Processing of personal data


## Memmo Family AB

# 1. Introduction

This privacy notice relates to Memmo Family AB's ("Memmo") processing of your personal data when you are either (i) using Memmo's services under Memmo's General Terms and Conditions, or (ii) acts as a Profile in accordance with a Profile Agreement ("Privacy Notice"). The purpose of this Privacy Notice is to inform you about the processing we undertake with your personal data. For any processing of personal data described herein, Memmo acts as controller.

Throughout this Privacy Notice the terms "controller", "processor" "processing" and "personal data" shall have the same meaning as in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (the "GDPR"). The terms "User" and "Profile" shall have the same meaning as set forth in the General Terms and Conditions.

References made to the "General Terms and Conditions" refer to the general terms and conditions for the provision of Memmo's services. Any reference to the "Profile Agreement" refers to the agreement entered into between Memmo and the Profiles (or lenders as the case may be).

The collection of your personal data is required in order to Memmo to perform under either the Profile Agreement or the General Terms and Conditions. If you do not wish to have your personal data processed, you will not be able to utilize the services or act as a Profile.

Any personal data processed by Memmo, as set forth in this Privacy Notice, have been collected directly from you, regardless if you are acting as a User or a Profile.

# 2. When and why do we process your personal data?

## User administration

We will process your personal data in order to manage and administer your user account, including handling of payment and providing you with support in relation to user related inquiries.

### Category of data subject: User

Categories of personal data:
* Legal basis
* Name
* Contact details
* Password
* User name on Instagram
* Card number

Contract: 
The processing is necessary in order to perform under the General Terms and Conditions and ensure that you are able to utilize the services.

Retention period: 
Personal data processed for this purpose is retained for as long as you have an active user account. If you have not used the services for more than two (2) year, your user account will be inactivated and subsequently deleted.

## Administration of contractual relationship

### Category of data subject: Profile

We will process your personal data in order to manage the contractual relationship with you as a Profile, including administration and payment of your remuneration in accordance with the Profile Agreement.

Categories of personal data:

* Legal basis
* Name
* Contact details
* Password
* User name
* Bank account number
* Personal identification number if payment is made to a natural person


Contract: 

The processing is necessary in order to perform under the Profile Agreement.

Personal identification number is necessary for identification given the purpose of processing


Retention period: 

Personal data processed for this purpose is retained during the term of your Profile Agreement with Memmo and will not be processed for this purpose thereafter.


## Managing our IT systems

### Category of data subject: User and Profile

We will process your personal data for the purposes of management of our IT systems in order to ensure that Memmo is able to deliver all functions required in order to provide the services I accordance with the General Terms and Conditions and carry out the tasks required in order to perform under the Profile Agreement.

Categories of personal data:

* Legal basis
* All categories of personal data described herein.


Contract: 

The processing is necessary in order to perform under the General Terms and Conditions (if you are a User) and/or the Profile Agreement (if you are a Profile).


Retention period: 

Personal data processed for this purpose is retained either for as long as you have an active user account (if you are a User) or during the term of the Profile Agreement (if you are a Profile).

## Marketing campaigns

### Category of data subject: User

We will process your personal data in order to provide you with marketing relating to our services, including to carry out marketing campaigns.

Categories of personal data:

* Legal basis
* Name
* Contact details


Legitimate interest: 

The processing is necessary in order to satisfy our legitimate interest in being able to provide you with marketing for the purposes of offering additional services or provide you with news and information relating to current services.

Retention period: 

Personal data is processed for these purposes for as long as you have an active user account and for one (1) year thereafter.

## Statistical analysis

We will process your personal data in order to perform statistical analyses for the purposes of developing the services regarding functionality, security and methods. Moreover statistical analysis can be performed in order to discover market trends etc.

### Category of data subject: User

Categories of personal data:

* Legal basis
* IP address
* Information about the device you are using, e.g.  device ID.
* Information about your use of the services


Legitimate interest: 

The processing is necessary in order to satisfy our legitimate interest in being able to develop our services and to increase our understanding of the markets and customers.

Retention period: 

Personal data will only be processed for this purposes during the brief moment when your personal data is anonymized. The analysis will only be performed using anonymized data.

## Comply with legal obligations

### Category of data subject: User and Profile

We will process your personal data to comply with legal obligations applicable to Memmo.

Categories of personal data:

* Legal basis
* All data collected that is necessary to fulfil each legal obligation.


Legal obligation: 

The processing is necessary in order to comply with Memmo's legal obligations, for example within the area of book-keeping and taxation.

Retention period: 

Personal data is retained for the period as necessary to fulfil the legal obligations applicable to Memmo.

## Establish, exercise and defend legal claims

### Category of data subject: User and Profile

For the purpose of establish, exercise and defend legal claims (for example in connection with a dispute or legal process) we will process your personal data.

Categories of Personal data:

* Legal basis
* All data collected that is necessary to establish, exercise or defend the legal claim.


Legitimate interest: 

The processing is necessary in order to fulfil our legitimate interest to establish, exercise or defend the legal claim, for example in connection with a dispute or legal process.

We will only process special categories of data, for example health data and information on trade union membership, to fulfil our legitimate interest to establish, exercise or defend legal claims.

Personal data relating to criminal offences or convictions will be processed only if necessary to fulfil our legitimate interest to establish, exercise or defend legal claims.

Retention period: 

Your personal data is retained for the period required in order for us to establish, exercise or defend the legal claim.


# 4. With whom do we share personal data?

### Processors acting on behalf of Memmo

Memmo will, if necessary, transfer your personal data to external parties such as vendors and service providers which process personal data in accordance with Memmo's instructions. Such recipients will act as processors on behalf of Memmo and comprise e.g. IT-service providers (cloud providers, web platform providers etc.). 

Memmo assigns the following service providers as data processors:

* Stripe Payments Europe, Ltd. (payment provider)
* Adyen N.V. (payment provider)
* PayPal (Europe) S.a r.l. et Cie, S.C.A. (payment provider)
* Octobat SAS (tax management)
* Paysalary Sverige AB (disbursement of payments)
* Gigapay Sweden AB (disbursement of payments)


Other recipients


* Recipient
* Purpose of transfer
* Legal basis
* Courts and outside counsels
* In order to exercise, establish or defend legal claims
* Our legitimate interest in having disputes settled by competent courts
* External auditors
* To fulfil legal obligations (such as accounting and auditing obligations)
* To fulfil legal obligations
* Authorities
* To fulfil legal obligations (for example due to requests from competent authorities)
* To fulfil legal obligations
* Banks
* To administer and handle payments made from or to Memmo
* To perform under a contract.
* Potential buyers of the business
* To provide potential buyers information about Memmo within the scope of a due diligence process.
* Our legitimate interest in being able to sell the business or portion thereof.


### Appropriate safeguards for transfers outside the EU/EEA-area	
Where a disclosure as mentioned above entails transfers of personal data outside the EU/EEA, Memmo will ensure that the EU Commission's standard contractual clauses have been entered into between Memmo and the receiving external party. Alternatively, other safeguards will be put in place prior to such transfers (for example ensuring that the recipient of data is certified under EU/US Privacy Shield).

You are entitled to receive a copy of any documentation demonstrating that appropriate safeguards have been taken in order to protect your personal data during a transfer outside the EU/EEA.
If you would like know more about the processing of your personal data and whether your personal data is transferred outside the EU/EEA, please contact us on the contact details as set out below.

# 4. Your rights
Under the GDPR you may be entitled to:

* Access to your personal data

You may request confirmation whether or not personal data is processed and if that is the case have access to your personal data and additional information such as the purposes of the processing. You are also entitled to receive a copy of the personal data undergoing processing. If the request is made by electronic means the information will be provided in a commonly used electronic format if you do not request otherwise.

* Rectification of incorrect or inadequate personal data

Memmo will take steps to keep your personal data accurate, complete and up-to-date. If you identify that any personal data related to you is inadequate, incomplete or incorrect, you are entitled to have the personal data corrected.

* Object to certain processing

You may object to the processing of your personal data processed on the basis of a legitimate interest, on grounds relating to your particular situation. Moreover, you may object to processing carried out for direct marketing purposes.

* Erasure of your personal dataUnder certain circumstances, you may have your personal data 
erased. For example, you are entitled to erasure when your personal data it is no longer needed for the purposes for which it was collected.
	
* Restriction of the processing of your personal data
* Under certain circumstances, you may ask us to restrict the processing of your personal data to only comprise storage, if you do not want your personal data erased.
* Data portability

As regards personal data that you have provided to Memmo, you may ask to receive a machine-readable copy of the data, in so far the data is processed on the basis of your consent or on the basis that the processing is necessary in order to perform an agreement with you. You also have the right to ask for such data to be transferred to another controller (where possible).

Complaints to the supervisory authority
You acknowledge that you always have the right to lodge complaints pertaining to the processing of your personal data to the competent data protection authority.


# 5. Information security

Privacy and security are essential parts of Memmo's work on data protection. We will ensure that the access to your data is accurately secured by applying appropriate safeguards, depending on the circumstances taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk. In support of this commitment, we have implemented appropriate technical, physical and organizational measures to protect your personal data against unauthorized or accidental destruction, alteration or disclosure and misuse, damage, theft or accidental loss or unauthorized access

# 6. Contact information

If you have any questions or concerns regarding the processing of your personal data or if you wish to exercise any of your rights as set out above, please contact Memmo on the contact details set forth below.

Memmo Family AB

Data protection officer: Daniel Mauno Pettersson: data-protection-officer@memmo.app

# 7. Other notices
We reserve the right to update this Privacy Notice, if necessary, for example to comply with legislative changes, regulatory changes, new practices and procedures, or requirements imposed by any authority. The most recent version is always available on this [link](https://memmo.me/privacy-policy) [insert link here] and the revisions will apply from the date of their publication on the website.

Version: 1.0

Last updated: 27th November 2019

