Privacy policy, version 1.1

Hodla AB is responsible for the search site, your account and the bookings and queue registrations you make with us. Hodla AB, which is changing its name to Playsa AB, corporate identity number 559427-7252, Malmö. Email: hej@playsa.se. Questions about personal data can also be sent to dataskydd@playsa.se, which goes to the same mailbox. Postal address: Vimpelgatan 1, 211 14 Malmö.

The organiser, that is the club, the municipal arts school or the company, is responsible for its own members and participants. If the organiser uses Playsa as its club management system, we handle the data on the organiser's behalf. Then the organiser's privacy policy applies, and it is the organiser you contact.

When you book a trial session or put your child in a queue, we send the booking to the organiser. After that, the organiser is responsible for how the booking is handled, for example who gets a place.

The organiser is also responsible for the photos it uploads to Playsa. See Clubs' photos in section 4.

About you as a parent

• Email address.
• Your name, but only when you register the child for a group. For an account and a trial session, the email address is enough.
• Mobile number, if you want SMS.
• Language and settings for messages.
• Logins and which devices are signed in.

About the child

• First name.
• Year of birth.
• Bookings of trial sessions and whether the child came.
• Places in queues, offers and your answers.

About your use

• IP address, browser and logs. Needed for the service to work and be secure.
• Push token, if you have the app and allow notifications.
• Alerts you have saved.
• Reviews you have written.

What we do not store

• The child's personal identity number or full date of birth.
• Your location. If you search near you, the location is only used in the search.
• Pictures. You cannot add pictures of yourself or your child with us.
• Health data.

Clubs can upload photos from their activities where children can be seen, if the guardians have said yes. Read more under Clubs' photos in section 4.

From phase 2 you can log in with BankID. We then get your name and personal identity number from BankID. The personal identity number is used so that we know for certain who you are.

You have the right to object to what we do on the basis of legitimate interest. See section 9.

We have built Playsa for children, so we are extra careful.

• We only ask for what we need: first name and year of birth.
• Children under 13 never log in themselves. You decide.
• We never show advertising, neither to you nor to the child.
• We do not create profiles of children and do not use children's data for marketing.
• We never sell data.
• Other parents do not see your child's name in queues or lists. The queue only shows numbers, for example "Place 4 of 12".
• The child's first name is visible to you, to the adults you have invited to the household and to the organiser you book with.
• Notifications on the lock screen can show the child's first name. You can choose a neutral text in the settings.
• When the child turns 18, we remove the child's profile from your account.

Clubs' photos

• Clubs, arts schools and companies can upload photos from their own activities, for example from a training session. The photos are shown with the organiser's activities on Playsa.
• If a child can be recognised in the photo, the organiser must have a yes from the child's guardian. If the child is older, the child must also get to say yes or no.
• The organiser is responsible for the photo and for the yes being in place. If you want to withdraw a yes, contact the organiser. The organiser then removes the photo.
• The photos are shown without names. We remove all information that comes with the file, for example where and when the photo was taken. We never keep the original file.
• We ask search engines not to show the photos when people search for images.
• Is your child in a photo that you do not want shown? Press "This is my child" next to the photo. You do not need an account. The photo stays until we have reviewed your report, by the next working day. If it is correct that a guardian has not said yes, we hide the photo. Otherwise it stays.
• Does your child have protected personal data? Also write to hej@playsa.se with a link to the page, and we review the report first.
• If you want to hear what happens to the photo, you can leave your email. You get a confirmation straight away and then our decision. The organiser never gets your address.
• If you report more than ten photos in one day, we do not store your email for the reports over the limit, and you get no reply about them. In that case, write to hej@playsa.se.
• If we hide the photo, the organiser is told that we did and why, but not who you are. Only we can show the photo again, and only if the organiser shows that the guardians have said yes.
• If you want the photo removed completely, write to the organiser or to hej@playsa.se with a link to the page. We reply within two working days.
• If you want to report something else in a photo, for example that it violates someone's rights, use the contact page on playsa.se.
• We keep the report for 12 months, so that we can see whether the button is misused. We do not store your IP address, only a code derived from it. The key the code is derived with changes every day and is deleted after two days. After that the code cannot be linked to you. The log of the emails we send you is deleted after 90 days.
• We do not hide a photo just because someone reports it. Then anyone could hide photos that are allowed to be shown. That is why we review every report, by the next working day.

This part is written for you.

• Playsa helps your parents find things you can do in your free time, like football, dance or swimming.
• We know your first name and the year you were born. We need that so the leader knows who you are and that you fit in the group.
• We do not know your personal identity number. We do not know where you live.
• We never sell anything about you. We show no advertising to you.
• Only your family and the club you are going to try out see your name.
• Your club can upload photos where you can be seen, if your parents have said yes. If you are a bit older, you also get to say yes or no. Your name is never shown with the photo.
• Do you not want to be seen in a photo? Press the button next to the photo, or ask an adult to write to us. We look at the photo by the next weekday. If your parents have not said yes, we hide it.
• Do you want to know what we have about you, or do you want us to remove something? Talk to your parents, or write to us yourself.

• The organiser you book with gets the child's first name and year of birth and your contact details, so that the booking works.
• Our suppliers help us run the service. They may only use the data to help us, and we have agreements with them.
• Public authorities get data only when the law requires it.

We never disclose data for marketing.

Some of our suppliers are American companies, and Supabase also has a company in Singapore. Data may therefore be accessed from or stored in the USA or Singapore. Email and SMS go through suppliers in the EU. We send as little as possible outside the EU, and never health data or personal identity numbers in email, SMS or notifications.

The transfers are protected in one of these ways:

• The supplier is certified under the EU-U.S. Data Privacy Framework, which the European Commission has approved.
• We have the European Commission's standard contractual clauses with the supplier.

Contact us if you want to know more about the protection for a particular supplier.

• Each organiser's data is kept separate from everyone else's. Automated tests check this with every change to the code.
• Sensitive data is encrypted with a separate key for each organiser.
• Administrators log in with two-factor authentication.
• We log who does what, so that we can see if something is wrong.
• An external security firm tests Playsa every year.
• If an incident affects you, you will be told.

You have the right to:

• find out what data we have about you and your child, and get a copy,
• correct errors,
• erase data,
• restrict how we use data, for example while we investigate whether something is wrong,
• move the data. You get it in a format that other systems can read.
• object to what we do on the basis of legitimate interest,
• withdraw consent, for example to newsletters,
• complain to IMY, the Swedish Authority for Privacy Protection. Address: Box 8114, 104 20 Stockholm, Sweden. Web: imy.se.

How to do it

• Write to hej@playsa.se from the email address you have in the account. Then we know it is you.
• We reply within one month. If the request is large, it may take up to two more months. We will then tell you within one month.
• It costs nothing.

The child's rights. The rights are also the child's. When the child is young, you use the rights on the child's behalf. The older the child gets, the more the child can decide. An older child can contact us directly.

If the question concerns data that a club or municipal arts school has about the child, contact them. We help the club to reply.

We only use cookies that are needed for the service to work: to keep you signed in when you have an account. No consent is needed for them. If you search without an account, we set no cookies. We measure visits with Vercel Web Analytics, which does not set cookies, does not store your IP address and does not follow you between websites. We use no cookies for advertising.

The queue is sorted automatically by when you put the child in the queue and by the organiser's priority rules. The rules are shown before you put the child in the queue. It is the organiser who decides who gets a place. You can ask the organiser to review a decision. We make no other automated decisions about you or your child.

If we change the policy in a way that affects you, we will tell you by email at least 30 days in advance.

Hodla AB, which is changing its name to Playsa AB, Vimpelgatan 1, 211 14 Malmö. Email: hej@playsa.se. We do not have a data protection officer.