PRIVACY POLICY FOR ADMINISTRATIVE USERS (GDPR)

This privacy policy describes how your personal data is processed as an administrative user in the Service.

1. Roles and responsibilities under GDPR

In connection with your use of the Service, the organization or company that invited you, the Service Issuer (%s), is the data controller for the processing of your personal data. The Service Issuer determines the purpose of your account and how the platform is used in their operations.

The owner of the platform, digiPlant AB, acts as the data processor. digiPlant AB operates the system, stores the data, and performs technical processing exclusively on behalf of and in accordance with instructions from the Service Issuer.

2. Information processed about you

The following data is processed to provide, secure, and monitor the internal handling of applications:

Identity and contact details: Name, email address (work email), and internal user ID.
Security and authentication data: Information linked to your designated authentication methods (e.g., two-factor status, SSO tokens, and encrypted system keys).
Activity and log data (Audit Trails): Technical logs of your actions in the system (time of login, IP address, and details of which applications and data you have accessed or modified).

3. Purpose and legal basis

The Service Issuer processes your data (through digiPlant AB's platform) based on the following legal grounds:

Performance of a contract (Article 6.1b): To provide you with the tools and system access required to perform your duties under your employment or consultancy agreement with the Service Issuer.
Legal obligation (Article 6.1c): To enable the Service Issuer to comply with legal requirements regarding traceability, documentation obligations, and official administration (to be able to show who handled a specific case).
Legitimate interest (Article 6.1f): To maintain a high level of IT security in digiPlant AB's infrastructure, protect applicants' personal data, and investigate any potential misuse of the Service.

4. Recipients and sharing of data

Your data (name and logged actions) is visible to the Service Issuer's system administrators for auditing purposes. digiPlant AB, as the data processor, has access to the data to perform technical support, maintenance, and ensure operation. digiPlant AB never sells or shares your data with third parties for commercial purposes.

5. Storage period and erasure

Your account data is deleted or anonymized when your employment or engagement with the Service Issuer ends and your account is closed. Important regarding logs: History and activity logs showing who reviewed or made decisions on specific application cases are generally stored for a longer period. This is required for the Service Issuer to fulfill legal obligations and audit requirements linked to the lifecycle of the public applications.

6. Your rights and contact

Since the Service Issuer is the data controller, you should contact them to exercise your rights under the GDPR (such as the right to access, rectification, or restriction). Please note the purpose of the data processing; your right to erasure of activity logs is heavily restricted due to the Service Issuer's statutory obligations regarding traceability and case management. For questions, please contact your internal contact person or data protection officer at the Service Issuer.