PRIVACY POLICY

This privacy policy (hereinafter the "Privacy Policy") applies at all times between Nysnö AB, company registration no. 559307-3413 (hereinafter “Nysnö”), and users (hereinafter the "User") in connection with the use of any of Nysnö's services, the User's usage of Nysnö’s website and Nysnö’s social media pages, or when contacting Nysnö, for instance via email (hereinafter collectively referred to as "Usage" and "Channels," respectively).

Nysnö acts as the data controller responsible for processing the User’s Personal Data (as defined in section 2), which is registered with Nysnö by the User's action or directly collected by Nysnö from the User via the Channels or from a third party.

The purpose of this Privacy Policy is to ensure that the User feels confident that Nysnö, as data controller, processes the User’s Personal Data in accordance with applicable data protection legislation. Below, the manner in how Nysnö processes the User’s Personal Data, the User’s rights, and how the User can contact Nysnö if they have questions or wish to exercise their rights, are described.

By providing information to Nysnö through any of the Channels or by otherwise using Nysnö’s services, the User consents to Nysnö processing the User’s Personal Data where such processing is necessary for Nysnö to provide services or information to the User or as otherwise stated in section 2 below. If the User does not provide required information or explicit consent where necessary, the User may not access Nysnö’s services or information.

Should Nysnö amend the Privacy Policy, Nysnö will notify the User accordingly.

“Personal Data” means any information relating directly or indirectly to an identified or identifiable natural living person. Personal Data processing occurs through the provision of Nysnö’s services or information requested by the User.

Nysnö processes Personal Data to administer the User’s registration for various services and expressions of interest with Nysnö, to enable the User to participate in Nysnö’s community, and otherwise to offer the User various services and information from Nysnö. Furthermore, processing is carried out for research purposes and to measure customer satisfaction, and for the use of Nysnö's app and digital platform. The latter primarily includes the processing of name, email address, telephone number, town or city, profile picture, profile description, geographical location, messages, chat and forum posts, notification settings, health declaration, and payments via, for example, PayPal and Swish. The purposes of processing Personal Data are to fully deliver services, inform Users about these services, market them, measure customer satisfaction, and conduct research. Nysnö collects and processes the User’s Personal Data only to the extent necessary to provide and market services, deliver related information, measure customer satisfaction, or conduct research. Upon contact with Nysnö, Nysnö saves the Personal Data necessary to communicate with the User. In using Nysnö’s services, Nysnö may also need to process necessary Personal Data regarding health and allergies; more information about this is provided in section 3.

The legal basis for collecting and processing the User's Personal Data is the User's consent, an existing contract between Nysnö and the User, or a legal obligation—such as when Nysnö must retain data according to accounting rules or to deliver a service to the User. Exceptions apply in circumstances where obtaining prior consent is practically impossible, the processing remains lawful, and Nysnö has a legitimate interest in processing Personal Data, e.g., for marketing purposes, follow-up of services performed, or to exercise or defend against legal claims (based on legitimate interests).

Sensitive Personal Data refers to information revealing ethnic origin, political opinions, religious beliefs, trade union membership, and Personal Data concerning health or sexual life.

Nysnö may process sensitive Personal Data about the User, such as data concerning physical or mental health, when conducting screenings prior to participation in retreat programs to assess the suitability of participants, or regarding allergies and similar matters, to adapt meals for retreat participants. This processing occurs only after obtaining explicit consent from the User or to fulfill contractual obligations towards the User.

Nysnö will not share User Personal Data with any third party without the User’s consent, except as specified in this Privacy Policy or in Nysnö’s cookie policy, unless required by law or necessary in connection with ongoing legal, administrative, or debt recovery proceedings involving Nysnö and the User. However, Nysnö reserves the right to share the User’s Personal Data with Nysnö’s affiliate, Lavin Education AB, company reg. no. 5594814880 (“Lavin”), if required for Lavin to deliver services to the User according to an agreement between the User and Nysnö.

Nysnö engages subcontractors to perform services (so-called "data processors"). These subcontractors may handle Personal Data and may require access to User Personal Data collected through Nysnö. Nysnö always strictly limits such subcontractors' access to the Personal Data necessary to fulfill the processing purposes outlined in section 2.2.

Additionally, Nysnö may engage subcontractors for third-party services related to Nysnö's own services, which provide these third-party services directly to the User and independently act as data controllers, such as payment solution providers. Therefore, Users may sometimes be required to submit Personal Data directly to these providers, whose handling of Personal Data is not covered by this Privacy Policy. Users are referred to the respective privacy policies of such subcontractors for information on how these subcontractors handle User Personal Data.

From time to time, Nysnö engages in research collaborations with various external actors, such as universities. Through its operations, Nysnö possesses unique and valuable data relevant to psychedelic research, which can significantly benefit the broader development of the psychedelic field. Nysnö will not share User Personal Data with such third parties without the User’s prior consent. However, Nysnö may share anonymized and/or aggregated data that cannot be specifically linked to the User without prior consent. Nysnö may also send inquiries to Users regarding whether they consent to being contacted by external parties for research participation. When research involving Users is conducted by a third party, that third party typically acts as the data controller.

The User has the right, free of charge, to request information about the Personal Data that Nysnö processes concerning the User (a so-called "register extract"). Should the User wish to know if Nysnö processes Personal Data about them, they may submit a written and signed request to Nysnö using the contact information provided below. When submitting the request, the User should clearly specify the information they are interested in. This allows Nysnö to provide the relevant details effectively. If the User makes repeated requests, Nysnö may charge a fee or, in some legally stipulated cases, refuse to comply with the request. Further rules apply as stipulated in section 17.1 for the User to exercise their rights according to this section 7.1.

Extracts from the register will be sent to the User within 30 days of Nysnö receiving the request. If the extract is extensive and Nysnö requires additional time, or if for any reason Nysnö cannot fulfill the request, Nysnö will inform the User accordingly.

To fulfill its obligation to maintain accurate and relevant Personal Data, Nysnö regularly reviews its records and updates Personal Data as necessary. If the User notices that the Personal Data processed by Nysnö is incorrect or incomplete, the User has the right to have their Personal Data corrected. Simple corrections are normally made without delay, but in other cases, Nysnö may need to consider the User’s request carefully. Nysnö will not approve a rectification request if it is impossible or demands unreasonable effort.

If the User’s Personal Data is amended at the User’s request, Nysnö will inform any subcontractors and partners who previously received this data of the updated Personal Data. If requested by the User, Nysnö will also inform the User about the parties who have been notified of the corrections.

Nysnö has the right to refrain from erasing Personal Data if it is necessary for Nysnö to fulfill a legal obligation, establish or defend legal claims against the User, for example in cases involving disputes due to outstanding claims or the User’s breach of agreement with Nysnö.

Upon receiving the User’s request, Nysnö will assess whether grounds exist for erasure of the User’s Personal Data. Nysnö will subsequently inform the User of the assessment. If Nysnö erases the User's data upon their request, Nysnö will inform subcontractors and collaboration partners to whom such data was disclosed. However, Nysnö will not perform such notification if doing so is impossible or requires an unreasonable effort.

Restriction means that Personal Data is marked and thereafter only processed for certain limited critical or statutory purposes.

The User has the right to object to Nysnö’s processing of their Personal Data when Nysnö relies on legitimate interest as the legal basis for processing. The User must specify in writing which processing they object to. Following such an objection, Nysnö may only continue processing if it can demonstrate compelling legitimate grounds for the processing that outweigh the interests of the User.

However, if the User’s Personal Data is processed for direct marketing purposes, the User has the absolute right to object to such processing at any time.

If the User wishes to make a request according to their rights stated above, such a request must be submitted in writing and sent by postal mail to Nysnö's registered business address as stated in the official business register at the time—mark the envelope "GDPR". Because it is crucial that Nysnö does not disclose the User’s Personal Data to unauthorized persons, requests must be submitted in writing, signed by the User, scanned, and sent by postal mail to Nysnö. The request must also include a signed copy of a valid identification document (passport or driving license) and precise details of the requested action, as well as the User’s contact information. The User's accounts in Nysnö's app or digital platform can instead be deleted in the respective platform in the manner indicated therein. Nysnö will then only retain such data as Nysnö is required by law to retain, for example accounting records.

If the User has any questions regarding this Privacy Policy or Nysnö’s processing of Personal Data, they may contact Nysnö via email at [email protected].