GDPR Compliance

Our commitment to data protection

Stockholm Atelier is committed to complying with the General Data Protection Regulation (GDPR) and protecting the privacy rights of individuals in the European Union and European Economic Area.

Legal basis for processing

We process your personal data based on the following legal grounds:

• Consent: You have given clear consent for us to process your personal data for specific purposes
• Contract: Processing is necessary for fulfilling services you have requested
• Legal obligation: Processing is necessary to comply with the law
• Legitimate interests: Processing is necessary for our legitimate business interests, provided it does not override your rights

Your GDPR rights

Under GDPR, you have the following rights regarding your personal data:

Right to access

You have the right to request copies of your personal data. We may charge a reasonable fee if your request is clearly unfounded or excessive.

Right to rectification

You have the right to request correction of any information you believe is inaccurate or incomplete.

Right to erasure

You have the right to request deletion of your personal data under certain conditions, such as when the data is no longer necessary for the purposes for which it was collected.

Right to restrict processing

You have the right to request that we restrict processing of your personal data under certain conditions.

Right to object

You have the right to object to our processing of your personal data under certain conditions.

Right to data portability

You have the right to request transfer of your data to another organization or directly to you under certain conditions.

How to exercise your rights

To exercise any of your GDPR rights, please contact us at [email protected]. We will respond to your request within one month of receipt.

Data retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including:

• Client correspondence and project details: retained for the duration of the project and up to 3 years afterward for reference
• Measurement data: retained indefinitely with your consent to facilitate future projects
• Financial records: retained for 7 years to comply with tax regulations

Data security

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit and at rest
• Regular security assessments
• Limited access to personal data on a need-to-know basis
• Staff training on data protection

International data transfers

We primarily store and process data within the European Economic Area. If we transfer data outside the EEA, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the European Commission.

Data breach notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach.

Supervisory authority

You have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal data violates GDPR. In Sweden, the supervisory authority is:

Integritetsskyddsmyndigheten (IMY)
Box 8114
104 20 Stockholm
Sweden
Website: www.imy.se

Contact information

For any questions or concerns regarding GDPR compliance or your data protection rights, please contact:

Stockholm Atelier
Data Protection Officer
Östra Kyrkogatan 17
111 28 Stockholm
Sweden
[email protected]