Utkast — ska granskas av jurist före publicering · Draft — pending legal review

This privacy policy explains how Hisland Sweden AB processes personal data in connection with the website hisland.com. We respect your privacy and process your data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Swedish law.

This policy covers this marketing website only. The processing of personal data within our products and services (for example Dynalope, Hisland Time and Hisland Reserve) is governed by separate terms and data processing agreements for each service.

Data controller

The controller responsible for the processing is:

  • Hisland Sweden AB (reg. no. 559494-3960)
  • Trappgränd 17, 442 31 Kungälv, Sweden
  • Email: info@hisland.com

If you have questions about how we process your personal data, or wish to exercise any of your rights, you are welcome to contact us at the address above.

What personal data we collect

We process the following categories of personal data through the website:

  • Information you submit in contact forms. When you contact us through a form on the website, we process the data you enter yourself — typically your name, email address and the content of your message. Form submissions are delivered to us via the Web3Forms service.
  • Technical data and server logs. When you visit the website, our hosting provider (Vercel) automatically records technical data such as IP address, browser type, referring page and the date and time of your visit. This data is used for operation, security and troubleshooting.
  • Embedded content. Some pages may contain videos embedded from YouTube. When you play such a video, Google/YouTube may process data about you in the same way as if you had visited YouTube directly (see the section on cookies).

The website is essentially "cookieless" — we do not set any marketing or tracking cookies. Read more in our cookie policy.

Purposes and legal basis

We process your personal data for the following purposes and on the following legal bases:

  • Responding to your enquiry. When you contact us we process your data in order to respond and assist you. The legal basis is our legitimate interest (Article 6(1)(f) GDPR) in responding to enquiries and, where the contact aims to enter into an agreement, to take steps at your request (Article 6(1)(b) GDPR).
  • Operation, security and troubleshooting. Server logs are processed on the basis of our legitimate interest (Article 6(1)(f) GDPR) in providing a secure and functioning website and protecting it against misuse.
  • Embedded content. Playing embedded videos is based on your consent (Article 6(1)(a) GDPR), which you give by actively starting the video.

Retention

We keep your personal data only for as long as necessary for the purposes for which it was collected:

  • Contact enquiries are kept for as long as needed to handle your enquiry and a reasonable period afterwards for follow-up — as a rule no more than 24 months — unless we need to keep them longer to fulfil an agreement or a legal obligation (such as accounting requirements).
  • Server logs are kept for a short period for operation and security and are then deleted or anonymised in accordance with our provider's routines.

Recipients and processors

We never sell your personal data. To operate the website we use a small number of providers that process data on our behalf as processors:

  • Vercel Inc. — hosting and delivery of the website (server logs).
  • Web3Forms — delivery of contact-form content to us.
  • Google/YouTube — embedded videos. Google acts as an independent controller for the processing that takes place when you play a video.

Data may also be disclosed to public authorities where we are legally required to do so.

International transfers

Some of our providers are established outside the EU/EEA, or may process data in countries outside the EU/EEA. When personal data is transferred to a third country, we ensure that the transfer is protected by appropriate safeguards under Chapter V of the GDPR — for example the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the EU–US Data Privacy Framework. You may contact us for more information about the safeguards applied.

Your rights

Under the GDPR you have, among others, the right to:

  • Access — obtain information about and a copy of the personal data we process about you.
  • Rectification — have inaccurate data corrected and incomplete data completed.
  • Erasure — have your data deleted (the "right to be forgotten") where the conditions are met.
  • Restriction — request that the processing of your data be restricted.
  • Data portability — receive the data you have provided in a structured, commonly used and machine-readable format.
  • Objection — object to processing based on legitimate interest.
  • Withdraw consent — where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out beforehand.

To exercise your rights, contact us at info@hisland.com. We will respond to your request without undue delay and within one month at the latest.

Right to lodge a complaint

If you believe that we process your personal data in breach of applicable law, you have the right to lodge a complaint with the supervisory authority, the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY):

  • Integritetsskyddsmyndigheten, Box 8114, 104 20 Stockholm, Sweden
  • Email: imy@imy.se · Web: www.imy.se

Cookies

Information about cookies and similar technologies used by the website can be found in our cookie policy.

Changes to this policy

We may update this privacy policy from time to time. The most recently updated version is always published on this page with the date shown. We will inform you of material changes in an appropriate manner.

Contact

If you have questions about this policy or our processing of personal data, contact us at info@hisland.com.