At Swedish National Maritime and Transport Museums (SMTM) we care about your privacy and always strive for a high level of data protection. We explain here how we collect and use your personal information. We also describe your rights and how you can exercise them.
We want to you to feel reassured about how we process your personal data. We are therefore open about how we collect and handle the information we save about you. You are always welcome to contact us with any questions you might have.
This information does not cover the processing of personal data that takes place within SMTM's purely administrative activities.
SMTM is a government agency. This means that messages sent to us as a general rule become public documents that are logged, registered and in response to a request will be disclosed according to the principle of public access. When any such request is received, a secrecy assessment is done in accordance with the Public Access to Information and Secrecy Act prior to disclosure. If there are grounds for secrecy, the personal data is not disclosed. Unless it is of crucial significance to the assessment of secrecy, SMTM does not have a right to inquire to whom the data is being disclosed.
The processing of personal data that is required under the Public Access to Information and Secrecy Act, archiving legislation and the Administrative Procedure Act for correct handling of the agency’s public documents, and that takes place pursuant to the EU General Data Protection Regulation, is deemed necessary in consideration of an important public interest.
Control of personal data
SMTM, which comprises the Naval Museum, the Maritime Museum, the Vasa Museum, Vrak - Museum of Wrecks and the Railway Museum, is the controller for the processing of personal data for which the agency determines purpose and funding. We are responsible, for example, for the processing that takes place when you provide personal data in connection with a ticket purchase, in recruiting, in dealing with questions put to the museum or when you choose to subscribe to a newsletter.
Statens maritima och transporthistoriska museer
Box 27131
102 52 Stockholm
Telephone: +46(0)8 519 549 00
E-mail: registrator@smtm.se
Corporate identity number: 202100-1132
Contact for questions about data protection
If you have any questions about how we handle your personal data or wish to exercise your rights regarding our processing of your personal data, you can contact our Data Protection Officer by sending an e-mail to:
What is personal data and what is processing of personal data?
Personal data is any kind of information that can be directly or indirectly associated with you as a person. This applies, for example, to name, personal identity number, address, e-mail address and telephone number. It also applies to images, sound recordings or IP addresses processed in a computer that may be personal data even if no names are mentioned. Sensitive personal data is personal data that requires an extra degree of protection. Examples of sensitive personal data are data on ethnic origin, political views, religious or philosophical beliefs, trade union membership or data concerning health.
Processing of personal data in principle means everything that can be done with the data. This may, for example, relate to collecting, registering, storing, printing or reading the data on a screen.
What personal data do we collect and why?
You can read here about what personal data we collect, for what purpose, how we process it and what legal basis we have for doing so.
Informing about our activities
To provide information about the activities of the agency and the museums, we may process data concerning name, professional title, contact details, still photograph, video or sound recordings. The information may be used on the agency's website, social media or in printed material (for example newsletters, brochures or reports). General images, ‘crowd pictures’ are used without each individual person being asked. The same applies to video and sound recordings. The legal basis for the processing is necessity to carry out a task of public interest.
Enquiries, comments and service matters
To enable us to answer questions concerning our activities, deal with service matters and enquiries by telephone, e-mail, chat, form or on digital channels, including social media, we process data concerning name, contact details and your correspondence for the person who is enquiring. The legal basis for the processing is necessity to carry out a task of public interest.
Contemporary documentation
To enable us to document the contemporary world, often referred to as contemporary documentation, we process data relating to name, personal identity number, professional data, still photographs, video or sound recordings. The information is used to preserve our cultural heritage for the present, the future and research. The legal basis for the processing is necessity to carry out a task of public interest.
Making our collections available
To enable us to list, scientifically process and make available our collections, we process data concerning the ownership history and provenance of objects (name of previous owner and year of birth) and, to some extent, personal photographs in the agency’s photograph collections. Images and information about objects are made available in the Digital Museum. The legal basis for the processing is necessity to carry out a task of public interest.
Applications for government grants
To enable us to handle applications for government grants for defence history museum activities and vessels of historical value, we process data concerning the applicant's name, contact details and personal identity number (where applicable), The legal basis for the processing is necessity to carry out a task of public interest.
Booking of premises and services
To enable us to manage and administer bookings of premises, educational activities, guided tours, programme activities, seminars and courses, we process data relating to names and contact details, as well as any data you yourself choose to provide, for example concerning allergies and medical conditions. In cases where invoicing occurs, personal identity number and invoicing address are also processed. The legal basis for the processing is necessity to fulfil the agreement that has been entered into.
Purchase of goods and tickets
To enable us to deal with orders and purchases of vouchers, e-tickets, publications, photographs and goods from the museum shops, we process data concerning name, contact details and payment and purchasing information. The legal basis for the processing is necessity to fulfil the agreement that has been entered into in connection with purchases of goods and tickets.
Participation in events and creative involvement
To enable us to fulfil our remit and spread interest and knowledge within our area, we sometimes arrange competitions or creative involvement through interactive digital solutions in exhibitions. When taking part, you provide data relating to name and e-mail address. We collect your personal data to enable you to take part in competitions and creative involvement. The legal basis for the processing is necessity to carry out a task of public interest.
Studies and surveys
If you choose to take part in our surveys and studies, we process data relating to your name and e-mail address. The aim of the processing is to study and improve our activities. The legal basis for the processing is necessity to carry out a task of public interest.
Subscribing to press releases and newsletters
If you register for a subscription to one of our newsletters or press releases, we process data relating to your name and your e-mail address. The objective in processing your personal data is to enable us to administer your subscription and send out the newsletters. The legal basis is necessity to fulfil the agreement you have entered into with us when registering as a subscriber. You can terminate your subscription at any time.
Mailings to specific stakeholders
To enable us to send out invitations to events and targeted mailings to specific stakeholders (the agency's network), we process data relating to the recipient's name and e-mail address. The legal basis for the processing is necessity to fulfil the agreement that has been entered into with specific stakeholders. You can terminate your subscription at any time.
Recruiting staff
To enable us to fill vacancies, we process your personal data when you apply for a job with us or submit an application. This applies to the applicant’s name, contact, details, educational background, work experience and personal letter, other attached files (for example written references and certificates), personal identity number and photograph where applicable. The purpose of the processing is to enable us to administer and fill the position. The legal basis for the processing is consent. The data is erased within 6 months after registration. If consent is renewed (question sent by e-mail), the data is retained for up to two years for possible matching with other roles. We use an external system in the recruitment process.
Procurement of goods and services
When we purchase goods and services, we do so in accordance with the rules on public procurement. We process personal data for communication and administration of a procurement case. The legal basis for the processing of personal data in connection with procurements is necessity to fulfil a legal obligation.
When a contract has been entered into with a supplier, we process personal data for the purpose of carrying out contract follow-up and invoice management, among other things. The legal basis for the processing is necessity to fulfil contracts that have been entered into.
How is your personal data protected?
We take measures to ensure that your personal data is always protected by us and that the processing takes place in accordance with applicable rules on data protection and our internal guidelines and procedures. Only those persons who actually need to process your personal data to be able to fulfil our stated purposes have access to it.
How do we handle personal identity numbers?
We will only process your personal identity number when it is clearly warranted in consideration of the purpose, necessary for reliable identification or if there is some other notable reason. We always minimise the use of your personal identity number as far as possible by using your birth registration number instead, in cases where this is sufficient.
Where do we process your personal data?
We process personal data in our own IT systems or engage other suppliers – processors. In cases where we make use of a processor, we draw up a data processing agreement to ensure that the data is processed in accordance with applicable rules. We endeavour always to process your personal data within the EU/EEA area.
Who may we share your personal data with?
Recipients of your personal data may be those who visit the museums, visit the government agency’s websites and social media channels, read newsletters and other external communication.
The employees of SMTM who will view the data need it for administrative purposes. As well as the disclosure of personal data that the government agency needs to undertake as a consequence of the principle of public access to official documents, the Swedish National Maritime and Transport Museums in some cases make use of processors. The processors who are engaged process the information on our behalf and in accordance with our instructions.
We have processors who assist us with:
- Marketing and information (services for newsletters and mailings, media and digital agencies, distribution).
- Booking and servicing (to manage various events, tours and courses).
- IT and web services (companies that deal with necessary operation, development, technical support and maintenance of our IT and web solutions).
Companies that are independent controllers
We also share your personal data with certain companies which are independent controllers. The fact that the enterprise is an independent controller means that it is not we who control how the information to be submitted to the company is to be processed.
Independent controllers we share your personal data with are:
- Government agencies (the police service, the Swedish Tax Agency or other agencies) if we obliged to do so by law or where crime is suspected.
- Companies that offer payment solutions (card-acquiring companies, banks and other payment service providers).
When your personal data is shared with a company that is an independent controller, the privacy policy and personal data handling of that company apply.
From what sources do we obtain your personal data?
In addition to the data you yourself supply to us, we may also collect personal data in connection with documentation of our activities and events. This may mean photographs, audio and video recordings. We may also collect personal data from you based on your purchases and how you use our services, and we may then collect from someone else (a ‘third party’).
The data we collect from a third party is as follows:
- Address information from public registers to make sure that we have the correct address details for you,
- Data on creditworthiness from credit rating agencies, banks or reference agencies
During what period will the personal data be stored?
As a government agency, the basic principle under archive legislation is that the agency must retain public documents. SMTM follows these rules on retention and purges public documents in accordance with purging rules and decisions.
Personal data that is not included in a public document is retained only for as long as necessary for the purposes for which it is processed. The documents that not to be regarded as public documents are, for example, drafts of decisions and reminder notes that have not been archived. When a matter has been finalised, an assessment is made of what is to be retained in the matter under archive legislation. The documents that contain personal data and that are not to be retained are erased or cleared of personal data.
Application documents that do not relate to the person who has obtained the position or the person has appealed against the appointment decision are purged after two years after the employment decision has become legally valid.
Data on purchases of goods and tickets is stored until the purchase has been carried out, including payment and delivery. Subsequently for the purpose of being able to deal with any complaint and warranty matters.
Documents that are of low or temporary significance are as a rule purged immediately or at the latest after two months.
Personal data on subscribers is erased when the subscription ends.
What rights do you have if we hold your personal data?
You have the right to request a register extract and to receive a copy of any personal data registered with us, together with information about how it is handled. This is done by applying in writing and with the signature of the applicant themselves. This means that applications must be made on paper (fax or e-mail are not accepted). It is also acceptable to send a registered letter to SMTM. State your full name, personal identity number and contact details.
Post the letter to:
Statens maritima och transporthistoriska museer
Box 27131
102 52 Stockholm
You have the right to one free register extract per year. The reply will be sent by post to your address in the population register, within one month.
Rectification, erasure or restriction
You have the right to demand rectification of data you consider to be incorrect, incomplete or misleading and the right to restrict the processing of the personal data until it has been rectified. In certain cases you also have the right to have your personal data erased. The right to erasure of data does not apply to the processing of the data in order to enable the Swedish National Maritime and Transport Museums to fulfil its remit or if stated by an official document.
In cases where you have given consent for the processing of your personal data, you can withdraw your consent at any time, which in such a case applies to the processing of personal data as of the time when the consent is withdrawn.
Children have the same rights to protection of their personal data as adults.
This means that children also have the right, for example, to receive information about the processing of personal data, to obtain access to their data, to have data rectified or erased and to receive compensation in the event of incorrect processing. This right can be asserted by the child themselves or by a guardian, depending on the age of the child.
If it is the guardian who asserts the rights, it must nevertheless be remembered that they do it on behalf of the child and that it is the rights of the child that are to be protected. The reply is sent by post to the child’s address in the population register.
Data portability
Data portability means that any person who has given their personal data in a structured, generally used and machine-readable format has the right to extract the data and to transfer it to another data controller.
The recipient of the personal data is obliged to facilitate such transfer of data. This obligation is, however, conditional on the data being processed on the basis of the data subject’s consent or an agreement with the data subject. And it applies only to such data as has been provided by the data subject themselves.
Questions and complaints
If you have any questions about the processing of your personal data, you are welcome to contact us:
Statens maritima och transporthistoriska museer
Box 27131
102 52 Stockholm
Telephone: switchboard +46 (0)8-519 549 00
E-mail: dataskyddsombud@smtm.se
If you are not satisfied with the reply you receive form us, you have the right to submit a complaint to the supervisory authority, the Swedish Authority for Privacy Protection.