Privacy policy

Uppsalaekonomerna Asset Management (UEAM), part of the Uppsalaekonomerna student society, is responsible for the processing of personal data on this website. Contact us at the address at the bottom of this page with any question about your data.

We load no scripts, maps, videos or embedded posts from other websites, and our font files are served from our own domain rather than from a font network. Your browser therefore only ever contacts our own address and the storage service that holds our PDFs and images. No requests go to Google, Meta or any other external network.

Reading this website asks nothing of you. It carries no contact form, no newsletter box and no comment field, so there is nothing on it that collects what you type, and nothing you have to sign in for. The one exception is the application form, which is not on this website at all: the “Join us” page links out to a form hosted elsewhere, tells you where it is hosted, and what you type there is covered by that provider’s terms as well as ours. If you want to reach us instead you write to the address at the bottom of this page, and then we hold only what you chose to put in that message.

The fund’s performance, holdings, dividends and reports, and the society’s events, are for the society’s members, so those pages ask for a sign-in. Creating an account stores your email address and a password, and the board records the date you were approved and sometimes a short note, such as “board HT26”, saying who you are. The password is kept by our provider as a hash and is never visible to us. None of it is published, none of it is shared with anyone beyond the providers named above, and it is used for one thing: deciding who may read those pages. It is one account for all of them — the fund, events, the screener and the analysis archive. Our provider sends the confirmation and password-reset emails, records when the account was created and last signed in, and keeps a short technical log of sign-ins, including the IP address, to protect the account against misuse.

The legal basis is legitimate interest (Article 6(1)(f) GDPR) — administering the society’s own membership. The account is removed when you stop being active in UEAM, and sooner if you ask: write to the address below and we will delete it, with no need to give a reason.

If you only read the website, nothing is stored in your browser: no cookies, no local storage, no identifiers.

The public site stores nothing on your device: it sets no cookies and writes nothing to local storage. The one item below is set only once somebody signs in — the handful of people who administer the site, and the society’s own members reading the fund pages:

A web manager can delete this cookie at any time through their browser settings. The site keeps working; they would simply need to sign in again.

Our hosting provider automatically logs technical details of every visit, including IP address, timestamp, the page requested and the browser type, in order to operate and secure the service. The legal basis is legitimate interest (Article 6(1)(f) GDPR). These logs are not used to follow individual visitors, and the provider keeps them for one hour before discarding them. We do not copy them anywhere else.

The site publishes the name, role, portrait and in some cases a quote for current members, along with photographs from our events in which members and guests may appear.

The legal basis is consent (Article 6(1)(a) GDPR). If you appear in a photograph or a quote you may withdraw your consent at any time. Contact us and we will remove the material, with no need to give a reason.

Details of current members are kept for as long as the person is active in UEAM. After that they are deleted. Event photos are cleared no later than ten years after the event. Data is deleted sooner than this if you ask us to. Our editing tools list anything that has passed one of these points, so it is reviewed by a person rather than left to lapse.

The website is hosted by Vercel, on servers in Stockholm, and its content is stored with Supabase on servers in Ireland. Both process data on our behalf as data processors, under a data processing agreement. Our application form is not part of this website: it is a form hosted by a third party, and the “Join us” page names which one before you go there. We share data with no one else.

Both Vercel and Supabase are US companies. Pages are rendered on servers in Stockholm and the content is stored in Ireland, both inside the EU, but two things reach beyond it: the providers' support and operations staff may in exceptional cases access the data from the US, and the images, fonts and scripts that go with a page are delivered from whichever of the host's edge locations is nearest the reader, which for a visitor outside Europe is a server outside the EU/EEA. Both count as third-country transfers. They rest on the European Commission's standard contractual clauses, and in Vercel's case also on the EU–US Data Privacy Framework. You can request a copy of the safeguards that apply.

Under the GDPR you have the right to:

• know what data we hold about you, and receive a copy of it
• have inaccurate data corrected
• have your data erased
• request that processing be restricted
• object to processing carried out on the basis of legitimate interest
• withdraw a consent you have given, without affecting processing carried out beforehand
• receive the data you gave us in a commonly used, machine-readable format, and have it sent to someone else where that is technically possible

Write to us at the address below and we will handle your request. We normally reply within one month.

We do not build profiles of visitors and we make no automated decisions about anyone, in the sense of Article 22 of the GDPR. Nothing on this site scores, ranks or sorts the people who read it, and nothing you do here changes what you are shown.

If you believe we are handling your personal data incorrectly, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se.