Privacy Policy for Rightholders

Applicable from and including 1 May 2022

We need to process your personal data as rightholders to enable us to offer our services. We at Copyswede care about your personal privacy and it is important to us that you understand how we process your personal data. The purpose of this Privacy Policy is to inform you about what personal data we process, why and how we process it, what rights you have and what responsibility we have for your personal data.

What does ‘personal data’ mean?

‘Personal data’ means all information that can be directly or indirectly attributed to a living natural person. Examples of personal data are name, address, personal identity (ID) number, telephone number and email address.

Who is responsible for your personal data?

Copyswede Ekonomisk Förening, organisation ID number 769602-0036, is the Controller of the personal data processed in Copyswede’s operation.

Our processing of your personal data as a rightholder

What is the purpose of our personal data processing?

If you are a rightholder, we will compile the information needed to enable us to distribute and pay out copyright levies to you. The data may also be used to manage and develop our processes and IT systems.

What personal data do we compile?

The personal data we compile includes, among other things, name, personal identity (ID) number, contact details, contributions to productions, levies and any companies to which levies are being paid.

How do we compile the personal data?

We compile personal data directly from you, for example, when we request a contract showing that you were involved in a film or television production. We also obtain data about you from various public registers, such as IMDB, the Swedish Film Database or from credits for programmes to which you have contributed. We can also obtain data about your contributions to productions from producers, television companies and Copyswede’s member organisations.

On what legal grounds do we process your personal data?

Our personal data processing is necessary to enable us to perform our legal obligations, for example, to enable us to pay out levies and manage rights in accordance with the Act on Collective Management of Copyright, and also to comply with tax legislation and perform the requirement to maintain accounting records.

Disclosure of personal data

We may disclose your personal data to a third party if this is required to enable us to fulfil our contracts or because of legal obligations. One example is when we share data with our cooperating organisations in order to be able to administer levies for rightholders. In this case, the third party is also the Controller. We may also disclose data to government authorities (the police, the Swedish Tax Agency or other public authorities) if we are obliged to do so according to law.

We also have suppliers that process personal data on our behalf and in accordance with our instructions. This may be, for example, companies that provide the necessary operation of technical support and maintenance of our IT systems. These suppliers are contractually bound not to use your personal data for any purpose other than to provide the agreed service on the terms and conditions specified by us and in compliance with applicable laws and rules. We are then still the Controller.

Disclosure of personal data to third countries

Personal data may be transferred to a third country if this is required to enable Copyswede to perform its legal obligations or undertakings in relation to rightholder organisations.
All such transfers are carried out with a level of protection adapted to the situation and pursuant to GDPR.

The special safeguards that Copyswede applies in the case of a transfer of personal data to a third country are:

• When the European Commission has decided that a country outside the EU/EEA ensures an adequate level of protection. What is meant by an ‘adequate level of protection’ is that the country imposes adequate protection for personal data corresponding to that offered by GDPR. This means that personal data can be transferred to the country in the same way as a country within the EU/EEA.

  The following is a list of the countries that the European Commission has decided have an adequate level of protection.

• If the third country is not deemed to have an adequate level of protection, Copyswede will enter into binding standard contractual clauses (SCC), which have been decided by the European Commission. This generally means that if Copyswede enters into a contract that includes standard contractual clauses with a country outside the EU/EEA, the transfer of personal data to the party to the contract in that country is permitted.

  You can find out more about standard contractual clauses here. 

  Here you can download Q&A about standard contractual clauses. 

How do we protect your personal data?

We protect your personal data via various security measures in our work processes and technical solutions. Only those employees who actually need to process your personal data have access to it.

For how long do we save your personal data?

We do not save your personal data for longer than is necessary to fulfil any of the purposes for which the personal data has been compiled, or to comply with laws or ordinances, the request of the supervisory authority or a court order. We clear data on an ongoing basis that is no longer needed for any of the above reasons.

What are your rights?

You have a number of rights relating to our processing of your personal data in accordance with applicable personal data legislation.

Right to know who is processing what, and why

You have the right to receive information about how your data is being processed. This includes information about:

• for how long we are saving your data,
• with whom we may share your data,
• your basic data protection rights,
• your information being transferred outside the EU,
• your right to lodge a complaint,
• how to withdraw your consent, if you have given it.

Right to have access to your data

You have the right to have access to the data we have about you free of charge.

Right to object

If we process your personal data without your consent, you have the right to object to this processing. In order to do this, you must specify the processing to which you are objecting. For us to be able to continue such processing, we must demonstrate that there are compelling legitimate reasons for the personal data being processed which override your interests.

Right to rectify your data

If you believe that our data about you is inaccurate or incomplete, you have the right to request that it is rectified.

Right to have data erased and ‘to be forgotten’

If we have requested your consent to process your data, you can ask us to stop processing it by withdrawing your consent. If we do not have any other legal reasons for the processing, we will cease the processing. You can ask for your personal data to be erased if we do not have any legal grounds for processing the data.

Restriction of data

You have the right to request that our processing of your personal data is restricted so that it may only be processed for certain limited purposes. You can request restriction:

• if you have contested that the data is accurate, for the period during which this is being investigated,
• if the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead,
• if we no longer need the personal data for the purposes of the processing, but it is required by you for the establishment, exercise or defence of legal claims,
• pending the verification of whether it is your or our legitimate grounds that are overriding in the case of an objection to the processing.

Where the processing has been restricted in accordance with an item above, we may only, with the exception of storage, process the data for the establishment, exercise or defence of legal claims or for the protection of the rights of another party or if you have given your consent.

Right to move your data

You have the right to ask to have the personal data relating to you and that you have provided to us transferred to another Controller if our right to process your data is based on your consent or the performance of a contract with you. This applies where the transfer is technically feasible and can be carried out by automated means.

Contact

You can contact us by email at dataskydd@copyswede.se or by telephone on +46 (0)8-545 667 00 if you have any questions or comments, or if you wish to exercise your rights. You can also write to ‘Dataskydd’ (Data Protection), Copyswede, Alströmergatan 12, 112 47 Stockholm, Sweden.

Complaints

You can lodge a complaint with us or with the Swedish Authority for Privacy Protection if you consider that your personal data is being processed in violation of applicable law.