Cette page n'existe pas en français. Elle est affichée en anglais.Vers la page d'accueil en français

Privacy policy

Malmö Musikskola AB wants you to feel confident about how we process personal data about you and your child. Here we explain what data we hold, why we hold it, how long we keep it and what rights you have. If you have any questions, you are always welcome to get in touch — the contact details are at the bottom of this page.

Who is responsible for the personal data?

Malmö Musikskola AB, corporate identity number 559315-8917, Sarvgränd 1B, 216 12 Limhamn, Sweden, is the data controller for the personal data processed when you register your interest, book a trial lesson, sign an agreement for lessons, use the family pages or otherwise contact the school.

What personal data do we process?

Contact and agreement details: name, e-mail address, telephone number and postal address of guardians and adult pupils; the pupil's name and date of birth; the content of the agreement (course, lesson length, price and commitment period), invoices and payments.
Personal identity number of adults who log in with BankID — guardians and adult pupils. It is used to establish securely who is logging in and who the contracting party is. For pupils who were transferred from our previous pupil register we also hold the pupil's personal identity number. Personal identity numbers are stored protected and separately from other data.
Teaching data: lesson times, attendance and absence, moved and saved lessons, the teacher's notes from the lesson and the material the teacher shares with you — for example sheet music, images, audio clips and links.
Registration of interest: what you enter in the form — name, e-mail address or telephone number, subject, the child's age, when you would like us to call and your message.
Messages: what you write to us, for example by e-mail, and the notices we send you by e-mail and text message.
Consents: your answers to the school's questions about images, video and audio in which the pupil appears or is heard, with dates and any withdrawal.
Technical data: logins and security logs, and the data needed to protect the website's forms against automated abuse, for example IP address.

We never ask for health data. When you report an absence you do not need to give a reason. There is an optional field for a comment to the teacher. If you choose to write something about health there, we process it on the basis of your explicit consent. The comment is read only by the teacher of the lesson and by the office, and it is not shown in the family pages afterwards.

Where does the data come from?

You provide most of the data yourself — when you register your interest, sign an agreement or use the family pages. We receive your name and personal identity number from BankID when you identify yourself. The teaching data is created by the school, by the teacher and the office. For families who were with us before we changed systems in the autumn of 2026, the data was transferred from our previous pupil register.

Why do we process the data, and on what basis?

To perform the agreement for lessons (Article 6(1)(b) GDPR): scheduling, attendance, lesson notes and material from the teacher, notices about lessons by e-mail and text message, invoicing and payment, price notices and terminations.
To enter into an agreement at your request (Article 6(1)(b)): registration of interest, trial lesson, offer of a place and identification with BankID before the agreement is signed.
To comply with legal obligations (Article 6(1)(c)): the Swedish Accounting Act requires invoices and payments to be kept; the GDPR requires us to be able to demonstrate which consents have been given.
On the basis of a legitimate interest (Article 6(1)(f)): administering the agreed lessons, protecting the website and the family pages against abuse, developing and troubleshooting our system, and recording the school's own concerts in order to document our activities. The recordings are never published without consent.
With your consent (Article 6(1)(a)): publishing images, video or audio in which the pupil appears or is heard — on the website, in social media or in print; sharing concert recordings with the families of those taking part; and adding images in which the pupil appears to the lesson notes. Health data that you yourself write in the absence comment is processed on the basis of your explicit consent (Article 9(2)(a)).

You can withdraw a consent at any time by contacting us. Material that has already been published is removed as soon as we can, and within 60 days at the latest.

We need the data about the contracting party and the pupil in order to enter into and perform the agreement; without it we cannot offer lessons. Everything else is voluntary.

We do not use your data for profiling or for automated decision-making of the kind referred to in Article 22 GDPR.

Children

The guardian is the contracting party and the account holder in the family pages. Children under 18 have no account of their own with us. We never publish images, video or audio in which a child appears or is heard without consent. For younger children, consent is given by the guardians. From the age of 16 the pupil decides, and the guardian passes the pupil's answer on to us.

Who can access the data?

The data is handled by the school's staff who need it for their work — the office, the pupil's teacher and substitute teachers. In group lessons, the families in the group can see the material that the teacher shares with the whole group.

In addition, we use suppliers who process data on our behalf. Some of them are themselves responsible for parts of their processing, for example the telecom operators that deliver a text message and the payment provider when it prevents fraud.

Operation and storage of our system Kadensa: the data is stored with Supabase, in a data centre within the EU. The website and the family pages run on Vercel.
E-mail and text messages from the school are sent through Sinch (the e-mail service Mailgun and Sinch's text message service), within the EU.
BankID: the identification is relayed by the e-identification broker Idura. We send no personal data to it; the broker passes your name and personal identity number to us once you have identified yourself.
Card payment is handled by Stripe. The card details go directly from you to Stripe. We pass on your name, your e-mail address and the amount. We never see or store the full card number — only the last four digits and the card type.
Accounting and invoicing are handled in the school's accounting system Fortnox. It receives name, address, e-mail address, amount and what the invoice is for, with the pupil's first name.
Protection of the forms: the website's forms are protected against automated abuse by Cloudflare, which receives the visitor's IP address and information about the browser.
Video from YouTube: if the teacher has linked a video in a lesson note, YouTube's player is loaded only when you press Play. Google then receives your IP address and information about your browser. We send no data about you to Google.
Development and troubleshooting: the school develops Kadensa itself and uses AI tools from Anthropic in that work. When a fault is investigated, individual items of data, for example a name and a lesson time, may be shown to the tool.

What is published with your consent becomes visible to everyone who visits the channel where it is published. We never sell personal data and do not disclose it to anyone for marketing. Public authorities receive data only when the law requires it.

Where is the data stored?

The data about pupils and agreements is stored in a data centre within the EU. Several of our suppliers are companies based outside the EU/EEA or belong to groups with operations there — this applies to the operation of the system and the website, card payments, the protection of the forms, YouTube and the AI tools used in development. When personal data is processed in a country outside the EU/EEA, for example in the USA, this is done on the basis of the EU Commission's standard contractual clauses or an adequacy decision. A text message to a telephone number outside the EU/EEA is delivered through telecom operators in the recipient's country.

How long do we keep the data?

Agreement and teaching data — lessons, attendance, notes and saved lessons — is kept for as long as the pupil is with us and for twelve months after the pupil's last agreement has ended.
Invoices and payments are kept for as long as the Accounting Act requires: seven years after the end of the calendar year in which the financial year ended. After that they are anonymised.
Registrations of interest are deleted twelve months after they were received.
Waiting list and trial lessons that do not lead to an agreement: the data is deleted after six months. If you have identified yourself in the sign-up or received an offer without going further, the data is deleted after one month.
Audio clips in the lesson notes are removed twelve months after they were added. Images and audio clips in which a pupil appears or is heard are also removed when the pupils in the lesson have left us, no later than 90 days after their last lesson.
E-mail and text messages that we have sent are deleted from our system within three months.
Consents are kept for as long as the pupil's data remains with us, as evidence that consent existed.
Concert recordings are kept for up to five years.
Security logs are kept for as long as they are needed to investigate faults and abuse.

Our previous pupil register and our previous system for registrations of interest are being closed down in connection with the move to Kadensa, and the data held there is deleted at that point.

When the purpose has ended, the data is deleted or anonymised. Data that must be kept by law is deleted when the statutory period has expired.

Your rights

You have the right to:

know what personal data we hold about you and your child, and receive a copy;
have inaccurate data corrected — you change your mobile number and whether you want text messages yourself in the family pages; anything else we correct when you contact us;
have data deleted when it is no longer needed — we cannot delete what the law requires us to keep, such as accounting records;
restrict processing or object to processing based on a legitimate interest;
receive your data in a machine-readable format;
withdraw a consent at any time, with effect for the future;
complain to the Swedish Authority for Privacy Protection (imy.se) if you believe we process your data unlawfully.

Cookies

The website uses only the cookies needed for it to work, for example for logging in to the family pages and remembering your language choice. We do not use cookies to follow you on other websites or for marketing. Read more on our cookies page.

Changes to this policy

We update the policy when our processing changes. The current version is always available on this page, with the date of the latest change.

Contact

Malmö Musikskola AB
Corporate identity number: 559315-8917
Sarvgränd 1B, 216 12 Limhamn, Sweden
Telephone: +46 40 643 00 07
E-mail: info@malmomusikskola.se

This privacy policy was last updated on 6 November 2026.