Privacy policy and data protection
Overview
- Introduction
- Processing of Personal Data
- Analytics Tools
- Your Rights
- Children’s Personal Data
- Transfer of Personal Data
- Monitoring and Compliance
- Contact Us
- Changes to the Privacy Policy
1. Introduction
1.1 The protection of your personal data is very important to us. We process your data in accordance with legal regulations, in particular the EU General Data Protection Regulation (“GDPR”) and the Swedish Data Protection Act. With the following information, in accordance with GDPR, we provide you with an overview of how we process your personal data and your rights.
1.2 The purpose of this privacy policy is to inform you how Nextgen Classroom AB (“Nextgen,” “Nextgen Classroom,” “we,” “us”) processes your personal data. With this policy, we want to make you aware of the information we collect and process about you, how long we store it, with whom we share it, and which rights you have in this regard.
1.3 This privacy policy governs the processing of personal data carried out by Nextgen Classroom when you purchase – or use – any of our services, as well as when you visit our website or otherwise contact us.
1.4 Nextgen Classroom has appointed a Data Protection Officer (DPO) for the company. If you have any questions regarding the privacy policy, how we process your personal data, if you wish to submit a request in accordance with the privacy policy, or if you wish to report a violation of this policy, please contact us or our DPO at privacy@nextgenclassroom.se.
2. Processing of Personal Data
2.1 We process your personal data to fulfill one or more purposes. For example, we process your information if you are a customer of ours, if you use our platform, if you subscribe to our newsletters, or if you contact us. Generally, we collect your personal data directly from you and process it only for the purpose for which it was collected.
In addition to the personal data we collect from you, or which we collect when providing our services, we may also collect personal data from third parties. These third parties may vary but may include, for example, information from public registers to verify the correct address, as well as credit institutions or banks from which we obtain creditworthiness information or information necessary for anti-money laundering checks.
The table below provides an overview of the purposes for which we process your personal data.
| Purpose | Categories of Personal Data | Legal Basis | Storage Period |
|---|---|---|---|
| To provide the service you have requested from us. | Name, email address, school, profile picture, municipality, job role, and content you as a user create on the platform. | Fulfillment of a contract with you or your employer. | As long as your account is active and for two years after inactivity. Written communication is stored for five years. |
| To provide customer service and respond to contact. | Name, email address, workplace, job title, and the information contained in your request or message. | Nextgen’s legitimate interest in providing customer service. | During the ongoing case and 90 days after the case is closed. |
| To send messages about operational information, such as notifications about maintenance and outages, as well as newsletters. | Name, phone number, email address, job title, and, if necessary, workplace. | Nextgen bases the processing on the legitimate interest of informing about service functionality. Nextgen bases the processing of newsletters on consent. |
For the duration of your active account. For the duration of consent. Documentation of consent is stored for two years after withdrawal. |
| To publish customer references. | Name, job role, workplace, information you provide in the reference. | Consent. | Until your consent is withdrawn or until the purpose ceases. Documentation of consent is stored for two years after withdrawal. |
| To comply with legal requirements, such as the Accounting Act. | Name, purchase details, invoice reference. | Legal obligation. | Seven years. |
| To protect and defend Nextgen’s legal interests. | Contact details such as name and email address. Correspondence. |
Nextgen bases such processing on its legitimate interest in protecting and defending its rights in the event of a dispute. | Until any dispute is resolved. |
Further details about the processing of personal data are outlined below.
2.2 To provide our service
In the course of the regular operation of our website, we collect certain information about usage in order to improve the website’s appearance and user experience, as well as to compile statistics. However, we do not collect any personal data for this purpose, and we do not currently use cookies to collect personal data from you. If this changes in the future, we will actively request your consent for such data collection, and we will only collect such information if you have given your consent. You will also be able to withdraw your consent at any time via a cookie banner on the website.
When you use our platform, we collect and process personal data about you in order to provide the service and ensure its functionality. The personal data includes name, email address, school, profile picture, municipality, job role, and user-generated content.
We process your personal data for as long as your account is active. You can delete your account and its content at any time. If your account has been inactive for one year, we will contact you via email with a request regarding the deletion of the account. If this request is not answered, we will send two additional requests before the account is automatically deleted after two years of inactivity.
We store necessary contact information as part of our customer relationship with you and regularly delete data as needed. Written communication is continuously deleted, but no later than five years after the end of the customer relationship. Information required for compliance with accounting legislation is stored for the current fiscal year plus seven years.
2.3 Customer service and contact
When you contact us via email, telephone, or through the form on our website, we process personal data such as name, email address, workplace, job title, and the information contained in your request. We use this information to respond to your inquiry, provide good customer service, and investigate any complaints.
We process your data based on our legitimate interest in using this specific information to handle customer service matters effectively and in a customer-friendly way (Art. 6.1.f GDPR).
We store your personal data collected in connection with your inquiry for the duration of the case. Personal data related to the case is automatically deleted 90 days after you close your inquiry. Certain data may be anonymized for statistical purposes so that we can improve our services.
2.4 Newsletters and operational information
If you have registered for our newsletter, we need to process your personal data when we send newsletters and other marketing to you. We process information such as your name, phone number, email address, job title, and, if necessary, your workplace. When we send you notifications related to planned maintenance and unplanned service interruptions, we process information such as your name, phone number, and/or email address.
We process your personal data for this purpose based on your consent (Art. 6.1.a GDPR). You have the right to withdraw your consent at any time. You can do this by sending an email to our DPO at privacy@nextgenclassroom.se or by clicking the unsubscribe link included in every newsletter.
If you withdraw your consent, we will cease processing your personal data for this purpose.
We keep documentation of your consent for up to two years after you have unsubscribed from our newsletter.
2.5 Publication of customer references
When we publish references that you have provided to us as a customer on our website, we process your personal data. This includes information such as name, role, and workplace.
We process your personal data because you have given your consent (Art. 6.1.a GDPR). You have the right to withdraw your consent at any time. You can do this by sending an email to our DPO at privacy@nextgenclassroom.se.
We keep documentation of your consent for up to two years after you have unsubscribed from our newsletter.
3. Analytics Tools
3.1 Nextgen Classroom uses various tools for diagnostic and usage analysis when collecting statistical data. The purpose of collecting analytical data is to monitor how our services perform and to learn how users interact with the services so that Nextgen can verify functionality and improve our services.
3.2 The information we collect is anonymized so that an individual cannot be identified through the datasets. We ensure that anonymization cannot be reversed. The categories of data we collect are technical and device-related (hardware type, operating system, browser type), service usage (session information and how users interact with the service), and monitoring (page load times, request timeouts, and bugs).
3.3 Since the information is anonymized, the collected datasets do not include personal data. Therefore, we do not process any personal data in connection with the use of these analytics tools. We do not use cookies for this.
4. Your Rights
4.1 When we process your personal data, you have a number of fundamental rights under the GDPR that you can exercise. You may exercise your rights by contacting us at privacy@nextgenclassroom.se. Please note that if your school is the data controller, you should contact them to exercise your rights.
Right of access
You have the right to request, free of charge, information about the processing we carry out regarding your personal data. You also have the right to obtain a copy of the personal data we process about you. This request must be submitted to us in writing, specifying which information you wish to access, and must include your name and be signed by you. We will respond to your request as soon as possible. If we cannot fulfill your request for access, we will provide a justification. The copy of your personal data will be sent to your registered address unless otherwise agreed in writing.
Right to rectification
Nextgen is responsible for ensuring that the personal data we process is accurate. If you notify us that the personal data you have provided is no longer correct, we will promptly rectify, block, or delete such data.
Right to erasure
You have the right to request that we erase your personal data without undue delay. Personal data shall be erased in the following cases:
- if the data is no longer necessary for the purpose for which it was collected;
- if you have withdrawn your consent and the processing is based solely on consent;
- if the processing is carried out for direct marketing purposes and you object to such processing;
- if you object to processing based on a balancing of interests and your interests outweigh ours;
- if your personal data has not been processed in accordance with applicable data protection regulations; or
- if erasure is required to fulfill a legal obligation.
There may be obligations that prevent us from immediately erasing all of your personal data. These obligations follow from applicable laws such as accounting regulations. If certain data cannot be erased due to legal requirements, we will inform you of this and ensure that the data is used only to fulfill such legal obligations and not for any other purpose.
Right to restriction of processing
You have the right to request that Nextgen temporarily restrict the processing of your personal data. Such restriction may be requested in the following cases:
- if you believe that the personal data we hold about you is inaccurate and you have requested rectification;
- when the processing of your personal data does not comply with applicable data protection rules, but you do not want the data to be erased and instead request restriction;
- when we no longer need the data for the purposes of our processing, but you require it to establish, exercise, or defend a legal claim.
If you have objected to our processing of your personal data, the use of the data may be restricted while the investigation is ongoing. In the event of restriction, we will only store your personal data and obtain your consent for any further processing.
Right to data portability
If we process your personal data based on your consent or to fulfill a contractual obligation with you, you have the right to request that we provide all personal data concerning you that is processed in an automated manner, in a machine-readable format (e.g., Excel or CSV file). Where technically feasible, you also have the right to request that we transfer your personal data to another controller.
Right to object
You have the right to object to our processing of your personal data if the processing is based on our legitimate interests. In such cases, we will ask you to specify which processing you object to. If you object, we will only continue processing your data if we can demonstrate compelling legitimate grounds for the processing that override your interests. We will always inform you of this outcome.
Right to withdraw consent
If you have given your consent to the processing of your personal data, you may decide at any time to withdraw your consent for the processing you previously agreed to. You can do so by contacting us at privacy@nextgenclassroom.se.
4.4 You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) if you are dissatisfied with our processing of your personal data: https://www.imy.se/.
5. Children’s Personal Data
Children under the age of 13 must not use Nextgen Classroom’s services. Nextgen Classroom does not knowingly collect personal data from children under 13. If we discover that children under 13 have provided us with personal data without proper consent, we will immediately delete the data.
6. Transfer of Personal Data
6.1 Only those individuals within our organization who need access to your personal data in order to perform their duties will have access to it.
6.2 We treat your personal data confidentially and generally do not transfer it to third parties. However, in order to provide certain services, we use selected third parties. Sharing your data with such third parties occurs for the same purposes and on the same legal bases on which the data was originally collected. Nextgen takes technical and organizational security measures to ensure that your data is handled securely.
Categories of recipients with whom your personal data may be shared include:
- Suppliers and subcontractors:
Nextgen Classroom uses third-party providers to manage parts of its operations, such as companies operating IT systems. We may share data with these providers when they perform services on our behalf. We enter into data processing agreements with such providers and take appropriate measures to ensure that your personal data is processed in accordance with this policy. - Banks and partners:
Nextgen Classroom may share your personal data with other independent controllers such as banks and business partners. These recipients manage and are independently responsible for the processing of your data. - Social media:
Nextgen Classroom uses social media platforms. When using social media, your personal data is collected and processed by these companies. Please refer to each company’s privacy policy for more information. - Authorities:
We will also disclose your personal data to authorities, such as the Swedish Tax Agency, if required by law, regulatory decision, court order, or if we reasonably believe disclosure is necessary to protect our rights.
6.3 When sharing your personal data, Nextgen Classroom takes technical and organizational measures to ensure your data is handled safely and securely. Our selected third parties will only process your data in ways and for purposes consistent with this policy.
6.4 Nextgen Classroom will not sell your personal data to third parties without your prior consent. We may transfer your personal data to a buyer/investor or a potential buyer/investor in connection with a restructuring, sale, or transfer of all or part of Nextgen Classroom’s shares, assets, or business. In such a case, we will take measures to ensure that the receiving party processes your personal data in accordance with this policy.
7. Monitoring and Compliance
If you are dissatisfied with how your personal data has been processed or believe that your data has been processed in violation of data protection laws, you are welcome to contact our DPO at privacy@nextgenclassroom.se. You also have the right to contact the supervisory authority IMY: https://www.imy.se/.
8. Contact Us
If you have questions regarding this privacy policy or our processing of your personal data, if you wish to submit a request in accordance with the privacy policy, or if you wish to report a breach of this privacy policy, please contact us or our DPO at privacy@nextgenclassroom.se.
9. Changes to the Privacy Policy
9.1 We reserve the right to revise and amend this privacy policy on the processing of personal data whenever we deem it necessary. In the event of material changes, we will notify you in advance via email or through a visible notice on our website.
9.2 This privacy policy was last updated on March 27, 2024.