Last updated: 2024-01-10

Baby Journeys Privacy Policy

Why and for whom?

On Baby Journey AB org.nr (559214-9966) („Baby Journey”, ”we”, ”us”, ”our„), we care about privacy. This means that we respect and safeguard your privacy and the right to control and transparency in the processing of your Personal Data.

Baby Journey is the Data Controller in relation to the Processing of Personal Data listed in this Privacy Policy („Privacy Policy“).Policy„The policy describes the purposes for which we need your Personal Data, the legal basis we rely on and the measures we take to protect Personal Data. We also provide information on how to exercise the rights you have in relation to our processing of your Personal Data.

We will also list our Data Processors so that you can feel confident about where your Personal Data is stored and Processed.

Definitions

”Treatment“ of Personal Data is anything that can be done with Personal Data, such as storing, modifying, reading, transmitting, etc.

”Applicable law“ is the legislation applicable to the processing of Personal Data including the General Data Protection Regulation (GDPR), complementary national legislation, as well as practices, guidance and recommendations issued by a national or European supervisory authority.

”Personal data“ is any information that can be linked to an identifiable living person.

”Data controller“ is the company/organization that decides for which purposes and in which way the Personal Data will be processed and is thus also responsible for ensuring that Personal Data is processed in accordance with Applicable Law.

”Data processor“ is the company/organization that processes Personal Data on behalf of the Controller and thus may only Process the Personal Data in accordance with the Controller’s instructions and applicable legislation.

”Registered“ means the living natural person whose personal data are processed.

”The service“ Baby Journey, the modern app for pregnancy & toddler years…

Baby Journey’s responsibility for personal data

The information in this Policy covers the Processing of Personal Data for which Baby Journey is the Data Controller, i.e. the Processing for which we determine the purpose (why a processing is done) and means (in what way, which personal data, for how long, etc.). The policy does not describe how we process personal data in the role of Personal Data Processor – i.e. when we process personal data on behalf of our customers.

Baby Journey’s business area is to create and operate a mobile application focusing on the pregnancy & toddler years. To optimize the Baby Journey App, we need to collect data from our users. We process your data mainly for the following purposes: to administer your account, make available and provide the App and integrate the App with third party services, and to improve your experience with the App and make it more personalized and relevant.

Processing of personal data by Baby Journey

We have a responsibility to describe and demonstrate how we meet the requirements imposed on us when processing your Personal Data. This section aims to provide information about:

• Why personal data processing is necessary in relation to the purpose
• Which legal basis we have identified for the Processing

Legal bases

Consent – Baby Journey processes your Personal Data after we have received your consent to the Processing. Information about the processing is always provided when we ask for consent.

How long do we keep your Personal Data?

We keep your Personal Data for as long as necessary for the purpose for which it was collected. Depending on the legal basis on which we support the processing, this can be a) result from a contract, b) be dependent on valid consent, c) be set out in legislation or d) result from an internal assessment based on a balance of interests. In the list below, we indicate (to the extent possible) the period for which the Personal Data will be stored or the criteria used to determine the period.

Treatments

1.   Processing and the purpose of the processing: Register user accounts to enable the customer to log in.

Personal data: First name, last name and email address.

Source: Directly from the user.

Legal basis: Consent

Period of storage: As long as there is valid consent. Information on how long the consent is valid is provided when the consent is obtained.

2.   Processing and the purpose of the Processing: Verify the user’s login details to increase security and prevent abuse.

Personal data: First name, last name and email address.

Source: Directly from the user.

Legal basis: Consent

Period of storage: As long as there is valid consent. Information on how long the consent is valid is provided when the consent is obtained.

3.   Processing and the purpose of the Processing: Information about your pregnancy (e.g. estimated date of delivery).

Personal data: Estimated date of delivery.

Source: Directly from the user.

Legal basis: Consent 

Period of storage: As long as there is valid consent. Information on how long the consent is valid is provided when the consent is obtained.

4.   Processing and the purpose of the Processing: Information about your child(ren).

Personal data: Birth day, birth time, birth weight, birth length, name, pictures.

Source: Directly from the user.

Legal basis: Consent

Period of storage: As long as there is valid consent. Information on how long the consent is valid is provided when the consent is obtained.

5.   Processing and the purpose of the Processing: Linking and synchronizing accounts between Baby Journey users.

Personal data: Name.

Source: Directly from the user.

Legal basis: Consent

Period of storage: As long as there is valid consent. Information on how long the consent is valid is provided when the consent is obtained.

6.   Processing and the purpose of the Processing: Information about your use of the application.

Personal data: IP address, language and identification information and operating system.

Source: Directly from the user.

Legal basis: Consent

Period of storage: As long as there is valid consent. Information on how long the consent is valid is provided when the consent is obtained.

7.   Processing and the purpose of the processing: When you use our Services, we collect Personal Data that is part of the input, file uploads or feedback you provide to our Services („Content“).

Personal data: User-generated content and personal data.

Source: Directly from the user.

Legal basis: Consent

Period of storage: As long as there is valid consent. Information on how long the consent is valid is provided when the consent is obtained.

Your rights

You are the controller of your personal data. We always strive to ensure that you can exercise your rights as effectively and smoothly as possible.

Access – You always have the right to receive information about the processing of your personal data. We only disclose information if we have been able to ensure that it is actually you asking for the information.

Rectification – If you discover that the Personal Data we process about you is incorrect, let us know and we will fix it!

Erasing – Do you want us to forget you completely? You have the right to request the erasure of your Personal Data when it is no longer necessary for the purpose for which it was collected. If we are obliged to retain your data by law or a contract we have entered into with you, we will ensure that it is processed only for the specific purpose set out in the law or contract; thereafter, we will ensure that the data is erased as soon as possible.

Objection – Do you disagree that our interest in processing your personal data outweighs your privacy interest? No problem – in that case, we will review our balance of interests and check that it still holds. We will of course take your objection into account when we make a new assessment to evaluate whether we can still justify our Processing of your Personal Data. If you object to direct marketing, we will delete your Personal Data immediately without reviewing our assessment.

Restriction – You can also ask us to restrict our processing of your data:

• While we are dealing with a request from you for any of your other rights
• If, instead of requesting erasure, you want us to indicate that the data should not be processed for a specific purpose. For example, if you don’t want us to send you advertising in the future, we still need to keep your name to know not to contact you.
• In cases where we no longer need the data for the purpose for which it was collected; provided that you do not have an interest in us keeping the data in order to pursue a legal claim.

Data portability – We can provide you with the data that you have provided to us or that we have received from you in the context of a contract with you. You will receive your data in a commonly used and machine-readable format that you can then take with you to another Data Controller.

Withdrawing consent – If you have consented to one or more specific Processing(s) of your Personal Data, you have the right to withdraw your consent at any time and thereby ask us to cease the Processing immediately. Please note that you can only withdraw your consent for future Processing(s) of Personal Data and not for any Processing that has already taken place.

How to use your rights

To exercise these rights, please contact our Data Protection Officer Timothy Forni at the following address: Timmy@babyjourney.se. To ensure a quick response, please provide your full name, username and email address used for registration. Please note that you should sign the request to receive information on the processing of your Personal Data.

Transfer of Personal Data

To run our business, we may need to rely on others who process personal data on our behalf, known as processors.

In cases where our Processors transfer the Personal Data to a country outside the EU/EEA, we have ensured that the Processing is lawful under applicable law by fulfilling one of the following requirements:

• there is an EU Commission decision that the country ensures an adequate level of protection;
• application of the European Commission’s standard contractual clauses for third country transfers; or
• other appropriate protection measures that comply with applicable law. 

We have entered into Data Processing Agreements (DPAs) with all our Data Processors. The PUB agreement regulates how the Processor may process the Personal Data and what security measures are required for the personal data processing.

We may also need to provide your Personal Data to certain designated authorities in order to comply with legal obligations or decisions by authorities.

Our Data Processors

7.   Data processor: Baby Journey AB

Personal data processed: Name, email address, pregnancy information, information about your child(ren), IP number and user behavior.

Instructions: Storage, Processing, Analysis.

Security

Baby Journey has taken technical and organizational measures to ensure that your personal data is processed securely and protected from loss, misuse and unauthorized or unauthorized access. 

Our security measures

Organizational security measures are measures that are implemented in practices and procedures within the organization. Our organizational security measures are:

• Internal steering documents (policies/instructions)
• Login and password management
• Information security policy

Technical security measures are measures implemented through technical solutions. Our technical security measures are:

• Access list
• Access log
• Backing up
  
  
• Regular monitoring of the security level
• Two-step verification

Cookies

Baby Journey uses cookies and similar tracking technologies to, among other things, analyze how Features are used so that we can provide you with the absolute best user experience. More information about how we use cookies can be found in our Cookie Policy (https://babyjourney.se/cookies).

If we do not keep our promises

If you feel that we are processing your Personal Data incorrectly, even after you have brought this to our attention, you always have the right to submit your complaint to the Swedish Data Protection Authority.

More information on our obligations and your rights can be found at https://www.imy.se/. You can also contact the European Data Protection Authority at imy@imy.se.

Changes to this policy

We reserve the right to make changes to this Policy. Where the change affects our obligations or your rights, we will inform you of the changes in advance to give you the opportunity to consider the updated policy.

Contact

Please contact us if you have questions about your rights or if you have any other questions about how we process your personal data: Timmy@babyjourney.se 

The controller shall provide the data subject with a copy of the personal data undergoing processing. For any additional copies requested by the data subject, the controller may charge a reasonable fee based on the administrative costs. The request will be provided in an encrypted format to the user with a 7-day grace period.