Privacy Policy
Thank you for taking the time to read our privacy policy! We who provide the services are Lavendla AB with corporate identity number 556977-7674 (“Lavendla“). For us, personal privacy is of the utmost importance and we therefore always strive to ensure that the persons who order our services or otherwise come into contact with us feel safe with our handling of Personal Data (as defined below). To achieve such security, we always strive to maintain the highest possible standard of protection of Personal Data. Lavendla therefore processes, handles, uses and protects Data Subjects’ Personal Data in accordance with this privacy policy (“Privacy Policy“).
1. DEFINITIONS
1.1 The following definitions shall, in this Privacy Policy, have the meaning explained below
“General Terms and Conditions” – The general terms and conditions applicable from time to time governing the provision of services and products by Lavendla.
“Customer” – Any natural or legal person who orders Lavendla’s services or products on their own behalf or on behalf of another.
“Visitor” – Any natural person who visits the Website.
“Payment information” – information about invoices, payments made, outstanding amounts and any costs and fees.
“Booking information” – date and time of the call, type of call (individual or couple therapy), location of the call (at Lavendla/video call/phone call/home visit), length of the call.
“Datalagen” – Act (2018:18) with supplementary provisions to the EU Data Protection Regulation.
“Estate” – The estate of the deceased for whom the Client orders Lavendla’s services.
“GDPR” – EU General Data Protection Regulation (2016/679).
“Perform the Service” – Perform all of Lavendla’s obligations to the Client and the Estate. This therefore also includes additional services in addition to transportation and coffin laying, such as the provision of catering, flower arrangements, legal assistance and the like.
“Information in communication ” – Information in written communication between us e.g. by email or letter.
“Therapy session notes ” – typically include: the background to the treatment sought, personal details provided by you (and, where applicable, by relatives), health conditions, diagnoses, medical assessments, treatments, actions taken, and results of actions.
“Contact details ” – Name, address, telephone number, and email address.
“Customer” – The recipient of the Service. This may be the Client or a legal entity, such as the Estate it represents.
“Sensitive Data” – data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership and data concerning health, a person’s sex life or sexual orientation, genetic data and biometric data to uniquely identify a person.
“Personal data” – Any information relating to a living natural person, by which that person can be directly or indirectly identified. Such information includes, for example, name, address or e-mail address and other information by which a natural person can be identified. For clarification purposes, it is noted that the estate, which is a legal person, and the deceased are not subject to personal data legislation.
“Data Subjects” – Natural persons whose Personal Data are processed by Lavendla.
“Website” – Lavendla’s website with the domain www.lavendla.se, www.wiljabegravningsbyra.se or any other domain owned and operated by Lavendla, including subdomains thereof,
2. PROCESSING OF PERSONAL DATA TO FULFILL THE AGREEMENT
2.1 Lavendla processes Personal Data provided by the Customer or other persons for the primary purpose of performing the Service in accordance with the General Terms and Conditions. This means that the Personal Data is collected and processed, for example, but not exclusively, to plan and carry out the funeral and in contact with the parish or Lavendla’s partners who provide, for example, catering and flower arrangements.
2.2 The legal basis for the processing mentioned in this section 2 is to be able to fulfill the agreement between Lavendla on the one hand and the Estate and/or the Client on the other.
2.3 When someone other than the Client is the Customer, it is the Customer who is the data controller. Lavendla is then the personal data processor for the Customer. If the Customer is a natural person who places the order as part of an activity of a purely private nature or in connection with the Customer’s household, Lavendla is the controller for the processing of the Customer’s personal data as set out in section 2.1. Processing of other people’s personal data (for example, other owners of the estate or funeral guests) for the purposes referred to in section 2.1 falls outside the scope of the GDPR.
3. PROCESSING OF PERSONAL DATA IN CONNECTION WITH THERAPY SERVICES
When you contract with Lavendla for counseling, therapy and treatments (collectively “Therapy Services“), these services are performed by a therapist or a coach.
In cases where you have booked an appointment with a psychologist or psychotherapist via our Website, the service is instead provided by the healthcare provider (psychologist/psychotherapist) you have booked. Such services constitute healthcare. In this case, Lavendla processes personal data in accordance with what is stated in point 4 below about our matching service.
3.1 Appointment booking and customer administration
Purpose of the processing: To use the information you have filled in/selected when booking to match you with qualified and for you compatible therapists/coaches; Administration relating to you for the purpose of providing you with Therapy Services, this includes processing for appointment booking; ensuring your identity; sending order confirmation; sending information and reminder of upcoming visits; invoicing and handling of payment.
Personal data: Name; Contact details; Booking information; the subject/symptom of the therapy session (constitutes sensitive data); Communication information; Invoice details and Payment details. If you book via the Website and accept cookies, the IP address is collected and if you found the Website via Google’s ad clicks, a click identifier for the ad is also collected – this processing is described below under point 14 (Cookies).
The personal data is collected from you in connection with booking an appointment and entering into a contract.
Legal basis: entering into and performing a contract with you (Article 6(1)(b)). Sensitive data is only processed if we have your explicit consent (Article 9(2)(a)). You have the right to withdraw your consent at any time, whereupon the processing of personal data will cease.
Information and reminders about upcoming visits sent digitally never contain information about the purpose of your booked appointment or other Sensitive Data.
3.2 Implementing the Therapy Services
Purpose of the processing: Carrying out the Therapy Services including making assessments of your condition in order to provide advice and follow up on previous advice/actions.
Personal data: Name; email; notes from therapy sessions. The personal data is collected from you and created by us in the provision of Therapy Services.
Legal basis: Performance of the contract between you and us (Article 6(1)(b) GDPR). Therapy session notes contain Sensitive Personal Data only if you have given your consent to this (Article 9(2a)). Our therapists and coaches are instructed to take notes with discretion and only what is necessary to carry out the Therapy Services properly. You have the right to withdraw your consent at any time, after which the personal data processing will cease.
3.3 Holding digital calls/meetings
Purpose of processing: Conducting the Therapy Services digitally via video call (if you have booked a video call) including sending you a link to the video call.
Personal data: Name; email. The video calls are not stored and are never recorded. The personal data is collected from you in connection with booking an appointment and entering into a contract.
Legal basis: Fulfillment of the contract between you and us (Article 6(1)(b) of the GDPR).
3.4 Quality assurance, monitoring and evaluation of therapy services
Purpose of processing: To continuously develop and ensure the quality of the Therapy Services; Administration, planning, monitoring, evaluation and supervision of the Therapy Services; Ensuring that personal data is protected, including enabling access to the personal data to be controlled and keeping logs of actions.
Personal data: Name; Contact details; Booking information; the subject/symptom of the therapy session (constitutes sensitive data); and Payment details.
The personal data is collected from you and created by us in the provision of Therapy Services.
Legal basis: Lavendla’s legitimate interest (Article 6(1)(f) of the GDPR) a) to develop and improve our business; and b) to protect the business and customers from e.g. security incidents. You always have the right to object to the processing. Sensitive data will only be processed if we have your explicit consent (Article 9(2a)). You have the right to withdraw your consent at any time, after which the personal data processing will cease.
3.5 Marketing our services
Purpose of processing: To market our services to you by sending you information and offers, e.g. via email, about our activities.
Personal data: Name; Contact details.
The personal data is collected from you.
Legal basis: Lavendla’s legitimate interest (Article 6(1)(f) of the GDPR) to market our business. You always have the right to object to the processing.
3.6 Deletion of personal data
Personal data is stored in our business system and deleted when it is no longer necessary, which we have assessed to be five (5) years from when it was collected. However, personal data on invoices and in accounting documents is stored for seven (7) plus one (1) year according to the Accounting Act. For marketing purposes in accordance with point 3.5 above, the data will be used for one (1) year from the time you see
4. PROCESSING OF PERSONAL DATA WHEN USING THE MATCHING SERVICE
4.1 Providing you with a digital matching service
Purpose of the processing: To be able to provide you with the matching service and the functionalities of the service digitally; To use the data you have filled in/selections you have made in the service to match you with qualified and for you compatible psychologists/psychotherapists; To administer our contractual relationship when you use the matching service such as communicating with you and sending you necessary information about the contract and the bookings you have made through the matching service; and To administer your appointment including ensuring your identity and providing your psychologist/psychotherapist with the information you have provided at the time of booking (thereafter a contract is concluded between you and the psychologist/psychotherapist).
Personal data: Name; Contact details; Booking information; Subject/symptom of the therapy session (sensitive data); Information in communication. If you book via the Website and accept cookies, the IP address is collected and if you found the Website via Google’s ad clicks, a click identifier for the ad is also collected – this processing is described below under point 14 (Cookies).
The personal data is collected from you in connection with booking an appointment and entering into a contract.
Legal basis: Conclusion and performance of the contract between you and us (Art. 6(1)(b) GDPR). Sensitive data is only processed if we have obtained your explicit consent (Art. 9(2)(a) GDPR). You have the right to withdraw your consent at any time, whereupon the processing of personal data will cease.
We are also a data processor to healthcare providers (psychologists/psychotherapists). In addition to the processing described above, we assist the healthcare provider (psychologist/psychotherapist) with system and administrative services when they provide you with their healthcare services (the treatment you have booked). Lavendla is then a so-called personal data assistant to the care provider and only acts on the care provider’s instructions. This concerns, for example, sending out an order confirmation regarding the agreement between you and the healthcare provider; sending information and reminders about upcoming visits; and enabling payment of your visit via the Website.
4.2 Marketing our services
Purpose of processing: To market our services to you by sending you information and offers, e.g. via email, about our activities.
Personal data: Name; Contact details.
The personal data is collected from you.
Legal basis: Lavendla’s legitimate interest (Article 6(1)(f) of the GDPR) to market our business. You always have the right to object to the processing.
4.3 Quality assurance, monitoring and evaluation of the matching services
Purpose of processing: To continuously develop and ensure the quality of the matching services; To ensure that personal data is protected, including enabling access to personal data to be controlled and keeping logs of actions.
Personal data: Name; Contact details; Booking information; the subject/symptom of the therapy session (constitutes sensitive data); and Payment details.
The personal data is collected from you and created by us in the provision of the matching services.
Legal basis: Lavendla’s legitimate interest (Article 6(1)(f) of the GDPR) a) to develop and improve our business; and b) to protect the business and customers from e.g. security incidents. You always have the right to object to the processing. Sensitive data will only be processed if we have your explicit consent (Article 9(2a)). You have the right to withdraw your consent at any time, after which the personal data processing will cease.
4.4 Deletion of personal data
The personal data is stored in our business system and deleted when it is no longer necessary, which we have assessed to be one (1) year from the last time you used the matching services.
5. CUSTOMER EVALUATION (OPTIONAL)
Purpose of processing: To obtain customer satisfaction from our customers in order to improve our services and products; To publish customer reviews on the Website for marketing purposes.
Attention! Do not leave a review if you do not want the review to be published on the Website.
Personal data: Name and email are shared with our subcontractor Trutspilot, who will send you an invitation to leave a review. If you leave a customer review via Trustpilot, we will have access to your name, your customer review (free text) and your rating, this information is published on the Website.
Name and email have been collected from you when booking or during the contractual relationship.
Legal basis: Our legitimate interest (Article 6(1)(f) of the GDPR) to evaluate, improve and market our services. You always have the right to object to the processing.
Recipient: We share your name and email with Trustpilot, who will send you an email invitation to leave a review. We publish your review on the Website, which means that it will be visible to everyone who visits our Website.
6. PROCESSING OF PERSONAL DATA FOR MARKETING PURPOSES
6.1 In addition to the above purposes, Lavendla processes Personal Data in order to better customize our services and offer relevant additional services or products to the Customer, the Estate or other persons whose Personal Data is processed by Lavendla.
6.2 The legal basis for the processing mentioned in this section is to perform a task relating to Lavendla’s legitimate interest. The Data Subject may at any time object to Lavendla processing data for this purpose.
6.3 Lavendla is the controller for the processing of Personal Data mentioned in this section. Lavendla is thus responsible for the processing of the Personal Data that Lavendla collects in connection with the performance of the Service.
7. OTHER PROCESSING OF PERSONAL DATA
7.1 The Customer may provide Personal Data that is not necessary for the purposes stated above. In cases where Lavendla is considered to be the controller for the processing of this data, the Client is deemed to have consented, or guarantees that consent exists, to such processing as, given the nature of the task, can be expected. In any event, consent includes collection, storage and erasure.
8. DATA NOT PROVIDED BY THE DATA SUBJECT
8.1 By obtaining a death certificate, Lavendla will process personal data relating to the owner of the deceased (name, social security number and address). The client also provides information regarding funeral guests (name and contact details).
9. RIGHTS OF THE DATA SUBJECT
9.1 The Data Subject has the following rights regarding Personal Data processed by Lavendla.
9.2 The Data Subject has the right to request information about the Personal Data processed by Lavendla, by contacting Lavendla in writing via the contact details in section 13 below. Each Data Subject is therefore entitled to a copy of the Personal Data relating to him/her that is being processed free of charge. For any additional copies requested by the Data Subject, Lavendla may charge a reasonable fee to cover administrative costs.
9.3 The Data Subject has the right to request the rectification of inaccurate or outdated such data, if necessary, by a written request to Lavendla.
9.4 The Data Subject has the right to withdraw any consent given in relation to the processing of Personal Data previously provided by the Data Subject to Lavendla. However, such a withdrawal may mean that the Data Subject can no longer take part in the services provided by Lavendla. The Data Subject has the right to request erasure or restriction of processing and to object to processing under certain conditions.
9.5 The Data Subject has, under certain conditions, the right to data portability, which means a right to obtain Personal Data and transfer it to another controller as long as it does not adversely affect the rights and freedoms of others.
9.6 If you think we have made a mistake in processing your Personal Data, please contact us using the details set out in section 13 below. You also have the right to make a complaint to the Swedish Authority for Privacy Protection(www.imy.se), Box 8114, 104 20 Stockholm, or such authority that replaces the Swedish Authority for Privacy Protection.
10. DISCLOSURE
10.1 After an assignment has been completed, documentation may be retained for up to five (5) years. This is to ensure that the documentation is retained in the event of ambiguities or disagreements. Some documentation is also kept for accounting purposes for seven (7) plus one (1) year.
10.2 In cases where there is no contractual relationship, but the processing is only for marketing purposes, the personal data will be deleted as soon as the Data Subject has objected to that processing.
11 SECURITY
11.1 Lavendla puts the Data Subjects’ personal integrity first and therefore actively works to ensure that the Data Subjects’ Personal Data is processed with the utmost care. Lavendla takes such measures as may reasonably be required to ensure that the Data Subjects’ Personal Data is processed securely and in accordance with this Privacy Policy.
12. PERSONAL DATA TO THIRD PARTIES
12.1 Lavendla will not sell or share Personal Data to third parties, unless otherwise stated in this Privacy Policy or the General Terms and Conditions.
12.2 However, Lavendla may transfer Personal Data relating to Data Subjects to:
i.) IT Service Providers. We use subcontractors for IT support, maintenance and server hosting (data storage). We also purchase IT systems for internal and external communication (e.g. sending emails and SMS to you), video call service, and for document storage. These subcontractors are data processors to us and may only process personal data according to our instructions and for our purposes. We always strive to ensure that our subcontractors also store data within the EU, but we have subcontractors based in the United States, which means that in some cases your personal data is subject to so-called third-country transfers. We only use U.S. subcontractors that are signed up to the new EU-US Privacy Framework. For more information on safeguards for third country transfers, please contact us;
ii.) Information service provider. To ensure your identity and correct address details, we check the identity information you provide against the population register. We purchase this service from a provider of such information services. In order to do this, we need to share your social security number with the provider;
iii.) Lavendla’s subcontractors and partners, who in some respects act as our data processors in accordance with our instructions, for the provision of our services
iv.) authorities or legal advisors in case of suspected violations of law, this Privacy Policy or the General Terms and Conditions; and
v.) authorities, legal advisors or other actors if required by Lavendla by law or government order.
12.3 Lavendla will only disclose the Data Subjects’ personal data to such third parties as Lavendla trusts. Lavendla carefully selects any partners to ensure that Users’ data is used in a way that is compatible with the regulations regarding personal data management that apply in Sweden.
13. AGGREGATED DATA (NON-IDENTIFIABLE PERSONAL DATA)
13.1 Lavendla may share aggregated information with third parties. In such a case, the aggregated information has been compiled from information collected in the implementation of Lavendla’s services and may, for example, consist of statistics on Internet traffic or the geographical location when ordering Lavendla’s services. Aggregated information does not contain any information that can be traced to a specific individual and therefore does not constitute Personal Data.
14 COOKIES, LINKS TO OTHER WEBSITES ETC.
14.1 When a Visitor visits the Website, information about the use will be stored through cookies. Cookies are passive text files that are stored by the browser in the Visitor’s device, i.e. computer, mobile or tablet, when connecting to the Website. Lavendla uses cookies to improve the Visitor’s experience of the Website and to collect information such as statistics about the Visitor’s use of the Website. This is done in order to ensure, maintain and improve the Website and Lavendla’s services and offers in general.
14.2 For the purpose of analyzing how the Website is used by our visitors and to subsequently improve it, as well as to provide you with a good user experience on your next visit, we collect and process the following personal data: your unique online identifier, which pages you have visited, how you have used the Website, and what settings/choices you have made. You must consent to cookies for this processing to take place. The processing of personal data is based on our legitimate interest (Article 6(1)(f) of the GDPR) to provide you with a good user experience of the Website and our commercial interest in obtaining information about visitors to the Website.
14.3 We use Google Ads to display our ads and promote our services online. When you click on one of our online advertisements, we collect, through Google Ads, your IP address and a unique click identifier for the advertisement. The data is used for the purpose of verifying that it is not a computer or internet bot or a fraudulent actor (so that we can prevent future ads from being shown to such an actor); to monitor the performance of our ad by counting the number of website visitors who found the Website by clicking on the ad; to determine which of these were converted into customers; and to improve our advertising. The processing of personal data is based on our legitimate interest (Article 6(1)(f) of the GDPR) to prevent fraud and to follow up on our marketing activities. The processing entails that your IP address and the unique click identifier for the ad are shared with system providers (personal assistants) to us. Furthermore, we share the results of the ad tracking with Google Ads (which is independently responsible for its processing).
14.4 Visitors can refuse the use of cookies at any time by changing the settings on their device. However, doing so may impair the Visitor’s experience of the Website.
14.5 The Website may contain links to websites belonging to third parties. Visitors who follow such a link should check the terms and policies of the website in question before disclosing their personal data to the provider of the website. Lavendla is under no circumstances responsible for such third-party websites.
15. CONTACT DETAILS
15.1 For questions, further information about Lavendla’s personal data processing or for contact with Lavendla in general, please use the information below:
Lavendla AB
Sveavägen 80, 113 59 Stockholm
E-mail: [email protected]
Telephone: 0771-22 21 21
Web: lavendla.com
16. CHANGES
16.1 Lavendla has the right to change or make additions to the Privacy Policy at any time. The latest version of the Privacy Policy will always be available on the Website. New versions of the Privacy Policy will enter into force thirty (30) days after information about the change has been clearly provided to you.
