Introduction
The purpose of this privacy notice is to provide information on how Global Compact Network Sweden (“GCNS” or “we”) process your personal data in connection with (i) management and communication regarding your membership in UN Global Compact (“UNGC”) or (ii) the course of our operations. GCNS is an independent legal entity established to advance the mission and principles of UNGC at the country level. The terms and conditions of the collaboration between GCNS and UNGC are governed by a Memorandum of Understanding.
All processing of personal data is carried out in accordance with the EU General Data Protection Regulation (the “GDPR”).
Description of personal data processing activities
| # | What personal data is processed? | For what purpose is the personal data processed? | What are the legal grounds for processing of personal data? | For how long the personal data will be stored? |
| 1 | Contact information (name and email address and job title).
This information is collected from UNGC’s central registry or from member companies’ websites. |
To send newsletters and other communication to you as a contact point or employee of a Swedish member organisation of the Global Compact. We also use necessary personal data to administer the membership of the organisation that you represent. | We have a legitimate interest to provide information about GCNS and UNGC and its respective activities, as well as to administer the membership of the organisation that you represent. The newsletter will only be sent to GCNS’s members. We safeguard that the processing is necessary to fulfil our legitimate interest and that our interest outweighs your interest in not having your personal data processed for this purpose.* | As long as you are a contact point or an employee of a Swedish member organisation of the Global Compact or until you unsubscribe from the newsletter. |
| 2 | Contact information (name and email address).
This information is collected through the newsletter registration form or the event registration form when you agree to subscribe to the newsletter. |
To send newsletters to subscribers. | We have a legitimate interest to provide information about GCNS and its activities. The newsletter will only be sent to subscribers, per their request. We safeguard that the processing is necessary to fulfil our legitimate interest and that our interest outweighs your interest in not having your personal data processed for this purpose.* | Until you unsubscribe from the newsletter. |
| 3 | Contact information (name and email address). | When you contact us directly via email, we use the personal data provided in your email to respond to your questions or comments. | We have a legitimate interest to answer your inquires. We safeguard that the processing is necessary to fulfil our legitimate interest and that our interest outweighs your interest in not having your personal data processed for this purpose.* | Until the processing is no longer required to perform one of our services or to manage and administer the membership of the organisation you represent. As a general routine all e-mails are archived or deleted after two years. |
| 4 | Contact information (name, email address and, in some cases, food preferences). | To administer your attendance to a seminar or event that we host which you have signed up for. | We have a legitimate interest to administer our events and seminars. We have a legitimate interest to provide information about GCNS and its activities, per your request. We safeguard that the processing is necessary to fulfil our legitimate interest and that our interest outweighs your interest in not having your personal data processed for this purpose.* | As long as the legitimate interest remains to e.g. administer follow-up questions, send outs or answer questions. As a general routine all personal data is deleted at least once annually. |
* You are always entitled to object to this assessment. You can read further about your rights below.
As a general rule, we will collect the personal data directly from you. However, this may also be done by one of our processors or another controller within UNGC.
Information regarding the membership of your organisation and the processing of personal data relating to the application for membership will be collected by UNGC and the Foundation for the Global Compact (see separate privacy policy here https://www.unglobalcompact.org/privacy-policy). However, we may also collect personal data about you from your organisation. This will be the case if you are a contact person for your organisation’s membership but was not the one filling out the application.
The provision of your personal data is not required under law or an agreement which we have entered into with you personally. However, in order to communicate with you and administer the membership we have to process some of your personal data.
Who has access to your personal data?
We have implemented appropriate technical and organisational measures to protect your personal data against loss, accidental and unlawful access and unauthorised disclosure. The number of persons with access to your personal data is limited. Only individuals associated with us that need to process your personal data in accordance with the purposes above have access to your personal data.
Personal data relating to a UNGC membership will be shared with the UNGC who act as independent controller for their processing of your personal data. For more information about how UNGC processes your personal data, please see https://www.unglobalcompact.org/privacy-policy.
We may also share your personal data with suppliers and partners that carry out services on our behalf or in other ways collaborate with us, including:
| Supplier/ collaborator | Type of personal data shared | Purpose of data sharing | Data policy |
| Mailchimp | Name, title, email | For the purpose of sending out newsletters. | https://mailchimp.com/legal/data-processing-addendum/ |
| Invajo | Name, title, email | For the purpose of administrating attendance at seminars/event that we host. | https://home.invajo.com/invajo-privacy-policy?hsLang=en |
| Bokoredo | Name, email | For invoicing purposes. | https://bokoredo.se/gdpr/ |
| Account Engagement (Salesforce) | Name, title, email | For the purpose of sending out newsletters. | https://www.salesforce.com/company/legal/privacy/ |
| Zoom | Name, title, email | For the purpose of administrating attendance at seminars/event that we host. | https://www.zoom.com/en/trust/privacy/ |
| Microsoft Forms | For the purpose of composing member surveys. | https://support.microsoft.com/en-us/office/security-and-privacy-in-microsoft-forms-7e57f9ba-4aeb-4b1b-9e21-b75318532cd9 |
We may disclose your personal data in response to a court order, subpoena, law enforcement proceeding, regulatory inquiry or as otherwise legally required. Such disclosure of personal data will be limited (a) to the extent necessary to comply with national security, public interest, or law enforcement requirements or (b) by statute, government regulation or case law that creates conflicting obligations or explicit authorizations.
Also, we may share personal data in order to enforce or apply our terms and other agreements; or to protect the rights, property, or safety of UNGC, our participants or signatories, or others. This includes exchanging information with other organisations for fraud protection and credit risk reduction.
Your personal data will be transferred to countries outside of EU/EEA, including the United States, which may have a lower level of protection of personal data than within the EU/EEA. The transfer is based on our legitimate interest in enabling cooperation within UNGC. When we transfer data to countries outside of EU/EEA, we ensure that appropriate safeguards are put in place to protect your personal information.
What are your rights?
Global Compact Network Sweden, reg. no. 802513-7103, with address Kronhusgatan 2G, 411 13 Göteborg, and email address info@globalcompact.se, is the data controller of the processing of your personal data. According to the GDPR you have the following rights:
- Right to access: You have the right to know what personal data we are processing about you, and you can request a copy of such data.
- Right to correction and deletion: You have the right to have incorrect personal data about you corrected, and in some cases, you may request that we delete your personal data.
- Right to object and request limitation: You have the right to object to certain processing of your personal data, and request that the processing of your personal data should be limited. Please note that limitation or deletion of your personal data may result in us not being able to g. invite you to our events or administer your membership.
- Right to data portability: Under certain circumstances you are also entitled to extract your personal data in a structured, commonly used and machine-readable format and to transfer the personal data to another controller.
If you have questions regarding how we process personal data about you, you are most welcome to contact us at the contact information stated above. If you have any objections or complaints about the way we process your personal data, you have the right to file a complaint with the Swedish Authority for Privacy Protection (Sw. Integritetsskyddsmyndigheten).
Changes
If any changes are made concerning the processing of your personal data, we will inform you of the changes by publishing an updated version of this privacy notice on our webpage.