This privacy policy details how we process and protect your personal data. It covers processing when using our services, apps, websites, and digital channels where reference is made to this policy.
The policy does not cover processing undertaken by us in the role of a data processor. Personal data is information that can identify you directly or indirectly.
We take steps to ensure that the personal data we store is protected and that our processing is in accordance with applicable legislation, regulations, and our internal guidelines.
1. Who is covered?
This privacy policy covers:
- Users of our services and apps where reference is made to this policy, as well as our websites and digital channels.
- Contact persons for a customer, supplier, or partner of Awaio.
- External parties who have contact with or otherwise communicate with Awaio.
Awaio AB is responsible for the processing of personal data described in this policy.
2. Where do we collect personal data from?
We collect personal data from the following sources:
- You: When you create a user account, use our apps and services, contact us, visit our websites, sign up for an event, or take part in a survey.
- Social platforms: If you visit our channels on social networking platforms (e.g. Facebook or LinkedIn), we collect the data you provide via those channels.
- Partners: When we charge for services or carry out an event or activity together with a partner, we may receive data from them.
- Public sources: Publicly available sources such as websites, various registers, and databases.
- External parties: Third parties that provide us with your personal data, such as in connection with communication.
3. Why do we process your personal data?
Below is a list of the purposes for which we process personal data. Not all processing may apply to you, this depends on your relationship with us.
- Providing our apps and services: To give you access to the app or service and manage your user account.
- Communicating about our apps and services: To inform you about updates, provide operational information, and answer your questions.
- Processing orders of services: To register orders and communicate with you about them.
- Managing payments: To register payments and communicate with you regarding them.
- Managing the customer or supplier relationship: To register contact persons, manage agreements, and administer invoices.
- Following up and evaluating the relationship: To follow up and evaluate customer or supplier relationships and cooperations.
- Communication between employees and external parties: We process personal data when applicable in connection with such communication.
- Communicating offers via various channels: To send you tailored offers via e-mail or social media. You may unsubscribe at any time.
- Managing our newsletters: To send and manage newsletters. Unsubscribe at any time via the link in the newsletter.
- Carrying out events and other activities: To register your participation and communicate with you about the event or activity.
- Answering questions: To process the data you provide when contacting us so we can answer your question.
- Conducting surveys: To collect your views on our business, products, and services.
- Enabling functionality on our websites: To remember your settings and provide a better experience on our websites.
- Following up on app and website usage: To collect and analyse visitor and user statistics across our apps, services, and websites.
- Recording phone calls: For training and quality purposes. You will be informed and can opt out.
- Ensuring technical functionality and security: For security logging, error handling, and backups.
- Managing and defending legal claims: When necessary in connection with a dispute or lawsuit.
- Fulfilling legal obligations: To fulfil accounting or data protection obligations and other legal requirements.
4. Which recipients do we share personal data with?
When necessary, we share your personal data with the following categories of recipients:
- Partners: Payment and event partners when processing invoices or organising activities together.
- Social networking platforms: Platforms we use to communicate our services and run advertising.
- External parties: Parties you or Awaio communicate with, such as by e-mail.
- Service providers: IT, storage, and communication providers engaged by Awaio. They act as data processors on our behalf and are contractually obliged to protect your data.
- Other recipients: External advisors, public authorities, courts, or the police when required to manage legal claims, fulfil legal obligations, or respond to a lawful request.
5. What rights do you have?
You have certain rights under data protection legislation in relation to the personal data we hold about you:
- Request access: Request a copy of the personal data we hold about you.
- Request rectification: Request correction of personal data that is incorrect or incomplete.
- Withdraw consent: Withdraw consent to processing based on consent at any time.
- Request erasure: Request deletion in some circumstances, subject to legal retention obligations.
- Unsubscribe: Opt out of marketing and mailings via the unsubscribe link in any mailing.
- Request restriction: Ask us to restrict processing in certain circumstances.
- Object to processing: Object to processing based on legitimate interests for reasons specific to your situation.
- Data portability: Request a copy of your data in a structured format to transfer to another service.
To exercise any of these rights, contact us using the details in the Questions section below.
6. Where & how we protect your data
We always endeavour to store personal data within the EU. In some cases your data is shared with recipients outside the EU/EEA, for example service providers engaged by us. We ensure appropriate security measures and data transfer agreements are in place in all such cases.
We take appropriate technical and organisational measures to protect your personal data against unauthorised access and unnecessary storage. We have implemented various policies for this purpose.
Your password protects your Awaio account. We recommend using a strong, unique password, never sharing it, restricting access to your devices, and logging out after each session.
7. Updates to this policy
We may update this privacy policy from time to time. We will notify you in advance by appropriate means, such as a message on our website or by e-mail, before any material changes take effect. The latest version is always available on this page.
8. Questions?
Should you have questions about this policy or wish to invoke any of your rights, please contact us. If you are not satisfied with our answers, you have the right to lodge a complaint with the Swedish Data Protection Authority.
Awaio AB
Corp. ID: 559257-9832
Östra Storgatan 9
553 20 Jönköping, Sweden
contact@awaio.com
9. Processing of personal data
Detailed information on the categories of personal data we process, the legal basis, and how long we store the data for each purpose.
Providing our apps and services
Personal data: Identity information, Communication, Contact information, Organisational information, Profile data, Technical data.
Legal basis: Fulfilment of agreements, processing is necessary to fulfil the applicable terms for the app or service.
Retention period: Retained for as long as your user account is active. If a user account is inactivated, disabled, archived, or deletion is requested, data is retained for 3 months from the archive or deletion request date.
Communicating about our apps and services
Personal data: Identity information, Contact information, Profile data, Technical data.
Legal basis: Fulfilment of agreements, processing is necessary to fulfil the applicable terms for the app or service.
Retention period: Retained for as long as your user account is active, after which it is deleted.
Processing orders of services
Personal data: Identity information, Communication, Contact information, Order information, Organisational information.
Legal basis: Legitimate interest in managing orders of goods and services. Fulfilment of agreements if the order is placed by an individual firm.
Retention period: Retained for as long as necessary to process the order and for 10 years thereafter. Accounting data retained for 7 years (Swedish Accounting Act 1999:1078).
Managing the customer or supplier relationship
Personal data: Identity information, Communication, Contact information, Payment and purchase information, Order information, Organisational information.
Legal basis: Legitimate interest in managing customer or supplier relationships. Fulfilment of agreements when concluded with an individual company.
Retention period: Retained for the duration of the relationship and for 10 years thereafter to manage and defend legal claims.
Communicating offers via various channels
Personal data: User-generated data, Audio and video material, Identity information, Contact information, Order information, Technical data.
Legal basis: Legitimate interest in communicating and distributing offers about our services.
Retention period: Retained throughout the customer relationship and for 12 months thereafter. Without a customer relationship, retained for 3 months from collection.
Managing our newsletters
Personal data: Identity information, Contact information.
Legal basis: Legitimate interest in managing our newsletters.
Retention period: Retained until further notice and until you unsubscribe.
Answering questions
Personal data: Identity information, Communication, Contact information, Order information, Organisational information.
Legal basis: Legitimate interest in responding to your question.
Retention period: Retained throughout the customer relationship and for 10 years thereafter. Without a customer relationship, retained for one month from the most recent communication.
Enabling functionality on our websites
Personal data: Technical data.
Legal basis: Legitimate interest in enabling website functionality for a better user experience.
Retention period: Retained throughout your visit and for 12 months thereafter.
Following up on usage of apps, services, websites and digital channels
Personal data: User-generated data, Technical data.
Legal basis: Legitimate interest in following up and evaluating use of our websites, digital channels, apps, and services.
Retention period: Retained for 3 months. Anonymised statistics are retained indefinitely or until deleted.
Ensuring technical functionality and security
Personal data: All relevant categories of personal data.
Legal basis: Legitimate interest in ensuring necessary technical functionality and security.
Retention period: Retained for as long as your user account is active. Log data retained for 12 months from the log entry time.
Managing and defending legal claims
Personal data: All categories necessary for the specific legal claim.
Legal basis: Legitimate interest in managing and defending legal claims.
Retention period: Retained for the period required to manage and defend the legal claim.
Fulfilling legal obligations
Personal data: All categories necessary for fulfilling the specific obligation.
Legal basis: Legal obligation.
Retention period: Retained for the period required to fulfil each legal obligation. Accounting data retained for 7 years (Swedish Accounting Act 1999:1078).
10. Categories of personal data
| Category | Examples |
|---|---|
| User-generated data | Clicks, visits, and behaviour on our websites, apps, and services. |
| Audio and video materials | Photography, film, audio recordings. |
| Health data | Allergies or other intolerances. |
| Identity information | Name, personal identity number, username, IP address. |
| Communication | E-mail content. |
| Contact information | Address, phone number, e-mail address. |
| Payment and purchase information | Card data, purchase information, transaction history. |
| Order information | Service, delivery time, price. |
| Organisational information | Title, company or organisation name, address. |
| Profile data | Profile settings. |
| Technical data | App version, device info, OS, browser, screen size, internet connection. |
11. Appendix A: Google User Data
To comply with the Google API Services User Data Policy and Google APIs Terms of Service, this section details how our applications use, store, and share Google user data.
Consent
When you connect your Google account, we request explicit consent before accessing any Google user data. You may revoke access at any time via myaccount.google.com/permissions.
Authentication data Required
Email, Name, Surname, Given name, Display name, used to uniquely identify you when authenticating and shared within your organisation's Awaio platform for context.
Extended user profile Optional
Organization, Department, Job Title, Phone numbers, Mobile phone, Photos, opt-in only. Stored and shared within the Awaio platform for context about users.
Calendar data Optional
Subject, Start/end time, Organizer, Participants, iCalUid, Recurrency data, opt-in only. Calendar data is not stored in the Awaio platform; it is used only in device memory to help you book resources. When a Google calendar event is used to create a booking, relevant fields are stored in the platform.
Data storage, sharing, and retention
All data in the Awaio platform is securely stored and encrypted in transit. No Google user data is shared with third parties. For retention periods, see "Providing our apps and services" in the detailed processing section above.