Smart Refill values privacy and process personal data in accordance with the GDPR. We use personal data to be able to deliver our services and fulfill our contractual obligations towards our customers (companies with whom we cooperate). Some personal information are mandatory to process as certain laws requires it (such as ‘Lag (2022:482) om elektronisk kommunikation’), while some personal information is processed because it is necessary for us to enter into or fulfill our contractual obligations towards our customers and thus guarantee functionality to end users (people who use services that supplied by our customers). If the personal information is not shared with us, we will not be able to deliver our services in accordance with the contractual obligations.
From where the personal data is collected:
The sources of personal information that is processed by Smart Refill mainly comes from the 3 following activities.
- Sim card registration
When a SIM card is registered, ‘Lag (2022:482) om elektronisk kommunikation’ requires a registration of a person’s identity. We therefore collect information such as telephone numbers, social security numbers, ID numbers, and addresses. Personal information collected in connection with SIM card registration is shared directly with the customer and is not stored at Smart Refill.
- Anonymous refills and subscriptions
Services can be subscribed to anonymously; in which case an account is created with a generated ‘card-reference’ that is not linked to the end user’s actual payment card details.
- Logins
When an end user registers on a platform and fill in their personal information to use a service.
Personal information that is processed and their purpose
We process names and surnames, social security numbers, phone numbers and information concerning the devices used to access the services. This information is necessary for Smart Refill to be able to deliver functionality and is also used during troubleshooting, for example when detecting bugs. Social security numbers are stored in some cases to be used for verification of student eligibility or who are entitled to receive bonuses (for example on birthdays). Some functions enable end users to add family members, it is however optional for the end user to or other information in the field. Smart Refill stores IP addresses to prevent attacks and thereby ensure functionality. Smart Refill does not store traffic data about the end-user’s communication history or the duration of phone calls.
Entities we share personal information with
To fulfill the purposes above and for customer service purposes, we share personal data with our main customers which for the most part are telecom operators who deliver services to end users. Moreover, Smart Refill also share personal information to other entities, such as to financial services; Vipps, BankID, Swish and Handelsbanken, to enable payments between end users and the service. In some situations, based on legal requirements or decisions from authorities, obliged to disclose information resulting from the decision of authorities, for example the Police Authority or the Financial Supervisory Authority. The legal basis for this personal information processing is the fulfillment of a legal obligation.
Your rights
End users have the right to know what we do with the personal information and for what purposes we process the information, how long we store it, and who accesses the data.
Right of access
To receive an extract of personal information, it must be clearly stated which information you want to receive. If for some reason we cannot fully respond to your request, we will provide an explanation and we will inform you of how long we need to respond to your request. You can contact us via mail to order an extract.
Right to rectification
If some of the information we process is incorrect or if additional information is needed for adequate processing, you have the right to have such incorrect data corrected or to supplement it with such additional information.
Right to erasure
You have the right to erase the personal information that we process if it is no longer necessary for us to process it or if you withdraw your consent. Please note that this may affect the functionality and prevent us from delivering the service to you. Contact us if you wish to delete your personal data.
Right to restriction of processing
You have the right to restrict our processing of your personal information in some cases. Restriction means that the information may only be processed for certain limited purposes. The right to restriction applies, among other things, if you believe that the information is incorrect, and you have requested correction and when you believe that the processing is unlawful and do not wish to erase the information.
Right to data portability
You have the right to data portability, which means that you may receive the information we process about you in a structured, electronically readable format which enables you to transmit the requested information to another service provider. This applies when the processing is based on your consent or when the personal information was processed to fulfill an agreement.
Withdraw consent
You give your consent when you register for a service that we deliver where it requires filling in personal information. You have the right to withdraw the consent you have given us for the certain processing of your personal data at any time. To withdraw your given consent, you can contact customer service. Note that your personal information may still be processed where it is based on a different legal basis other than consent.
Contact
If you have questions about our processing of personal information, want incorrect data rectified, want certain data deleted or have complaints about the processing, you are welcome to contact our customer service. It is also possible to file a complaint to the Data Protection Authority (Integritetsskyddsmyndigheten) or another data protection authority within the EU if you believe that the GDPR has been violated in another EU member state.