Controller Name: Me and You Software (MYS) AB, Swedish Company Reg. No. 559510-8357
Address: Luftkabelgatan 9, 125 49 Stockholm, Sweden
Email for Privacy Matters: privacy@meandyousoftware.com
Data Protection Officer (DPO): Nash Carlson Ddungu

We process personal data that you provide to us, data we collect automatically, and data we receive from third parties. We collect several types of information from and about users, including:

• Account information: full name, email address, company name, job title, phone number, billing address
• Profile information: username, password, profile photo, professional information
• Communications: support requests, correspondence, survey responses, feedback

2.1. Account and Contractual Data: We process identification data (name, email, IP address), billing information (address, VAT number, payment details), and login credentials for the purpose of performing our contract with you (GDPR Art. 6.1.b) and maintaining security. This processing is necessary for the performance of a contract and for compliance with legal obligations under Swedish accounting law.

2.2. Usage and Support Data: We process technical logs, device information, and support tickets. The purpose is to ensure the proper functioning of the service, to debug errors, and to improve our product (GDPR Art. 6.1.f - Legitimate Interest).

2.3. Marketing Data: We process contact details and interaction metrics to send newsletters, event invitations, or promotional content (GDPR Art. 6.1.a - Consent). You have the right to withdraw this consent at any time via the unsubscribe link in our emails.

The legal bases for our processing of personal data under the GDPR include:

• Contractual Necessity (Art. 6.1.b): Processing necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
• Legal Obligations (Art. 6.1.c): Processing necessary for compliance with a legal obligation to which the controller is subject.
• Legitimate Interests (Art. 6.1.f): Processing necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.
• Consent (Art. 6.1.a): Processing based on the data subject's freely given, specific, informed, and unambiguous indication of his or her wishes.

We will retain your personal data only for as long as is necessary for the purposes set out in this Privacy Policy. The criteria used to determine our retention periods include:

• The length of time we have an ongoing relationship with you and provide the Service to you;
• Whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records of your transactions for 7 years under Swedish accounting legislation);
• Whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation, or regulatory investigations).

Upon expiration of the applicable retention period, we will securely delete or anonymize your personal data.

5.1. General Prohibition on Collection. Our Service is not directed to children under the age of 16, and we do not knowingly collect personal data from children under this age.

5.2. Age of Consent for Information Society Services. In accordance with Article 8 of the GDPR and the Swedish implementation thereof, the processing of personal data of a child shall be lawful where the child is at least 13 years old in relation to the offer of information society services made directly to a child. Where the child is below the age of 13, such processing shall be lawful only if and to the extent that consent is given or authorized by the holder of parental responsibility over the child.

5.3. Special Provisions for Services Requiring Higher Protection. For certain features of our Service that we determine to involve higher risk or specific legal requirements under Swedish or EU law, we may apply a higher age threshold of 16 years old. Where this applies, we will clearly state the higher age requirement at the point of registration for that specific feature.

5.4. Parental Consent Verification. Should we require parental consent for a user under the applicable age threshold, we will make reasonable efforts to verify that consent is given or authorized by the holder of parental responsibility, considering available technology. This may include, but is not limited to:

• Requesting a signed consent form sent to a parent/guardian email address;
• Using a credit card or other online payment system that provides notification of each separate transaction to the primary account holder; or
• Requesting verification of official identification.

5.5. Rights of Parents and Guardians. If you are a parent or guardian and you believe that your child has provided us with personal data without your consent, you have the right to:

• Request access to the child's personal data (Art. 15 GDPR);
• Request the erasure of the child's personal data (Art. 17 GDPR);
• Withdraw your consent at any time (Art. 7.3 GDPR).

To exercise these rights, please contact our Data Protection Officer/Privacy Team at privacy@meandyousoftware.com. We will promptly delete or anonymize the data of any child where we have inadvertently collected it without verified parental consent.

5.6. Consequences of Age Misrepresentation. If we become aware that a user has misrepresented their age and is below the required age of consent without appropriate parental authorization, we will immediately terminate their account and delete all associated personal data, except where retention is required by Swedish law (e.g., records required for accounting or legal claims).

Under the GDPR, you have the following rights regarding your personal data:

• Right of Access (Art. 15): The right to obtain confirmation as to whether or not personal data concerning you is being processed, and, where that is the case, access to the personal data and specific information.
• Right to Rectification (Art. 16): The right to obtain the rectification of inaccurate personal data concerning you.
• Right to Erasure (Art. 17): The right to obtain the erasure of personal data concerning you without undue delay in certain circumstances ("right to be forgotten").
• Right to Restriction of Processing (Art. 18): The right to obtain restriction of processing in certain circumstances.
• Right to Data Portability (Art. 20): The right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format.
• Right to Object (Art. 21): The right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on legitimate interests.
• Right to Withdraw Consent (Art. 7.3): Where processing is based on consent, the right to withdraw consent at any time.

To exercise these rights, please contact us at privacy@meandyousoftware.com. We will respond to your request within one month (extendable by two further months where necessary, taking into account the complexity and number of requests).

7.1. Location of Processing. Your personal data is primarily stored and processed within the European Union/European Economic Area (EU/EEA).

7.2. Third Country Transfers. In some cases, we may transfer personal data to third countries outside the EU/EEA (for example, to cloud service providers or support tools). Where such transfers occur, we ensure an adequate level of protection is guaranteed through one of the following safeguards:

• An adequacy decision adopted by the European Commission;
• Standard Contractual Clauses (SCCs) approved by the European Commission pursuant to Article 46 GDPR; or
• Binding Corporate Rules (BCRs) for intra-group transfers.

For transfers of personal data to third countries that are not subject to an adequacy decision, we rely on the European Commission's Standard Contractual Clauses and implement supplementary technical and organizational measures to ensure a level of protection essentially equivalent to that guaranteed within the EU.

We use cookies and similar tracking technologies to track activity on our Service and hold certain information. We use both session cookies (which expire once you close your web browser) and persistent cookies (which stay on your device until you delete them).

We only place non-essential cookies (marketing, analytics, preferences) on your device after obtaining your explicit consent via our cookie banner, in compliance with the Swedish Electronic Communications Act (Lag om elektronisk kommunikation) and the ePrivacy Directive.

You can manage your cookie preferences at any time by clicking Cookie Settings.

Under the GDPR, you have the right to lodge a complaint with a supervisory authority. In Sweden, the relevant authority is:

Integritetsskyddsmyndigheten (IMY)
(formerly known as Datainspektionen)
Box 8114, 104 20 Stockholm, Sweden
Website: www.imy.se
Email: imy@imy.se

IMY is the Swedish watchdog that ensures compliance with GDPR and is an active authority that does not hesitate to issue guidelines and fines.