1. Data controller

The data controller for the processing of your personal data is:

Company name: HSÖ Konsult AB

Company registration number (Sweden): 556644-7990

Postal address: Dunkevägen 22, SE-554 47 Jönköping, Sweden

E-mail: admin@orangize.se

If you have questions about how we process your personal data, or wish to exercise your rights, you are welcome to contact us at the e-mail address above.

2. What personal data we process

Depending on how you use the website, the course and the shop, we may process the following categories of personal data:

On registration (free Steps 1–3)

• Name and e-mail address.
• Account details, such as username and password (the password is stored in encrypted form).

On purchase of the paid course (Steps 4–12) or the e-book

• Name and e-mail address.
• Payment and order details, such as purchase history and order confirmation. The payment itself is handled by our payment provider, which processes your card or payment details – we do not store full card details.
• For company purchases, also company name, company registration number and VAT number, and any invoice and reference details.

When using the course

• Data about your progress in the course, such as completed lessons and results from exercises and self-assessments, and login times.

When contacting us

• The data you provide yourself when you contact us, such as name, e-mail address and the content of your message.

Technical data

• IP address, information about your device and browser, and the strictly necessary cookies required for the website, login and security to work (see section 4).

3. Purposes and legal basis

We process your personal data for the following purposes and on the following legal bases:

• To provide and administer your account and the course (Steps 1–3 and Steps 4–12), including login, unlocking of content and technical operation. Legal basis: performance of a contract.
• To handle purchases, payment, delivery of the e-book and accounting. Legal basis: performance of a contract and legal obligation (including the Swedish Accounting Act).
• To answer questions and handle support and complaint matters. Legal basis: performance of a contract or our legitimate interest in being able to help you.
• To maintain security and prevent misuse, unauthorised sharing and attempted intrusion. Legal basis: our legitimate interest in protecting the service and our users.
• To use strictly necessary cookies so that the website works. Legal basis: our legitimate interest / the processing being necessary to provide the service you request. For any non-essential cookies, we ask for your consent (see section 4).

4. Cookies and similar technologies

The website currently uses only strictly necessary cookies. These are required for basic functions such as login, security and the checkout to work, and do not require your consent.

Embedded videos are shown via Vimeo in privacy mode, which means they do not set tracking cookies when you visit the page.

If we add features in the future that use non-essential cookies – for example visitor statistics – consent is handled through our cookie solution (Cookiebot), where you can give or withdraw your consent at any time.

5. Recipients and data processors

To provide the service we use certain suppliers that process personal data on our behalf (data processors). They may only process the data according to our instructions and under data processing agreements. Recipients may be:

• Web host and operations provider, which stores the website and its database, and provides our e-mail: Oderland Webbhotell AB (Sweden).
• Payment providers when you purchase Steps 4–12 or the e-book: Stripe Payments Europe Ltd (Ireland) and, if you choose to pay with Klarna, Klarna Bank AB (Sweden). Each provider processes your payment details under its own privacy policy.
• Vimeo (video hosting) when embedded videos are played.
• Cookiebot / Usercentrics for cookie consent management.

We never sell your personal data to third parties. Data may also be disclosed where we are required to do so by law or by a decision of a public authority.

6. Transfers outside the EU/EEA

Some of our suppliers, for example Vimeo and Stripe, are based in or may transfer personal data to the United States or another country outside the EU/EEA. Where such a transfer takes place, we ensure that there is a valid basis and appropriate safeguards under the GDPR, such as the European Commission's standard contractual clauses, an adequacy decision or another valid transfer mechanism.

7. How long we keep your data

We keep your personal data only for as long as necessary for the purposes for which it was collected, or for as long as we are required by law to keep it:

• Account details for the free Steps 1–3: for as long as you have an active account. You may request deletion of the account at any time.
• Data linked to the paid course: during the period of access (12 months) and thereafter for as long as needed to manage the relationship.
• Order details for the e-book: for as long as the download links are provided, and thereafter as accounting records.
• Accounting records: seven years under the Swedish Accounting Act.
• Support and complaint matters: for as long as needed to handle the matter.

8. Your rights

Under the GDPR you have the following rights:

• Right of access – to know what data we process about you (a copy of your data).
• Right to rectification – to have incorrect data corrected.
• Right to erasure – to have your data deleted, to the extent this does not conflict with the law.
• Right to restriction of processing.
• Right to object to processing based on legitimate interest.
• Right to data portability – to receive data you have provided in a machine-readable format.
• Right to withdraw consent, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise your rights, contact us at admin@orangize.se.

9. Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss and misuse.

10. Complaints to a supervisory authority

If you believe we are processing your personal data incorrectly, you have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), https://www.imy.se. If you live in another EU/EEA country, you may also complain to the data protection authority in your own country.

11. Changes to this policy

We may update this privacy policy, for example when our business or the legislation changes. The latest version is always published on the website, with the date of the last update.

12. Contact

Do you have questions about this privacy policy or about how we process your personal data?

HSÖ Konsult AB – admin@orangize.se