Privacy notice

Who is responsible

For a registration to Leon Lurje Trophy 2027, Skatesweden Events AB (org. nr 559215-9536) decides what is collected and why - they are the data controller. Write to them about your data at info@skatesweden.se. Postal address: Idrottens Hus Box 11016, 100 61 Stockholm.Website: https://www.skatesweden.se.

Unispect, operated by Hellersjö Consulting AB, runs the software on the organiser's behalf as a processor under a written data processing agreement (Art. 28 GDPR). Reach the operator at info@hellersjo.com.

For your Unispect account - your name, email and sign-in - Hellersjö Consulting AB is the controller, because the same account works for every competition on the platform. That includes the sign-in logs and the protection of the service against misuse.

If you hold a role in an organisation in Unispect - an administrator of a club, for example - which role you hold is processed on that organisation's behalf, because it is the organisation that decides who may access its data.

What we collect, and why we are allowed to

What	Why	Our legal basis
Team name, category, ISU member federation	Entering your team into the competition	Art. 6(1)(b) - the contract you enter into by registering
Contact person's name, email and phone	Confirming the registration and reaching you about changes	Art. 6(1)(b)
Rooming list - names, countries, phone numbers	Telling the hotel who is staying and in which room	Art. 6(1)(f) - the organiser's and the hotel's legitimate interest in knowing who is on the premises
Passport or national ID numbers	Hotel check-in, which many hotels cannot complete without one	Art. 6(1)(f), and Art. 6(1)(c) where local law obliges the hotel to record it
Travel details - flight numbers, arrival and departure times	Arranging transfers and shuttles	Art. 6(1)(b)
Allergies, dietary needs, accessibility requirements, short health notes	Feeding people safely, and making the venue and hotel work for them	Art. 6(1)(a) and Art. 9(2)(a) - explicit consent from the person themselves, or from a parent or guardian for a child who cannot decide it themselves. The team's contact person cannot consent for anyone else - see below
Consignment seller details - name, email, phone	Labelling your goods, paying you your share and reaching you about collection	Art. 6(1)(b) - the agreement to sell your goods
Payouts to sellers	Settling up after the sale, and keeping the accounts	Art. 6(1)(b), and Art. 6(1)(c) - the Swedish Bookkeeping Act requires the organiser to keep the record
Personal identity number (personnummer) on a member profile	Identifying you reliably as a member where the club needs to, for example in reporting to a federation or a grant body	Art. 6(1)(b) or (f). Art. 6(1)(c) only where a law requires the number - a requirement in a federation's own rules is not a legal obligation

We do not use any of this for advertising, we do not sell it, and we do not make automated decisions about anyone with it.

Health information is treated differently

Allergies and dietary requirements are special category data under Art. 9 GDPR - legally the same class as medical records. The legal basis is consent (Art. 6(1)(a)), and the exception from the ban on processing them is explicit consent (Art. 9(2)(a)). In practice:

Consent comes from the person the information is about. The team's contact person fills in the registration but cannot consent for anyone else. So the contact confirms that the people concerned have agreed, and for each person with a note of their own records whether that person or a parent or guardian consented. We keep who recorded it, when, and which version of this notice applied.
Children. For a child who cannot yet judge what it means, a parent or guardian gives the consent. An older child who understands what is shared and with whom can consent themselves. There is no fixed age; it depends on the child and on the information.
The fields stay closed until that consent exists. A registration can be completed without ever opening them.
Write only what is needed for the hotel or caterer to act - "no nuts", "wheelchair" - not diagnoses or medication.
They are encrypted with a key held outside the database, and deleted first - well before the rest of the registration.

Consent can be withdrawn at any time, and withdrawing deletes the information immediately. The contact person can remove one person's note on the rooming list, or withdraw consent for the whole team from the registration page. If you are on a team and want to withdraw your own consent, ask the team's contact person or the organiser.

How long we keep it

What	How long
Passport and national ID numbers	Deleted 14 days after the competition ends
Allergies, dietary needs, accessibility and other health-related notes	Deleted 30 days after the competition ends
Your registration, contact details, roster and travel details	Deleted 180 days after the competition ends
Registrations you started but never submitted	Deleted 30 days after they were last edited
Your Unispect account - name, email address and sign-in	Kept while the account exists; deleted when you delete the account from your profile page or ask us to
Consignment seller contact details - email and phone	Deleted 90 days after the sale
A paid consignment seller's name, next to the payout	Kept until the end of the seventh calendar year after the end of the organiser's financial year in which you were paid, because the Swedish Bookkeeping Act requires the organiser to keep the payout record that long
Invitations and campaign messages sent to you	Deleted 180 days after they were sent
The record of who looked at your data	Deleted after 365 days

These periods are read straight from the system that enforces them, so this table cannot drift away from what actually happens. Deletion runs automatically every day.

Who else sees it

The hotel named in the registration - rooming list including passport or ID numbers, for check-in. A hotel registering its guests is responsible for that data itself
The catering supplier at the venue - dietary requirements, in aggregate where possible
Hellersjö Consulting AB (Unispect) - operates the registration system on the organiser's behalf as a processor under Art. 28
Microsoft Azure (Sweden Central; email within Europe) - hosting, database, storage and email, as a sub-processor
Microsoft Entra External ID - the sign-in directory, holding the email address and display name of account holders, as Hellersjö Consulting AB's processor for the accounts
The hotel named in the registration - rooming list including passport or ID numbers, for check-in. A hotel registering its guests is responsible for that data itself
The catering supplier at the venue - dietary requirements, in aggregate where possible
Hellersjö Consulting AB (Unispect) - operates the registration system on the organiser's behalf as a processor under Art. 28
Microsoft Azure (Sweden Central; email within Europe) - hosting, database, storage and email, as a sub-processor
Microsoft Entra External ID - the sign-in directory, holding the email address and display name of account holders, as Hellersjö Consulting AB's processor for the accounts

The hotel, the caterer and the transport provider receive what they need from the organiser. A hotel that registers its guests is responsible for that data itself.

Registrations, rosters and every other competition record are stored in Microsoft Azure in Sweden, and email is handled within Europe. Microsoft may to a limited extent process data outside the EU/EEA, for example for support and security work; that takes place under the European Commission's standard contractual clauses. The sign-in directory (Microsoft Entra External ID) that holds account holders' email addresses and display names is currently located in the United States. That transfer relies on Microsoft's certification under the EU-US Data Privacy Framework and on the standard contractual clauses in Microsoft's data processing terms.

Your rights

You can exercise most of these yourself, straight away, from your registration page:

See it all (Art. 15, 20). "Prepare my copy" gives you a JSON file with everything held, why, and for how long.
Correct it (Art. 16). Every wizard step stays editable until the change deadline.
Delete it (Art. 17). "Delete our details" removes every personal field from the registration and its rooming list.
Withdraw consent (Art. 7(3)). One checkbox, as easy to untick as it was to tick, and it deletes the data it covered.
Object or restrict (Art. 18, 21). Contact us and we will act within one month.

Account holders can download a copy of everything held about their account - profile, club memberships and every team they have registered - and delete the account, from My profile. Deleting the account removes your name, contact details and sign-in; a team registration you made is kept for the organiser until its own deletion date, so delete that from its registration page first if you want it gone too. Anything else, contact us.

If you are on a team's roster but did not register the team yourself, contact the organiser, whose details are at the top of this page, or the team's contact person. The copy of a registration does not include other people's passport or ID numbers or health notes.

If you are not satisfied with how we handle a request, you can complain to Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm, imy@imy.se.

Cookies

We only set cookies that are strictly necessary, so none of them needs your consent under the ePrivacy rules: one keeps you signed in, one remembers the language you chose in the footer, and two short-lived ones exist only for the moments it takes to sign in and are gone afterwards. Dates and numbers follow your browser's own region settings and are not stored anywhere. There is no analytics, advertising or tracking on this site - which is why there is no cookie banner asking you to agree to any.

Security

Health notes, passport and ID numbers, personal identity numbers, phone numbers, the contact person's details and flight numbers are each encrypted, and the whole database is encrypted too. A registration is reached only by the account that made it and by those the organiser has given access - there is no link that opens it on its own, so a forwarded email discloses nothing. We record reads, changes, exports and deletions of registrations - when, by which account, and why - and your copy of your data includes that record.