Privacy and personal data

Draft. The text is reviewed before a Gärdsmygen can be started here.

This page is about Gärdsmygen, where associations start and board members log in. The controller of the data here is the provider (named before sign-up opens). What a board puts into its Gärdsmygen is the association's responsibility; see the privacy page on the association's own Gärdsmygen.

What we keep and why

The association's name, organisation number, town and number of apartments, and the name, email and role of whoever signed it up: to make the association's Gärdsmygen ready, write about the free period and invoice (contract).
An application to become a pilot association: the association's name, organisation number, town and number of apartments, and the name, role on the board, email and phone of whoever applied and what the association wants help with: to contact the board about becoming a pilot association (consent, given with the tick on the page). The application is removed when the association starts its Gärdsmygen, and after twelve months at the latest.
A fingerprint of the email address of each board member who can log in, not the address itself: to find the right association when someone logs in here (contract).
Fingerprints of network addresses for two days: to stop misuse of sign-up and login (legitimate interest).
One-time codes, stored as fingerprints, for a day.

The board’s mailbox

A board can connect its mailbox at Google (Gmail and Google Workspace) or Microsoft (Outlook.com and Microsoft 365) by signing in there, or a mailbox at another email service with its address and password. Gärdsmygen requests read and send access to the mailbox only to turn new mail in the inbox into cases and to send the board’s replies from the board’s own address. Nothing in the mailbox is changed or deleted. The access key or the password is kept encrypted until the mailbox is disconnected.

Gärdsmygen’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. What Gärdsmygen reads through Microsoft’s services is used in the same way and only for the same purposes: never for advertising, never sold and never to train a language model.

Where and for how long

The data is stored with Netlify in Frankfurt and mail goes through Lettermint in the EU. A sign-up that is never confirmed is removed after a day. The data is kept while the association uses Gärdsmygen. When the association is closed, or when the read-only time after an expired subscription has run out, the register of login fingerprints is emptied and the name and email of whoever signed it up are erased. What remains is the record of which terms were accepted and when, a short log of what the platform did (with no personal data), and the invoices we have sent, which we keep as long as the Bookkeeping Act requires. If the association erases the person who signed it up as a member, their name and email are erased here too.

Your rights

You can find out what we hold about you, have it corrected or removed, and object to the processing. Write to contact@gardsmygen.se. You can also complain to the Swedish Authority for Privacy Protection (imy.se).

No cookies for tracking or statistics; only those needed for language, login and sign-up.