Privacy Notice
Last updated: 2026-09-22
This English version is a convenience translation — the Swedish version governs.
Version history
- — Counsel-reviewed final edition of the whole legal pack; effective on this date.
- — First consolidated edition of the legal pack (draft).
The boxed summaries are reading aids, not the binding text.
1. INTRODUCTION
In this Privacy Notice you can read about how Lubb IT AB (company reg. no. 556938-6484) ("we", "our" or "us") processes personal data in connection with Kursregistrering.se ("the Platform"). The Platform can be used by Course Organizers to administer courses and by Course Participants for, for example, course registration and use of the participant portal. "You" and "your" refer to the person whose personal data is processed.
2. DEFINITIONS
This Privacy Notice uses definitions from the EU General Data Protection Regulation 2016/679 ("GDPR"), such as "personal data", "processing", "data subject", "controller" and "processor". These terms have the same meaning as in Article 4 of the GDPR.
3. CONTROLLER
We are the controller for the processing of personal data described in this Privacy Notice, unless stated otherwise.
When we process Course Participants' personal data on behalf of a Course Organizer, the Course Organizer is the controller and we are the processor. We then process the personal data in accordance with the data processing agreement we have entered into with the Course Organizer and the Course Organizer's instructions. That processing is not covered by this Privacy Notice.
We provide the Platform, but we are not responsible for the courses offered and administered by the Course Organizer through the Platform. The contractual relationship concerning the course in question is between the Course Organizer and the Course Participant. To learn more about how the Course Organizer processes personal data, read the Course Organizer's privacy notice or contact the Course Organizer directly.
4. HOW WE OBTAIN YOUR PERSONAL DATA
We obtain your personal data primarily directly from you, for example when you register your user account, use the Platform, contact us or otherwise communicate with us.
We can also receive your personal data from a Course Organizer, for example when a representative of the Course Organizer provides your contact details to us so that you can be registered as a contact person or user of the Platform.
If we obtain your personal data from someone other than you, we inform you in accordance with the requirements of Article 14 of the GDPR, unless an exemption applies.
5. CATEGORIES OF PERSONAL DATA WE PROCESS
We only process personal data that is necessary and relevant for the purposes concerned. The personal data we primarily process is identifying information (e.g. name) and contact details (e.g. email address, telephone number and postal address). More information about which personal data is processed is set out in section 7.
6. LEGAL BASIS FOR THE PROCESSING OF THE PERSONAL DATA
The GDPR requires that we have a legal basis for every processing of personal data. Depending on why the personal data is processed, we rely on one of the following legal bases:
- Contract (Article 6(1)(b) GDPR): The processing is necessary to enter into or perform a contract with you.
- Legal obligation (Article 6(1)(c) GDPR): The processing is necessary for us to fulfil obligations under law, for example under accounting or data protection legislation.
- Legitimate interest (Article 6(1)(f) GDPR): The processing is necessary for our or a third party's legitimate interests, following a balancing of interests in which we have assessed that the processing does not outweigh your rights and freedoms.
In certain cases you need to provide personal data so that we can fulfil a legal obligation, enter into or perform a contract, or provide our services. If you do not provide the data, it can mean that we cannot provide the service in question or fulfil our obligations.
7. PURPOSES OF THE PROCESSING OF THE PERSONAL DATA
Below we describe the purposes for which we process personal data, which personal data is processed, which legal basis applies to the processing, the recipients of the personal data, and how long the personal data is stored. For information about how we use cookies and similar technologies, please see our Cookie Notice.
7.1 Providing and administering access to the Platform
Purpose: Providing and administering access to the Platform and its features, including creating and administering user accounts for the Course Organizer's users.
Personal data: Identifying information (e.g. name); contact details (e.g. email address); for the Course Organizer's users also account information (e.g. user ID and login credentials) and information about Course Organizer and permission level.
Processing: We administer Course Participants' access to the participant portal and administer user accounts for the Platform for the Course Organizer's users. For the Course Organizer's users we also handle login, authentication and permissions.
Legal basis:
- Course Participants: Contract – the processing is necessary to perform the User Terms and give the Course Participant access to the participant portal and its features.
- The Course Organizer's users: Legitimate interest – our legitimate interest in providing the Platform to the Course Organizer and administering user accounts and access for its users.
Recipients: Providers of IT systems and of hosting, storage and authentication services (processors).
Storage period: For Course Participants, the personal data is stored for as long as the Course Participant has access to the participant portal. Access normally ends two (2) years after the course in question has ended, unless it ends earlier in accordance with the User Terms. For the Course Organizer's users, the personal data is stored for as long as the user account is active and is deleted at the latest one (1) year after the account has been closed or deactivated. Personal data can be stored longer if it is processed for another purpose stated in this Privacy Notice.
7.2 Administering the customer relationship with Course Organizers
Purpose: Administering the customer relationship with Course Organizers, handling contract-related matters, communicating with representatives and contact persons, and administering invoicing and payments for our services.
Personal data: Identifying information (e.g. name); contact details (e.g. email address and telephone number); information about Course Organizer and position/role; contract and service information; invoicing and payment information (e.g. invoice details, payment status and transaction details); correspondence information (e.g. the content of messages, notes and other information you provide).
Processing: We record and administer contact details, communicate with representatives and contact persons, handle contract and service matters, create and send invoices, follow up payments, and document communication.
Legal basis: Legitimate interest – our legitimate interest in administering and performing our contractual relationship with the Course Organizer, communicating with its representatives and contact persons, and administering invoicing and payments for our services.
Recipients: Providers of IT systems, communication solutions, and invoicing and payment services (processors).
Storage period: Contact details, information about Course Organizer and position/role, contract and service information, and correspondence information are stored during the customer relationship and thereafter for up to two (2) years after the customer relationship has ended. Invoicing and payment information that forms part of accounting records is stored for as long as required under applicable accounting legislation.
7.3 Providing support for the Platform
Purpose: Handling support cases and questions concerning the use of the Platform and providing support for the Platform.
Personal data: Identifying information (e.g. name); contact details (e.g. email address and telephone number); information about Course Organizer; correspondence information (e.g. the content of messages, case history, notes and other information you provide); technical information relevant to the support case.
Processing: We receive and record support cases, communicate with the person contacting us, troubleshoot and resolve problems, and document and follow up the case.
Legal basis:
- Course Participants: Contract – the processing is necessary to perform the User Terms and provide support concerning the Platform.
- The Course Organizer's users: Legitimate interest – our legitimate interest in providing support concerning the Platform to the Course Organizer and its users.
Recipients: Providers of IT systems and of communication and support services (processors).
Storage period: The personal data is stored for as long as necessary to handle the support case and thereafter for up to one (1) year after the case has been closed. Personal data can be stored longer if there is another legal basis for continued processing.
7.4 Maintaining the function, operation and security of the Platform
Purpose: Ensuring the function, availability, operation and security of the Platform, and preventing, detecting and handling technical faults, security incidents and unauthorised access.
Personal data: Identifying information (e.g. user ID); technical information (e.g. IP address, log data, device and browser information, and information about time and activity on the Platform).
Processing: We collect and analyse technical information and logs, monitor the function and security of the Platform, and identify, troubleshoot and handle technical faults, security incidents and unauthorised access.
Legal basis: Legitimate interest – our legitimate interest in ensuring a functioning and secure Platform and in preventing, detecting and handling technical faults, security incidents and unauthorised access.
Recipients: Providers of IT systems and of hosting, storage, monitoring and security services (processors).
Storage period: The personal data is stored for as long as necessary for each purpose and normally for up to one (1) year from when it was collected. Personal data needed to investigate or handle an identified technical fault, a security incident or suspected unauthorised access can be stored longer, for as long as necessary for that purpose.
7.5 Fulfilling legal obligations
Purpose: Fulfilling legal obligations that apply to our business, for example concerning bookkeeping and accounting, the handling of data subjects' rights and personal data breaches, and other obligations under applicable legislation.
Personal data: The personal data necessary to fulfil the legal obligation in question, for example identifying information (e.g. name); contact details (e.g. email address and telephone number); invoicing and payment information; correspondence information; information about personal data breaches and data subjects' requests.
Processing: We retain accounting records, handle and document requests from data subjects, investigate and document personal data breaches, and disclose information to authorities when the law requires it.
Legal basis: Legal obligation – the processing is necessary to fulfil our legal obligations under, for example, the GDPR and bokföringslagen (1999:1078) (the Swedish Accounting Act).
Recipients: Authorities and other recipients when disclosure is required by law, and suppliers that process personal data on our behalf (processors).
Storage period: The personal data is stored for as long as required under the applicable legal obligation. Personal data included in accounting records is stored until the end of the seventh (7) year after the end of the calendar year in which the financial year closed. Personal data linked to rights requests is normally stored for up to three (3) years after the matter was closed, and personal data linked to personal data breaches for up to five (5) years after the investigation was concluded, unless longer storage is required by law or due to legal proceedings.
7.6 Communication and marketing
Purpose: Communicating with existing and potential Course Organizers and providing information about the Platform, our services, offers and news.
Personal data: Identifying information (e.g. name); contact details (e.g. email address and telephone number); company-related information (e.g. organization and position); information about any customer relationship and previous communication.
Processing: We record and use contact details to communicate and to send information and marketing, and we handle objections and unsubscriptions from mailings.
Legal basis: Legitimate interest – our legitimate interest in communicating with existing and potential Course Organizers and in informing about and marketing the Platform and our services.
Recipients: Providers of systems for mailings and communication (processors).
Storage period: Personal data concerning representatives of existing Course Organizers is processed during the customer relationship and thereafter for at most one (1) year. Personal data concerning representatives of potential Course Organizers is instead processed for at most one (1) year from collection or the most recent contact, whichever occurs last. If the data subject objects to processing for direct marketing, the personal data is no longer used for that purpose.
8. HOW LONG WE STORE PERSONAL DATA
We store personal data for as long as it is needed for the purposes for which it was collected, to fulfil legal obligations, or to establish, exercise or defend legal claims. The specific storage periods for the different processing activities are set out in section 7.
If you request that your personal data be deleted, we sometimes need to retain data, for example to fulfil a legal obligation or handle a dispute. When the personal data is no longer needed, we delete or anonymise it in accordance with applicable legislation and our internal procedures.
When personal data is deleted from our active systems, it can remain in backups for up to thirty (30) calendar days before it is deleted or overwritten. The data is not used for other purposes during this period.
9. WHERE WE PROCESS PERSONAL DATA
We aim to process personal data within the EU/EEA. In certain cases, personal data can be transferred to or processed in countries outside the EU/EEA, for example when we use providers of IT services, communication solutions or other external services.
If we transfer personal data to a country outside the EU/EEA, we ensure that the transfer complies with the GDPR and that appropriate safeguards are in place. Such safeguards can, for example, consist of an adequacy decision by the European Commission or standard contractual clauses approved by the European Commission, supplemented with additional safeguards when required. You can contact us to learn more about transfers of personal data to countries outside the EU/EEA, which safeguards we use, or to obtain a copy of the relevant standard contractual clauses.
10. RECIPIENTS OF PERSONAL DATA
We can disclose personal data when it is necessary to provide our services, fulfil legal obligations, perform contracts, or protect our rights and interests. Personal data can be disclosed to the following recipients:
- Authorities: We can disclose personal data to authorities when required by law or by a decision of an authority, or when it is necessary to prevent, detect or investigate crime, security incidents or other irregularities.
- Processors: We use suppliers that process personal data on our behalf, for example providers of IT systems, communication solutions, support services, and hosting and storage services. These suppliers process the personal data in accordance with our instructions and the data processing agreements entered into.
- Third parties that are independent controllers: In certain cases, we can disclose personal data to organizations or companies that are themselves responsible for how they process the personal data, for example in connection with business transactions or collaborations.
11. Your rights under the GDPR
When we are the controller for the processing of your personal data, you have the following rights under the GDPR:
- Right to information: You have the right to receive clear information about how we process your personal data, for example why we process it, which data is processed, how long it is stored and which recipients can gain access to it. This information is provided in this Privacy Notice. If we did not obtain the personal data directly from you, you also have the right to information about where the data comes from.
- Right of access: You have the right to request a copy of the personal data we process about you and to receive information about the processing, for example why we process the data, which recipients receive it and whether it is transferred to countries outside the EU/EEA.
- Right to rectification: You have the right to have inaccurate personal data corrected and incomplete personal data completed. If it is possible and does not involve a disproportionate effort, we also inform recipients who have received the data about the rectification. You also have the right to information about which recipients have been informed.
- Right to erasure ("the right to be forgotten"): In certain cases, you have the right to have your personal data deleted, for example if the data is no longer needed for the purposes for which it was collected, if you withdraw your consent, or if the processing violates applicable legislation. However, we sometimes need to retain certain personal data to fulfil legal obligations or to establish, exercise or defend legal claims. If the personal data is deleted, we also inform recipients who have received the data, if it is possible and does not involve a disproportionate effort. You also have the right to information about which recipients have been informed.
- Right to restriction of processing: In certain cases, you have the right to request that the processing of your personal data be restricted, for example if you consider the data inaccurate or if the processing is unlawful but you do not want the data deleted. When the processing is restricted, we normally only store the personal data and process it in certain specific situations, for example with your consent or to establish, exercise or defend legal claims. We inform you before a restriction of processing is lifted.
- Right to data portability: If our processing is based on consent or contract, you have in certain cases the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format. You can also have the right to have the personal data transferred directly to another controller, if it is technically feasible.
- Right to object: You have the right to object to the processing of your personal data when the processing is based on our legitimate interest. If you object, we only continue the processing if we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or if the processing is needed to establish, exercise or defend legal claims. You always have the right to object to the processing of your personal data for direct marketing.
- Right not to be subject to automated decision-making: You have the right not to be subject to decisions based solely on automated processing, including profiling, if the decision has legal or similarly significant consequences for you. We do not make such automated decisions about you.
12. HOW YOU EXERCISE YOUR RIGHTS
You can exercise your rights under the GDPR by contacting us via the contact details at the bottom of this Privacy Notice. Exercising your rights is free of charge. However, if a request is manifestly unfounded or excessive, in particular because it is repetitive, we can charge a reasonable administrative fee or refuse the request.
If we have reasonable grounds to doubt your identity, we can ask for additional information necessary to verify it.
We respond to your request without undue delay and normally within one month of receiving it. If the request is complex or we have received many requests at the same time, the response time can be extended by up to two months. In that case, we inform you of the extension and the reasons for it within the first month.
Certain rights apply only under specific conditions under the GDPR and other applicable legislation. If we cannot accommodate your request, we inform you why.
13. CHANGES
We update this Privacy Notice when needed. The latest version is always available on our website. If we make material changes that affect how we process your personal data, we inform you of the changes when the law requires it.
14. Contact details
If you have questions about this Privacy Notice or how we process your personal data, you are welcome to contact us:
- Email: info@kursregistrering.se
- Postal address: Lubb IT AB, c/o Marcus Ludvigsson, Kerstingatan 13 lgh 1403, 582 13 Linköping, Sweden
- Telephone: 070-78 10 259 (weekdays excluding public holidays, 09:00–16:00 CET/CEST)
We have currently not appointed a data protection officer.
If you are dissatisfied with how we process your personal data, you have the right to lodge a complaint with IMY (the Swedish Authority for Privacy Protection), which is the supervisory authority in Sweden:
- Email: imy@imy.se
- Telephone: 08-657 61 00
- Postal address: Integritetsskyddsmyndigheten, Box 8114, 104 20 Stockholm
If you reside in another EU/EEA country, you can also contact the supervisory authority in your country of residence. A list of the supervisory authorities within the EU/EEA is available on the website of the European Data Protection Board (EDPB): https://edpb.europa.eu/about-edpb/about-edpb/members_en.