Privacy policy
Information about Norrlandsoperan’s processing of personal data
1. Introduction
In order to fulfill our commitments to you as a customer, provide good service, offers and information about our performances and concerts, we need to save and handle certain personal data.
Norrlandsoperan needs to collect certain information that is directly or indirectly linked to the buyer, customer, competition participant, job applicant (so-called “Personal Data”) in order to fulfill our commitments, agreements, legal requirements or other legitimate interest.
The GDPR (General Data Protection Regulation 2016/679) or the Data Protection Regulation as it is called in Swedish regulates how we may process your personal data. The regulation came into force throughout the EU/EEA from May 25, 2018.
2. The Principle of Public Access
As Norrlandsoperan is owned by Umeå Municipality and Region Västerbotten, we are also subject to the principle of public access to official documents, which means that in certain cases we are obliged by law to disclose public documents.
Information that you provide to us that is part of a public document, such as an e-mail or letter, may therefore be disclosed. A confidentiality assessment is made before disclosure in accordance with Chapter 21 §7 of the Public Access and Secrecy Act (2009:400) if it can be assumed that the information or disclosure will be processed in violation of data protection legislation.
3. What is Personal Data?
Any information that can be linked to an individual is considered personal data. So-called indirect data such as telephone numbers, mobile numbers, e-mail addresses and user IDs are also personal data. Personal data also includes photos, videos and recorded conversations.
4. What Is the Processing of Personal Data?
Processing of personal data is any operation which is performed on personal data, whether or not by automatic means. The GDPR applies to fully automated processing, but also to manual processing if the personal data is or will be included in a register.
You can assume that everything that is done with personal data in a computer counts as processing. Collection is a processing operation, registration is a processing operation, printing is a processing operation, etc. It is not only the handling of personal data in IT systems and databases that counts as processing operations, but also in Office files such as Word and Excel, as well as PDF files.
5. What Personal Data Do We Process?
When you make a purchase through one of our ticket offices or buy a ticket via our e-commerce platform, we will collect the following personal data:
- First and last name.
- Postal address.
- Telephone number.
- Email address.
- Social security number (in external payment service, Payex).
When you subscribe to our newsletter, your email address and your first and last name will be collected and stored.
When you enter one of our competitions, we need your name, year of birth, address and email address when you register. We may also digitally broadcast the competition live and take photographs of participants.
For winners where a prize is paid, we also need your social security number and bank details.
When you register for a workshop or audition we need your name and email address. When you apply for a project grant, we also need your social security number or organization number and address. If relevant for the selection process, we may also collect information on year of birth, gender, project description and photographs and/or audio/video material.
In addition, we may collect telephone numbers, social security numbers and addresses from approved participants. We may also take photographs of participants and make short audio and video recordings during the workshop or audition.
In the case of registration or participation of minors, the name, email address, telephone number and address of the guardian will be saved.
If you are an invoice customer or supplier, we process contact information that you have provided, such as name, address, telephone number, email address, organization number, customer number and bank details. In addition, we process information about the assignment or the services or products to be performed/delivered.
In the context of handling whistleblowing cases, personal data in the form of names may be processed for the following categories of data subjects:
- The person reporting a case, unless they choose to remain anonymous.
- The person or persons who appear in a report.
- The person who has an administrative role to process and investigate reported cases.
When you submit an application for a job vacancy at Norrlandsoperan, we process the following personal data for the recruitment process: name, address, telephone number and email address.
We also process other personal data that may be contained in your application documents, in a personal letter and CV, references, any interview notes and personality tests and any digitally submitted audition.
If you have a protected identity, please contact the contact person indicated in the job advertisement.
We may process your personal data if you visit our website. Whether and, if so, what personal data we process about you depends partly on the settings you have in your own browser and partly on the settings you made when you landed on our website. Our website uses cookies, which are small text files that collect various types of information about how you as a visitor use our website. You can read about our use of cookies and which cookies we use in our Cookie Policy.
We are responsible for the personal data we publish on our social media channels on LinkedIn, Facebook and Instagram. If you interact with our social media channels, we process your profile data and data in posts or comments that you make in our social media channels. We have a responsibility to ensure that inappropriate or offensive posts are not published on our channels. In such cases, we will remove those posts.
6. Purposes And Legal Grounds for Processing Personal Data
Our purpose in processing your personal data is primarily to fulfill our agreements or commitments to you, including providing you with tickets and/or other valuable documents (e.g. gift cards) and sending you information and updates by email about the event for which you have purchased a ticket. If you have a user account on “My pages” on Norrlandsoperan.se, the purpose is also to provide you with a well-functioning e-commerce platform, where you can buy tickets for various events and see your history of previous purchases.
The purpose is also to verify that, when you buy tickets through the ticket office or the e-commerce platform, you are acting in your capacity as a consumer and will not resell tickets for commercial purposes.
The legal basis for the processing of personal data is partly to fulfill our agreements or commitments to you, and partly our legitimate interest in ensuring that you act as a consumer.
The purpose of our communication with you via newsletters and mailings about upcoming events, performances and products is to promote Norrlandsoperan’s events and related products. You will only receive this type of direct marketing after you have given your consent to our processing of your personal data. You always have the option to opt out of such communications by clicking Unsubscribe at the bottom of the relevant email or unsubscribing through the box office. The purpose is also to inform you of updates to our terms and conditions by email.
When we send out analog direct mailings regarding, for example, subscriptions, which you have not previously registered your interest in, we may process your personal data. This is because our legitimate interest in making available and offering a rich cultural offering outweighs the interests of the data subject. You can always opt out of this type of invitations and marketing by sending an email to .
In some cases, we send out invitations regarding premieres to cultural, political and business leaders. We do this based on Norrlandsoperan’s legitimate interest as these people are relevant and have a special importance for the organization and the business. If you do not want to take part in the VIP invitation, please contact us at .
Information when registering for the competition
Norrlandsoperan collects your name, artist name, email address and year of birth when you register to participate in the competition. We will use this information in order for the judges to know who is participating and to make their assessment of the contestants. The legal basis of the processing is our legitimate interest in providing and administering participation in competitions.
Live broadcast, recording and still images during the competition
Norrlandsoperan may film the competition to show our activities and make the event visible. It is a public and scenic performance where the public can also take part in the competition on site. The legal basis for the processing is our legitimate interest in enabling the public to take part in the competition and our activities even if they cannot be present.
Recordings and still images may be published on our social channels (Instagram, Facebook) and used for marketing purposes on our website.
Information to winning contestants
If you are successful in the competition and wish to receive payment of the prize money (applies to Up North), Norrlandsoperan will, in addition to your name and artist name, collect your social security number, address and bank details. The processing is carried out on the basis of our legitimate interest in administering and carrying out the payment of the competition prize/prize money.
We publish the name and picture of the winners in our social channels (Instagram, Facebook), to credit the winners with the fact that they have won the competition and to showcase our business based on our legitimate interest.
When you apply, we collect certain information so that we are able to inform you whether you have been accepted or not. In some cases, this information is also needed to assess whether you are qualified for participation. If you have been accepted, we collect additional data from you so that we can contact you with information about the workshop or audition. The data collected is used to communicate information about the activity to you and to know who is participating. In case of project applications the data is used to verify the authenticity of the application and to make a correct assessment process. The processing operations are necessary for the purposes of our legitimate interest in providing and managing your participation in workshops or auditions.
Where audio and video is recorded, this is for documentation and/or marketing purposes. We may publish the name and picture of participants in our social channels (e.g. Instagram, Facebook). The processing is based on our legitimate interest in marketing our business.
If you are contracted after an audition, we will need your social security number, your postal address and your email address in order to administer and make payment of any agreed compensation. The processing is necessary for us to fulfill our side of our contract with you.
If minors are contracted, information about name and social security number may be used in connection with the notification to the Swedish Work Environment Authority for consent to exceptions to working time rules. The processing is based on our legitimate interest to administer the application to the Swedish Work Environment Authority.
The documents that are subject to archiving under the Archives Act are listed in our document management plan. The document management plan is approved by the Board of Norrlandsoperan. Contact our data protection coordinator to find out more. The documents that are to be preserved are transferred to Umeå municipality’s city archive and after that, Umeå municipality becomes the data controller for the processing of any personal data included in said documents.
If you have purchased tickets or we have invoiced you for a service or participation fee, we need to save information and invoicing documents to comply with the Accounting Act. The legal basis for processing is legal obligation.
The processing of your personal data in our registers is based on when we have entered into an agreement with you as a data subject and legitimate interest if we have entered into an agreement with the organization you are employed by. Processing is also based on a legal obligation when we are required by law to process your personal data. The processing is necessary for us to be able to properly administer the financial transactions generated by the business relationship.
The purpose of the processing is to be able to comply with the legal requirements imposed on the organization to enable whistleblowing and conduct the investigation required by the cases. The purpose is also to process personal data where necessary in the context of follow-up cases. This means that we may need to process personal data to:
- Manage reported whistleblowing cases.
- Enforce the organization’s rights and obligations based on the irregularities revealed in whistleblowing cases.
- Comply with the legal requirements imposed on the organization.
The legal basis for processing personal data in connection with whistleblowing cases is a legal obligation under Chapter 5, Section 2 of the Act on the Protection of Persons Reporting Misconduct.
The legal basis for processing personal data in connection with the follow-up of whistleblowing cases and other measures taken as a result of a reported case is the fulfillment of a legal obligation or our legitimate interest in the matter.
Our purpose in processing your personal data in connection with recruitment is to be able to administer and carry out our recruitment processes in an efficient and correct manner. As an employer, Norrlandsoperan has a legitimate interest in being able to find suitable candidates to fill a particular position and administer the application.
The purpose of the processing is to obtain information on how our website is used in order to evaluate and improve the website and to understand how visitors use it and to ensure the functionality of the website. We rely on the legal basis of legitimate interest for the use of strictly necessary cookies as they are needed to provide you with a functioning website. The processing of your personal data using non-essential cookies is based on the legal basis of consent, where applicable.
The purpose of our social media channels is to disseminate information about our activities and services. If you interact with any of our social media channels, you also agree to receive our posts in your own feed. You can unlike the page or hide individual or all of our posts at any time. The legal basis is our legitimate interest to promote our business.
7. For How Long Do We Keep Your Personal Data?
If your customer account has been inactive for more than 24 months, your data will be automatically deleted. You always have the right to cancel your user account for the e-commerce platform. If you want to cancel your user account, please contact us using the contact details below.
If you have subscribed to our newsletter, we will keep your email address and your first and last name until you inform us that you no longer wish to receive the newsletter.
The personal data is stored for two years after the end of the competition to enable contact regarding any follow-up, and to guarantee transparency in the selection process in accordance with the Principle of Public Access and the Discrimination Act. The data is then deleted.
For competition winners, the payment information is stored in our financial system for seven years (not including the current year) based on the requirements of the Book-keeping Act. Images and videos published on social media will not be deleted.
The personal data is stored for two years after the end of the workshop or audition in order to enable contact regarding any possible follow-up, and to guarantee transparency in the selection process in accordance with the Principle of Public Access and the Discrimination Act. The data is then deleted. Images and video material published on social media will not be deleted.
For project applications where financial support has been granted, the necessary payment information is saved in our financial system based on the requirements of the accounts (seven years, not including the current year).
If you are contracted after an audition and compensation is paid, we will save the necessary payment information in our financial system based on the requirements of the Book-keeping Act (seven years, not including the current year).
For the Book-keeping Act, we need to save invoicing documents that may contain personal data for seven years.
General documents that are to be saved for archival purposes will be preserved and transferred to Umeå municipality’s archive, when the documents are no longer needed in our operations. If a document is not to be retained for archival purposes, we will delete (erase or destroy) the document. This will only occur after the document has met the needs we have (for example, certain legal requirements or another public or legitimate interest) to keep the document (i.e. it has reached its deletion deadline).
Our document management plan includes all public documents and the applicable deletion periods or whether they have a preservation decision (to be kept for archival purposes).
When we have transferred documents to Umeå municipality’s archive, Umeå municipality becomes the data controller for the personal data contained in the public documents. Therefore, you need to contact Umeå municipality if you want to exercise your rights for public documents that have been transferred to them.
Personal data is only stored for as long as there is a need to retain it in order to fulfill the purposes for which the data was collected and in accordance with legal obligations. Norrlandsoperan’s supplier and customer registers are deleted once a year. This also applies to customer and supplier invoices and contracts. The criterion for deletion is in accordance with the Book-keeping Act, which means that contact information, inactive contracts and supplier invoices are deleted seven years after the end of the financial year to which the documents relate.
There may be legal obligations that prevent us from deleting certain personal data. These obligations can be found, for example, in accounting legislation and the Principle of Public Access.
Your personal data involved in a whistleblowing case will be kept for two years from the date that the case is closed.
The personal data used to manage administration and authorization will be stored as long as the authorization is valid.
When the retention period expires, all personal data will be deleted.
If a case requires further internal investigation, we will continue to process your personal data for as long as the case requires it.
Interview notes and information from referees, etc. are kept for as long as they are needed within the framework of the application procedure. After the application procedure and any appeal period is over, these are deleted.
At the end of the application procedure, the contact details of the candidate who has been offered the position, as well as his or her personal letter and CV, are archived together with the recruitment decision in the personnel file. Personnel files are kept for archival purposes and are handed over to our archiving authority upon termination of employment.
Application documents from those who have not received the position applied for are stored for two years to fulfill the appeal period under the Discrimination Act. The legal basis for preservation for the purpose of ensuring action before any discrimination process is a legal obligation.
Personal data collected during visits to our website are deleted when we no longer have a legitimate interest in saving this data. How long a cookie is stored is indicated in the cookie banner and in our Cookie Policy.
Your personal data, in the form of interactions or comments you make, where it is clear that you as an individual are the sender will be retained until further notice or until you delete the interaction or comment yourself, or when we delete the post on our social media channel. Where appropriate, we will remove unwanted comments on an ongoing basis.
8. Who We Share Your Personal Data With
Data processors
In order to provide you with the e-commerce platform and ticket office, we use suppliers for server space, email management and digital ticketing system, for example (so-called data processors). Our servers, as well as the servers of our data processors, are mostly located in the EU.
If you want to know which data processors we have, you can get information about this by contacting us through the contact details below. You can also read the section about your rights below.
Transfers to third countries
In some cases, our suppliers (or their respective subcontractors) process personal data in a country outside the EU/EEA, a so-called third country. If personal data is transferred to a third country, we will always take appropriate security measures to best protect your personal data. Such appropriate safeguards may include:
- Ensuring that the European Commission has decided that the country to which the personal data is transferred achieves an “adequate” level of protection equivalent to the level of protection ensured by the GDPR.
- We enter into the EU Commission’s standard contractual clauses with the recipient of the personal data in the third country. When personal data is transferred to third countries under the European Commission’s standard contractual clauses, we assess whether there is legislation in the recipient country that affects the protection of your personal data. If necessary, we will take specific technical and organizational measures to ensure that the protection of your data is maintained during the transfer to the relevant country outside the EU/EEA.
You can contact us via and request a copy of the security measures.
Other data controllers
As Norrlandsoperan is subject to the Swedish Archives Act, we will transfer certain documents containing personal data to Umeå municipality. After the transfer, Umeå municipality will be the data controller for the processing of personal data for archival purposes.
9. Your Rights
As a data subject, you have certain rights. These rights are based on the General Data Protection Regulation and are set out below.
Information on the processing of personal data
If your personal data is processed, the data controller must provide written information about what categories of data about you are being processed, including:
- The source of the data.
- The purposes of the processing.
- The recipients or categories of recipients to whom the data are disclosed.
- The existence of automated decision-making, including profiling.
- Whether the personal data is transferred to a third country (a country outside the EU/EEA).
- If possible, the planned period for which personal data will be stored.
- Your right to lodge a complaint.
- How to withdraw your consent, if you have given it.
- Contact details of the organization responsible for processing your personal data and their data protection officer or contact person.
Right to access your personal data (Register extracts)
In addition to the right to be informed in writing of what personal data is processed about you, you have the right to obtain copies of the personal data processed about you. This includes information in systems and databases.
You have the right to know the following:
- What personal data and categories of personal data are processed, for example what email address we have processed for you.
- What the personal data is used for, for example, when selling tickets in order to contact you in matters regarding the performance.
- How long the data will be stored.
- Who we have shared the personal data with, for example if we share your address with our printing partner so that they, on our behalf, can send you information about our performances. Where we have received or obtained the data from, for example from you or a public register.
You make your request by writing to us via the email address provided below. Please mark your request with “Personal data”.
Since Norrlandsoperan is subject to the Principle of Public Access to official records, your register extract will also be a public document that may be disclosed (after confidentiality assessment) in the event of a request for disclosure of a public document.
Right to rectification
You have the right to request the rectification of inaccurate data. You also have the right to supplement with relevant personal data that is missing from the controller. We will correct personal data that is inaccurate on our own initiative and after you have brought it to our attention.
Right to erasure
You have the right to request that we erase (the ‘Right to be forgotten’) your personal data from our systems and those of our data processors (our partners or parties helping us to fulfill our contract or commitment with you) if we have no legal basis to continue processing your personal data.
You have the right to have your data erased if any of the following apply:
- When our processing is based on consent and you withdraw it.
- The data is no longer needed for the purpose for which it was collected or processed.
- The processing is for direct marketing and you opt out of direct marketing.
- The processing is based on a balance of interests and the legitimate grounds do not override your interest.
- Erasure is required to comply with a legal obligation.
However, certain exceptions apply, where we cannot delete your personal data if it is needed to comply with a legal obligation or for archiving purposes.
Legal obligations can be, for example, the Book-keeping Act, consumer law legislation, tax legislation, etc. Most of the data we need to process about you relates to the products and services that have been invoiced to you or to fulfill an agreement or commitment with you.
As Norrlandsoperan is owned by the public sector (Umeå municipality and Region Västerbotten), some documents may be of public interest and must be preserved for archival purposes. This can be, for example, plans and descriptions of our activities. The documents that are preserved are transferred to Umeå municipality’s city archive for archiving. Once the documents have been transferred, Umeå municipality becomes the data controller. The documents to be saved or preserved are described in our document management plan, which is adopted by Norrlandsoperan’s board.
Right to object and restriction
In some cases, you have the right to object to our processing, or request that we restrict the processing of your personal data. This applies when we process personal data based on a legitimate interest or balancing of interests, or consent.
When we receive your request, we will reassess our balancing of interests and provide you with feedback on the outcome. This means that we may:
- Grant your request.
- Partially grant your request.
- Decide that our balance of interests still outweighs yours and therefore cannot grant your request.
You make your request or objection by submitting it in writing to us through the email address provided below. Please mark your request with “Personal data”.
Right to data portability
For certain personal data, you have the right to obtain the data or have it transferred to another controller, e.g. the right to data portability. This right applies when we process your personal data to fulfill a contract with you or based on your consent.
The personal data that you can obtain or transfer are those that you have provided to us yourself or that have been processed based on your use of our products or services. At Norrlandsoperan, this normally concerns:
- Name.
- Billing address.
- Email address.
- Telephone number.
- Ticket purchase.
To submit a data portability request, please make your request by submitting it in writing to us via the email address provided below. Please mark your request with “Personal Data”.
Time limits applicable when exercising your rights
All the rights described above are subject to the same deadline, which means that we must handle your request as quickly as possible, but at the latest within one month of receiving it. The month starts on the day we receive your request and ends on the same date the following month.
If necessary, the deadline may be extended to two months, in which case we will inform you within the first month. The reason for an extension may be that a request is complicated to fulfill or that many requests have been received at the same time.
Withdrawing consent
If you have given your consent for the processing of personal data, you always have the right to withdraw or revoke your consent at any time by contacting us via the contact details below. Our processing will then come to an end as soon as we have had the opportunity to handle your request, which will be as soon as possible.
Your withdrawal does not affect the processing that has already taken place on the basis of your consent. For example, if your consent relates to an image in a printed program, this means that we will not print new examples of the program where your image appears, but all old programs that are already printed with your image will continue to be available in our range and will also be saved for archival purposes.
Complaints
If you believe that we have failed in our processing of your personal data or if you have any questions about our privacy policy, please contact our responsible contact person using the contact details below. Please mark the letter “Personal data”.
Under data protection legislation, you have the right to lodge a complaint regarding our processing of your personal data with the Swedish Data Protection Authority, which is the supervisory authority for personal data processing in Sweden. You can contact them at .
More information on the applicable data protection legislation and guidance can be found on IMY’s website, where you can read more about your rights: https://www.imy.se/.