Thank you for trusting us at the Möbeldesignmuseum/the Museum of Furniture Studies (“Möbeldesignmuseum”) with your personal data. Möbeldesignmuseum is operated by IKEA Älmhult AB (“IKEA”, “we”, “us” or “our”).
Möbeldesignmuseum invites visitors to subscribe to our online newsletters. By opting in via the subscription button located in the footer of any page on our website, you will receive Möbeldesignmuseum’s monthly newsletter. We will use your email address exclusively for sending the newsletter and keeping you informed about news and events related to the museum. You can unsubscribe at any time by following the instructions provided in our newsletters.
We commit ourselves to be transparent with you by providing clear information about what personal data we collect hereunder; what we do with it and why; who we disclose it to; how we protect personal data, and what choices you have regarding the use of your personal data by us and third parties.
THE COMPANY RESPONSIBLE FOR THE PROCESSING OF YOUR PERSONAL DATA AND HOW TO CONTACT US
We, IKEA Älmhult AB, with company registration no. 559070-5058, c/o IKEA of Sweden AB, Box 702, 343 81 ÄLMHULT are responsible for the processing activities when you interact with Möbeldesignmuseum/IKEA in any of the ways described in this Privacy Statement.
If you have questions about our Privacy Statement or practices, please feel free to get in touch. You can contact us at data.protection@Inter.ikea.com.
DESCRIPTION OF HOW WE PROCESS YOUR PERSONAL DATA
We are happy that you share your personal data with us! We want to make your experience with us as joyful, meaningful and simple as possible. To achieve this, we collect some information about you. This section tells you what personal data we collect and process, why we process it, and the lawful basis and storage period for the personal data in question.
What purpose we process for:
To provide you with Möbeldesignmuseum’s newsletter which you have subscribed to, keeping you informed about news and events related to Möbeldesignmuseum.
What personal data we process:
Your email address.
Our lawful basis for the processing:
Legitimate interest (Article 6.1 (f) GDPR).
The processing is necessary for purposes of our legitimate interest to be able to provide you with the requested newsletter(s).
Storage period:
We will store your email address for as long we plan to continue with the newsletter. If we decide to discontinue the newsletter, your email address will be deleted. You can unsubscribe at any time by following the instructions provided in the newsletters, in which case your email address will be deleted within 30 days from your request.
WHO DO WE SHARE YOUR PERSONAL DATA WITH?
Your personal data is initially collected and processed by us. We commit to never sell your personal data.
Nevertheless, to conduct our business, we need to work with service providers and business partners who will process your personal data. We are responsible for any sharing of your personal data and for making sure your personal data is safe when shared with these third parties as set out below.
We share your personal data with our service providers who process the personal data on our behalf, which means that we remain responsible for the data they are processing. Currently, we share your personal data with the following categories of service providers:
IT service providers, e.g. for specific functionalities and hosting, who will process the personal data on our behalf and on our instructions to ensure good and secure IT operations. We only share your personal data with our IT service providers if it is necessary for them to fulfil their obligations towards us according to our contract with them.
Other IT service providers and platforms: In many cases, the personal data produced through your interaction with us will be processed through IT services and platforms that we use for multiple purposes such as product development, cooperation with you, etc. We only share your personal data with them if it is necessary for us to fulfil our mutual obligations.
We also share your data with other organisations, who will be independently responsible for certain processing of your personal data. These are:
With the IKEA value chain: IKEA is one brand, but multiple companies. Each company plays a specific role in achieving the IKEA vision. We share your data with other companies operating under the IKEA brand. However, where possible, we pseudonymise the personal data to minimise the risk of impact on your privacy.
Business Partners: We work together with other companies that can support us in achieving the IKEA vision. These companies might for example support us in finance and administration, design and development, etc. Other companies might support us with media, marketing, or social media. We share your personal data with them for different business purposes. However, where possible, we pseudonymise the personal data to minimise the risk of impact on your privacy.
If you have any questions regarding how we share your personal data or want to know more about who we share your personal data with, please feel free to contact us at data.protection@inter.ikea.com.
WHERE IS YOUR PERSONAL DATA PROCESSED?
Your personal data will, in most cases, be processed within the EU.
However, your personal data will be processed outside of the EU/EEA if the service providers we use are based outside of the EU/EEA. Therefore, your personal data will be transferred outside the EU/EEA in the following cases:
If the service provider or business partner is based outside of the EU/EEA. However, we protect your personal data and reduce the risk associated with transferring it outside of the EU/EEA by striving to only store your personal data on the IT service providers’ servers within the EU/EEA.
In the above situations, the transfers only take place in accordance with applicable data protection legislation, meaning that we will transfer your personal data outside the EU/EEA when we can ensure an appropriate level of protection of your personal data. We will transfer your personal data under the Standard Contractual Clauses (article 46.1 (c) GDPR), Module 2, together with supplementary measures. You can find the Standard Contractual Clauses here:
https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en
If you want to know more about what safeguards we implement for transfers of personal data or to receive a copy of the safeguards, you are always very welcome to contact us.
YOUR RIGHTS
Below you will find a detailed description of your rights and how to exercise them. In summary you have the following rights:
the right to lodge a complaint with a supervisory authority,
the right to withdraw your consent,
the right to access what personal data we process about you,
the right to rectification of any personal data that is inaccurate,
the right to erasure of the personal data we process,
the right to restrict our processing,
the right to data portability, and
the right to object to our processing of your personal data.
If you want to know more about your rights or if you want to exercise any of your rights, please contact us at data.protection@inter.ikea.com and we will help you.
RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY (ARTICLE 77 GDPR)
You have the right to lodge a complaint with a supervisory authority.
The supervisory authority in Sweden is Integritetsskyddsmyndigheten (IMY)/The Swedish Authority for Privacy Protection (https://www.imy.se/)
In detail. Your right to complain exists without prejudice to any other administrative or judicial remedy. You have the right to lodge a complaint with a supervisory authority in the EU/EEA Member State of your habitual residence, place of work, or place where the alleged infringement of applicable data protection laws has allegedly occurred.
RIGHT TO WITHDRAW CONSENT (ARTICLE 7.3 GDPR)
You have the right to withdraw your consent at any time. This can easily be done in the Application under privacy settings. When you withdraw your consent, it will be done on behalf of all others using the same System as you. Notwithstanding the foregoing, when you withdraw your consent in relation to receiving push notifications regarding the System it will only affect you, since such push notifications are sent to your specific device.
In detail. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
RIGHT TO ACCESS (ARTICLE 15 GDPR)
You have the right to obtain confirmation as to whether we are processing personal data concerning you or not. You can make a request by contacting us. If we do process your personal data, you also have a right to obtain a copy of the personal data processed by us as well as information about our processing of your personal data.
In detail. The information we provide includes the following:
the purposes of the processing,
the categories of personal data concerned,
the recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organisations,
where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period,
the existence of the right to request rectification or erasure of personal data or restriction of processing of personal data concerning you or to object to such processing,
the right to lodge a complaint with a supervisory authority, and
the appropriate safeguards pursuant to
Article 46 GDPR relating to the transfer of personal data to a third country.
For any further copies of the personal data undergoing processing requested by you, we may charge a reasonable fee based on administrative costs. If you have made the request by electronic means the information will be provided to you in a commonly used electronic form, unless otherwise requested by you.
RIGHT TO RECTIFICATION (ARTICLE 16 GDPR)
You have a right to obtain, without undue delay, the rectification of inaccurate personal data concerning you.
In detail. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including the means of providing a supplementary statement.
We will notify each recipient to whom the personal data has been provided of any correction that has been made unless this turns out to be impossible or entails a disproportionate effort. If you want information about these recipients, you are welcome to contact us.
RIGHT TO ERASURE (“THE RIGHT TO BE FORGOTTEN”) (ARTICLE 17 GDPR)
You can at any time ask us to delete some or all of your personal data.
In detail. You have the right to obtain from us the erasure of your personal data and we have the obligation to erase your personal data without undue delay where one of the following grounds applies:
the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed,
you withdraw your consent and there is no other legal ground for the processing,
you object to the processing pursuant to Article 21.1 GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21.2 GDPR,
the personal data has been unlawfully processed, or
the personal data has to be erased for compliance with a legal obligation in Union or Member State law that applies to us.
We will notify each recipient to whom the personal data has been provided about any erasure of personal data according to the above, unless this turns out to be impossible or entails a disproportionate effort. If you want more information about these recipients, you are welcome to contact us at data.protection@inter.ikea.com.
Note that our obligation to erase and inform according to the above shall not apply to the extent that processing is necessary according to the following reasons:
for exercising the right of freedom of expression and information,
for compliance with a legal obligation which requires processing by Union or Member State law which applies to us, or
for the establishment, exercise or defence of legal claims.
RIGHT TO RESTRICTION OF PROCESSING (ARTICLE 18 GDPR)
You have the right to demand restriction on the processing of your personal data.
In detail. The right applies if:
the accuracy of the personal data is contested by you, during a period enabling us to verify the accuracy of the personal data,
the processing is unlawful, and you oppose the erasure of the personal data and instead request the restriction of the use,
you need the personal data for the establishment, exercise or defence of legal claims even though we no longer need the personal data for the purposes of the processing, or
you have objected to processing pursuant to Article 21.1 GDPR pending the verification of whether our legitimate grounds override yours.
Where the processing has been restricted according to the above, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. We will notify you before the restriction of processing is lifted.
We will notify each recipient to whom the personal data has been provided about any restriction of processing according to the above unless this turns out to be impossible or entails a disproportionate effort. If you want more information about these recipients, you are welcome to contact us at data.protection@inter.ikea.com.
RIGHT TO DATA PORTABILITY (ARTICLE 20 GDPR)
You have the right to receive your personal data from us in a structured, commonly used and machine-readable format and, where technically feasible, to have your personal data transferred to another data controller (“data portability”).
In detail. The right applies to our processing of your personal data when it is based on the lawful basis of consent (Article 6.1 (a) GDPR or contract (Article 6.1 (b) GDPR) and the processing is carried out by automated means.
The exercise of the right to data portability shall be without prejudice to the right to be forgotten, Article 17 GDPR.
Your right to data portability shall not adversely affect the rights and freedoms of others.
RIGHT TO OBJECT (ARTICLE 21 GDPR)
You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data that is based on the lawful basis legitimate interest (Article 6.1 (f) GDPR), including profiling.
In detail. If you object, we shall then no longer process the personal data in question, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of you, or for the establishment, exercise or defence of legal claims.
Balancing of interests’ assessments when processing personal data based on the lawful basis of “legitimate interest”
As we state in the tables below, for some purposes, we process your personal data based on our “legitimate interest”. By carrying out a balancing of interests’ assessment concerning our processing of your personal data, we have concluded that our legitimate interest for the processing outweighs your interests or rights which require the protection of your personal data.
If you want more information in relation to our balancing of interests’ assessments, please do not hesitate to contact us.
