Fine Art Education Sweden AB (hereinafter "buddy.art" or "we") is the data controller for the processing described in this policy. This privacy policy describes the methods we use to collect, manage and protect your personal data.

This privacy policy took effect on 23 February 2023 and was last updated on 30 August 2026.

Information we collect

The information we collect falls into one of two categories: "voluntarily provided" information and "automatically collected" information.

"Voluntarily provided" information refers to any information you consciously and actively give us when using or participating in any of our services and campaigns.

"Automatically collected" information refers to any information automatically sent by your devices when you access our products and services.

Log information

When you visit our website, our servers may automatically log the standard data provided by your web browser. This may include your device's Internet Protocol (IP) address, your browser type and version, the pages you visit, the time and date of your visit, the time spent on each page, and other details about your visit.

In addition, if you encounter certain errors while using the website, we may automatically collect data about the error and the circumstances surrounding it. This data may include technical details about your device, what you were trying to do when the error occurred, and other technical information related to the problem. You will not necessarily be notified of such errors.

Be aware that while this information may not identify you personally, it may be possible to combine it with other data to personally identify individuals.

Device information

When you visit our website or interact with our services, we may automatically collect information about your device, such as:

  • Device type
  • Operating system
  • Approximate geographic location (based on IP address)

The data we collect may depend on the individual settings and software of your device. We recommend that you check the guidelines of your device manufacturer or software provider to learn what information they make available to us.

User-generated content

We consider "user-generated content" to be material (text, image and/or video content) voluntarily provided by our users for the purpose of publication, processing or use on our platform. All user-generated content is linked to the account or email address used to submit the material.

Please be aware that any content you submit for the purpose of publication may become public, directly or after review. Once published, it may be accessible to third parties not covered by this privacy policy.

Transaction data

Transaction data refers to data that accumulates in the normal course of operation on our platform. This may include transaction records, stored files, user profiles, analytics data and other metrics, as well as other types of information created or generated as users interact with our services.

Collection and use of personal data

We may collect personal data from you when you do any of the following on our website:

  • Purchase a product, service or subscription
  • Use a mobile device or web browser to access our content
  • Contact us via email, social media or similar technologies
  • Mention us on social media

We may combine voluntarily provided and automatically collected personal data with general information or research data we receive from other trusted sources. For example, if you provide us with your location, we may combine this with general information about currency and language to give you an improved experience of our website and service.

Protection of your personal data

We protect your personal data using industry standards to prevent loss, theft and unauthorised access or use. Although we do our best to protect your information, no method of electronic transmission or storage is 100% secure. We therefore cannot guarantee the complete security of your data.

You are responsible for ensuring the security of your own information within the scope of our services. This means that you should not share your login links or one-time codes. Also take care not to share sensitive personal data such as phone numbers, addresses or financial information via our platform.

How long your personal data is kept

We keep your personal data only for as long as necessary, based on the purpose defined in this privacy policy. For example, if you give us your email address when contacting us with a question, we may keep this information for as long as the matter is active and for future reference so that we can handle similar questions more efficiently. When the information is no longer needed, we will delete it or anonymise it so that you can no longer be identified.

We may need to keep your personal data to comply with legal, accounting or reporting requirements, or to preserve it for research and archiving in the public interest.

Children's privacy

We do not direct any of our products or services to children under 13, and we do not knowingly collect personal data from children under this age.

Disclosure of personal data to third parties

We may disclose personal data to:

  • third-party service providers to enable them to provide their services, for example IT support, data storage, hosting, error tracking, maintenance and payment processing
  • our employees and/or related entities
  • our current or future business partners
  • credit reference agencies and courts, if you fail to meet your payment obligations for the goods or services we have provided
  • courts and law enforcement agencies, as required by law, in connection with actual or anticipated legal proceedings, or to establish, exercise or defend our legal rights
  • third parties that help us provide information, products, services or direct marketing to you
  • an entity that acquires, or to which we transfer, all or substantial parts of our assets and business

Third parties we currently use include:

  • Firebase - user authentication, database and file storage
  • Mailjet - transactional emails and newsletters
  • Stripe - payment services
  • Vercel - web hosting and analytics

International transfers of personal data

The personal data we collect is stored and/or processed in Belgium, Germany and Sweden, or where our partners and third-party providers have facilities. We strive to ensure that as little data as possible leaves the EU/EEA in order to maintain the integrity and confidentiality of the information collected.

The countries where we store, process or transfer your personal data may not have the same data protection laws as the country in which you originally provided the information. If we transfer your personal data to third parties in other countries: (i) we will carry out those transfers in accordance with the requirements of applicable law; and (ii) we will protect the transferred personal data in accordance with this privacy policy.

Your rights and control over your personal data

Your choice: By providing personal data to us, you understand that we will collect, retain, use and disclose your personal data in accordance with this privacy policy. You do not have to provide personal data to us, but if you do not, it may affect your use of our website or the products and/or services offered on or through it.

Information from third parties: If we receive personal data about you from a third party, we will protect it in accordance with this privacy policy. If you are a third party providing personal data about someone else, you represent and warrant that you have that person's consent to provide the personal data to us.

Marketing permission: If you have previously agreed to us using your personal data for direct marketing purposes, you may change your mind at any time by contacting us using the details below.

Access: You may request details of the personal data we hold about you.

Rectification: If you believe that any information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, please contact us using the details provided in this privacy policy. We will take reasonable steps to correct any information found to be inaccurate, incomplete, misleading or out of date.

Erasure, restriction and objection: You may ask us to erase your personal data, to restrict the processing of it, or object to processing based on our legitimate interests. You also have the right to receive the data you have provided yourself in a machine-readable format (data portability).

Non-discrimination: We will not discriminate against you for exercising any of your rights over your personal data. Unless your personal data is required to provide you with a specific service or offer (e.g. processing of transaction data), we will not deny you goods or services and/or charge you different prices or rates for goods or services, including by granting discounts or other benefits, or imposing penalties, or provide you with a different level or quality of goods or services.

Personal data breaches: In the event of a personal data breach we comply with the laws that apply to us, including the obligation to notify the supervisory authority and, in certain cases, to inform you.

Complaints: If you believe that we have breached a relevant data protection law and wish to make a complaint, please contact us using the details below and provide us with full details of the alleged breach. We will promptly investigate your complaint and respond to you in writing, setting out the outcome of our investigation and the steps we will take to deal with your complaint. You also have the right to lodge a complaint with the supervisory authority, in Sweden the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), www.imy.se.

Unsubscribe: To unsubscribe from our email list, use the unsubscribe links in our emails or contact us using the details below. We may need to confirm your identity by requesting certain information from you.

Business transactions

If we or our assets are acquired, we would include data, including your personal data, among the assets transferred to the parties acquiring us. You acknowledge that such transfers may occur, and that the parties acquiring us may, to the extent permitted by applicable law, continue to use your personal data in accordance with this policy, which they will be obliged to adopt as it is the basis for any ownership or usage rights we have over such information.

Limits of our policy

Our website may link to external websites that are not operated by us. Please be aware that we have no control over the content and policies of those websites and cannot accept responsibility or liability for their respective privacy practices.

Updates to this policy

We reserve the right to update our privacy policy when necessary, to reflect changes in how we run our business, keep up with current practice, or adapt to new laws and regulations. Any changes to the policy will be announced and published at the same URL where this policy is available.

Should legislation require it, we will ensure that we obtain your consent or offer you the option to either accept the new terms or opt out, depending on the changes proposed for the use of your personal data.

Additional information under the General Data Protection Regulation (GDPR) (EU)

Data controller / data processor

The GDPR distinguishes between organisations that process personal data for their own purposes (data controllers) and organisations that process personal data on behalf of other organisations (data processors). We, Fine Art Education Sweden AB (buddy.art), at the address given under "Stamps and seals" at the bottom, are the data controller for the personal data you provide to us.

We will only collect and use your personal data where there is a legal basis for doing so. In such cases we ensure that collection and use take place in accordance with the law, fairly and transparently. Where your consent is requested to process your personal data and you are under 13, we will instead seek consent from your parent or legal guardian before processing your data for the intended purpose.

Our legal bases depend on the services you use and how you use them. This means that we only collect and use your information on the following grounds:

Where you give us consent to collect and use your personal data for a specific purpose, you may withdraw your consent at any time using the tools we provide. However, this will not affect any use of your information that has already taken place. When you contact us, you may consent to your name and email address being used so that we can respond to your enquiry. Although you may request that we remove your contact details at any time, we cannot recall any email we have already sent. If you have further questions about how to withdraw your consent, please contact us using the details in the last section of this privacy policy.

Performance of a contract or transaction

Where you have entered into a contract or transaction with us, or to take preparatory steps before we enter into a contract or transaction with you. For example, if you purchase a product, service or subscription from us, we may need to use your personal and payment details to process and deliver your order.

Our legitimate interests

Where we consider it necessary for our legitimate interests, such as providing, operating, improving and communicating our services. We consider our legitimate interests to include research and development, understanding our audience, marketing and promoting our services, measures taken to operate our services efficiently, market analysis, and measures taken to protect our legal rights and interests.

Compliance with law

In some cases we may have a legal obligation to use or retain your personal data. Such cases may include (but are not limited to) court orders, criminal investigations, government requests and regulatory obligations. If you have further questions about how we retain personal data to comply with the law, please contact us using the details in the last section of this privacy policy.

International transfers outside the European Economic Area (EEA)

We will ensure that any transfer of personal data from countries within the European Economic Area (EEA) to countries outside the EEA is protected by appropriate safeguards, for example by using standard contractual clauses approved by the European Commission, or the use of binding corporate rules or other legally accepted means.

Data transfer and deletion of your personal data

At buddy.art we give you the ability to control your personal data. You can exercise your rights by following these steps:

  1. Sign in to your account.
  2. Go to Account settings and select "Download or delete your data". Here you have the following options:
    • Download your data: You can request a copy of all personal data that buddy.art holds about you.
    • Delete your account: If you wish, you can permanently delete your account and all associated personal data from buddy.art.

Important: Deleting your account is final and cannot be undone. We will not be able to restore your account or your data if you change your mind later.

Remember that certain information that has been made public at least once may remain with third parties such as search engines, despite deletion from our services.

Questions about your privacy

For any questions or concerns regarding your privacy, you can email registrator@buddy.art.

Stamps and seals

This website is operated by buddy.art, part of Fine Art Education Sweden AB.
Reg. no. 559295-4449
VAT no. SE559295444901
Registered office: Stockholm, Sweden
Mail: KIVRA 559295-4449, SE-106 31 Stockholm, Sweden
Visit: Industrigatan 9, SE-112 46 Stockholm, Sweden
Email: hello@buddy.art