Data Protection

The Swedish Heart-Lung Foundation’s data protection policy.

Who collects and processes your information?

The Swedish Heart-Lung Foundation, registration number 802006–0763, is responsible for collecting and processing your personal information.
For questions regarding the processing of your information, please contact the Swedish Heart-Lung Foundation’s Data Protection Group at: dataskydd@hjart-lungfonden.se.

Data Protection – cyber security

View your information

Log in to Mina uppgifter (“My Pages”) to view the information we have stored about you. You can also edit your information there if anything is incorrect.

Log in to My Pages

Your right to decline marketing and personalisation

You have the right to decline all direct marketing and all automatic personalisation.

You may contact us to do so.

You can also choose to turn off some or all cookies when using our website.

What information do we collect?

Information you provide to us when you:

• Make donations
• Order informational materials
• Create your own digital fundraising page on our website
• Register for seminars
• Contact us in any way

This includes:

• Personal and contact information such as name, personal identification number, address, email address and phone number
• Information about donations and orders
• Bank account numbers for direct debit
• Card information for card payments
• Information about any company you have stated that you represent
• Any other information you choose to provide

Information you provide when you wish to include us in your will

• Personal and contact information such as name, personal identification number, address, email address and phone number
• Where applicable, the original or a copy of your will, and any other information you give us regarding your intended bequest

If you have notified us that you intend to leave a bequest, your information will not be automatically deleted.

Information you provide to us in surveys

• The information you submit
• The time of submission/registration

Information you provide when you have specifically registered to be contacted for participation in the Swedish Heart-Lung Foundation’s contexts
(e.g., participation in newspaper articles)

• Your personal and contact information
• The information and personal story you have provided, which may include health-related information

We delete this information after 5 years if we have not been in contact with you during that time.

This information is not shared with third parties without your consent and is not used for any other purpose.

If you have provided health-related information, the legal basis for processing is your consent.

In other cases, the legal basis is our legitimate interest to conduct effective public opinion work to highlight our mission and activities.

• Information provided by another person suggesting that you may be interested in being contacted by us
• Personal and contact information such as name, address, email address and phone number

Who recommended that we contact you

We use this information to contact you. If we are unable to reach you, the information is deleted within 6 months.

Information collected from website visits

• How you arrived at our website and how you use it
• Your clicks and scrolling behaviour on our website

Information collected from email newsletters

• Whether you opened the newsletter
• Which links you clicked

Information from purchased address lists in recruitment campaigns

• Personal and contact information
• Address source

Information we receive from third parties

• Statistical demographic information from data providers regarding the area where you live (source: da.conzoom.eu)
• Updated personal and contact information from the population register and telephone number registries
• Information regarding whether payments have been successfully completed (e.g., card payments) from payment providers
• Contact information for corporate decision-makers from data providers
• Data extracted using AI from bequest cases and related documentation

Information we create ourselves

• Segmentation of our database into different types of individuals, segments and groups
• Probability calculations for groups, such as the likelihood that you may be interested in receiving fundraising letters
• Notes from our contacts with you

Information collected in connection with digital gift cards

• Information about you as a gift card recipient is stored only to fulfil the giver’s order. This information is not used for marketing.
• When donations are made through digital gift cards, the giver provides the recipient’s contact information for delivery of the greeting. Because these details are provided by a third party, we cannot prevent recipients from receiving a gift card even if they have previously opted out of communication from us.

What do we do with your information?

We process your information for the following purposes:

1. Process your donation or order.
   For example: sending payment slips, printing memorial cards, registering direct debit mandates with Bankgirocentralen, and processing card payments through our service providers. Our Donor Service assists via email, mail and phone with the registration of donations.
2. Compile statistics.
   Your information is used to create aggregated statistics and statistical models to improve our operations. Website visits are analysed in third-party web analytics tools. We sometimes hire research companies to collect data for statistical purposes.
3. Contact you by phone.
   For example, thank-you calls, surveys, information and donation requests. External service providers are used for this purpose. Calls may be recorded for quality assurance.
4. Personalise future communications and content.
   We use statistical models based on your previous donations and orders, research areas you have supported or indicated an interest in, probability calculations and demographic information. These processes are partly automated and involve automated decision-making.
5. Manage your intention to include us in your will.
   We register information about your intention and, upon request, can store your will.
6. Forward your name and address to the relatives of a deceased person
   When you make a memorial donation, your name and address are sent to the relatives. The purpose is to inform them about how many donations have been made and by whom, as confirmation that everything has been registered correctly and to enable them to send thank-you notes.
7. Postal mailings.
   For example, fundraising letters, thank-you letters and surveys. External service providers are used.
8. Email and SMS mailings.
   For newsletters, thank-you messages, information and surveys.
   Our legitimate interest is to conduct efficient fundraising.
   If you have explicitly subscribed to our newsletter, the legal basis is consent. External service providers are used.
9. Keep our records accurate and update your personal and contact information. To ensure we have correct information, updates are made using data from information providers. Our legitimate interests are to conduct effective fundraising and to correctly identify you to ensure transparency and easy access to your data.
10. Comply with applicable law.
    Information about orders is used as documentation for accounting purposes. This is a legal obligation.
11. Provide you with access to your information.
    Including correction requests. BankID/Mobile BankID may be used for secure identification. BankID is owned by Finansiell ID-Teknik BID AB. Your identification/signature is transferred through the BankID system. Our legitimate interest is to provide secure and easy access to your data. We also have a legal obligation to give you access and facilitate corrections.
12. Process crossword competition entries.
    If you participate in a crossword competition, we process your entry, name, email and town. This information is shared with a data processor and stored for as long as the competition is active, or for a maximum of 60 days.
    Our legitimate interest for purposes 1–7 is to conduct efficient fundraising.
    For IT operations and development of the Swedish Heart-Lung Foundation’s internal systems, we use IT service providers.

When is your information deleted?

Unless otherwise stated under “What information do we collect?”, we delete your information in our campaign system 4 years after our last contact with you or after your last donation or order.
Your personal and contact information is deleted from the accounting system 7 years after you have made donations or placed orders.

Your rights

You have the right to:

• Request correction of your information.
• Gain access to your information.
• Request transfer (portability) of information you have provided to another organisation.
• Object to our processing of your information.
• Withdraw your consent at any time if processing is based on consent.
• Request deletion of your information.
• Request restriction of processing, temporarily, for example during correction or in relation to a complaint.
• Lodge a complaint with a supervisory authority.

The Swedish Authority for Privacy Protection (IMY) is the supervisory authority you may contact.

Transfer to third countries

We use cloud services for parts of our data processing. This means that your information may be transferred to the United States, which is considered a “third country”.

As a protective measure, the EU Commission’s Standard Contractual Clauses (SCCs) are used.