Privacy policy

Konserthuset Stockholm is keen to ensure that all people who visit our website or access our operations will feel secure in all contacts with us. We place great emphasis on your personal data being processed correctly and securely. In this policy, we explain how we handle your data and about the rights that you have. We never sell your data to other parties.

På svenska

The link has been copied

The Stockholm Concert Hall Foundation (referred to in this policy as Konserthuset Stockholm) is the controller for the processing of your personal data. We process your personal data in accordance with the General Data Protection Regulation (EU) 2016/69, often referred to as GDPR.

This privacy policy describes the handling of personal data that takes place when you come into contact with us as a customer, audience member, participant in an activity or website visitor, or are in any other way interested in our operations. It also applies to anyone who applies to us for a job.

If you are an employee or have been engaged as an assistant or contractor, you will find information about how we handle your personal data in our internal privacy policy.

Contact details for the controller

Konserthuset Stockholm’s operations are run by the Stockholm Concert Hall Foundation, corporate ID number 802001-8266, postal address Box 7083, SE-103 87 Stockholm, Sweden.

Any questions regarding our handling of personal data may be sent by email to info@konserthuset.se. You can also send a letter by post to Konserthuset Stockholm, Personuppgifter, Box 7083, SE-103 87 Stockholm, Sweden.

What personal data do we collect and why?

Personal data comprises all information that can be used in order to identify an individual person, such as name, date of birth, phone number, email address or physical postal address. Personal data can also mean electronic identities, such as an IP address, if this can be linked to a natural person. Personal data also includes behavioural information, such as purchasing history.

Within the framework of our operations, we process personal data that you provide to us, for example in connection with ticket purchases, but also personal data that we obtain from a third party or public register. Personal data can also be generated when you use some of our digital services.

We process personal data for the following main purposes:

Management of your customer account
Management of ticket purchases and bookings
Ordering of refreshments before a performance and during the interval
Preparation of accounts
Sending out practical customer information
Sending out newsletters
Sending out the “Lyssna” magazine
Communication and interaction
Information and PR
Management of registrations for activities and events
Management of applications
Statistics and analysis
Producing photos and videos
Establishing, exercising or defending legal claims
CCTV surveillance

We process your personal data in different ways. The processing of personal data refers to a measure or a combination of measures. Examples of processing activities include collection, storage and transfer.

Every time we process personal data, we must have a legal basis for this. This policy is based upon four of the six legal bases in legislation:

Consent. This is when you have expressly notified us that we may process your personal data. This may, for example, concern subscription to a newsletter or when you accept cookies on our website. You can withdraw your consent at any time.
Fulfilment of an agreement. This applies when we need certain data to be able to fulfil an agreement, e.g. to deliver a ticket or send a product that you have purchased.
Legal obligation. In certain cases, we have an obligation in law to compile and save some data. We have, for example, obligations in respect of the Swedish Accounting Act and the Swedish Discrimination Act.
Legitimate interest. This applies to those instances when it is considered reasonable for Konserthuset to process personal data in order to run its operation. This might be, for example, in connection with recruitments or when we communicate with customers prior to a concert visit. To claim a legitimate interest, we have performed what is known as a balancing of interests between our interest in processing your personal data for a given purpose and your interest in not having your personal data processed by us, and we have reached the conclusion that our interest outweighs your interest.

Below you will find detailed information about our processing of personal data for specific purposes.

1. Management of your customer account

Personal data: Name, email address, phone number, postal address, company or organisation (if relevant), booking number and purchasing history.
Purpose: When you create a customer account with us, we process your personal data for the purpose of managing and administering it.
Legal basis: Fulfilment of an agreement.
Storage period: We store your personal data so that we can manager and administer your customer account for up to three years from the date of your last login.

If you would like your data to be erased earlier than this, please contact the box office by emailing biljett@konserthuset.se or by phoning +46 8 50 66 77 88. You can request the erasure of personal data via your customer account.

2. Management of ticket purchases and bookings

Personal data: Name, email address, phone number, postal address, company or organisation (if relevant), customer number, booking number, card number and purchasing history.
Purpose: We need the data to administer your purchase, e.g. to deliver your ticket, or to be able to make changes to your booking.
Legal basis 1: Fulfilment of an agreement. We process your personal data in order to fulfil agreements on ticket purchases and bookings.
Legal basis 2: Legal obligation. In the event that we use your personal data in order to deal with complaints, we support the processing through the fulfilment of our legal obligation under current consumer legislation.
Storage period: We store your personal data so that we can manage your bookings and subsequently for up to three years after the last concert event in order to be able to deal with any complaints that may arise.

If you would like your data to be erased earlier than this, please contact the box office by emailing biljett@konserthuset.se or by phoning +46 8 50 66 77 88. You can also request the erasure of personal data via your customer account.

3. Ordering of refreshments before a performance and during the interval

Personal data: Name, email address, phone number, postal address, company or organisation (if relevant), customer number, booking number, card number and purchasing history.
Purpose: Management of orders for food and drink in connection with concert visits.
Legal basis 1: Fulfilment of an agreement. We process your personal data in order to fulfil agreements concerning orders for food and drink in connection with concert visits.
Legal basis 2: Legal obligation. In the event that we use your personal data in order to deal with complaints, we support the processing through the fulfilment of our legal obligation under current consumer legislation.
Storage period: We store your personal data so that we can manage your orders and subsequently for up to three years after the last concert event in order to be able to deal with any complaints that may arise.

4. Preparation of accounts

Personal data: Name, customer number, booking number and, if relevant, bank account for repayment purposes.
Purpose: When you make a purchase from us we may process your personal data for the purpose of fulfilling our legal obligations under the Swedish Accounting Act (1999:1078).
Legal basis: Fulfilment of a legal obligation.
Storage period: We store your personal data during the period when the accounts are being compiled and for seven years after the end of the year in which the data was registered.

5. Sending out practical customer information

Personal data: Name, email address, phone number, customer number, booking number and purchasing history.
Purpose: We use personal data so that we can send you information ahead of your concert visit or if we need to contact you in the event of major changes concerning artists or programmes, or if a concert were to be cancelled. If you purchase a concert subscription, we use the data to send you our “Lyssna” magazine as well as information about renewal ahead of an upcoming season.
Legal basis: Konserthuset’s legitimate interest in being able to communicate with its customers.
Storage period: We retain your personal data for up to one year after each mailing.

6. Sending out newsletters

Personal data: Email address and, if relevant, purchasing history (applies for existing customers).
Purpose: We may process your personal data for the purpose of sending our digital newsletter containing information about upcoming concerts, special offers and other information about Konserthuset Stockholm’s operations. If you are an existing customer of ours, we may also use your behavioural data (i.e. your previous concert visits) so that we can provide you with more relevant, personalised special offers. This processing can be equated to profiling, to which you can object at any time (read more under the section entitled Right to object).
Legal basis: Consent.
Storage period: We store your personal data until you withdraw your consent or choose to cancel your subscription.

You can withdraw your consent or cancel your subscription at any time via the link at the bottom of the actual newsletter, via your customer account with us (My Pages), by emailing biljett@konserthuset.se or by phoning +46 8 50 66 77 88.

7. Sending out the “Lyssna” magazine

Personal data: Name and postal address for postal subscription. Name and email address for digital subscription.
Purpose: We process your personal data in order to send you the “Lyssna” magazine three times a year, and digitally or by post.
Legal basis 1: Fulfilment of an agreement. We send the magazine to anyone who has a concert subscription or has signed up for a free subscription.
Legal basis 2: Legitimate interest. In the event that we would like to inform you about our operations in connection with your professional role, we process your personal data with the support of our legitimate interest in informing about our operations.
Storage period: We store your personal data until you choose to cancel your subscription or object to our mailings.

You can cancel your subscription or decline to receive mailings at any time by notifying us by email at info@konserthuset.se or by phoning +46 8 786 02 00.

8. Communication and interaction

Personal data: Name, email address, phone number and any other information you provide us with in your contact with us.
Purpose: In the event that you contact us or interact with us in any other way, by phone, email, social media or otherwise, we may process your personal data for the purpose of communicating and interacting with you.
Legal basis: Konserthuset’s legitimate interest in being able to communicate and interact with you.
Storage period: We process your personal data during the period of our ongoing correspondence and for one year after the last instance of correspondence between us.

9. Information and PR

Personal data: Name, email address, job title, organisation or company.
Purpose: We process your data in order to use mailings to inform the media and other stakeholders about Konserthuset’s operations and about news relating to the organisation.
Legal basis: Legitimate interest. Konserthuset’s legitimate interest in presenting its operations and other important information to the media, industry contacts, etc.
Storage period: We process your personal data until you inform us that you do not wish to receive mailings or we purge our register.

You can decline to receive messages at any time via the link at the bottom of the press release or by declining mailings by notifying us by email at info@konserthuset.se or by phoning +46 8 786 02 00.

10. Management of registration for activities or events

Personal data: Name, email address, phone number and any other information you provide us with in your contact with us.
Purpose: When you register for an activity or an event with us, we may process your personal data in order to administer and manage your participation, for example by sending a confirmation, information and, if relevant, an invoice.
Legal basis: Fulfilment of an agreement. We need to process your personal data in order to fulfil the agreement you conclude with us ahead of your participation.
Storage period: We retain registration data for up to one year after the activity or event has taken place.

11. Management of applications

Personal data: Name, email address, phone number, postal address, professional information (e.g. certificates and qualifications), year of birth, nationality and any other information you provide us with in connection with your application.
Purpose: In connection with an application for an audition or other kind of recruitment, we process personal data so that we can manage your application. We must, for example, be able to maintain contact with you by email in order to send an invitation to the actual audition or interview, and be able to communicate with any references provided.
Legal basis 1: Legitimate interest. Konserthuset’s legitimate interest in administering and processing applications.
Legal basis 2: Legal obligation. Konserthuset needs to process your data in order to meet the requirements of the Swedish Discrimination Act (2008:567).
Storage period: We retain the data for two years after the completion of the recruitment process in order to meet the requirements of the Swedish Discrimination Act (2008:567).

12. Statistics and analysis

Personal data: Purchasing history, interaction data and online identifiers.
Purpose: In order to develop our operations, we may, either manually or through the use of cookies and similar tracking technology, process your personal data for the purpose of keeping and analysing statistics on, for example, ticket purchases or the use of our website.
Legal basis: Consent, which is obtained through your choices and our cookies banner.
Storage period: We store your personal data for one year or until you withdraw your consent.

You can withdraw your consent at any time by notifying us by sending an email to info@konserthuset.se. In the event that you gave your consent via our cookies banner, you can withdraw your consent by following the instructions in our cookies policy.

13. Producing photos and videos

Personal data: Your depiction in photos and/or videos.
Purpose: We may make recordings or take photos in conjunction with our concerts. This may involve taking photos of our operations for information or PR purposes. We also have a mandate to offer certain concerts in digital format for those who are physically unable to visit us (which we provide primarily through our own streaming service, Konserthuset Play), and to document operations and preserve image and video material for archival and cultural historical purposes and future research. Concerts may also be recorded or documented in other ways by external parties. Our photos and videos are typically not searchable at a personal level, but as a visitor at Konserthuset Stockholm you may be seen in a photo or video in such a way that you can be identified. You give your approval to this when you approve our conditions of sale in connection with making your booking. We do not obtain further consent from the audience members concerned prior to publication or further distribution.
Legal basis 1: Legitimate interest. Konserthuset Stockholm’s legitimate interest in being able to let more people have access to its operations and in documentation and archiving of operations for cultural purposes.
Legal basis 2: Fulfilment of an agreement. Through the approval of our conditions of sale, approval is granted to the possibility that you may appear in photos and video material as described above.
Storage period: We retain your personal data for the period required to fulfil our archiving and cultural historical obligations. For processing based on the fulfilment of an agreement, the personal data will be saved during the agreement’s period of validity or for as long as is required to fulfil Konserthuset Stockholm’s archiving and cultural historical obligations.

14. Establishing, exercising or defending legal claims

Personal data: Name, email address, phone number, postal address, customer number, booking number, card number and purchasing history.
Purpose: In the event that Konserthuset Stockholm needs for some reason to establish, exercise or defend its legal claims, we may process your personal data for these purposes.
Legal basis: Konserthuset Stockholm’s legitimate interest in processing your personal data in order to be able to establish, exercise or defend our legal claims.
Storage period: We process your personal data during the period necessary to enable us, in each case in question, to establish, exercise or defend our legal claims, for example in connection with a dispute. Once it has been possible to settle our legal claims, we will erase your personal data.

15. Security cameras

Personal data: Your depiction in photos and/or videos.
Purpose: When you enter Konserthuset Stockholm, we may process your personal data if you are depicted through our CCTV surveillance, which takes place for the purpose of preventing and investigating crime, guaranteeing safety and combating misconduct. CCTV cameras are positioned at the entrance to our audience lift at street level and at our reception/stage entrance at Hötorget 8 and nearby areas.
Legal basis: Konserthuset Stockholm’s legitimate interest in preventing and investigating crime, guaranteeing safety and combating misconduct.
Storage period: We process your personal data for seven days from the date on which the recording was made.

About cookies

When you visit our website, we process personal data in the form of functional (necessary) cookies. If you give your consent to other voluntary cookies that are used for statistical and marketing purposes, we also process personal data in the form of cookies for these purposes. There is separate information about both necessary and voluntary cookies in our cookies policy.

What are your rights in relation to your personal data?

As a data subject, you have a number of rights under GDPR in relation to your personal data. These rights are set out below. If you wish to exercise your rights, you can contact us via the contact details at the top of this privacy policy.

Right to be informed
You have the right to receive information about how we process your personal data. Such information is provided through this privacy policy in connection with the collection of your personal data and is always available on our website. You also have the right to receive special information in the event that a personal data breach were to occur involving your personal data and a potential risk of, for example, fraud or identity theft. We communicate such information to you directly by email.

Right to access
You have the right to receive a confirmation of whether or not Konserthuset is processing your personal data. In the event that Konserthuset is processing your personal data, you have the right to receive information about the processing and to have access to your personal data in the form of a free-of-charge register extract of the personal data that is registered about you and how it is being processed.

A request for a register extract can be emailed to info@konserthuset.se. Konserthuset reserves the right to take measures in order to assure itself of the identity of anyone requesting an extract. If a request for a register extract is lodged repeatedly, Konserthuset has the right to make a reasonable charge to administer the request.

Right to rectification
You have the right to have incorrect personal data rectified or supplemented with any personal data that is missing. The right to rectification applies for personal data that has been obtained from both you and a third party, and, if relevant, your profile that we have created by means of profiling. You can notify us by sending an email to info@konserthuset.se if you want us to rectify or supplement your personal data.

Right to erasure
In some instances, you have the right to have the personal data that Konserthuset Stockholm is processing about you erased without unreasonable delay. This applies if:

the personal data is no longer necessary for the purposes for which it was collected or processed in any other way;
you withdraw your consent on which the processing is based and there is no other legal basis for continued processing;
you object to processing that is based on Konserthuset’s legitimate interest and there is no legitimate reason for continuing with the processing that outweighs your own interest;
processing is taking place for direct marketing purposes and you object to the data being processed;
the personal data has been processed in an illegal way; or
it is required to fulfil a legal obligation.

In the event that it is necessary to continue to process your personal data in order to, for example, fulfil a legal obligation, Konserthuset is not obliged to erase your personal data.

Right to restriction of processing
In some instances, you have the right to request that our processing of your personal data be restricted. This applies if:

you contest the accuracy of the personal data, you can request restricted processing during the time we are verifying the accuracy of the data;
the processing is unlawful and you oppose the erasure of the personal data and request instead that use of the data be restricted;
Konserthuset no longer needs the personal data for the purposes of processing, but you need it in order to establish, exercise or defend legal claims; or
you have objected to processing that is based on the balancing of interests we used as a legal basis for one purpose, you can request restricted personal data processing during the time we work to assess whether our legitimate interests outweigh your legitimate interest.

In the event that processing has been restricted, Konserthuset Stockholm may only process personal data, with the exception of storage, in order to establish, exercise or defend legal claims, to protect another party’s rights or because you have provided your consent. If you have had your processing restricted, Konserthuset will inform you before the restriction of processing ceases.

Right to data portability
Under certain conditions, you have the right to receive the personal data you provided to Konserthuset Stockholm in a structured, commonly used and machine-readable format, and to transfer this personal data to another controller without hindrance from Konserthuset Stockholm. The right to data portability requires that processing is automated, that transmission is technically feasible and that processing is based on consent or that it is necessary in order to fulfil an agreement.

Right to object
You have the right to object at any time to our processing of your personal data that is supported by the balancing of interests as a legal basis (legitimate interest). Continued processing of your personal data requires that we demonstrate a legitimate reason for the processing in question. Otherwise, we may only process the data in order to establish, exercise or defend legal claims. You also have the right to object to profiling and other processing of personal data in respect of you, if the processing of the information is based on the customer relationship between you and Konserthuset Stockholm. You can contact us at any time to have access to our balancing of interests by emailing us at info@konserthuset.se.

You always have the right to object to processing that is performed for direct marketing purposes. If you do this, we will cease the processing without first performing any balancing of interests.

As a data subject, you also have the right not to be subject to a decision based solely on automated decision-making, if such decision-making has legal consequences or similarly affects you significantly. You have the right to object to such processing, including profiling. This right does not apply, however, if the decision-making is necessary in order to conclude or fulfil an agreement with you, or if you have provided your express consent.

Right to withdraw consent
In cases where you have provided your consent, you have the right to withdraw your consent at any time. You can withdraw your consent by sending a message to us to this effect by email to info@konserthuset.se. In the event that you have provided your consent by accepting cookies in our cookies banner, you can withdraw your consent at any time by adjusting your choices in accordance with our cookies policy.

Right to submit a complaint
If you are not satisfied with Konserthuset’s processing of personal data, you can contact the Swedish Authority for Privacy Protection (IMY) and lodge a complaint.

The contact details are as follows:
Website: imy.se (opens in an new window)
Email: imy@imy.se
Postal address: Box 8114, SE-104 20 Stockholm, Sweden
Phone: +46 8 657 61 00

Who may have access to your data?
In our operations, we collaborate with different partners in order to be able to offer the best possible service and develop our operations. We need to share your personal data with these partners so that they can perform certain tasks for us. However, they have no independent rights to your personal data beyond those we have under this policy.
Your personal data is shared only with trusted third parties, and Konserthuset Stockholm will never sell your personal data to another party. The sharing of your personal data with external parties is based on the same purposes and legal bases for which it was collected.
When a service provider processes personal data on our behalf, we have what is known as a processor agreement with the service provider. Such an agreement makes it clear that the service provider is processing the personal data on our behalf and in accordance with our instructions, and that the service provider undertakes to comply with the regulations in force concerning the processing of personal data. The processor agreement aims to ensure that your personal data is just as secure at our service providers as it is with us.

Below are the categories of recipients with which your personal data may be shared.

Suppliers and subcontractors: Within the framework if day-to-day operations, personal data may be shared with suppliers and subcontractors, who then process personal data on behalf of Konserthuset Stockholm. This may involve providers of IT services, e.g. software or data storage, suppliers of ticketing systems or systems for direct marketing and other mailing activities, restaurateurs, financial service providers, suppliers of printing services, suppliers of delivery services, suppliers of analytical systems and recruitment firms.

Might we transfer your personal data outside the EU/EEA?
In certain cases, we may share your personal data with actors in a country outside the EU/EEA, a so-called “third country”. GDPR does not apply in a third country, which may pose an increased risk from a privacy perspective with regard to, among other things, the opportunity for government agencies in a third party to gain access to your personal data and for your ability to exercise control over the personal data. In order to protect your personal data and maintain an adequate level of security in respect of your personal data, the transfer is based on a decision from the EU Commission on an adequate level of security or through appropriate security measures such as binding corporate provisions approved by the authorised supervisory authority, or the EU Commission’s standard contractual clauses combined with organisational and technical security measures. In the event that we transfer your personal data to the USA, we may base the transfer on the transatlantic agreement between the EU and the USA, the EU-USA Data Privacy Framework, on the condition that the US undertaking taking receipt of the data is affiliated to and certified under the EU-USA Data Privacy Framework. In other cases, we base the transfer on one of the other transfer mechanisms in Chapter V GDPR.

You can read about which countries are deemed to have an adequate level of security on the EU Commission website (opens in a new window).

You can read more about standard contractual clauses on the EU Commission website (opens in a new window).

You can read about which recipient US undertakings are affiliated to and certified under the EU-USA Data Privacy Framework on the Data Privacy Framework Program website (opens in a new window).

We always conduct a risk assessment before a transfer takes place to a third party, and take both technical and organisation security measures in order to guarantee an appropriate level of security. We strive to transfer as little personal data as possible to countries outside the EU/EEA, and if possible do so in anonymised form. If you would like to find out more about the security measures that Konserthuset Stockholm takes in an individual case, please contact us by email at info@konserthuset.se.

The following recipients outside the EU/EEA may be considered:
Suppliers and subcontractors: In certain cases, your personal data may be shared with suppliers and subcontractors outside the EU/EEA. These may include suppliers of ticketing and CRM systems, suppliers of digital communication systems and suppliers of streaming services. The data may include customer data in ticketing systems, CRM, digital communication and data in videos, in order to conduct Konserthuset Stockholm’s operations.

Social media: When you contact or in some other way interact with Konserthuset Stockholm on social media such as Facebook, Instagram, LinkedIn and YouTube, your personal data is also collected and processed by the undertakings behind these social media.
In connection with these undertakings receiving your personal data, the personal data may be transferred to the USA. Below you will find the social media we use and how to proceed in order to find further information about how they process your personal data.

Facebook and Instagram
When you use these services to contact or interact with us, your personal data is processed by the undertaking Meta Platforms Ireland Ltd (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland), a subsidiary of Meta Platforms, Inc.
    Meta Platforms, Inc. has its registered office in the USA, a third country with an adequate level of security according to the EU Commission, on the condition that the US company taking receipt of the data is affiliated to and certified under the EU-USA Data Privacy Framework (“EU-USA DPF”).
    As of the date of the most recent update of this privacy policy, Meta Platforms, Inc. is affiliated to and certified under EU-USA DPF, which means that all third-party transfers are based on the EU Commission’s decision on adequacy.
    You can read about how Meta Platforms Ireland Ltd. processes personal data in Meta’s privacy policy (opens in a new window).

Linkedin
When you use this service to contact or interact with us, your personal data is processed by the undertaking LinkedIn Ireland Unlimited Company (Wilton Plaza, Wilton Place, Dublin 2, Ireland), a subsidiary of LinkedIn Corporation.
    LinkedIn Corporation has its registered office in the USA, a third country with an adequate level of security according to the EU Commission, on the condition that the undertaking in the USA taking receipt of the data is affiliated to and certified under the transatlantic agreement known as the EU-USA Data Privacy Framework (“EU-USA DPF”).
    As of the date of the most recent update of this privacy policy, LinkedIn Corporation is affiliated to and certified under EU-USA DPF, which means that all third-party transfers are based on the EU Commission’s decision on adequacy. LinkedIn also states that standard contractual clauses are used in parallel; read more about this on the LinkedIn website (opens in a new window).
    You can read about how LinkedIn Ireland Unlimited Company and LinkedIn Corporation process personal data in LinkedIn’s privacy policy (opens in a new window).

Youtube
When you use this service to contact or interact with us, your personal data is processed by the undertaking Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), a subsidiary of Google LLC.
   Google LLC has its registered office in the USA, a third country with an adequate level of security according to the EU Commission, on the condition that the undertaking in the USA taking receipt of the data is affiliated to and certified under the transatlantic agreement known as the EU-USA Data Privacy Framework (“EU-USA DPF”).
    As of the date of the most recent update of this privacy policy, Google LLC is affiliated to and certified under EU-USA DPF, which means that all third-party transfers are based on the EU Commission’s decision on adequacy.
    You can read about how Google Ireland Limited processes personal data in Google’s privacy policy (opens in a new window).

Links to Konserthuset Stockholm’s social media channels:

Facebook

Instagram

Youtube

Youtube — Kungliga Filharmonikerna

LinkedIn

Linkedin – Konserthuset Stockholm

How does Konserthuset Stockholm protect your personal data?
We are keen to ensure that your personal data is stored securely, and we have taken the technical and organisational measures that we consider necessary in order to protect your data against loss, misuse, unauthorised access, unauthorised disclosure, modification or destruction. We work on an ongoing basis to develop our information security in order to protect your personal data.

Changes to our privacy policy
We may make changes to this policy, for example because of changes in the laws, directives and regulations governing the processing of personal data or due to case law concerning how the rules are to be interpreted. The latest version of our privacy policy is always available on our website: konserthuset.se.

This policy was updated on 19 September 2024.