Privacy Policy

Who is responsible for your data

Mira Creative Studio – Ideell förening, organisation number 802557-5849, with its registered office in Täby Municipality, Sweden, is the data controller for the personal data described here.

Mira Creative Studio is a separate legal entity from its sponsor, Mira Plus AB, and is responsible for its own handling of personal data.

What this website collects

This website collects personal data in one place: the contact form.

When you send us a message we collect the name, email address and message you enter. We use them only to read and reply to what you sent.

The legal basis is our legitimate interest (GDPR Article 6(1)(f)) in receiving enquiries about Mira Creative Studio and its activities, and being able to reply to the people who send them.

Your message is saved in this website's database and also sent by email to creative@miraplus.nu so that we can reply. We keep contact messages for 12 months after we last replied to you, and then delete them.

We do not ask for information about children through this website. The form is intended for parents and guardians writing on a child's behalf, and anything concerning a child is discussed with you directly afterwards.

What the association collects

Outside this website — when you apply for membership, sign up for an activity, volunteer or make a donation — we may also collect:

name, date of birth, address, telephone number and email address
membership category and payment records
for members under 18: a parent or guardian's name, telephone number and email address
activity registrations, areas of interest and volunteer preferences

We collect this to administer membership, organise activities, communicate with members and guardians, handle fees and donations, and meet our legal obligations. Each of those purposes has its own legal basis:

Membership and activity administration — necessary to perform the membership or participation arrangement (GDPR Article 6(1)(b)).
Accounting and payment records — necessary to meet a legal obligation (Article 6(1)(c)), principally the Swedish Accounting Act.
Keeping members and guardians informed about the association and the activities they have signed up for — our legitimate interest in running the association (Article 6(1)(f)).
Newsletters, photographs and optional information — your consent (Article 6(1)(a)), which we ask for separately and which you can withdraw at any time.

Where information is required for membership or participation, we say so when we ask for it. If it isn't provided we may be unable to register the membership or let someone take part. Optional information is exactly that — you don't have to give it, and nothing depends on it.

We only collect what we need to run the association and deliver activities safely.

Support needs, health and accessibility

If you choose to tell us about support needs, accessibility requirements, allergies or other health-related information, we process it only:

with your explicit consent;
to make participation safe and possible; and
to the extent necessary, and no further.

Where this is health data or another special category of personal data, our legal basis is your explicit consent — GDPR Article 6(1)(a) together with Article 9(2)(a).

Access is limited to the people who need it to carry out their role. You can withdraw your consent at any time.

Photographs and video

We publish photographs and video only where consent has been given. For members under 18 we normally obtain that consent from a parent or guardian, in line with our photo and media consent procedures. Images may appear on our website, in social media, in printed material, in presentations and in grant applications.

We do not identify children by full name without specific permission.

You can withdraw consent at any time. This applies to future use; material already printed or published elsewhere cannot always be retrieved.

How long we keep your data

Contact form messages — 12 months after our last reply.
Membership data — while you are a member, and for 12 months afterwards.
Accounting records, including membership fee and donation payments — 7 years, as required by the Swedish Accounting Act (bokföringslagen).
Consents — for as long as the consent applies, so that we can show it was given.

When data is no longer needed it is securely deleted or anonymised.

Where your data is stored

This website is hosted by Hostup, on servers in Sweden, and email is sent through our hosting provider's relay.

Service providers that handle personal data on our behalf — website hosting, email and other necessary IT services — act as our data processors. They may only process the information according to our instructions and the requirements of data-protection law.

We aim to use services that process personal data within the EU/EEA. If personal data is transferred outside the EU/EEA, we ensure that appropriate safeguards required by the GDPR are in place.

Who has access

Personal data is accessible only to the people within Mira Creative Studio who need it for their role. We do not sell, rent or trade personal information.

We disclose information only when required by law, with your consent, or where it is necessary to protect someone's vital interests.

How we protect it

We use restricted access, password-protected systems, secure storage of documents, regular software updates, and secure deletion of information we no longer need.

Your rights

You have the right to ask us to:

tell you what personal data we hold about you
correct it if it's wrong
delete it
restrict or object to how we use it
provide it in a portable form

You can also withdraw any consent you have given, at any time.

We do not use personal data for automated decision-making or profiling.

Email creative@miraplus.nu and we'll respond.

If you think we've handled your data incorrectly, you can complain to the Swedish Authority for Privacy Protection (IMY, Integritetsskyddsmyndigheten), imy.se.

Cookies

This website uses only the cookies it needs to work: one to keep track of your session, and one to protect forms against cross-site request forgery.

We use no analytics, no advertising and no third-party tracking. That is why you are not asked to accept cookies when you arrive.

Changes to this policy

If we change how we handle personal data we will update this page. The current version is always the one published here.

Last updated: 9 August 2026