Lejonet och Kronan
Controller: Lejonet och Kronan. Contact: Fredrik Hultin, info@lejonetochkronan.org.
What we collect: name, email, phone number, lodge, degree, your guest's name, dietary requirements and allergies, and payment status and amount. When you pay, we see the sender's name and account on the payment, and for refunds the bank details you give us.
Why and on what basis: to administer your registration, payment, catering and entry. Your lodge, degree and dietary requirements can reveal sensitive information, so we only process them with your explicit consent (GDPR Art. 9(2)(a)). Payment details are processed to fulfil the purchase (Art. 6(1)(b)) and kept as required by accounting law.
Who has access: the organisers and staff at the event. The data is stored encrypted within the EU with Amazon Web Services in Ireland. Staff views, exports and changes are logged. Payments are received in the association's bank account.
Protection against abuse: the registration form is protected against bots with Cloudflare Turnstile, which checks the browser without tracking cookies. Cloudflare may process your IP address for this, also outside the EU under the EU standard contractual clauses. We also keep technical logs with IP address and the page requested for 30 days, to detect and investigate attacks. The legal basis for both is our legitimate interest in a secure service (Art. 6(1)(f)).
How long: registration details are automatically erased 30 days after the event. Only the amount, payment reference and dates are kept, as required by Swedish bookkeeping law. Backups are deleted automatically within a further 7 days.
Your rights: you can request access, correction or deletion, and withdraw your consent at any time by contacting us. Withdrawing consent cancels your registration. You can also complain to the Swedish Authority for Privacy Protection (IMY).