Your rights as a model
When you or your child takes part in photos or film with us, we process certain personal data. Here we explain how it works, why we do it and what rights you have.
Privacy policy for modelling assignments
We at Aktiebolaget Bostäder i Borås, company registration number 556024-8782 (”we”), are responsible for processing your or your child's personal data when you or your child is filmed or photographed by us as a model. In this privacy policy we describe how we process your and/or your child's personal data in connection with a modelling assignment.
If you as a model are under 13, the information in this privacy policy is addressed to you as a guardian.
You have several rights under the EU General Data Protection Regulation (”GDPR”) when we process your or your child's personal data, for example the right to complain to the Swedish Authority for Privacy Protection and the right to object to the processing of your or your child's personal data under certain conditions.
When we publish photos and film on social media, your or your child's personal data will be transferred outside the EU/EEA.
You will find full information below about how we process your or your child's personal data when we photograph or film you or your child, and what rights you and your child have. First, a short summary.
Summary
We process your or your child's personal data in order to:
• Publish photos and films from modelling assignments;
• Comply with the rules of the Swedish Accounting Act; and
• Answer questions and communicate with you.
When we publish photos and film on social media, your or your child's personal data will be transferred outside the EU/EEA.
Further down you will find a more detailed description of how we process your or your child's personal data.
Rights
Under the GDPR you have several rights that can be exercised in relation to our processing of your or your child's personal data. As the guardian of a child under 13, it is you who exercises your child's rights. In summary, you and your child have the following rights:
• The right to complain to the Swedish Authority for Privacy Protection,
• The right of access,
• The right to object,
• The right to erasure,
• The right to rectification,
• The right to restrict the processing of personal data, and
• The right to data portability.
If you have any questions about these rights, or want to exercise any of your or your child's rights, you are welcome to contact us at gdpr@bostaderiboras.se.
This is how we process personal data for modelling assignments
Below you can read about who receives your or your child's personal data, a detailed description of how we process the personal data for each purpose, our balancing of interests and a detailed description of your and your child's rights.
We process personal data about you or your child when you or your child takes part as a model in one of our photo shoots or in one of our films.
We always give information about our photo, film and sound recording, and obtain consent under the Swedish Act (1978:800) on names and images in advertising when we enter into the model agreement with you.
Who is responsible for the processing of personal data?
Bostäder i Borås (company registration number 556024-8782) is the data controller for the processing of your or your child's personal data that takes place when you or your child takes part as a model in one of our photo shoots or in any of our films.
Contact us
If you have any questions about our processing of your or your child's personal data, or if you want to exercise any of your or your child's rights, you can contact us.
The easiest way to reach us is by e-mail at gdpr@bostaderiboras.se or by post to our company address Västerbrogatan 8, 503 30 Borås, Sweden.
The data protection officer of Bostäder i Borås can be contacted at dso@borasregionen.se. You can also contact IMY (the Swedish Authority for Privacy Protection) at the following e-mail address imy@imy.se.
Who has access to your or your child's personal data, and why?
Your or your child's personal data is processed mainly by us at Bostäder i Borås. In some cases we need to share your or your child's personal data in order to carry out a modelling assignment:
- We use IT suppliers, for example for the services Sharepoint and Mediaflow, which we use to store photos and films. These suppliers are given access to your and/or your child's personal data so that we can manage our photo and film material. Such suppliers process personal data on our behalf as our data processors and only according to our instructions.
- We use photographers, who are given access to your or your child's personal data by taking photos and filming, and by cutting and editing photo and film material in which you or your child appears. The photographer may further process your or your child's personal data appearing in the photo and film material for their own purposes as an independent data controller.
- We publish photos and films on our social media: Facebook, Instagram and LinkedIn. Meta (Facebook and Instagram) and LinkedIn may process your or your child's personal data for their own purposes, and are independent data controllers for such processing of your or your child's personal data as appears in photos and films published on their platforms.
Where is your or your child's personal data processed?
We always work to ensure that your or your child's personal data is not transferred outside the EU/EEA, and we store your and/or your child's personal data only within the EU/EEA. When we publish photos and film on social media, however, your or your child's personal data will be transferred outside the EU/EEA, as Meta and LinkedIn are based outside the EU.
When your personal data is transferred outside the EU/EEA, namely to the USA, this is done on the basis of what is known as an adequacy decision from the European Commission under Article 45 of the GDPR. This means that the EU has assessed that a particular country has an adequate level of protection for your personal data. This agreement between the EU and the USA is called the EU-US Data Privacy Framework. Meta and LinkedIn are certified under the EU-US Data Privacy Framework. On the Data Privacy Framework website you can look up information about the suppliers that are certified.
Detailed description of how we process your or your child's personal data
Here you can read in detail about why we process your or your child's personal data, which categories of personal data we process and what the legal basis for processing your or your child's personal data is. You can also read about how long we store your or your child's personal data. We collect your personal data from you or your child.
Your and your child's rights
Under the GDPR you and your child have certain rights; see more information below.
If you have any questions about these rights, or want to use any of your or your child's rights, you are welcome to contact us using the contact details above. The Swedish Authority for Privacy Protection also has more detailed information about when your or your child's rights apply and what exceptions there are.
The right to complain - Article 77 of the GDPR
You have the right to lodge a complaint with the competent supervisory authority if you consider that the processing of your or your child's personal data breaches the GDPR. In Sweden the competent supervisory authority is the Swedish Authority for Privacy Protection.
The right of access (”the right to a register extract”) - Article 15 of the GDPR
You have the right to confirmation as to whether or not we process your or your child's personal data. You can send a request by contacting us at gdpr@bostaderiboras.se. If we process your or your child's personal data, you also have the right to a copy of the personal data we process, together with information about the processing, for example the purposes of the processing and how long the data is kept.
The right to object - Article 21 of the GDPR
You have the right to object at any time to processing of your or your child's personal data that is based on a balancing of interests.
The right to rectification - Article 16 of the GDPR
You have the right to have inaccurate personal data concerning you or your child corrected without undue delay. You also have the right to have incomplete personal data completed.
The right to erasure (”the right to be forgotten”) - Article 17 of the GDPR
Under certain conditions you have the right to have your or your child's personal data erased by us without undue delay, for example if the personal data is no longer necessary for the purposes for which it was collected or processed.
The right to restriction of processing - Article 18 of the GDPR
Under certain conditions you have the right to require us to restrict our processing of your or your child's personal data, for example if you contest the accuracy of the data, or if the processing is unlawful and you oppose erasure of the personal data and instead request that its use be restricted.
The right to data portability - Article 20 of the GDPR
When we process your or your child's personal data in order to perform a contract, you have the right to receive the personal data concerning you or your child. The right applies to data you have provided to us, in a structured, commonly used and machine-readable format. You also have the right to transfer this personal data to another data controller, where this is technically possible.
Balancing of interests
We process your or your child's personal data when we answer your or your child's questions and handle any claims, using a balancing of interests as the legal basis. The balancing of interests means that we assess that our legitimate interest in carrying out the processing outweighs your or your child's interest and your or your child's fundamental rights not to have your or your child's personal data processed by us. The processing we carry out on the basis of a balancing of interests is set out in the table above.
If you want to know more about how we have made this assessment, you are welcome to contact us.