Why and how do we process your personal data?
We at MATCHi AB care about your privacy and want you to feel safe when we process your personal data. In order for you to use, and for us to provide, our online booking system and the service MATCHi, we will need to process your personal data for different purposes.
We will process your personal data for the following purposes:
We do not sell your personal data, but we might need to share it with, for example our connected partners and venues, our IT-suppliers and the suppliers of the analytic services we use (mainly Google and Amplitude). In certain situations, your personal data will be processed outside the EU but only when we can ensure an appropriate level of protection for your personal data.
When we process your personal data, you have certain rights. This means that you, for example, have the right to information and access to your personal data, a right to request that we delete your personal data, a right to withdraw your consent or object to our processing and a right to lodge a complaint with a supervisory authority. You can read more about your rights here.
Who is responsible for the processing of your personal data?
MATCHi AB (Swedish registration number 556871-6129), is responsible for the processing of your personal data. We also process personal data as processors on behalf of our connected partners and venues in order to facilitate your bookings and purchases, you can read more about this here.
If you want to know more about our processing of your personal data or if you want to exercise any of your rights, please contact us and we will help you. Our email address is dataprotection@matchi.se and our postal address is Gullbergs Strandgata, 411 04 Gothenburg.
You can access our full privacy policy here.
We at MATCHi AB (“we”, “our” and “us”) care about privacy and want you to feel you are in safe-hands when we process your personal data and we work hard to protect your integrity.
This privacy policy applies to you who use our online booking system and service (the “MATCHi”) on our website www.matchi.se or in our MATCHi app.
Here we explain why we process your personal data, what your rights are, the legal basis on which we handle your data and for how long we store it.
MATCHi AB (Swedish registration number 556871-6129), is responsible for the processing of your personal data.
Please note that we also process data on behalf of our partners and venues. Should you have any questions regarding this or if you wish to exercise any of your rights under data protection legislation, please contact us via our e-mail address dataprotection@matchi.se or write us a traditional letter to our postal address Gullbergs Strandgata, 411 04 Gothenburg, Sweden.
We collect your personal data directly from you when you register a MATCHi account or when you use MATCHi, for example when you make a booking on our website or in our app (or a venues website if its bookings are powered by MATCHi) or if you choose to up-date or add to your account information. Much information is voluntary to provide, the more information you choose to contribute, the better functionality you will receive when using MATCHi.
We will also collect your personal data from other sources in the following situations:
In general, you are not required to provide personal data to us, but certain information needs to be provided in order to use MATCHi. In which situations you need to provide personal data to us is described in the below charts where the legal basis is stated as “Performance of a contract” or “Legal obligation”. If you do not provide such personal data to us, we will not, for example, be able to make MATCHi available for you.
Your personal data is primarily processed by MATCHi. This means that your personal data will be handled by our employees and representatives, but only to the extent it is needed for them to conduct their work.
Certain information about you may be visible to others. Whether information is public or not is clearly noted within the system and you can control this via your accounts privacy settings or by the choices you make when using MATCHi, opting for the visibility you prefer. The more information you share the more you will be able to access yourself.
Sometimes our partners or venues use MATCHi as administrators. They can then process your personal data if you are affiliated with them through your membership or because you are their customer. They might also show information about activities or events on screens displayed at the venue and such displays can include information entered into MATCHi.
In certain cases, we need to share your personal data with our suppliers, partners and subsidiaries in order to conduct our business efficiently. We are responsible for any sharing of your personal data to such suppliers, partners or subsidiaries and to make sure your personal data is safe when shared with third parties.
We will share your personal data with the following recipients:
We, as well as our processors, process your personal data within the EU/EEA. In some instances, we will transfer your personal data outside of the EU/EEA to our IT-suppliers that process personal data as our data processors and according to our instructions. Such transfer only takes place in accordance with applicable data protection legislation, meaning that we will transfer your personal data outside the EU/EEA when we can ensure an appropriate level of protection of your personal data.
The below charts describe in detail why we process your personal data, which categories of personal data we process, our legal basis for the processing and for how long we process your personal data. The legal basis is the basis for our processing of your personal data according to the GDPR. You will also find information about for how long we process your personal data.
This is partly such information we have a legal obligation to provide and might feel a bit long and complicated – do not hesitate to contact us if you have any questions regarding our processing of your personal data. Our contact details can be found in the beginning of this privacy policy.
| Purpose with our processing | What personal data we process | Our legal basis for the processing |
|
|
Performance of a contract
The processing is necessary in order for us to enter into and fulfil the contract we have with you concerning your use of MATCHi. If the data is not provided to us, we will not be able to administrate your registration and your account. |
|
|
Legitimate interest
The personal data will be processed based on our legitimate interest to verify that you are not a robot. |
| Storage period: We will process your
personal data for this purpose until you choose to delete your MATCHi account.
The personal data we process to verify that you are not a robot when you register an account will only be processed until your account is registered. |
||
| Purpose with our processing | What personal data we process | Our legal basis for the processing |
|
|
Performance of a contract
The processing is necessary in order for us to fulfil the contract we have with you concerning your registration at MATCHi. If the data is not provided to us, we will not be able to administrate your MATCHi account. Legitimate interest The personal data that you choose to register on your profile will be processed based on our legitimate interest to enable a personalised profile at MATCHi. |
|
|
Consent
We will only process your personal data for this purpose if you have consented to our personal data processing. You can withdraw your consent at any time by disabling this function in your settings. |
|
|
Legitimate interest
The personal data that you choose to register on your profile will be processed based on our legitimate interest to help you find partners and venues near you. |
|
|
Legitimate interest
The personal data that you choose to register on your profile will be processed based on our legitimate interest to create a more social MATCHi. |
|
|
Consent
The matchmaking function is optional and we will only process your personal data for this purpose if you choose to activate this function and thereby have consented to our personal data processing. We will only process the information you choose to register. You can withdraw your consent at any time. The best way to do this is to de-activate this function and to remove the information you no longer wish to have processed. You have the right to object to the processing described above and you may read more about this under the section explaining your rights. |
| Storage period: We will process your personal data for this purpose until you choose to unregister/delete your account. You may also choose to withdraw your consent by deactivating the match-making function and delete the information you have chosen to enter for match-making purposes or contact us if you want any help in this matter. | ||
| Purpose with our processing | What personal data we process | Our legal basis for the processing |
|
|
Legitimate interest
The personal data will be processed based on our legitimate interest to compile statistics. |
| Storage period: We will process your personal data related to statistics until you choose to delete your MATCHi account. | ||
| Purpose with our processing | What personal data we process | Our legal basis for the processing |
|
|
Legitimate interest
The personal data will be processed based on our legitimate interest to provide customer service. Performance of a contract The processing might also be necessary in order for us to fulfil the contract we have with you concerning your use of MATCHi. If the data is not provided to us, we will not be able to help you. |
| Storage period: We will process your personal data related to customer service and support matters until you choose to unregister/delete your MATCHi account. | ||
| Purpose with our processing | What personal data we process | Our legal basis for the processing |
|
|
Legitimate interest
The personal data will be processed based on our legitimate interest to provide and improve our customer service. You can prevent Google Analytics from using your personal data by downloading and installing this browser add on. From time to time, different cookies may be used. If these cookies are not essential to the service, we process the data based on your consent, when this is the case you can withdraw your consent at any time. |
| Storage period: We will store your personal
data until you delete your account at the latest, but some date may be deleted
earlier.
Google will continue to store your personal data for their own purposes and Google will inform you separately about such storing. |
||
| Purpose with our processing | What personal data we process | Our legal basis for the processing |
|
|
Legitimate interest
The personal data will be processed based on our legitimate interest to send marketing, wider information and obtain survey results to improve our service and decision making. |
| Storage period: We will process your personal data for this purpose as long as you have a MATCHi account. You can always choose to unsubscribe or object to receiving newsletters, surveys and marketing at any time. If you object to receiving marketing from us, we keep track of this in our “unsubscribe-list” to avoid sending you any further such material. You can also at any time make an active choice in your account settings letting us know if you wish to receive newsletters and or if you wish to partake in surveys. | ||
| Sharing: To handle our surveys we work with Survey Monkey. We also use a third party to send information. | ||
We always strive to keep a good relationship with you and answer all questions you may have. If you have any questions, would want to make a complaint regarding MATCHi or if we would have a claim against you as a user, we will process your personal data as described below. We will collect your personal data from you or provide the information ourselves.
Note that an ongoing matter may mean that we cannot delete all your personal data after your request.
| Purpose with our processing | What personal data we process | Our legal basis for the processing |
|
|
Legal obligation
The processing is necessary to comply with legal obligations to which we are subject, i.e. consumer law. In these cases, you need to provide your personal data to us since we otherwise will not be able to comply with your consumer rights. Performance of a contract The processing might also be necessary in order for us to fulfil the contract we have with you concerning your use of MATCHi. If the data is not provided to us, we will not be able to assess and fulfil contractual obligations. Legitimate interest We also have a legitimate interest to process your personal data to defend ourselves against a possible complaint or claim. |
| Storage period: We will store your personal data from the time the complaint or claim was initiated and for the duration of such complaint or claim and if you have a MATCHi-account, we store the information for as long as you have an account. | ||
We will store information about you who have chosen to object to receiving marketing from us – see the below chart for information about this. We have received the personal data from you.
| Purpose with our processing | What personal data we process | Our legal basis for the processing |
|
|
Legal obligation
The processing is necessary to comply with legal obligations which we are subject to, i.e. marketing law which require us to not send marketing material to individuals who have objected to receiving such marketing. We cannot make sure you will not receive marketing from us without processing your personal data for this purpose and you are therefore required to provide your personal data to us. |
| Storage period: You will be listed in our “unsubscribe-list” until further notice. | ||
| Purpose with our processing | What personal data we process | Our legal basis for the processing |
|
|
Legal obligation
The processing is necessary to comply with legal obligations to which we are subject, i.e. bookkeeping and accounting legislation or other transaction related legislation to counter money laundering, terrorism or comply with sanctions. |
| Storage period: We will store any document constituting bookkeeping material and personal data included therein for seven to eight years according to bookkeeping and accounting legislation. The regulation means that we store bookkeeping material until and including the seventh year after the end of the calendar year for the fiscal year to which the personal data relates. | ||
For certain processing of your personal data, we act as processor to our partners and venues where they include some of your personal data in MATCHi. In many cases, this personal data overlap with the data that we ourselves control and sometimes it might contain more information, often such as membership status. This means that if you are a MATCHi user and make a booking at a venue, we will forward your information to the venue as you are their customer or member and they are responsible for how they process your data independently of us.
If you have a request regarding the data we process on behalf of our partners or venues, we will always have to consult the controller before we take any action. If you want information about how the respective venue processes your data, we direct you towards the venue and you can always find contact details to the responsible partner or venue in MATCHi and in your booking information or receipt. If you are a member or customer of a particular venue, other venues which are not affiliated with your venue will not be able to access your personal data that is processed by us on behalf of a particular venue.
The data that may overlap is described in the schedule below listing our purposes and legal basis on which we process it. The below is provided to give an overview of the information involved and is not meant to be exhaustive. Each venue processes information for their own purposes, which might differ from ours and make their own decision on what ground the processing takes place.
| Purpose with our processing | What personal data we process | Our legal basis for the processing |
|
|
Performance of a contract
The processing is necessary in order for us to fulfil the contract we have with you concerning your use of MATCHi. If the data is not provided to us, we will not be able to administrate your bookings and purchases at venues. |
|
|
Legitimate interest
The personal data will be processed based on our legitimate interest to fulfil our contractual obligations in relation to our connected partners and venues and in order for them to perform their obligations in the contract they have with us an in the contract they have with you as we only act as a mediator when providing the booking service, selling vouchers or memberships. |
| Storage period: We will store your personal
data as long as necessary to administrate your booking and purchase We will
process your personal data after this for purposes stated in the charts above,
e.g. to administrate your account and provide you with its features or for
bookkeeping purposes etc.
In addition to the above, our connected partners and venues are themselves also responsible for your bookings, applications and purchases. They will store your information in accordance with their own privacy rules and to the extent the venue's information is stored by MATCHi, we process this personal data on behalf of the venue and in accordance with our data processing agreement with the venue. |
||
| Sharing: When you make a booking, application or purchase at a venue, we will forward your information to the venue as you are their customer and/or member and they are responsible for how they process your data independently of us. | ||
You have certain rights regarding your personal data and we outline them below.
If you want to know more or if you want to exercise any of your rights, please contact us and we will do our best as we are happy to help. Our contact information can be found at the beginning of this privacy policy.
You have the right to obtain confirmation as to whether we are processing personal data about you or not.
In detail: Information we provide include the following:
- the purpose of the processing;
- categories of processed personal data;
- recipients or categories of recipients to whom personal data can be shared, especially if located in third countries;
- expected retention times for storage or the criteria used to establish such time;
- information about your rights to have personal data corrected, deleted or limit the processing thereof or your right to object to such processing;
- your right to lodge a complaint with a supervisory authority;
- any application of automated decision making, including profiling in accordance with GDPR, articles 22.1 and 22.4; and
- if personal data is transferred to a third country or international organisation, you also have the right to information about what measures, in line with GDPR article 46, have been taken to ensure an appropriate level of data protection.
You also have the right to obtain a copy of the personal data processed by us. Should you request more copies we may choose to charge a reasonable fee to cover administrative costs. If the information is requested via e-mail, you will receive the information in a common electronic format.
You have a right to correct any inaccurate personal data concerning you that we may be processing and to ask us to have incomplete personal data completed.
In detail: With consideration of the purpose you have a right to complete any non-complete personal data. If possible and within reasonable efforts, we will inform each recipient with whom the personal data has been shared in case of any rectification. If you want more information about such recipients you are welcome to contact us. Our contact information can be found at the beginning of this policy.
Under certain circumstances, you have a right to request that we delete your personal data. In addition to our own processing of personal data, we also process data on behalf of venues as data processors. If you request that MATCHi delete your personal data, we will handle your request as related to our own processing but should you also want a venue to stop processing your personal data, you must contact the venue directly.
In detail: You have the right and we have the obligation to delete your personal data without undue delay if any of the following applies:
- personal data are no longer necessary for purposes which they were collected or processed,
- you object to the processing pursuant to Article 21.1 of the GDPR and there are no legitimate reasons for the processing outweighing your reasons, or you object to the processing in accordance with Article 21.2 of the GDPR,
- personal data has been non lawfully processed, or
- personal data must be deleted in order to fulfil a legal obligation under EU law or any applicable national law to which we are subject.
In the event that we have made public the personal data and are required to delete it as above, we will, taking into account available technology and the cost of implementation, take reasonable steps including technical measures, to notify the controllers of your request and that you wish they delete any links to, or copies or reproductions of specific personal data.
Please note that our obligation to delete and notify does not apply to the extent processing is necessary for the following reasons:
- to exercise the right to freedom of expression and information,
- to fulfill legal obligations under EU law or applicable national law to which we are subject, or
- to be able to establish, assert or defend legal claims.
We delete your personal data at your request, provided that we do not have an obligation to save the personal data in accordance with applicable laws and regulations.
We will notify each recipient to whom the personal data has been shared of any deletion that has taken place as described above, unless this proves to be impossible or entails a disproportionate effort. If you want information about these recipients, you are welcome to contact us. You will find our contact information at the beginning of this privacy policy.
Under certain circumstances, you also have a right to request that we restrict our processing of your personal data.
In detail: The right applies if:
- you dispute the accuracy of the information (but only for such time that allows us to verify),
- the processing is illegal and you oppose the deletion of personal data and instead request a restriction on the use of the data,
- you need the personal data to assert or defend legal claims even though we no longer need the data for our purposes, or
- you have objected to the processing in accordance with Article 21.1 of the GDPR and we have not done an assessment of whether our legitimate interest in the processing outweighs your legitimate reason for restricting the processing of your personal data.
If the processing referred to above is restricted, such personal data (with the exception of storage) may only be processed with your consent or to establish, assert or defend legal claims or to protect the rights of any other persons or for reasons of public interest. Furthermore, we will notify you before ceasing to restrict any processing.
We will notify each recipient to whom the personal data has been disclosed of any restriction on processing taken place as described above, unless impossible or if it entails a disproportionate effort. If you want information about these recipients, you are welcome to contact us. You will find our contact information at the beginning of this privacy policy.
Under certain circumstances, you have a right to receive your personal data from us in a structured, commonly used and machine-readable format and, where technically feasible, have your personal data transferred to another company (“data portability”).
In detail: The right to data portability applies to personal data that you have provided to us in a structured, widely used and machine-readable format, if the processing is based on the legal basis of performance of contract (GDPR, Article 6.1 b) and the processing is automated.
The exercise of the right to data portability does not affect the application of Article 17 of the GDPR, which shall not apply to processing that is necessary for the performance of a task of general interest or that is part of the exercise of authority performed by us.
Your right to data portability must not adversely affect the rights and freedoms of others.
You have a right to object to our processing of your personal data when the processing is based on the legal basis “legitimate interest” and we will always consider your objection. You always have a right to withdraw any consent you have given us, partly or completely. For example you can always withdraw consent to use your data for marketing and profiling purposes, such as sending newsletters, surveys or giving you customised suggestions. You can read more about this in the charts above.
In detail: If you object, we may no longer process your personal data as long as we can not demonstrate compelling legitimate reasons for the processing that outweigh your interests, rights, and freedoms or whether it is for the determination, exercise, or defence of legal claims.
You always have the right to lodge a complaint with a supervisory authority. You may do this in the EU/EEA member state where you live, work or where an infringement of applicable data protection laws is alleged to have occurred. The supervisory authority in Sweden is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten).
As we state above, for some purposes, we process your personal data based on our “legitimate interest”. By carrying out a balancing of interests assessment concerning our processing of your personal data, we have concluded that our legitimate interest for the processing outweighs other concerns. This assessment is done with caution and we strive to strike a fair balance.
If you want more information about any aspect of how we process your data or if you want to exercise any of your rights, you are very welcome to contact us. Our contact information can be found in the beginning of this privacy policy.
***
This Privacy Policy was adopted by MATCHi AB on the 21 of July 2022 and the latest revision was made on the 18 January 2023.