Terms & Privacy

1General

1.1This privacy policy (the "Privacy Policy") always applies, unless otherwise agreed in writing, between Eudelics AB, reg. 559356-8644 (“Eudelics”), and each person who provides Eudelics with their personal data (the "Data Subject").

1.2Concepts in this Privacy Policy, e.g. “personal data”, “data controller”, “processing”, “data processor”, “standard contractual clauses” and “supervisory authority”, shall have the meaning ascribed to them in Regulation (EU) 2016/679 of the European Parliament and of the Council (the “GDPR”), unless the circumstances obviously require another order of interpretation.

1.3Eudelics is the personal data controller for the processing of personal data which is registered with Eudelics via the webpage www.eudelics.com, or any of its sub-domains or connected webpages (together the “Website”), or which Eudelics collects directly from a Data Subject or from a third party. Eudelics may also process personal data on behalf of one of Eudelics’ clients, in which case Eudelics acts as a data processor, and the client as the data controller.

1.4This Privacy Policy serves to assure the Data Subject that Eudelics, in its capacity of personal data controller, processes personal data in accordance with applicable privacy laws and regulations. Eudelics, in its capacity of data processor, shall also strive to adhere to this Privacy Policy when processing personal data on behalf of a data controller, however, such processing is always subject to the instructions given by the data controller.

1.5Below follows a description of how Eudelics processes the Data Subject's personal data. Information is also given regarding the Data Subject’s rights, and how the Data Subject can get in contact with Eudelics in case the Data Subject has any questions or wants to exercise his or her rights.

1.6By using the Website or in any other way soliciting Eudelics’ services (together hereinafter referred to as the "Services"), the Data Subject agrees to Eudelics’ processing of the Data Subject's personal data in accordance with this Privacy Policy. By using the Website, the Data Subject also agrees to Eudelics cookie policy.

2Changes to the privacy policy

2.1Eudelics may at any time, and at its sole discretion, update or make changes to this Privacy Policy.

2.2Should Eudelics have to change this Privacy Policy, the Data Subject will be informed through announcements on the Website.

3Processing, objectives and legal basis

3.1The purpose of processing the personal data is to enable Eudelics to offer the Services in full, provide information about the Services and market the Services. Eudelics may use personal data for email marketing, facilitating sales, newsletter dispatches, webinar invitations, or re-targeting through advertisement platforms such as LinkedIn, Google or Facebook etc.

3.2The collection and processing of the Data Subject's personal data is conducted solely with the Data Subject's consent or on the premise of an existing agreement or legal obligation, e.g. when Eudelics must save the data according to accounting rules. Exceptions are made for cases where a prior consent is not possible for practical reasons, when the processing of the data is permitted by law, or when Eudelics has a legitimate interest in processing the personal data, e.g. for marketing, follow-up of the Services, or for exercising or defending Eudelics against legal claims, in accordance with a so-called balance of interests.

3.3Any personal data that Eudelics processes in connection with the registration of the Data Subject’s use of the Services is referred to below as "Registration Data".

3.4Eudelics processes the Registration Data to administer the Data Subject's to be able to offer and market the Services to the Data Subject. The legal basis for the processing is the Data Subject’s consent and/or Eudelics’ contractual relationship with the Data Subject in accordance with Eudelics’ general terms and conditions.

3.5When a Data Subject contacts Eudelics via Eudelics’ support service, Eudelics saves the personal data that Eudelics needs to be able to provide the support service as part of the Services, administer support and complaint cases and be able to contact the Data Subject. In addition to Registration Data, Eudelics may process personal data relating to case/ticket numbers. The legal basis for the treatment is Eudelics’ contractual relationship with the Data Subject in accordance with Eudelics’ general terms and conditions.

3.6Eudelics processes the Data Subject’s Registration Data for direct contact with the Data Subject via email, in order to conduct Data Subject surveys or to deliver updated purchase terms, newsletters etc. The legal basis for the processing is a so-called balance of interests.

3.7Eudelics may process the Registration Data to fulfill its legal obligations based on legal requirements, judgments or decisions by authorities etc. In such cases, the legal basis for the processing is Eudelics’ legal obligation.

4Sensitive personal data

4.1Eudelics does not process sensitive personal data, i.e. data which reveals a Data Subject’s racial or ethnic origin, political opinions, religious or philosophical beliefs or membership of a trade union, or data concerning sex life or sexual orientation. The only exception is data concerning health, as described in this section.

4.2To assess whether it is safe for a Data Subject to take part in a program, Eudelics collects data concerning health. This includes whether the Data Subject has a diagnosed mental health condition or takes psychiatric medication, which is asked in the screening questions on the Website, and the more detailed physical and psychological health information that Eudelics requests later in the screening process.

4.3Eudelics processes data concerning health only with the Data Subject’s explicit consent. On the Website, consent is given by ticking the consent box before the screening answers are submitted; later in the screening process it is given in writing. The data is used only to assess suitability and safety, and to prepare and deliver the Services. It is not used for marketing.

4.4Data concerning health is accessible only to Eudelics and, where necessary for the safety of the Data Subject, to the medical professional involved in the Data Subject’s program, and is not shared with anyone else without the Data Subject’s consent. It is stored with Eudelics’ subcontractors for data storage and email (so-called data processors), such as Google Workspace, as described in sections 5 and 7.

4.5The Data Subject does not have to provide data concerning health, but if it is not provided Eudelics may be unable to assess whether the Data Subject can safely take part in a program. The Data Subject may withdraw consent at any time by emailing info@eudelics.com. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. Eudelics will then delete the data concerning health in accordance with section 12, unless Eudelics is legally required to keep it.

5Sharing of personal data to third parties

5.1Without the Data Subject's explicit permission, Eudelics will not share the Data Subject's personal data with any third party in any other way than what follows from this Privacy Policy, unless Eudelics is obliged to do so following the applicable regulations or unless the personal data is shared in connection with an ongoing legal-, administrative- or recovery procedure in which the Data Subject and Eudelics are both parties.

5.2Eudelics uses subcontractors for services in connection with Eudelics’ Services (so-called data processors). These data processors may process personal data and may need some access to personal data collected in connection with the Services. Eudelics may also need to use the data processors’ services to store personal data. Eudelics always ensures that data processors only process the Data Subject's personal data in accordance with Eudelics’ instructions and only for the purpose of providing the agreed upon services to Eudelics.

6Storing of personal data

6.1The Data Subject's personal data will not be stored for any longer than necessary, with regards to the purpose of the processing and taking into account Eudelics’ legal obligations, e.g. regarding to accounting regulations etc.

6.2Eudelics regularly deletes all personal data which is no longer needed with regards to the purpose of the processing, in accordance with the relevant laws and regulations in force at any time.

7Transfer of personal data outside the EU

Eudelics only transfers personal data to data processors in third countries (i.e. countries outside the EU/EEA) if the third country has an adequate level of protection according to applicable privacy laws and regulations and the data processor has agreed to the EU Commission’s standard contractual clauses for data transfers between EU and non-EU countries.

8The right to request information

8.1The Data Subject has a right to request and obtain, free of charge, information regarding what personal data (if any) that is being processed by Eudelics (a so-called register extract). The Data Subject also has the right have any incorrect personal data corrected. If the Data Subject wishes to know if Eudelics processes any personal data about the Data Subject, he or she can send a written and signed request to Eudelics in accordance with section 17 below. In the request, the Data Subject needs to indicate specifically what kind of information the Data Subject is interested in receiving (unless the Data Subject is interested in receivinginformation about all personal data). That way, Eudelics can provide the Data Subject with information that is relevant. If the Data Subject repeatedly sends requests for an extract from the register, Eudelics may charge a fee or, in some cases, in accordance with statutory law, refuse to comply with the request.

8.2The extract from the register will be sent to the Data Subject within 30 days from the time Eudelics received the request. If the extract is extensive and Eudelics needs more time or if Eudelics for some reason cannot comply with the Data Subject’s request, Eudelics will without undue delay notify the Data Subject thereof.

9The right to rectification

9.1In order to fulfill its obligations to always have accurate and relevant personal data, Eudelics systematically works with its registers and updates personal data where necessary. If the Data Subject notices that the personal data Eudelics processes is incorrect or if Eudelics lacks important personal data, the Data Subject has the right to have their personal data corrected. Eudelics normally performs simple data corrections without consideration, but in some cases Eudelics may need to consider the Data Subject's request. Eudelics will not approve the Data Subject's request if it is impossible or requires an unreasonable amount of work. Upon a request by the Data Subject, Eudelics will inform the Data Subject about whom the correction has been submitted to.

9.2In the event that the Data Subject's personal data is changed at the Data Subject's request, Eudelics will inform any data processors and partners that processes the personal data about the change.

10The right to erasure

10.1The Data Subject has the right to request that Eudelics erases the Data Subject's personal data when:

• they are no longer needed for the purposes for which they have been collected and for which they are being processed;
• Eudelics processes personal data under the Data Subject's consent and the Data Subject withdraws said consent;
• Eudelics processes personal data for direct marketing and the Data Subject opposes the continued processing for this purpose;
• Eudelics processes personal data on the legal basis of a balance of interests and there are no legitimate interests that weigh heavier than the Data Subject's interest;
• Eudelics does not process personal data in accordance with applicable rules;
• It is required that personal data is erased in order to fulfill a legal obligation; or
• there is another relevant legal basis for the Data Subjects request to erase the personal data.

10.2Eudelics has the right to refrain from erasing the Data Subject's personal data if Eudelics needs to retain such data in order to a legal obligation or in order to make/defend against legal claims towards/from the Data Subject.

10.3When Eudelics receives the Data Subject’s request regarding erasure, Eudelics will conduct an assessment in order to evaluate if there are reasons to erase the Data Subject’s personal data. The Data Subject will then be informed about Eudelics’ assessment. If the Data Subject’s personal data are erased at the Data Subject’s request, Eudelics will inform potential suppliers and third-party partners to which personal data has been transferred that the personal data has been erased. However, Eudelics will not do this if it is impossible or requires an extensive amount of work.

11The right to restriction of processing

11.1The Data Subject has the right to request the restriction of Eudelics’ processing of the Data Subject's personal data when:

• the Data Subject has disputed the accuracy of the personal data, during the time Eudelics has the opportunity to check whether the personal data are correct;
• the processing is illegal, and the Data Subject opposes that the personal data is deleted and instead requests a limitation of its processing;
• Eudelics no longer needs the personal data for the purposes of the processing, but the Data Subject needs the personal data to be able to determine, enforce or defend legal claims; or
• the Data Subject has objected to processing in accordance with section 13 below, when awaiting information of the legitimacy of whether Eudelics’ interests weigh heavier in relation to the interests of the Data Subject.

11.2Restriction of processing implies that the personal data will be marked, so that they in the future may only be processed for certain limited purposes.

12Deletion of personal data

12.1The personal data will not be retained for any longer than is necessary with regard to the purposes of the processing, and Eudelics will otherwise delete personal data in the manner that follows from applicable legislation, where an examination is made on a case-by-case basis when different types of personal data should be culled.

12.2If the Data Subject requests that the Data Subject’s personal data shall be deleted, Eudelics will delete or de-identify the personal data no later than 30 days from the reception of the request. This is provided that the personal data is not required to be saved in the future in order for Eudelics to fulfill its legal obligations or to be able to exercise its legal claims.

13The right to withdraw consent and object to processing

13.1The Data Subject has the right to object to Eudelics’ processing of the Data Subject's personal data which Eudelics conducts with the support of so-called balancing of interests according to law. If the Data Subject wishes to exercise this right, the Data Subject needs to specify in writing which processing the Data Subject objects to. In the event of such an objection, Eudelics may only continue to process the Data Subject’s personal data if Eudelics can show that there are compelling and entitling reasons for why the personal data must be processed, and provided such reasons weigh heavier than the Data Subject's interests.

13.2If the Data Subject's personal data is processed for direct marketing, the Data Subject always has the right to object to the processing at any time.

14The right to data portability

If the Data Subject has provided his or her personal data to Eudelics, the Data Subject may, in some cases, be entitled to extract his or her personal data in order to, for example, move them to another company. In order for the Data Subject to be able to use his or her right to so-called data portability, the Data Subject's request must relate to personal data that the Data Subject himself/herself has provided to Eudelics and which Eudelics processes with the consent of the Data Subject or to fulfill an agreement with the Data Subject. The right to data portability does not apply when Eudelics’ processing of the Data Subject's personal data is based on a balance of interests or a legal obligation for Eudelics. The right to data portability does not apply when data portability is technically difficult to implement.

15The right to complain

In the event that the Data Subject has complaints or objections in connection with Eudelics’ Processing of the Data Subject's personal data, Eudelics kindly asks the Data Subject to initially contact Eudelics, so that Eudelics can help the Data Subject in the best way possible. However, the Data Subject always has the right to submit his or her complaints directly to the relevant data protection authority.

16Security

Eudelics undertakes all appropriate technical and organizational security measures, that are required in accordance with applicable regulatory frameworks governing the processing of personal data, to ensure a high level of security appropriate to the risks and to protect the personal data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to processed personal data.

17Contact information

If a Data Subject wishes to exercise its rights under these Terms, or If the Data Subject has any questions about this policy or Eudelics’ personal data processing, a request shall be made in written form and sent to Eudelics by email to info@eudelics.com.