active consent from the data subject is the basis that makes processing lawful. This is also required if the data are considered sensitive under the regulation. Where legislation requires it, or where the situation makes it appropriate, we collect an active consent to processing from the data subject.
Information to data subjects
In our processing of personal data we also make sure to meet the information obligation described in the GDPR, and to inform you that your data are being processed by us. This applies provided that the personal data concerned have not already been made public, for example because they are openly available (on the internet or in the media) or have actively been published or provided to us by the data subject themselves.
Restricting access
We have routines and working practices for handling personal data securely. The starting point is that only employees and, where applicable, the client for whom we carry out the assignment who need the personal data to perform their tasks should have access to them.
Deletion
Personal data that are no longer used, for example because the client assignment within which they were processed has ended, because the data have otherwise become out of date for the assignment, or because a contract or collaboration has expired or similar, are deleted regularly. The exception is where the personal data need to be kept for a period in order to meet, for example, a complaints period, if there is reason to believe that the completed assignment, contract or collaboration will in the near future turn into a new assignment, contract or collaboration with the same counterparty, or if it is in our interest to be able to account afterwards for how the assignment was carried out.
Transfer of personal data
In some cases we transfer personal data to other parties. This may involve personal data we have processed on behalf of a client where it is part of our assignment to hand the data over to the client, or personal data processed within a tool or digital platform where our own policy does not apply and the policy of the tool or platform applies instead. Otherwise, personal data are transferred between the agencies of Diplomat Group and to possible collaboration partners when our client assignments require it.
IT security
We follow the data security measures required by the GDPR. This includes, for example, encryption of our networks and restricting access to data to prevent so-called personal data incidents. We have internal policies and routines for IT security and for handling personal data incidents that meet the statutory requirements.
4. Your rights
The Data Protection Regulation gives you the right to:
- request information about which personal data we process about you
- have incorrect personal data corrected and, in some cases, ask us to delete your personal data
- object to certain personal data about you being processed and request that the processing of your personal data be restricted
- have the personal data you have provided to us transferred to another controller (right to data portability)
- if processing is based on consent, withdraw that consent, and
- if you are dissatisfied with how we process your personal data, lodge a complaint with Datainspektionen (the Swedish Data Protection Authority), which is the responsible supervisory authority.
5. Contact information
For questions about our privacy policy or about our processing of personal data, contact info@talecontent.se
