Lo_Co privacy notice

The controller is Anton Wieselblad, as a private individual, running Lo_Co until a company is registered. Anton Wieselblad is also, today, the only platform operator, meaning the person who reviews suppliers, landowners and exceptions.

Contact the controller about anything to do with your personal data at:

anton.wieselblad@gmail.com

When you support an event or a request, we ask for your email address. You don't need an account. We use the address to count support and to prevent duplicate or fake support. The legal basis is our legitimate interest in support numbers that can be trusted. We don't use the address for marketing, and we don't send any email to it.

Clerk, which handles our sign-in, runs on every page of this website, even if you don't sign in. So your IP address and device details reach Clerk (USA, certified under the EU-US Data Privacy Framework). The legal basis is our legitimate interest in secure sign-in.

Clerk also sets the cookies that make sign-in work, again on every page. They are strictly necessary for the service, so under the Swedish Electronic Communications Act (Chapter 9, Section 28) no consent is needed. We use no analytics or advertising cookies.

If you use "Use my location", your browser's coordinates are sent to us to find the nearest postal code. Lo_Co doesn't store the coordinates, but our hosting provider's request logs briefly keep the request address (which includes the coordinates) and your IP address.

If you use "Report this information" on an event page, your email app sends the report to the platform contact address, so we receive your email address along with what you write. We use it only to check the report and reply if needed. The legal basis is our legitimate interest in keeping public information accurate. We delete the email once the report has been dealt with, at the latest 12 months after it arrived.

You need a member account to create a request, but not to support. You must be 13 or older to create one. You confirm this yourself, and we don't check it. If you're younger, you can still support events and requests without an account.

If you create a member account, we process:

• the verified email address you sign in with;
• your sign-in ID at Clerk;
• which version of this notice you acknowledged, and when;
• the requests you create, which are linked to your account.

The legal basis is our contract with you: providing the account. We store no location and no filters for your account.

The category, area and description of a request you create are published on the request's page, where anyone can see them. So don't include personal details there. Your email address isn't shown there.

We count how many requests each member creates and stop at 5 in 24 hours, and we record each request in the decision history. The legal basis for both is our legitimate interest in demand that can be trusted and traced. The IDs in that history, including your member ID and sign-in ID, stay even if your account is erased, as they do for business accounts.

If a request can't be sent, the draft is kept in that browser tab until you send it, sign out there or close the tab.

Sign-in is handled by Clerk, which processes your email address, IP address, device details and verification codes.

Want your account erased? Write from the account's verified email address, because we only act on requests from there. If you remove your sign-in without writing to us, the member account stays with us.

anton.wieselblad@gmail.com

If you sign up as a supplier, we process:

• the email address you sign in with;
• the legal name (for a sole trader, this is personal data);
• the contact person's name and email address;
• your answers about the vehicle, waste handling, gas or open flame, and the resources you need;
• which version of the terms of use you accepted;
• the full documents you upload as evidence (they may contain, for example, personal identity numbers or addresses) and their validity dates;
• your bookings;
• the decision history for your account (see below).

We use this to check that you meet the requirements to trade on a spot and to run your bookings. For a sole trader, the legal basis is our contract with you. For contact people at companies, it is our legitimate interest in verifying eligibility and running bookings.

If you sign up as a landowner, we process:

• the email address you sign in with;
• the contact person's name and email address;
• the organization's name;
• the email addresses of colleagues you invite;
• which version of the terms of use you accepted;
• your land spots, including their addresses;
• the public details you write for a spot: the "About this spot" text and details about parking, the entrance, seating and toilets;
• the decision history for the organization and its spots (see below).

The legal bases are the same as for suppliers: our contract with you, or our legitimate interest when you are the contact person for an organization.

A spot's public details are shown publicly on event pages at that spot, together with your organization's name ("From <name>, the landowner"). If the organization is named after you, that is a person's name. The legal basis for publishing them is the same: our contract with you, or our legitimate interest when you are the contact person for an organization. A platform operator can hide the details, and the organization then sees the reason.

Earlier versions of the details stay in the decision history, but unlike the rest of it they are removed on request: we replace the text and keep only who changed which field, and when.

If a platform operator or a colleague at your organization invited you, we got your email address from that person, not from you. We keep the address, who invited you and to which organization, so the invitation can be accepted and traced. Lo_Co doesn't email you; the person who invited you shares the link themselves. The legal basis is our legitimate interest in letting organizations add their colleagues.

We keep a history of decisions about your account: approvals, rejections, verifications, the reasons given, and the email addresses in invitations. It exists so approvals stay traceable afterwards, which is why it can't be erased on request.

Sign-in is handled by Clerk, which processes your email address, IP address, device details and verification codes.

An email address is required to support, sign up or accept an invitation. To create a request, you need a member account. As a supplier, evidence is required to be verified and to book. Without them, that action isn't possible.

Every booking request goes through rule-based eligibility checks. They can allow it, refuse it with a reason and a way to fix it (for example, expired evidence or a schedule clash), or send it for manual review. Your documents aren't read by AI.

You can always ask for a person (the controller) to review an automatic refusal. Write to:

anton.wieselblad@gmail.com

• Clerk – sign-in. Clerk runs on every page of the public website.
• Vercel – hosting for the website and the app, including request logs.
• Neon – the database, in an EU region.
• Google – the contact inbox (Gmail), if you email us.
• OpenStreetMap Foundation (UK) – map tiles load straight from its servers, so it receives your IP address and browser details every time you view a map.
• Södertälje kommun – when a landowner draws or edits a land spot's boundary, the property map loads straight from the municipality's map server, so it receives the landowner's IP address, browser details and which map area is shown.

Some of the recipients above are based outside the EU/EEA, or are owned by a company that is:

• Clerk (USA) – sign-in data, and the IP address and device details of every visitor to the public website, are processed in the US. Clerk is certified under the EU-US Data Privacy Framework, and Clerk's data processing agreement applies.
• Vercel (USA) – the website and the app run on Vercel, which processes requests and logs mainly in the US. The transfer is covered by the EU's standard contractual clauses in Vercel's data processing agreement.
• Neon (USA) – the database itself is in the EU (Frankfurt), but Neon is a US company whose staff may access it from the US. The transfer is covered by the EU-US Data Privacy Framework, with standard contractual clauses as a fallback.
• Google (USA) – if you email us, your email is stored in a Gmail inbox. Google is certified under the EU-US Data Privacy Framework. During the pilot Lo_Co uses a personal Gmail account, so there is no separate data processing agreement with Google.
• OpenStreetMap Foundation (UK) – the EU has decided that the UK protects personal data adequately.

Contact us if you want a copy of the safeguards that apply.

Today, data is kept with no fixed end date, except report emails (see Visitors who support). That includes sign-ups that were rejected or never finished, and email addresses from support. We will set concrete retention periods and update this notice when we do.

Until then, we handle erasure requests manually by email, except for the decision history.

You have the right to access your data, have incorrect data rectified, have data erased, restrict processing, and receive your data to move it elsewhere (data portability).

You also have the right to object to processing based on our legitimate interest. We will then stop, unless we can show compelling grounds that override your interests.

Write to us to use your rights:

anton.wieselblad@gmail.com

If you are unhappy with how we handle your data, you can complain to the Swedish Authority for Privacy Protection (IMY).

Swedish Authority for Privacy Protection (IMY)