Introduction
Influeri AB (“Influeri” or “we” in any form) is committed to protecting your privacy.
Influeri provides the Influeri platform (the “Platform”), an automated marketing system for companies that want to use influencer profiles (“Profiles”) in their marketing campaigns (“Campaigns”). Profiles create posts in the Platform which are used in the Campaign in question (“Posts”) after approval from the relevant customer.
This personal data policy (“Privacy Policy”) informs you about how we, as a data controller, process Profiles’ personal data and personal data concerning contact persons / representatives and users linked to our customers and other partners. It also describes the rights of individuals under applicable data protection legislation and how they can be exercised.
Terms defined by law — such as “personal data”, “processing” and “controller” — have the same meaning here as in the relevant law, unless otherwise specified.
Processing refers to any action involving your personal data including collection, management, storage, sharing, access, use, transfer and erasure or destruction. “Personal data” means any information that can be linked directly or indirectly (e.g. in combination with other information) to an identifiable natural person. A controller is a natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.
“Applicable data protection law” means the legislation, regulations and rules in force from time to time relating to the protection of fundamental rights and freedoms of natural persons and, in particular, the right to protection of personal data — including Regulation (EU) 2016/679 (General Data Protection Regulation, the “GDPR”) and legislation supplementing the GDPR.
If you have questions about our processing of your personal data, please contact us using the details at the end of this policy.
1. Where we collect personal data from
We collect personal data from:
- You — e.g. when you contact us in the normal course of business.
- Third-party databases. We collect Profiles’ personal data from social media via partner databases.
- Other contact persons of the company or organisation you represent — e.g. if your employer or a colleague provides information about you such as name, position and contact details.
2. When and why we process personal data
2.1 Contacts for customers and other partners
2.1.1 Managing business relationships
To manage normal business relationships we process your personal data as a contact person and/or representative of our customers or partner companies. This includes managing an existing or potential contractual relationship and normal business correspondence, including communication with you as a contact person and/or representative.
Categories: Identity data (including social security number if a sole proprietorship), Contact data, Organisational data, Communication data.
Legal basis: Necessary for our legitimate interest in managing, entering into and maintaining business relationships with the company or organisation you represent. If you are the owner of a sole proprietorship with whom we have or plan to enter into a contract, processing is necessary to perform the contract and/or to take steps at your request prior to conclusion. Processing of social security numbers is necessary for the purpose.
Retention: For the duration of the relationship, or for the shorter period you act as representative/contact person. Thereafter for the time necessary to establish, exercise or defend legal claims — up to the general limitation period, which in Sweden is ten (10) years.
2.1.2 Create and manage user accounts for customers in the Platform
We process personal data for our clients’ employees who have user accounts in the Platform.
Categories: Identity data, Contact data, Organisational data, Account data in the Platform, Activity information in the Platform.
Legal basis: Necessary for our legitimate interest in providing the Platform to our customers.
Retention: Until the account is closed.
2.2 Profiles
2.2.1 Find Profiles for Campaigns
We process Profiles’ personal data to find suitable Profiles for our customers’ Campaigns by searching third-party databases (and, where the Profile has a Platform account, among those accounts). By matching Profiles’ social media with the client’s mission statement and desired target group, the Platform selects matching Profiles which are then presented to the customer for selection.
Categories: Account information and social media account content, Information on interactions on social media accounts, Information on followers and, where applicable, Statistics on published Posts.
Legal basis: Necessary for our legitimate interest in finding suitable Profiles for specific Campaigns to fulfil contracts with our customers, and for our legitimate interest in providing Profiles with opportunities to enter into contracts with our customers.
Retention: Until the end of the relevant Campaign.
2.2.2–2.2.3 Creating and managing user accounts for Profiles in the Platform
To upload material to the Platform within an assignment, the Profile must first create an account. We therefore process the Profile’s personal data to enable use of the Platform.
Categories: Identity data, Contact data, Account data in the Platform, Activity information in the Platform.
Legal basis: Necessary for our legitimate interest in offering Profiles the opportunity to create an account and to enter into contracts with our customers. Typically also in the Profile’s own interest as they may be considered for business opportunities.
Retention: Until the Profile chooses to close the account (via settings in the Platform).
2.2.4 Future campaigns
We use personal data stored in the Platform from previously completed Campaigns to create a basis for finding suitable Profiles for future Campaigns.
Categories: Identity data, Contact data, Statistics on published Posts, Information on activity in the Platform.
Legal basis: Legitimate interest as in 2.2.1.
Retention: Until the Profile closes the account or five (5) years from the Profile’s last activity in the Platform.
2.2.5 Profiles that do not want to be contacted
We process personal data to ensure we do not contact Profiles who have asked not to be contacted.
Categories: Identity data, Contact data. Legal basis: Legitimate interest in honouring opt-outs. Retention: Five (5) years.
2.3 Other processing concerning both customers and Profiles
Managing and responding to feedback and questions
If a representative or a Profile contacts us (e.g. via email), we process personal data provided to communicate with the individual and to investigate and respond.
Categories: Identity data, Contact data, Organisational data, Communication data. Legal basis: Legitimate interest in handling support cases. Retention: Until the case is closed and thereafter for the time needed to establish, exercise and defend legal claims.
2.3.1 Developing the Platform
We process personal data to develop the Platform — compiling feedback and results and analysing use of the Platform.
Categories: Identity data, Contact data, Organisational data, Communication data, Statistics for published Posts. Legal basis: Legitimate interest in improving the Platform. Retention: Five (5) years.
Fulfilling legal obligations
We process personal data to comply with legal obligations that apply to us, such as bookkeeping and accounting requirements.
Categories: All data necessary to fulfil the respective obligation. Legal basis: Necessary to comply with legal obligations. Retention: As long as needed to fulfil those obligations.
2.3.2 Establishing, enforcing or defending legal claims
For the purpose of establishing, exercising or defending legal claims (e.g. in a dispute or legal proceedings) we may process your personal data.
Categories: All data necessary for the purpose (sensitive data only if necessary for the claim). Legal basis: Legitimate interest in establishing, exercising or defending claims. Retention: During the statutory limitation period (general period in Sweden: ten (10) years).
3. Recipients with whom personal data is shared
When necessary we share personal data with the following recipients. Unless otherwise specified, named recipients are independent controllers for their own processing.
- Customers — selected Profile data is shared with the customer selecting Profiles for a Campaign.
- Profiles — campaign-relevant customer information is shared with selected Profiles.
- Service providers / processors — see §4.
- Authorities and courts — where required by law or to establish, exercise or defend legal claims.
- Professional advisers and auditors — under confidentiality.
4. Data processors
To fulfil the purposes above we share your personal data with service providers we have engaged, such as system providers. Engaged providers may only process your personal data according to our explicit instructions and may not use the data for their own purposes. They are required by law and contract to take appropriate technical and organisational security measures to protect your data.
5. Transfer of personal data to non-EU/EEA countries
If Influeri transfers or discloses your personal data to a recipient in a country outside the EU/EEA area (third country), Influeri will ensure that appropriate safeguards are in place (such as the European Commission’s standard contractual clauses and other necessary measures) to protect the personal data.
Under the GDPR you have the right to obtain, upon request, a copy of the documentation demonstrating that appropriate safeguards have been put in place when personal data is transferred to a third country.
To learn more about whether your personal data is transferred to a third country, contact us at the details in §7.
6. Your rights
In connection with our processing you may exercise the following rights under the GDPR. To exercise any right, contact us via the details in §7.
Access
You can request confirmation of whether we are processing your personal data. If so, you have the right to access the data and to information such as the purpose of processing, and to receive a copy. If the request is made electronically, information will be provided in a commonly used electronic format unless you request otherwise.
Rectification
If personal data concerning you is inaccurate or incomplete, you have the right to have it rectified or completed.
Objecting
You may object to processing for direct marketing purposes or — if processing is based on legitimate interest — for reasons relating to your particular situation. We must then cease processing unless we demonstrate compelling legitimate grounds that override your interests. We may continue processing necessary to establish, exercise or defend legal claims. Processing for direct marketing always ceases upon objection.
Erasure
You can have personal data deleted where: it is no longer necessary for the purposes collected; processing is based solely on consent and you withdraw it; you object and there is no overriding legitimate ground (or the processing is for direct marketing); processing is unlawful; or erasure is required to comply with a legal obligation. The right does not apply to the extent processing is necessary to exercise freedom of expression and information, to comply with a legal obligation, or to establish, exercise or defend legal claims. Where we have made data public and you have a right to erasure, we may be obliged to notify other controllers of your request.
Restriction
You can request restriction to storage only where: you contest accuracy (for the period we verify it); processing is unlawful and you oppose erasure; we no longer need the data but you need it for legal claims; or you have objected pending verification of legitimate grounds. We may still process with your consent, for legal claims, or to protect the rights of another person.
Withdrawing consent
Where processing is based on your consent, you may withdraw that consent at any time.
Data portability
Where processing is based on consent or necessary for performance of a contract with you and data was obtained from you, you may request a machine-readable copy and transfer to another controller where possible.
Complaint to the supervisory authority
You may lodge a complaint regarding our processing with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY). For contact details visit www.imy.se. You are also welcome to contact us first with any questions or complaints.
7. Contact details
Data controller: Influeri AB · org. no. 559333-4740
Emmy Rappes gata 1 · 113 68 Stockholm · Sweden
Email: info@influeri.com
8. Categories of personal data
Where we refer to categories above, the terms mean:
- Identity data — name, personal identity number (where relevant), date of birth.
- Contact data — email, phone, postal address, social handles.
- Organisational data — employer, title, role, organisation number.
- Communication data — contents of correspondence, support tickets, notes.
- Account data in the Platform — username, login, settings, consents.
- Activity information in the Platform — actions taken, campaigns viewed, messages sent.
- Account information and social media account content — public profile data, posts, media.
- Information on interactions — likes, comments, engagement signals.
- Followers and statistics on Posts — reach, impressions, engagement and performance metrics.