Your data - Privacy Policy

Who we are

Indian Association of Luleå (Indiska Föreningen i Luleå) is a non-profit association representing the Indian community in the Norrbotten region of Sweden. We are the data controller for the personal data described in this policy.

If you have any questions about this policy or how we handle your data, contact us at info@iaol.se.

Information we collect

We only collect the information needed to run the association and its events:

• Account details — your name and email address, used to sign you in and identify you as a member.
• Family details — a partner you link your account with, and the names of children you add, so you can RSVP for your household.
• Membership — your membership status and the year it applies to, and a record that you have reported a membership payment.
• Event participation — your RSVPs (attending / maybe / not attending), which family members are attending, and any volunteer slots you sign up for.
• Technical & usage data — basic, mostly anonymous analytics about how the website is used (see “Cookies and analytics”).

How we use your information

We process your personal data on the following legal bases under the GDPR:

• To provide membership and manage the association — on the basis of our agreement with you as a member.
• To organise events, RSVPs and volunteering — on the basis of your consent and our legitimate interest in running community events.
• To communicate with you about your membership and events — on the basis of our legitimate interest in keeping members informed.
• To keep the website and app secure and improve them — on the basis of our legitimate interest.

Payments

Membership fees are paid via Swish. We do not collect or store your card or bank details — those are handled entirely by Swish and your bank. We only record that you have reported a payment, which an administrator then confirms.

Cookies and analytics

Our website uses cookies that are necessary for sign-in and core functionality. With your consent, we also use Google Analytics to understand, in aggregate, how the site is used so we can improve it. You can decline analytics cookies via the cookie banner, and you can clear cookies in your browser at any time.

How we store and protect your data

Your data is stored in our database and authentication system provided by Supabase, and the website is hosted by Vercel. Access is restricted, and members can only see their own data and that of their linked family. We take reasonable technical and organisational measures to protect your information.

Sharing your information

We do not sell your personal data. We share it only with the service providers that help us operate, who process it on our behalf:

• Supabase — database, authentication and file storage.
• Vercel — website hosting and delivery.
• Google Analytics — aggregate website usage statistics (only with your consent).
• Swish — membership payments (we do not receive your payment credentials).

Data retention

We keep your account and membership data for as long as you are a member and for a reasonable period afterwards for our records. Event and RSVP history may be retained for the association’s archives. You can ask us to delete your data at any time, subject to any legal record-keeping obligations.

Children’s information

Children are added to the association only by their parent or guardian, who provides the child’s name to enable family RSVPs. We do not knowingly collect any other information about children. A parent or guardian can remove a child’s record at any time.

Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request erasure of your data (“right to be forgotten”).
• Object to or restrict certain processing.
• Request a copy of your data in a portable format.
• Withdraw consent at any time, where processing is based on consent.

Contact and complaints

To exercise any of your rights, or if you have questions about this policy, email us at info@iaol.se. We will respond as soon as we reasonably can.

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).

Changes to this policy

We may update this policy from time to time. When we do, we will revise the “last updated” date shown with the policy.