Privacy Policy

Introduction

Your privacy is important to Läkare Utan Gränser (MSF Sweden), which is part of the global Médecins Sans Frontières (MSF) movement. We take the processing of your personal data seriously and want you to know how we handle it. In this Privacy Policy, you will find information about the type of data we collect and how we use it. It also explains the technical and organisational measures we have put in place to safeguard your privacy and how you can control our access to your personal data.

Our objective is to ensure that your privacy is respected at all times and that your personal information is processed lawfully by MSF Sweden. We take responsibility for how we use personal data and ensure that it is processed only for defined purposes. For example, if you are a donor, we need to record your donation. If you are a job applicant, we need some information to invite you to an interview. We are responsible for protecting your personal data from unauthorised access. We process personal data in accordance with applicable laws, especially the EU General Data Protection Regulation (2016/679) ("GDPR").

MSF Sweden is the Data Controller responsible for the processing of personal data that we collect about you.

The person responsible for MSF's processing of personal data is the General Director: Ylva Jonsson Strömberg.

For any questions, or to exercise your rights, you can contact MSF Sweden by post, email or phone at the details below:

Läkare Utan Gränser  
Postal address: Box 47 021, 100 74 Stockholm  
Visitor address: Liljeholmsstranden 5, 117 61 Stockholm  
Phone: (+46) 010-199 33 00  
Donor service: givarservice@lakareutangranser.se

Scope

This Privacy Policy applies to all those whose personal information is collected and processed by MSF Sweden, for example when you:

• visit the MSF Sweden website;
• make a one-time donation or become a monthly supporter via our website;
• contact our donor services via our website;
• subscribe to our newsletter;
• apply for a job at MSF Sweden via our website;
• contact MSF Sweden regarding other matters via our website;
• participate in one of our events, such as conferences, seminars, trainings, information events or discussion events;
• or otherwise interact with us in ways that may apply.

General processing of your data

Definitions

In this Privacy Policy, we use certain terms that have the following meanings.

• "Personal data" means information and assessments that can be linked to you as an individual, such as your name, email address, telephone number, IP address, etc.
• "Data Subject" refers to an individual who is identified or identifiable, directly or indirectly, on the basis of Personal Data.
• "Processing" means any collection, storage, use, erasure or other handling of your personal data.
• "Data controller" is the enterprise that, alone or together with others, determines the purpose and the means to be used in connection with the processing of personal data. The Data Controller is the person who has the primary responsibility for ensuring that the processing of your personal data is in accordance with the Personal Data Act and other legislation.
• "Data processor" is a third-party enterprise that processes personal data exclusively on behalf of a Data Controller. In principle, a Data Processor cannot process personal data for its own purposes.

MSF Sweden's processing of your personal data may be related to our fundraising, recruitment and communication activities and may more specifically include registering, organising, structuring, storing, correcting or changing, gathering, reading, using, sharing, limiting, deleting or destroying data.

We only register personal data that is needed for us to carry out our work, and only when we can clearly justify the need to use the data. We never retain personal data longer than necessary for the specific purpose for which it was collected.

I am a donor

If you make a one-off donation or are a monthly donor to MSF Sweden, we collect, record and store your personal data in our donor system only for as long as there is a legitimate need to do so, and in any event no longer than required under applicable law. This also applies to other donation methods, such as legacy gifts, although such donations may in some cases require longer retention periods. Your personal data will be deleted or anonymised when there is no longer a legitimate need for us to retain it, unless we are legally required to keep it for a longer period. Please feel free to contact us if you would like more detailed information.

What kind of personal data do we collect from a donor?

We collect, record and store your name and contact details (address, telephone numbers, email address), date of birth, gender, language preference and, for regular donors, the invoicing details necessary to fulfil the obligations of the regular giving contract, for example bank account number.

We register transaction history, such as the time of donation, campaign, amount and payment method. We also record information about your wishes and interests and the type of donations, including but not limited to one-off donations, regular donations, major donations, company donations, trust donations, honorary gifts, legacies and private fundraising campaigns for MSF Sweden.

How do we use donors' personal data?

Donors' data is held in the donor register of MSF Sweden.

We process your personal data for the following purposes, including but not limited to, to:

• inform you about our work and our organisation;
• fulfil your donation, order or request;
• process your payment and process or detect any fraud;
• thank you for your donation and tell you how your donation will be used;
• offer ways to support our medical humanitarian cause;
• provide efficient and reliable donor services through the administration of your donor profile, handling your requests, correcting data or sending information, for example in legacy matters or donation certificates for honorary gifts at your request;
• communicate with you by post or through our digital channels (email, text and image messages);
• analyse, group and collect statistics about our donors by choices, priorities and preferences in order to customise information, advertisements and offers;
• analyse donor behaviour to identify errors and to maintain, develop, test and improve our donor services and/or the technical platforms on which they are provided, to strengthen our communication and enhance user experience;
• administer the donor register (system administration) to maintain a well-functioning donor database.

Lawful basis used to process donors' personal data

• Fulfilment of an agreement between MSF Sweden and the donor
• Donor's consent
• MSF Sweden's legal obligations
• MSF Sweden's legitimate interest

How donors' personal data is obtained

• Directly from the donor
• Regarding direct marketing to potential future donors, MSF Sweden may use the services of external service providers.

To ensure up-to-date contact information and maintain the data quality of our donor register, MSF Sweden routinely checks and updates the personal data of registered donors against third-party and public registers.

I have subscribed to a newsletter

If you subscribe to a newsletter from MSF Sweden, we collect, record and store your personal data in our donor database for as long as necessary.

What kind of personal data do we collect from a newsletter subscriber?

We collect, record and store your name and contact details, such as address, telephone numbers, email address, date of birth, gender and language preference. We keep activity logs about how the newsletter is received, opened, read and shared. We also record information about your wishes and interests.

How do we use newsletter subscribers' personal data?

Data is held in the customer register of MSF Sweden.

We process your personal data for the following purposes, including but not limited to, to:

• inform you about our work and our organisation;
• thank you for your participation and tell you how your support is beneficial;
• communicate with you by post or through our digital channels (email, text and image messages);
• analyse, group and collect statistics about our newsletter subscribers by choices, priorities and preferences in order to adapt information, advertisements and offers;
• analyse newsletter subscriber behaviour to identify errors and to maintain, develop, test and improve our donor services, communication and user experience;
• administer the customer register (system administration) to maintain a well-functioning database.

Lawful basis used to process newsletter subscribers' personal data

• Subscriber's consent

How newsletter subscribers' personal data is obtained

• Directly from the subscriber

I have signed a petition or sent a support message

If you sign a petition created by MSF Sweden or send us a support message, we collect, record and store your personal data in our customer register for as long as necessary, but no longer than up to 5 calendar years after you signed the petition or sent us a support message.

What kind of personal data do we collect from a petition signatory?

We collect, record and store your name and your contact details: telephone number and email address only.

In general, MSF Sweden does not transfer personal data to third parties unless the person has given consent for us to do so, for instance when signing a petition. If you sign a petition, your first and last name are provided to the petition target as part of the list of signatures.

How do we use a petition signatory's personal data?

Data is held in the customer register of MSF Sweden for as long as necessary, but no longer than 5 calendar years.

We process your personal data for the purpose of advocating on specific areas of our social mission, such as neglected diseases, forgotten crises or restricted access to healthcare.

Lawful basis used to process petition signatories' personal data

• Petition signatory's consent

How petition signatories' personal data is obtained

• Directly from the petition signatory

I am a job applicant

If you apply for a position with MSF Sweden, either at the office, for an assignment abroad, or as a volunteer or consultant, we collect, record and store your personal data in our recruitment system for up to 24 months after the end of the recruitment process, unless you withdraw your application and subsequent consent for data processing at any time before that.

What kind of personal data do we collect from a job applicant?

We collect, record and store the following data:

• your name and contact details, such as address, telephone number and email address;
• your résumé/CV with information about your education, training and work experience;
• your motivation letter;
• your grades and certificates, and the results from assessments, tests or tasks;
• information provided by your references;
• and, in general, information you have provided as part of the recruitment process.

How do we use a job applicant's personal data?

Data is held in the third-party recruitment system used by MSF Sweden.

We process your personal data for the following purposes, including but not limited to, to:

• administer your application and select candidates in the recruitment process;
• communicate with you via the recruitment platform and possibly also through other digital channels by email, text and image messages;
• collect statistics on applications to analyse behaviour and patterns in order to adapt our capacity (the statistics are aggregated data, meaning that applicant information will not be revealed);
• analyse and group applications by choices, priorities and preferences in order to adapt information, advertisements and offers to our applicants in the future;
• analyse applicant behaviour to identify errors and to maintain, develop, test and improve our application services, the technical platforms on which they are provided, and communication and user experience.

Lawful basis used to process job applicants' personal data

• Job applicant's consent
• MSF Sweden's legitimate interest

How job applicants' personal data is obtained

• Directly from the job applicant
• From reference(s) provided by the job applicant

I visit the website(s) of MSF Sweden

When you visit our website(s), we collect your personal data for statistical and analytical purposes. MSF uses tracking tools that collect information about events on the website and information about the devices/browsers that visit the website.

Event data includes page views, clicks, scrolling and other engagement on the web pages, with details about which page and element are interacted with and the time of the event. Device data includes browser and operating system details, as well as approximate geographic location. Geography is derived from the IP address and can provide precision at municipality level.

See the full overview of cookies and tracking tools. There you can also change and withdraw any consent you have given to the use of cookies on our website. There are different purposes for the data collection.

Analysis of website behaviour

The legal basis for this purpose is legitimate interest.

• Information about behaviour on the website is used for statistics, adapting marketing and improving user-friendliness.
• The tool we use for this is Matomo Analytics.
• Matomo Analytics does not store cookies in your browser and does not store any identification numbers linked to you over time.
• All data in Matomo is automatically deleted after 25 months.
• All processing and storage of data takes place within the EU/EEA.

Advertising optimisation and targeting

The legal basis for this purpose is your consent, provided through the consent banner that appears on your screen when you enter the website. You can change or withdraw your consent yourself.

• Information about behaviour on the website is used to report results from advertising and by the advertising platforms' algorithms to help ensure that ads are better targeted to people who are likely to be interested in our messages.
• The advertising providers that receive information about your visit to our website are Google, Meta and Microsoft. These actors may link this information to other information they have stored about you.
• The tracking tools store cookies in your browser with identification numbers that are linked to you over time and across different websites.
• If you want to influence how the advertising platforms use data about you for targeting, you can read more and make adjustments at Google, Meta and Microsoft.
• Data collected by the advertising providers may be processed and stored in the United States and/or other countries where these entities have data centres.

I have communicated with MSF on social media

MSF uses the Retriever Social Media Management tool to manage and respond to direct messages and comments on our posts on Instagram, Facebook and LinkedIn. We do this in order to respond effectively to inquiries, moderate comment fields and communicate with our followers, based on our legitimate interest.

Through automatic linking to platforms, information about interaction with our profiles on Instagram, Facebook and LinkedIn is stored in Retriever Social Media Management. The information stored includes your name, link and ID/username to your profile, as well as the content of the message/comment and the time it was sent.

The data is stored in the EU and in accordance with the GDPR.

In the event of a breach of the guidelines for using our comment fields that leads to the deletion of a comment, we take a screenshot of the comment and the author's name. These are stored internally by us and deleted within 3 years. Serious violations of our guidelines may be reported to the police.

Use of third parties, disclosure and security

MSF Sweden uses third-party service providers or data processors to manage certain personal data on our behalf.

Where we use third-party solutions such as service providers, subcontractors and collaboration partners to improve our services or handle administration of our systems, all processing is regulated through Personal Data Processing Agreements between MSF Sweden and the third-party service provider. This is to ensure that your personal data is handled securely and is not shared with others. When we end third-party contracts, we ensure that your personal data is deleted from the third-party systems.

MSF is an international movement, and MSF Sweden shares personal data about its members, employees and service providers with other MSF entities. Other MSF entities may be located outside the European Union.

Security for personal data

MSF Sweden endeavours to protect your personal data and has taken reasonable technical and organisational measures to secure the transmission and storage of processed personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, such data.

To ensure that personal data is processed in a secure and confidential manner, MSF Sweden uses data networks with firewalls and secure passwords in line with industry standards. The employees, individual contractors and service providers of MSF Sweden are contractually obliged to respect the confidentiality of information they have access to and to act in accordance with MSF Sweden's set of policies and guidance, this Privacy Policy and other internal rules and regulations concerning the processing of personal data in MSF.

In the event of a possible personal data breach, MSF Sweden will contact the relevant authorities and notify any affected individuals.

Your data protection rights

You have several rights regarding the processing of your personal data described in this notice. You have the right:

• to obtain information about the processing of your personal data;
• of access to your data;
• to rectification of your data;
• to the erasure of your data and to be forgotten;
• to restrict the processing of your data;
• to data portability;
• to object to the processing of your data;
• not to be subject to a decision based solely on automated processing.

MSF Sweden is subject to a variety of legal and contractual obligations that may affect how we keep, store and share your data. Not all rights can be exercised in all situations. Factors such as the legal basis for using your personal data influence the situation.

For more information, please see the website of the Swedish Data Protection Authority:
https://www.imy.se/

Exercising your data protection rights

If you wish to exercise your data protection rights or have a question about this Privacy Policy, please contact MSF Sweden by phone, by email at givarservice@lakareutangranser.se, or by filling in this form: Begäran om borttagning av personuppgifter.

To help us respond accurately to your request, please specify how you wish to exercise your data protection rights or which data you want to access. We will need to verify your identity before we can fulfil your request. If we are unable to verify your identity based on your request, we will contact you and request additional information.

MSF Sweden has 30 days to respond to your request, although we will do our best to contact you as soon as possible. If we are unable to fulfil your request, we will notify you and provide the reason.

Right to complain or report a data breach

If you believe that your personal data has been implicated in a data breach, we encourage you to report this to us as soon as possible. You also have the right to file a complaint with the Swedish Data Protection Authority regarding our processing of your personal data. You can find the contact details of the Swedish Data Protection Authority and more information about your rights at https://www.imy.se/. Before considering submitting a complaint to the Swedish Data Protection Authority, we encourage you to contact us at givarservice@lakareutangranser.se so that we can first try to handle the situation.

Miscellaneous

Personal data for children

As a general rule, MSF Sweden does not target children for fundraising, communication, advocacy or recruitment. If MSF Sweden visits schools or other similar contexts, photos may be taken with the prior written consent of the guardian.

If you are a guardian and become aware that your child has shared any personal data with MSF Sweden, we encourage you to contact us.

External links

MSF Sweden may be present or featured in third-party channels such as social media platforms, job sites, blog posts, advertisements or commercials, which have their own privacy and data protection policies and notices. This means that this Privacy Policy does not apply to any other digital channels.

Changes to this policy

In the event of changes in our processing of personal data, or changes in applicable legislation, MSF may change or revise this Privacy Policy.

When the Privacy Policy changes, the new Privacy Policy will be posted on this page. Major changes will be made visible, but we still recommend that you read the Privacy Policy regularly when you visit our website.
You can see when the Privacy Policy was last updated at the top of the page.