1. WHO WE ARE

Scandinavian Drone AB (Corporate ID No. 559457-9327)

Business address:
Idévägen 9
312 62, Mellbystrand
Sweden

NOTE: It is not permitted to copy any content from this privacy policy; see the Copyright Act.

This privacy policy explains how we collect and use (process) personal data in our business operations. Scandinavian Drone AB, represented by its CEO, is responsible for the processing.

We take your privacy seriously and have taken several measures to ensure that we provide you with clear information about how we process your data and what rights you have. If you feel that anything is unclear or missing, please do not hesitate to contact us.

2. YOUR RIGHTS

If you are not satisfied with how your data is processed, you can file a complaint with the Swedish Data Protection Authority, but we hope you will contact us directly first so that we can try to resolve the matter for you in a satisfactory manner.

Access to and correction of your personal data: You may request a copy of all the data we process about you and ask us to correct any information that is inaccurate.

Deletion or restriction: In certain situations, you may ask us to delete and/or restrict the processing of your personal data, but we cannot delete data that we are required by law to process.

Objecting to processing: If we process your data based on a legitimate interest, you have the right to object to such processing.

Data portability: If we process data about you based on consent or a contract, you may ask us to transfer that data to you or to another data controller.

You also have the right to withdraw your consent at any time.

If you are not satisfied with how your data is being processed, you may file a complaint with the Swedish Data Protection Authority, but we hope you will first contact us directly so that we can try to resolve the matter to your satisfaction.

3. WHO WE PROCESS PERSONAL DATA ABOUT

We process personal data about:

• Customers
• Potential customers (leads)
• Students in our courses
• Website visitors
• Contacts at suppliers and partners
• Job seekers
• Employees
• Former employees

4. HOW WE COLLECT PERSONAL INFORMATION

Providing personal data to us is voluntary, but in order for us to conduct business and/or provide you with the best possible support, we need certain information from you. We do not rent, buy, or sell personal data to or from others. We do not use automated decision-making or profiling when processing your personal data, and we do not process special categories of personal data beyond what is required in a normal employment relationship.

We process personal data when you:

• Purchase our products or services
• Sign up for a membership with us
• Contact us by phone, text message, our website, email, or social media
• Sign up for our newsletter
• Request access to free content from us
• Sign up for events we organize, both free and paid
• Complete a survey
• Use our website

5. PURPOSE, LEGAL BASIS, AND STORAGE

Pursuant to Article 6(1) of the General Data Protection Regulation, we process personal data based on:

a) Your consent.

b) A contract we have entered into.

c) A legal obligation to which we are subject.

f) A legitimate interest that we believe we have.

As a general rule, personal data may not be processed or stored for longer than is necessary to fulfill the purpose of the processing. To comply with this, we conduct annual GDPR audits in which we formally assess and review our data protection practices. The purpose is to modify, update, and, if necessary, delete personal data. We process data for as long as we are required to do so under applicable legal obligations, such as those related to accounting, tax, or labor laws and/or other relevant rules and regulations.

Your personal data will only be stored as long as we have a purpose and a legal basis:

Until you withdraw your consent (e.g., in connection with email and text message marketing)
As long as we have a contractual obligation, and, where applicable, in accordance with accounting and bookkeeping rules (e.g., in connection with a sale)
As long as we have a legal obligation and in accordance with applicable laws and regulations (e.g., in connection with employment)
As long as we have a legitimate interest, or until you ask us to stop processing your personal data in this manner (e.g., in connection with marketing to existing customers)

You may contact us at any time if you wish for us to stop processing or to delete your personal data. We will fulfill our obligations under applicable law. Please note that we cannot delete personal data that we are legally required to process.

6. HOW WE PROCESS YOUR DATA

Here we describe in detail when and how we process your personal data, for what purposes, on what legal basis, and for how long. We process personal data when:

You communicate with us

When you give us your business card or contact us via the website (contact form, comment field, chat, or similar), via email, phone (calls, text messages), or social media, we process personal data. Depending on where and how you send us a message, this may include your name, contact information, IP address, and other information you choose to send us.

We use a CRM (Customer Relationship Management) system and/or a customer support system to process personal data about potential and existing customers. (Please note that we are not responsible for the dialogue we have with you on social media; rather, the platform itself is responsible. We encourage you not to send sensitive information to us there, including special categories of personal data (e.g., regarding your health), as such platforms are not considered secure.)

The purpose is to be able to respond to your inquiries, for historical purposes, and to maintain documentation in the event that we receive complaints, appeals, or legal claims. The legal basis is f), where the legitimate interests are to be able to respond to your inquiries, for historical purposes, and to maintain documentation in the event that we receive complaints, appeals, or legal claims. We review, archive, and delete inquiries as needed, but no less frequently than every three years. Accounting records are retained for up to five years, in accordance with the provisions of the Accounting Act.

You purchase our products and services (including digitally)

When you purchase products and services from us, we process personal data such as your name, contact information, order and payment details, and purchase history. The purpose is to deliver products and services to you following an order or purchase, to maintain a record of products and services sold, and generally to manage and follow up on our customer relationship with you. The legal basis is (b) contract and (c) legal obligation under, among other things, the Accounting Act and the Tax Act. Accounting records are retained for up to five years in accordance with the provisions of the Accounting Act.

If you have purchased a service where all or part of the service is delivered digitally, such as via video (e.g., e-learning), either one-on-one between us and you, or one-to-many between us and a group of people, we also process personal data such as name, profile picture, video (image and audio), messages (chat), and IP address. Depending on the type of service, content from video meetings with multiple participants may also be shared with other individuals, for example, if the service is designed as a group program. The content is not shared with unauthorized parties. For services where we use a webinar solution, read more below about the types of personal data processed. The legal basis is (f), where the legitimate interest is to be able to offer such services digitally. Any recordings from group calls are stored for as long as the product/service is offered and are subsequently deleted no later than within 5 years.

Marketing to Existing Customers

When you become a customer of ours, we process personal data as described above. If you have an existing customer relationship with us, we will be able to send you marketing communications via email, text message, and similar communication channels, in accordance with the Marketing Act.

The purpose is to provide good customer service. The legal basis is f), where the legitimate interests are to be able to offer you relevant products and services. The legal basis may also be a), if you have given us your consent. You may opt out of this type of marketing at any time. Information on how to unsubscribe from marketing in the form of newsletters is included in every newsletter. If you receive marketing in other forms, you can unsubscribe by notifying the sender. The data is retained for as long as the customer relationship lasts, until you unsubscribe or object to the processing.

You are applying for one or more jobs with us

When you apply for a job with us, we process personal data such as your name, contact information, resume, and other information we need to evaluate your application. The legal basis is (b) contract, and potentially Article 9(2)(b) and (h) if your application contains special categories of personal data. The data is deleted after a candidate has been selected for the position, unless you have consented to us storing your data for a longer period in case you wish to apply for a job at a later date.

For employees, we process personal data as described above, in addition to data necessary to pay salaries and otherwise administer the employment relationship. The legal basis for this is (b) contract, (c) legal obligations under applicable employment law, and, where applicable, Article 9(2)(b) and (h) for special categories of personal data. Information about employees is generally deleted when the employment relationship ends, unless specific reasons (e.g., a dispute regarding termination or dismissal) make it necessary to retain it for a longer period. Data related to payroll administration is retained for up to five years, in accordance with the provisions of the Accounting Act.

You become a student and use our online portal

When you apply for a job with us, we process personal data such as your name, contact information, resume, and other information we need to evaluate your application. The legal basis is b) contract, and potentially Article 9.2 b) and h) if your application contains special categories of personal data. The data is deleted after a candidate has been selected for the position, unless you have consented to our storing your data for a longer period in case you wish to apply for a job at a later date.

For employees, we process personal data as described above, in addition to data necessary for paying salaries and otherwise administering the employment relationship. The legal basis for this is (b) contract, (c) legal obligations under applicable employment law, and, where applicable, Article 9(2)(b) and (h) for special categories of personal data. Information about employees is generally deleted when the employment relationship ends, unless specific reasons (e.g., a dispute regarding termination or dismissal) make it necessary to retain it for a longer period. Data related to payroll administration is retained for up to five years, in accordance with the provisions of the Accounting Act.

You sign up for our newsletter

We send out newsletters via email with information about new products, services, articles, blog posts, discounts, offers, and similar content. When you subscribe to the newsletter, we process personal data such as your name and email address.

The purpose is to keep you informed about relevant news and offers, as well as to provide good customer service to potential and existing customers. The legal basis is a) consent. Subscribing to the newsletters is voluntary, and you may withdraw your consent (unsubscribe) at any time by clicking “unsubscribe” at the bottom of one of the emails.

The service provider we use to send out newsletters has built-in analytics that track whether subscribers open and click on links in the newsletters. If you do not want your activity to be tracked in this way, you should not subscribe. We use this data to analyze how effectively our newsletters reach our subscribers, so that we can continuously improve them with content relevant to our subscribers. The legal basis is (f), where the legitimate interests are to be able to offer digital newsletters, analyze their effectiveness, and continuously improve our operations. The data is stored for as long as you remain a subscriber and an active reader. We remove inactive subscribers by reviewing open rate statistics.

You request access to free content from us

We sometimes offer free content, such as white papers, checklists, manuals, guides, mini-courses, and similar materials. Depending on the type of free content, this may include a document (e.g., a PDF file), access to online courses, videos, or other materials, with or without one or more emails. For each such “freebie,” we will clearly inform you of what it consists of. When you request access to such content, we process personal data such as your name and email address. The purpose is to be able to offer free content to potential and existing customers, and the legal basis is a) consent.

If the free content is sent out as automated emails, we use a service provider for this purpose. The service provider we use to send emails has built-in analytics that track email opens and any clicks within the emails. If you do not want your activity to be tracked in this way, you should not request access to free content from us. We use this data to analyze open and click-through rates so that we can continuously improve the content we offer. The legal basis is f), where the legitimate interests are to be able to offer free digital content, analyze its effectiveness, and continuously improve our operations. The data is stored for a maximum of 3 years after you request access to the content and is then deleted during our next GDPR audit. If you have signed up for something that includes one or more emails, you may withdraw your consent (unsubscribe) at any time. If you access our online portal and/or a webinar, we process personal data as described elsewhere in this privacy policy.

You register for an event

When you participate in our events, we process personal data such as your name and contact information. For paid events, we also collect booking and payment information. The purpose is to offer relevant courses, lectures, and workshops or to fulfill the agreement regarding a booked event. The legal basis is a) consent, b) contract, and c) legal obligation under, among other things, accounting and tax laws.

We may also use your personal data to send you a request to evaluate the event you attended and, if applicable, invite you to other similar events. If we record the event, we will inform you of this. The legal basis for this processing is f), where the legitimate interests are to continuously improve our products and services and to provide you with good customer follow-up. The information is stored until you request that it be deleted or, at the latest, up to 3 years after the event. If it is a paid event, the information will be stored for up to five years in accordance with the rules of the Accounting Act.

You register for an event — inparticular, participation in digital events (webinars, etc.)

The platforms we use to deliver digital events also have built-in analytics that track participation times, the number of minutes spent participating, and links clicked. If you do not want your activity to be tracked in this way, you should not register for such a digital event. We use this data to analyze participation so that we can continuously improve the content we deliver. The legal basis is f), where the legitimate interests are to be able to offer events digitally, analyze participation levels, and continuously improve our operations. The data is stored until you request its deletion or, at the latest, for up to 3 years after the event.

You consent to our use of your personal data for marketing

If you have given us your consent, we will use your personal data for marketing and advertising on digital platforms. We will ask for your consent for each specific purpose, such as uploading your email address to Facebook’s advertising system (Ads Manager). We use such lists to either target our marketing at you and/or people similar to you, or to exclude you and/or people similar to you from such marketing. The legal basis is a) consent, and the data is stored for as long as you allow it. To ensure that we comply with privacy principles, we will request renewed consent every three years. If you withdraw your consent, we will immediately stop using your data for this purpose and delete it during the next GDPR review.

You are responding to a survey

We always inform you of the purpose of the surveys we conduct and whether they are anonymous or not. We do not share the information with others or use it for purposes other than those specified. In anonymous surveys, we do not collect any personal data. The legal basis for surveys that are not anonymous is a) consent. The data is stored until you request that it be deleted or, at the latest, 3 years after you completed the survey.

You are a supplier or partner of ours

When you enter into an agreement with us—whether as a supplier, business partner, or data processor—we process personal data such as your name, contact information, and correspondence. The purpose is to enter into an agreement with you, and the legal basis is b) a contract. The information is stored for up to five years in accordance with the provisions of the Norwegian Accounting Act. We process personal data related to general correspondence and communication as described above.

You use our website

When you use our website, we process personal data in accordance with our cookie policy. The purpose is to administer our website, market the company, and respond to inquiries from visitors. The legal basis for cookies that store or process information falling under Section 2-7b of the Electronic Communications Act is consent through a default setting in your browser, in line with IMY’s recommendations described here.

To preserve any history and context in the comments section, comments are not systematically deleted.

7. WHO WE SHARE DATA WITH

To conduct our business efficiently and securely, we sometimes need to share your personal data with parties such as:

• Data processors: providers of various services who process your personal data on our behalf (e.g., for IT and administrative services, accounting, cloud storage, web hosting, email marketing, etc.)
• Professional advisors from fields such as law, finance, accounting, auditing, etc.
• User support for IT and administrative systems
• Government agencies to which we are required to report

We do not necessarily share all of your personal data with all parties, but only the information that is relevant to the specific party. When we must share your personal data, we require that everyone with whom we share your personal data secure your data in accordance with sound information security practices and regulatory requirements. We enter into data processing agreements with all parties who process data on our behalf.

8. TRANSFER OF PERSONAL DATA TO COUNTRIES OUTSIDE THE EU/EEA

In certain cases, your personal data is transferred outside the EU/EEA, such as when we use service providers outside the EU/EEA to manage newsletter mailings, process customer data, make products and services available on our website, facilitate payments, ensure the security of our website, and otherwise conduct our business in a secure and efficient manner.

The transfer of personal data outside the EU/EEA takes place only if there is a valid legal basis under Chapter V of the General Data Protection Regulation (GDPR). The transfer is based on one of the following:

• a decision by the European Commission on the adequate level of protection in the recipient country, or for organizations that have joined the EU–US Data Privacy Framework,
• standard contractual clauses adopted by the European Commission, supplemented by the additional safeguards required following a case-by-case assessment, or
• binding corporate rules approved by a competent supervisory authority.

If you would like to know which service providers we use outside the EU/EEA and access documentation of the safeguards in place, please contact us.

9. SECURITY

We take information security seriously, and we will always do our utmost to protect your personal data in the best possible way. We use, among other measures, strong passwords, data encryption, access controls, backups, and, where possible, two-factor authentication to secure our data and prevent unauthorized individuals from viewing, modifying, deleting, or otherwise affecting the data we store, including your personal data.

We use only reputable providers of IT and administrative services, such as web hosting, website and computer security, antivirus protection, email providers, backup services, and more. We only allow others to access and/or process your personal data in accordance with our instructions, and only when absolutely necessary (e.g., for IT support).

We have established procedures for handling data security breaches, and in the event of a breach, we will submit a breach notification to the Norwegian Data Protection Authority within 72 hours of the breach being detected. If the breach poses a high privacy risk, we will also notify the affected data subjects.

NOTE: It is not permitted to copy any content from this privacy policy; see the Copyright Act.