Privacy policy

Data controller

Lion and Sun Association, a non-profit association based in Gothenburg, Sweden. Privacy contact: info@lionsun.se.

Purposes and legal basis

We process personal data for the following purposes, each with a legal basis under the General Data Protection Regulation (GDPR):

• Membership and member services (account, membership card, members' area): performance of the membership agreement, Article 6(1)(b).
• Membership fees and bookkeeping: legal obligation under the Swedish Accounting Act, Article 6(1)(c).
• Contact and volunteer forms: legitimate interest in answering people who get in touch, Article 6(1)(f).
• Newsletter: your consent, Article 6(1)(a). You can withdraw it at any time.
• Security (sign-ins, IP address, audit log of administrative actions): legitimate interest in protecting members' data, Article 6(1)(f).

Sensitive data

Being a member of the association can reveal a political opinion, which is sensitive personal data (Article 9). We process it under Article 9(2)(d), as a non-profit body with a political aim, and never disclose members' data outside the association without explicit consent. Access to the member register requires two-factor authentication and is logged.

What we collect

Depending on how you use the site, we process:

• Account and membership: name, email, phone number if given, membership number, payment status, which version of the terms you accepted and when.
• Payments: Stripe handles card details; we receive the payment reference, amount and date.
• Contact and volunteer forms: name, email, your message and, for volunteers, areas of interest, availability, languages and city.
• Newsletter: email, language and when you confirmed the subscription.
• Technical data: IP address and browser at sign-in, on forms and for administrative actions.

Retention

Member data is anonymised within 90 days after membership ends. Bookkeeping records are kept for seven years under the Swedish Accounting Act. Audit log entries are kept for five years, without personally identifying information once an account is deleted. Contact and volunteer messages are kept while the matter is ongoing. Newsletter addresses are removed when you unsubscribe.

Processors and transfers outside the EU/EEA

We use the following providers. Several are US companies, so data may be transferred to or be accessible from the United States. Such transfers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

• Vercel Inc. (USA): hosting of the website (servers in Stockholm).
• Supabase Inc. (USA): database and sign-in.
• Stripe Payments Europe Ltd. (Ireland) / Stripe Inc. (USA): payment of membership fees.
• Cloudflare Inc. (USA): domain name (DNS), email forwarding and the security check against automated form submissions (Turnstile).
• Resend Inc. (USA): sending email from the website (confirmations, password resets, messages to the association).

Your rights

You have rights of access, rectification, erasure, portability and objection. Send requests to info@lionsun.se. You can always lodge a complaint with the Swedish Authority for Privacy Protection (IMY).