To provide the Chroma EZPZ.

• Performance of a Contract
• Legitimate Interest
• Consent

• User Data
• Usage Data

To understand, diagnose, troubleshoot, and fix issues with the EZPZ app.

• Performance of a Contract

• User Data
• Usage Data

To evaluate and develop new features, technologies, and improvements to the EZPZ app.

• Legitimate Interest

• User Data
• Usage Data

For marketing or advertising where the law requires us to collect your consent. For example, when we use cookies to understand your interests or the law requires consent for email marketing.

• Consent

• User Data
• Usage Data
• Survey and Research Data

To comply with a legal obligation that we are subject to. This might be:

• an obligation under the law of the country / region you are in
• Swedish law (because of our headquarters in Sweden), or
• EU law that applies to us

• Compliance with legal obligations

• User Data
• Usage Data
• Survey and Research Data

To comply with a request from law enforcement. This will only apply when a competent law enforcement authority contacts us. These include the police, the courts, and prisons.

• Compliance with legal obligations
• Legitimate interest

• User Data
• Usage Data
• Survey and Research Data

To fulfill contractual obligations with third parties.

• Legitimate interest

• User Data
• Usage Data

To take appropriate action with reports of intellectual property infringement and inappropriate content.

• Legitimate interest

• User Data
• Usage Data

To establish, exercise, or defend legal claims.

• Legitimate interest

• User Data
• Usage Data
• Survey and Research Data

To conduct business planning, reporting, and forecasting.

• Legitimate interest

• User Data
• Usage Data

To conduct research and surveys.

• Legitimate interest

• User Data
• Usage Data
• Survey and Research Data

Your rights

Access

You always have the right to receive information about the personal data processing that concerns you. We are always open and transparent about how we process your personal data. If you want a deeper insight into which personal data we process about you, you can request access to the data (the information is provided in the form of a register extract stating the purpose, categories of personal data, categories of recipients, storage periods, information about where the information came from collected and the existence of automated decision-making).

We only disclose information if we have been able to ensure that it is you who is requesting the information. Therefore, keep in mind that if we receive a request for access, we may ask for additional information to ensure efficient handling of your request and that the information is provided to the right person.

Be informed

Be informed of the personal data we process about you and how we process it.

Rectification

You can request that your personal data be corrected if the information is incorrect. You also have the right to request a supplement to any incomplete personal data.

Erasure

You can request deletion of personal data that we process about you if:

• The personal data is no longer necessary for the purposes for which it was collected or processed.
• You object to a balance of interests we have made based on legitimate interest and your reason for objection outweighs our legitimate interest.
• You object to processing for direct marketing purposes.
• Personal data is processed illegally.
• Personal data must be deleted in order to fulfill a legal obligation to which we are subject.

Please note that we may have the right to deny your request if there are legal obligations that prevent us from immediately deleting certain personal data. These obligations come from, for example, accounting legislation and tax legislation or banking and money laundering legislation. Processing may also be necessary for us to be able to establish, assert or defend legal claims. Should we be prevented from complying with a request for deletion, we will instead block the personal data from being used for purposes other than the purpose that prevents the requested deletion.

Restriction

You have the right to request that our processing of your personal data be restricted. If you believe that the personal data we process is incorrect, you can request a limited processing for the time we need to check whether the personal data is correct. If we no longer need the personal data for the stated purposes, but you do need them to be able to establish, assert or defend legal claims, you can request limited processing of the data from us. This means that you can request that we do not delete your information.

If you have objected to a legitimate interest assessment that we have made as a legal basis for a purpose, you can request limited processing for the time we need to verify whether our legitimate interests outweigh your interests in having the data deleted.

If the processing has been restricted according to any of the above situations, we may only, in addition to the storage itself, process the data to establish, assert or defend legal claims, to protect someone else's rights or if you have given your consent.

Object

You always have the right to avoid direct marketing and to object to any processing of personal data based on a balance of interests.

Data portability

In certain cases, you have the right to request that personal data about you and personal data you have provided to us, be transferred to another controller (so-called data portability). A prerequisite for data portability is that the transfer is technically possible and can be automated. What is written about the rights above only applies to the processing of personal data covered by the GDPR.

Direct marketing

You have the right to object to your personal data being processed for direct marketing. The objection also includes the analyzes of personal data (so-called profiling) that are performed for direct marketing purposes. Direct marketing refers to all types of outreach marketing measures (e.g. via mail, e-mail and SMS). Marketing measures where you as a customer have actively chosen to use one of our services or otherwise contacted us to find out more about our services do not count as direct marketing.

If you object to direct marketing, we will stop processing your personal data for that purpose as well as stop all types of direct marketing measures.

Remember that you always have the right to decide which channels we will use for direct mail and personal offers. For example, you can choose to only receive offers from us via e-mail, but not SMS. In that case, you should not object to the processing of personal data as such, but instead limit our communication channels.

You can also object specifically to the analyzes we do (profiling).

Withdrawal of consent

Withdraw your consent to us collecting or using your personal data.

You can do this if Chroma is processing your personal data on the legal basis of consent.

Legitimate interest

Withdraw your consent to us collecting or using your personal data.

Where we use a balance of interests as a legal basis for a purpose, you have the right to object to the processing. In order to continue to process your personal data after such an objection, we need to be able to show a compelling justified reason for the processing in question that outweighs your interests, rights or freedoms. Otherwise, we may only process the data to establish, exercise or defend legal claims.

Right to lodge a complaint

Contact the Swedish Authority for Privacy Protection or your local data protection authority about any questions or concerns. The Swedish Authority for Privacy Protection is the supervisory authority, i.e. responsible for monitoring the application of the legislation. If you believe that a company is processing personal data incorrectly, you can submit a complaint to the Swedish Authority for Privacy Protection.