Grappling Lab Sweden processes personal data in order to operate and administer a Submission Wrestling gym. This primarily includes communicating with people who wish to try a class, administering memberships, providing practical information about training, processing payments and maintaining safety in the operation.
Data controller
Grappling Lab Sweden AB is the data controller for the processing of personal data described on this page. For questions about personal data, you may contact us at Info@GrapplingLabSweden.se.
What personal data do we process?
When you contact us through the form, we may process your name, email address, telephone number and the message you provide. If you begin a trial period or become a member, we may also process information required for membership administration, payment, direct debit, attendance-related communication and practical information about training.
Why do we process the data?
We process personal data in order to answer questions, receive expressions of interest, administer trial training, manage memberships, send practical information and follow up on matters relating to the gym. The data is not used for purposes unrelated to Grappling Lab Sweden's operation.
Legal basis
The legal basis depends on why the personal data is processed.
When you contact us with questions, express an interest in trying a class or apply for membership, we process the information needed to respond to your enquiry and administer the contact.
If the processing is carried out to handle a membership application or to take steps before entering into a possible membership agreement, the processing is based on Article 6(1)(b) of the GDPR.
For general questions, planning a trial session and other communication that does not directly concern entering into an agreement, the processing is based on Article 6(1)(f) of the GDPR. Our legitimate interest consists of being able to respond to enquiries, plan the operation and communicate with people who are interested in Grappling Lab Sweden.
When you become a member, we process the information needed to enter into and perform the membership agreement, administer the membership, communicate with you and manage membership fees and payments. The processing is based on Article 6(1)(b) of the GDPR.
Information that must be processed or retained in order to comply with legal obligations, for example under bookkeeping legislation, is processed under Article 6(1)(c) of the GDPR.
Personal data needed to operate and protect the website, prevent misuse, detect technical faults, compile server-based website statistics or establish, exercise or defend legal claims is processed under Article 6(1)(f) of the GDPR. Our legitimate interests consist of being able to operate a secure and functioning business, improve the website, handle incidents and protect the company's legal interests.
External functional services, such as Google Maps and embedded YouTube videos, are activated only after you have given your consent. Such processing is based on Article 6(1)(a) of the GDPR. You may withdraw or change your consent at any time through the website's cookie settings.
Training, safety and health information
Submission Wrestling is a physical contact sport. We therefore ask you to inform the instructors about injuries or other circumstances that are important so that the training can be carried out safely.
We do not normally request health information through the website forms and we do not maintain a general register of members' health.
If you voluntarily provide information about an injury or your health, we first try to use the information only in the current training situation without documenting it.
If it is necessary to record or retain health information, this will normally take place only after you have given separate and explicit consent. The processing is then based on Articles 6(1)(a) and 9(2)(a) of the GDPR.
You may withdraw such consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.
If information about an injury or incident must be processed in order to establish, exercise or defend a legal claim, the processing may be based on Articles 6(1)(f) and 9(2)(f) of the GDPR.
In an emergency where a person is physically or legally incapable of giving consent, processing may in exceptional cases be necessary to protect the vital interests of that person or another person under Articles 6(1)(d) and 9(2)(c) of the GDPR.
Photos and video
Photos, videos and audio recordings in which a person can be identified are personal data.
Grappling Lab Sweden AB has chosen to use separate consent as the legal basis when identifiable photos or videos are published for marketing purposes on the website, in social media or in other marketing material. The processing is then based on Article 6(1)(a) of the GDPR.
For persons under the age of 18, we obtain the approval of a parent or legal guardian. We also take the child's own wishes and maturity into account.
Consent may be withdrawn at any time by contacting us. After consent has been withdrawn, the material will not be used in new publications. We will also, without undue delay, take reasonable steps to remove the material from websites, accounts and other channels that we control.
Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.
Google Maps and YouTube
We use Google Maps to display maps and directions and YouTube to display embedded videos.
The services are loaded only after you have consented to functional services through the website's cookie settings. When a map or video is loaded, Google and YouTube may process technical information, such as your IP address, browser and device information and information about how the service is used.
Google and YouTube may act as independent data controllers for parts of this processing. Their processing is carried out in accordance with their own privacy terms.
Who receives the data and which service providers do we use?
Personal data is handled only by people within Grappling Lab Sweden AB who need it to administer contact, trial training, memberships, accounting and payments. We use the following service providers and services:
Netlify: used to host and publish the website, process website forms, provide technical logs and provide Netlify Web Analytics.
YouTube and Google: used to display embedded videos on the website. The videos are loaded in privacy-enhanced mode from youtube-nocookie.com and only after the visitor has consented to functional services. When a video is loaded or played, YouTube and Google may process technical information such as the IP address, browser information and information about use of the video under their own terms.
Proton Mail: used for email and communication with people who contact us, attend trial training or are members.
Fortnox: used for accounting, invoicing, payment administration and other financial administration.
Swedbank: used for the company bank account, banking services, payments and direct debit administration.
Bankgirot: used for Bankgiro services, direct debit and the transmission of payment information.
Netlify, Proton Mail and Fortnox may process personal data on our behalf when providing their respective services. Such processing must be covered by applicable agreements and data protection terms. YouTube and Google may act as independent data controllers for processing that takes place when videos are loaded or played. Swedbank and Bankgirot process data to carry out payments and may also have their own legal obligations, for example under rules governing banking, payments, accounting and anti-money laundering. They may therefore act as independent data controllers for parts of the processing. We disclose only the information required for the relevant service and purpose.
Transfers of personal data outside the EU and EEA
Some of our service providers may process personal data outside the EU and EEA.
Netlify may process personal data in the United States and in other countries. Netlify states that transfers to countries without an adequacy decision may, among other things, be protected by the European Commission's standard contractual clauses. For transfers to the United States, the EU–US Data Privacy Framework may be used where the receiving organisation participates in the framework.
Google and YouTube may process personal data in the United States and other countries. Google LLC states that the company participates in the EU–US Data Privacy Framework.
Proton Mail is provided by Proton AG in Switzerland. Switzerland is covered by a European Commission adequacy decision.
Where a transfer is made to a country that is not covered by an adequacy decision, the transfer must be based on appropriate safeguards, such as the European Commission's standard contractual clauses.
You may contact us if you would like more information about a particular transfer, the safeguard used or how you can obtain a copy of the applicable safeguards.
Server-based website analytics through Netlify
We use Netlify Web Analytics to obtain aggregated statistics about how the website is used, such as page views, unique visitors, visited pages, referring websites, approximate geographic distribution and technical errors such as missing pages. The statistics are generated from Netlify's server and CDN logs. According to Netlify, this function does not use cookies and does not run an analytics script in the visitor's browser. To calculate unique visitors, Netlify distinguishes between different IP addresses within the selected time period. Technical connection data, including IP addresses, may therefore be processed by Netlify. The processing is based on our legitimate interest in understanding how the website is used, identifying technical problems and improving the website. Grappling Lab Sweden does not use the statistics to identify individual visitors or for direct marketing. Because the service is server-based and does not use cookies, it is not controlled by the choices made in the website's cookie banner. Retention and deletion follow the settings and terms applicable to our Netlify service.
How long do we retain the data?
We do not retain personal data for longer than is necessary for the purpose for which it was collected. The data is then deleted or anonymised unless we are required to retain it by law or need it to establish, exercise or defend legal claims.
People who attend trial training but do not become members: names, contact details, messages and information used to administer trial training are deleted or anonymised no later than three months after the most recent trial session or the most recent contact, whichever occurs later. The information may be retained for longer if the person expressly asks us to remain in contact, if an ongoing matter must be handled or if retention is required by law.
Membership data during the membership: information required for membership administration, communication and payments is retained for as long as the membership remains active.
Membership data after the membership has ended: the ordinary membership register and routine contact details are deleted or anonymised no later than twelve months after the membership ends. Limited contract, consent and payment information required to handle claims, objections or disputes may be retained for up to three years after the membership ends. If a matter or dispute is still ongoing, the information required for that matter may be retained until it has been finally resolved.
Accounting records: information forming part of accounting records, such as invoices and payment records, is retained for seven years after the end of the calendar year in which the relevant financial year ended.
Injuries, incidents and insurance matters: information required to handle an injury, incident, insurance matter or legal claim is retained only for as long as the matter and any applicable legal obligations require. It is then deleted or anonymised.
The same deletion principles apply to information stored in email, administrative systems and other working copies. Backups are overwritten in accordance with each service provider's ordinary routines.
Do you have to provide the personal data?
The information marked as mandatory in our forms is required so that we can respond to your enquiry, administer a trial session or process a membership application.
Your name and contact details are required so that we can identify and communicate with you. Information needed for payment and direct debit must be provided so that we can manage the payment through the selected payment method.
If the necessary information is not provided, we may not be able to respond to the enquiry, administer the trial session, process the membership application or perform the membership agreement.
Information that is not marked as mandatory is voluntary. It is also voluntary to consent to external functional services, photography, filming and other processing based on consent.
Your rights
You have the right to request confirmation as to whether we process personal data about you. If we process such information, you have the right to access it and receive a copy of the personal data.
You also have the right, where the requirements of the GDPR are met, to request:
- rectification of inaccurate or incomplete personal data,
- erasure of personal data,
- restriction of processing,
- to object to processing based on a legitimate interest,
- data portability for personal data processed by automated means on the basis of consent or a contract.
Where processing is based on consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.
These rights are not absolute. A request may in some cases be rejected in whole or in part if continued processing is required by law or is necessary to establish, exercise or defend legal claims.
Contact us at Info@GrapplingLabSweden.se if you wish to exercise any of your rights. We normally respond to your request within one month.
Automated decision-making and profiling
Grappling Lab Sweden AB does not use automated decision-making or profiling where decisions are based solely on automated processing and produce legal effects or similarly significant consequences for you.
External service providers may process information in accordance with their own privacy terms when you choose to activate their services.
Complaints
If you believe that your personal data is being processed incorrectly, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection, IMY.
Changed purposes and updates
If we intend to begin processing personal data already collected for a new purpose, you will be provided with information about the new purpose and other relevant information before the new processing begins.
This information may be updated if the business, the website, the service providers or our processing of personal data changes.