Privacy Policy

1. Introduction

SignUp Software (“SignUp“, “we“, “us” or “our“) is processing your personal data when you interact with us in various contexts.

We respect your privacy and are committed to protect the personal data we process about you. All processing of personal data is carried out in accordance with the requirements set out applicable data protection legislation, including the General Data Protection Regulation EU 2016/670 (“GDPR”).

We may at our own discretion update this privacy policy at any given time (see at the end the date this policy was last updated). If material changes are made, we will provide policy on this website prior to the change becoming effective.

Throughout this privacy policy the term “processing” is used to cover all activities carried out by SignUp involving your personal data, including e.g. collecting, handling, storing, sharing, accessing, using, transferring and disposing of your personal data. The term “personal data” refers to any information relating to an identified or identifiable natural person, whether directly or indirectly.

Depending on in which capacity you are reading this policy, the processing of your personal data may differ. You may read this policy in the capacity as a (i) visitor on our digital channels, or (ii) a corporate contact person (e.g. a supplier or customer contact). To make this policy more relevant to your particular situation, the policy is divided into two sections with specific information related to the various roles that you may have when we are processing your personal data.

2. If you are a visitor on our digital Channels Or a User of our services

2.1 Who is the data controller?

The data controller for the processing of personal data when you are a visitor on our digital channels or a user of our services is SignUp Software AB.

2.2 How do we collect your personal data?

We collect the data either from you, or indirectly from you through the collection of data that is generated by you, including your devices, when visiting our website or our digital channels (e.g. through the use of cookies and similar technologies). Please see our Cookie Policy for more information regarding the collection of data from your devices.

2.3 Purposes of the processing of your personal data

2.3.1 Track your use of our website and our digital channels

When you are browsing the website or our digital channels, we will process your IP address and browser user agent string to track your activity. Your personal data is processed for this purpose to manage your use of and improve this website, for our internal records and for statistical analysis.

2.3.2 Communicate with you and respond to your questions or feedback

Where we offer you a possibility to communicate with us by asking questions or providing feedback regarding our services and our business, we will process your personal data when you submit a question, comment, feedback or any other message or inquiry. The purpose of the processing is to be able to communicate with you and to handle your inquiry.

2.3.3 Visitor administration (at our premises)

We are processing your personal data when we administrate e.g. events and meetings at our premises, including keeping participation lists and ensuring that your food preferences are respected.

2.3.4 Managing user accounts

Your personal data is processed by SignUp for the purpose of managing our user accounts, e.g. to keep track of the number of users of the solution/service for the purpose of license management, to handle on and offboarding of user accounts and to allow you to access and use the SignUp solutions or services that your employer has purchased from SignUp.

2.4 With whom do we share your personal data?

Where necessary in order to achieve the purposes set out above, we share your personal data with other entities or authorities. Please note however that we, regardless of the recipients’ capacity, only will share your personal data with entrusted actors and only to the extent necessary.

Data processors acting on behalf of us

In order to fulfil the purposes of the processing of your personal data and to be able run our business, we transfer personal data to external parties such as third-party service providers that we have engaged, as well as other partners that process your personal data on our behalf. These external parties will act as our data processors and may only process your personal data in accordance with our instructions and not for their own purposes. We are the data controller for the processing of personal data that these external parties carry out on our behalf.

Recipients that act as data controllers

The personal data processed by SignUp when you visit our website will not be shared with any third party that will process the personal data in the capacity as a data controller.

3. If you are a Corporate contact person

3.1 Who is the data controller?

The SignUp entity you have contact with will independently be the data controller for the processing of personal data as described below. However, with respect to the processing of personal data for the purposes of managing the contractual relationship between SignUp and the organisation you represent (see section 3.3.1), all SignUp entities listed below will be processing the personal data as joint controllers. See more on the joint controllership in section 3.4 below.

3.2 How do we collect your personal data?

We collect the personal data that you, or the relevant supplier/business contact that you represent, have provided us within the scope of our business relationship with the supplier. For the purpose of sending B2B marketing we may collect personal data from third parties that lawfully sell company information for marketing purposes.

3.3 Purposes of the processing of your personal data

3.3.1 Administration of contractual relationship

Your personal data will be processed because we have a legitimate interest of administering the relationship with our customers, suppliers and partners, and to be able to manage the overall cooperation and day-to-day activities. This also includes processing within the scope of the negotiation, execution of our commercial and legal agreements.

3.3.2 Marketing and sales activities (B2B)

Your personal data will be processed for the purpose of marketing our products and services. We may contact you in your capacity as someone who has the authority and legal capacity to procure products and services on behalf of the organisation you represent.

3.3.3 Respond to questions and requests

For the purpose of responding to questions or requests sent to us, e.g. via e-mail or phone.

3.3.4 Invoicing administration

We will process your contact information for reference purposes when we are either issuing invoices to or receiving invoices from the company that you represent, as your contact information may be visible on the invoices (depending on whether the organisation you represent has named you as a invoice reference or not).

3.3.5 Fulfil legal obligations

We will process your personal data where necessary in order to comply with legal obligations, e.g. accounting obligations.

3.3.6 Establish, exercise and defend legal claims

For the purposes of establishing, exercising and defending legal claims (for example in connection with a dispute or legal process) we may process your personal data.

3.4 With whom do we share your personal data?

Where necessary in order to achieve the purposes set out above, we share your personal data with other entities or authorities. Please note however that we, regardless of the recipients’ capacity, only will share your personal data with entrusted actors and only to the extent necessary.

Data processors acting on behalf of us

In order to fulfil the purposes of the processing of your personal data and to be able run our business, we transfer personal data to external parties such as third-party service providers that we have engaged, as well as other partners that process your personal data on our behalf. These external parties will act as our data processors and may only process your personal data in accordance with our instructions and not for their own purposes. We are the data controller for the processing of personal data that these external parties carry out on our behalf.

Recipients that act as data controllers

The categories of recipients mentioned in the table below will process personal data in the capacity as data controllers, i.e. these recipients will determine the purposes and means of the processing without our involvement.

Join controllership

For the purposes described in sections 3.3.1 and 3.3.2 above, i.e. managing contractual relationships and sending B2B marketing, all SignUp entities listed in section 3.1 above will be joint controllers for the processing of your personal data. The reason for the joint controllership is that all SignUp entities jointly determine the purposes and means of those processing activities. You may contact any of these entities if you have any inquiries or wish to exercise your rights under applicable data protection legislation.

The SignUp group has concluded an Intra-Group Data Transfer Agreement (“IGDTA”) to which all SignUp group companies are parties. The IGDTA sets out the framework of rules that apply internally at SignUp when sharing data between group entities. It also includes an arrangement for joint controllership as required under article 26 GDPR. If you wish to receive more information about the joint controllership or the fundamentals of the arrangement under the IGDTA, please contact us on the contact information below.

4. Appropriate safeguards for transfers of personal data outside of the EU/EEA

We may transfer or disclose personal data to recipients located outside the EU/EEA (third country), mainly in situations where we are using third-party data processors that will process data in a third country, or if we share personal data with a group company located outside the EU/EEA.

When we transfer or disclose your personal data to a recipient in a country outside of the EU/EEA, we will always ensure that appropriate safeguards have been taken (such as the EU Commission’s standard contract clauses, including other supplementary safeguards as necessary in each case) to protect the personal data. Further, we are regularly carrying out risk assessments to assess what supplementary measures that needs to be taken to protect the personal data subject to the transfer or disclosure.

Any third-country transfers of personal data within the SignUp group, e.g. to group entities that operate outside the EU/EEA, are governed by the IGDTA which includes all necessary safeguards (including the EU Commission’s standard contractual clauses) to ensure that any such transfer of personal data is compliant with applicable data protection legislation.

You are entitled to request to receive a copy of any documentation demonstrating that appropriate safeguards have been taken in order to protect your personal data during a transfer to a third country.

If you would like further details about the processing of your personal data and whether your personal data is transferred to a third country, please contact us on the contact details as set out below under Section 7.

5. Your rights

Under applicable data protection laws, you have certain rights in relation to the processing of your personal data. We process your personal data to the extent necessary in order to fulfil your rights. Please submit requests for exercising your rights by contacting us on the contact details set out in Section 7 below.

You have, under certain circumstances, the right to exercise the following rights:

Access

You may request confirmation whether or not personal data is processed and, if that is the case, access your personal data and additional information such as the purposes of the processing. You are also entitled to receive a copy of the personal data undergoing processing. If the request is made by electronic means the information will be provided in a commonly used electronic format if you do not request otherwise.

Object to certain processing

You have the right to object to the processing of your personal data based on a legitimate interest for reasons which concerns your particular situation. In such a situation, we will stop using your personal data where the processing is based on a legitimate interest, unless we can show that the interest overrides your privacy interest or that the use of your personal data is necessary in order to manage or defend legal claims.

Rectification

You have at any time the right to have inaccurate personal data rectified, as well as, taking into account the purposes of processing, the right to have incomplete personal data completed which relates to you.

Erasure

You may have your personal data erased under certain circumstances, such as when your personal data is no longer needed for the purposes for which it was collected. However, we cannot delete your personal data if we e.g. are obligated under law to keep the data.

Restriction of processing

You may ask us to restrict the processing of your personal data to only comprise storage of your personal data under certain circumstances, such as when the processing is unlawful, but you do not want your personal data erased. If the processing of your personal data has been restricted we may only, besides storing the data, process your personal data with your consent, or in order to establish, exercise or defend legal claims or to defend rights of others.

Withdrawal of consent

You have the right to at any time withdraw your consent to processing of personal data to the extent the processing is based on your consent.

Data Portability

You may ask to receive a machine-readable copy of the personal data processed on the basis of your consent or on the basis that the processing is necessary in order to perform an agreement with you, and which personal data have been provided to us by you (data portability) and ask for the information to be transferred to another data controller (where possible).

Complaints to the supervisory authority

You acknowledge that you always have the right to lodge complaints pertaining to the processing of your personal data to your local supervisory authority. The GDPR/UK GDPR supervisory authorities that are available in the countries where SignUp operates are:

6. Contact information

If you have any questions or concerns regarding the processing of your personal data, you can send an email to legal@signupsoftware.com. You may also contact the SignUp entity acting as data controller (as described above) by using the below contact information.