Skip to content

Personal Data Processing

The Data Controller is the Board of the Foundation Hallands Länsmuseer Halmstad and Varberg.
The purpose of this policy is to inform and ensure that the Foundation Hallands Länsmuseer Halmstad and Varberg (hereinafter referred to as “the Foundation”) handles personal data in accordance with the EU General Data Protection Regulation (GDPR). This policy covers processing activities involving personal data, including both structured and unstructured information.

What is personal data?

Personal data refers to any information that can be linked to an individual, either on its own or in combination with other personal data.

Examples of personal data include:

  • Name
  • Address
  • Personal identity number
  • Phone number
  • Email address
  • Voice and image
  • IP addresses

The Foundation’s board is responsible for the processing of personal data and must ensure that such processing is carried out in accordance with applicable legislation.

The Foundation collects and processes personal data as required by internal and external operations, always with a defined and specific purpose that is supported by a lawful basis (see below).

The Foundation will not transfer, distribute, or forward personal data to any third party unless allowed by applicable lawful grounds.

Lawful Grounds for Each Type of Processing

  • Contract: Processing is necessary to fulfill a contract with the data subject (e.g., employment contracts, delivery agreements, insurance contracts).
  • Legal Obligation: Based on national legislation (e.g., the Accounting Act, the Patient Data Act, the Administrative Procedure Act).
  • Legitimate Interest / Fundamental Interest: Based on a balance of interests. Legitimate interest means weighing the benefit of processing against the risk to the individual’s privacy.
  • Public Interest: Requires national legislation (e.g., the Archives Act).
  • Official Authority: Requires national legislation.
  • Balancing of Interests: See “Legitimate Interest / Fundamental Interest.”
  • Consent: Only used when necessary and should be avoided if possible. Consent can be oral or written; written consent is required for minors.

Principles Applied to All Personal Data Processing

  • Lawfulness
  • Purpose Limitation
  • Data Minimization
  • Accuracy
  • Storage Limitation
  • Integrity and Confidentiality

Rights of the Data Subject

The data subject has the right to request in writing:

  • Access to personal data: The right to request a record of the personal data processed by the Foundation.
  • Rectification: The right to have incorrect or incomplete personal data corrected.
  • Erasure (“right to be forgotten”): Personal data may be deleted if no longer necessary for the original purpose. Legal obligations (e.g., accounting or tax laws) or contract fulfillment may prevent immediate deletion.
  • Restriction of processing: Personal data may be restricted to specific purposes, particularly if the data subject contests the accuracy of the data. Processing is limited while the accuracy is being verified.
  • Data portability: Under certain conditions, the data subject has the right to receive their data in a structured, commonly used, and machine-readable format and transmit it to another data controller.

To request rectification, erasure, restriction, or data portability, please contact:
Email: info@hallandslansmuseer.se

Complaints

The data subject has the right to lodge complaints regarding the Foundation’s processing of personal data with the Swedish Authority for Privacy Protection (IMY).
Website: www.imy.se