PRIVACY POLICY

1. GENERAL INFORMATION

1.1 This Privacy Policy governs and explains how your personal data may be collected and used through your use of this website. This includes any personal data you may provide when you email us or register with us on the site, or when you sign up to the Quit Like Sweden newsletter, submit a testimonial or donate to the Quit Like Sweden campaign.

1.2 This website is managed for and behalf of the Quit Like Sweden campaign by Castro Consulting Limited (“the Company”). The Company is the Controller of “personal data” for the purposes of this website’s Privacy Policy. If you have any questions regarding this Privacy Policy, or the collection and processing of your personal data while using this website, please direct them to info@quitlikesweden.org.

2. WHAT PERSONAL DATA MIGHT WE COLLECT

2.1 Personal data means any information about an individual from which that person can be identified. As a visitor, you do not have to submit any personal data in order to use this website. You may however choose to give us your personal data such as your name and contact details by filling in online forms, signing up for our newsletter or by corresponding with us by email or otherwise.

2.2 We do not intend to collect any personal data from anyone who is under the age of 18 or who is subject to other legal restrictions in their country of residence that prohibits them from viewing or submitting personal information to this site.

3. HOW WE USE YOUR PERSONAL DATA

3.1 We will only collect and process information about you in connection with issues relating to the Quit Like Sweden campaign. Under the UK General Data Protection Regulation (UK GDPR) the legal basis upon which we will process your personal data are as follows:

• • With your consent: we will always ask for your consent to process your personal information for specific purposes, which you may withdraw at any time.

  • Our legitimate interests: we may also process your information based on our legitimate interests as the Quit Like Sweden campaign for example when communicating with you, with your prior consent, in relation to our campaign and related vaping issues.

  • Compliance with legal obligations: we may also process your data in compliance with a legal or regulatory obligation that applies to us.

3.2 You can withdraw your consent and opt out of receiving newsletters or information from us about the Quit Like Sweden campaign or ask us to delete and stop using your personal information at any time by contacting info@quitlikesweden.org.

4. THIRD PARTY WEBSITES AND SOCIAL MEDIA

4.1 The website contains links to other websites. We are not responsible for the privacy provisions or practices of third-party websites.

5. RECIPIENTS OF PERSONAL DATA

5.1 We may disclose your personal data to other organisations in connection with the above purposes, including:

• • To third parties who we engage to provide services to us in connection with this website, such as outsourced service providers, IT services providers and professional advisers;

  • To competent regulatory authorities and bodies as requested or required by law; and

  • To digital marketing and analytics service providers.

6. INTERNATIONAL DATA TRANSFERS

6.1 It is possible that the information you provide to us may be transferred to countries outside the European Economic Area (EEA). By way of example, this may happen where any of our servers or those of our third-party service providers are from time to time located in a country outside of the EEA. These countries may not have similar data protection laws to the UK. Where possible, we will seek to work with service providers whose servers are located within the EEA.

6.2 If we transfer your information outside of the EEA, we will take steps to ensure that appropriate security measures are taken with the aim of ensuring that your privacy rights continue to be protected as outlined in this policy. These steps include imposing contractual obligations on the recipient of your personal information or ensuring that the recipients are subscribed to ‘international frameworks’ that aim to ensure adequate protection.

7. DATA RETENTION

7.1 We will retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

8. YOUR RIGHTS

8.1 Under certain circumstances, you have rights under data protection laws in relation to your personal data. These include the right to:

• • Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

  • Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

  • Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law.

  • Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes.

  • Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

  • Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

  • Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

9. CHANGES TO OUR PRIVACY POLICY

9.1 We may update this Privacy Policy from time to time in response to changing legal, technical, or business developments. When we update our Privacy Policy, we will take appropriate measures to inform you, consistent with the significance of the changes we make.

9.2 You can see when this Privacy Policy was last updated by checking the “last updated” date displayed at the top of this Privacy Policy.

10. HOW TO CONTACT US

10.1 If you have any questions or concerns about our use of your personal information, please contact us at info@quitlikesweden.org.