Privacy Protection Information

Mediaflow processes personal data both as a data controller (for its own purposes) and as a data processor on behalf of others (for purposes determined by the data controller). This privacy information describes what applies when Mediaflow processes your personal data as a data controller.

When Mediaflow provides its service; Mediaflow Content Hub and other services that enable Mediaflow's customers to work smarter and more efficiently with their digital assets, Mediaflow acts as a data processor to the customer (data controller) using the service. Mediaflow's role as a data processor includes the processing of all information that is uploaded/inserted/created or otherwise managed in the platform. Processing of personal data that we perform as a data processor primarily includes collection (when the data controller uploads or creates information in the service), processing, storage, and deletion. Personal data may occur in everything from media files such as images, video and audio clips to text files such as documents and messages sent between users in the service.

For more information on how your personal data is processed when using any of Mediaflow's services for businesses, we refer you to the data controller that you use Mediaflow's services through (typically your employer or client).

Mediaflow is a European company with headquarters in Uppsala, Sweden. We provide software and services to both public and private organisations in Europe. 

All important privacy decisions at Mediaflow are made at the group/management level. Our data protection team consists of five people within the company who meet regularly with our data protection officer and have ongoing consultations with expert lawyers on these issues. The responsible data controller for the processing of personal data described here is:

Data controller: Mediaflow Europe AB
Reg. no.: 556649-7573
Headquarters: Fyrisborgsgatan 3, 754 50 Uppsala, Sweden.
Phone: +46 (0)8-121 50 500

Contact information for Mediaflow Sweden and our subsidiaries can be found at
https://www.mediaflow.com/en/about-us/contact/.

We value your opinion. If you have comments or questions about our privacy policy, other privacy issues, or wish to exercise your rights, please contact our data protection team at privacy@mediaflow.com.

You may directly or indirectly provide us with information about yourself and/or your business in several ways that we process as a data controller. This may occur when you order our services or contact us through our website. Below are the processing activities we carry out as a data controller.

For those who order services, training, and sign agreements

For those who order services, training, or sign agreements with us, we need to collect certain personal data to communicate with you and provide you with the service/training you have ordered. This includes providing an admin account for you to manage your services as a customer, and having a contact person for training, agreements, and invoicing. The personal data we collect for these purposes includes:

• First and last name, employer's address, phone number, email address, job role, and workplace.

The legal basis for the processing is our legitimate interest in being able to communicate with you and deliver the service/training, including invoicing (where relevant), to you or the organisation you represent.

For those who contact us

You have the opportunity to contact us in different ways with questions. This can be done through a user account within the service under our support tab, or through web forms, email or telephone which are available on our website. We may process your personal data in connection with this for the purpose of answering any questions you may have for us. The personal data we collect depends on the information you choose to provide to us, but typically includes:

• First and last name, company/business, email address, phone number, and

• Other information you choose to include in your message.

The legal basis for processing is our legitimate interest in communicating with you and providing relevant support for any questions received.

For those who subscribe to newsletters and other marketing materials from us

Mediaflow uses your email address as a tool, for the purpose of communicating newsletters and other relevant marketing to you unless you have chosen not to receive such communications from us. You always have the right to decline to receive marketing material from Mediaflow, which can be done in the following ways:

1. By following unsubscribe instructions in marketing communications,
2. Change preferences on your account if you have an account with Mediaflow,
3. Contact us via email at privacy@mediaflow.com, or
4. By using applicable subscription management tools.

Note that even if you choose to unsubscribe from receiving marketing materials, you may still receive administrative information from Mediaflow, such as order confirmations and notifications that are necessary to manage your account on the service Mediaflow provides you as a customer.

The legal basis is our legitimate interest in sending out marketing to current and potential customers.

Recruitment

If you apply for a job or internship at Mediaflow, we process the personal data that you provide us in your application, as well as during the recruitment process, for the purpose of administering your recruitment process and either offering you a position or informing you that we will not proceed with your application. The personal data we collect for these purposes typically include:

• First and last name, address, social security number, contact information (email and phone number), and
• Grades, references, certificates, and other information you provide us in your application (such as in your CV and cover letter).

The personal data processed are collected directly from you or via a third party you apply through, such as a recruitment agency.

The legal basis is our legitimate interest in administering your recruitment process. Your personal data will be stored throughout the recruitment process and will be deleted after the process is completed, unless otherwise agreed with you. We may keep your information for future recruitments, but only after obtaining your consent, which can be withdrawn at any time.

For visitors to Mediaflow's website

When you visit Mediaflow's website, we may collect personal information about you through so-called cookies if you have consented to it. For more information, please see our Cookie Notice.

For those participating in webinars or events

Mediaflow may organise webinars and events for stakeholders, such as potential customers and users, with the purpose of promoting our services. The personal information we collect for this is:

• First and last name, company/business, job title, phone number, and email address.

The information may be collected directly from you, from your employer, or from LinkedIn.

The legal basis for the collection is our legitimate interest in inviting stakeholders to our webinars and events, administering them, and communicating with participants before and after the event.

We strive to always process your personal data within the EU/EEA. Within the scope of our services for businesses, when Mediaflow acts as a data processor, personal data will be handled and stored within the EU/EEA unless otherwise agreed between Mediaflow and the customer (data controller) for whom you use the service. In this regard, we refer you to your employer or organisation, on whose behalf you use the service, to obtain information about the extent to which your personal data may be processed outside the EU/EEA.

In the event that Mediaflow needs to process your personal data outside the EU/EEA as a data controller, for example if Mediaflow uses an IT provider who has subcontractors outside the EU/EEA, we will always take all legal, technical and organisational measures required to ensure that your information is processed at the same level of protection offered within the EU/EEA.

Within Mediaflow

Since Mediaflow has subsidiaries in Scandinavia, it is important for us to provide you with the best possible overall service and customer experience. To enable this, we sometimes need to collaborate on the handling of your personal data and share information between the companies in the Mediaflow group.

Outside of Mediaflow

Mediaflow may also share your personal information with external third parties in the following contexts:

Mediaflow's suppliers and subcontractors

Suppliers or subcontractors who provide services and functionalities to Mediaflow may be involved in the processing of your personal information in order to perform our obligations towards you. We only share your information when we deem it safe and in compliance with privacy protection legislation. We follow legal, technical, and organisational requirements to ensure that your information is handled securely.

Authorities

The Police Authority and other authorities may request access to personal information from Mediaflow. In these cases, Mediaflow only provides the information if we are legally obliged to do so. Examples of when this may occur are when:

• A request for information with the support of a search warrant.
• A request from the Privacy Protection Authority to review how Mediaflow handles your personal information in any respect.

Mediaflow may also share information about you if we determine that we have a legitimate interest to do so, for example, to establish, assert, or defend our legal claims. We ensure that the processing involved is necessary to fulfill that interest, and that our interest outweighs your right not to have your information processed for that purpose.

Mediaflow only stores your personal data for as long as necessary to fulfill our obligations to you and as required by statutory storage periods, especially regarding accounting requirements. When we process your personal data on other legal grounds, such as legitimate interest, the information is stored for as long as necessary to fulfill the purposes described above.

In the Mediaflow service system, personal data is recorded and deleted by the data controller customer according to the agreement between the data controller and Mediaflow.

Privacy legislation provides you with certain statutory rights that you can exercise against us. Below you will find a description of these rights:

Right of access

You have the right to request information about what personal data we process about you, by requesting a summary (a register extract) of our processing of your personal data free of charge. If we receive more than one request for a register extract about you per year, we may be entitled to charge a fee to handle your request.

Right to rectification

You have the right to have your personal data corrected if we have incorrect or incomplete information about you.

Right to erasure and restriction

You have the right in certain cases to request the erasure of your personal data that we process, for example, if the data is no longer necessary for the purpose for which it was collected. Erasure of personal data cannot be done if it is necessary to fulfil an agreement or if other Swedish or European law, court or authority decisions say otherwise.

Right to restriction

In some cases, you have the right to request that we restrict the processing of your personal data. For example, if you dispute that your personal data is correct, you can request a restriction of processing for a period of time that allows us to verify whether the personal data is correct.

Right to data portability

You have the right to receive the personal data we process about you in a structured, commonly used, and machine-readable format to the extent technically feasible, and to have this personal data transferred to another data controller. The right to data portability applies to personal data processed in an automated manner based on an agreement with you or your consent.

Right to object

You have the right to object to our processing of your personal data to the extent that the processing is based on the legal basis of legitimate interest. However, we may continue to process your data if we have compelling legitimate grounds for the processing that outweigh your interests.

Contact and complaints

If you want to contact us with questions or exercise your rights, please use the email privacy@mediaflow.com.

If you have complaints about Mediaflow's processing of your personal data, you have the right to submit such a complaint to the Swedish Data Protection Authority (www.imy.se).

If Mediaflow makes significant changes to this information text, we will take reasonable steps to notify you of such changes, such as sending an email to you and posting a notice on our website before the changes take effect.

This privacy information is reviewed at least annually, and all changes are approved by Mediaflow's data protection team. Last updated: 2023-01-18.