Privacy policy for creators
Västerberget AB (Alour) · Version 1.2 · Last updated 7 October 2026
This policy explains how we handle personal data about you when you freelance for us, or when you are the contact person for a company that freelances for us. It belongs to section 10.3 of our framework agreement for creator assignments. In case of discrepancies, the Swedish version prevails.
1. Who is responsible for your data?
Västerberget AB, reg. no. 556913-5055, Ljungdalsgatan 4, 426 69 Västra Frölunda, Sweden, is the data controller. We operate under the brand Alour.
If you have questions, or want to exercise any of your rights, email jobb@alour.se.
| Matter | Email address |
|---|---|
| Cancellations under the framework agreement | jobb@alour.se |
| Questions about the framework agreement | kristofer@alour.se |
| Personal data and your rights | jobb@alour.se |
The framework agreement refers to the addresses above. If we change an address, we will announce it in one of our assignment channels, and emails to the previous address will be considered received for 30 days after the announcement.
2. What data we process
- Contact and identity details: name, email, phone number, address and company registration number. If you run a sole proprietorship, the registration number is the same as your personal identity number.
- Details about your business: F-tax status, VAT registration and information about representatives.
- Payment details: invoices, amounts and the account you want to be paid to.
- Assignment details: requests, replies, bookings, cancellations, briefs, deliveries and time data.
- Messages: what we write to each other via SMS and email, and previously in Slack and WhatsApp, including time data and delivery status. SMS to and from our assignment number and emails from jobb@alour.se are logged in our planning tool.
- Documentation of inability to work: if you provide documentation showing that you were ill or injured. We never ask for a diagnosis or medical records.
- Data in disputes: for example regarding penalties, client protection or damages.
- Portfolio: which approvals you have received to show material in your portfolio.
If you appear in images, film or audio in our own marketing, this only happens with your separate consent. You will then receive specific information when we ask for that consent.
3. Why we process the data and on what legal basis
| What we do | Legal basis |
|---|---|
| Entering into and performing the framework agreement and bookings, communicating about assignments and paying you, when you are the contracting party yourself (sole proprietorship) | Contract (Article 6.1 b GDPR) |
| The same when a company is the contracting party and you are the creator or contact person for the company | Legitimate interest in carrying out the assignments (Article 6.1 f) |
| Accounting, invoices and tax | Legal obligation under, among others, the Swedish Bookkeeping Act (Article 6.1 c) |
| Checking F-tax status | Legal obligation and legitimate interest (Article 6.1 c and f) |
| Keeping requests, confirmations and cancellations as evidence of what was agreed | Legitimate interest in being able to show what applies (Article 6.1 f) |
| Handling penalties, client protection, damages and other legal claims | Legitimate interest (Article 6.1 f) |
| Handling documentation of illness or injury | Legitimate interest (Article 6.1 f) and the exemption for legal claims (Article 9.2 f) |
| Showing your name, image or voice in our marketing | Your consent (Article 6.1 a), which you can withdraw at any time |
You need to provide contact, business and payment details for us to enter into an agreement and pay you. We use an automated tool, an AI assistant in our planning tool, that suggests which creators suit an assignment, sends requests and sorts the replies. Who gets booked is always decided by a person at our company, and we make no decisions about you based solely on automated processing.
4. Who we share the data with
- IT providers whose services we use: 46elks (sending and receiving SMS), Google Workspace (email and storage in Google Drive), ClickUp (assignment planning, log of requests and replies, and AI assistant), Make (automation of messages and workflows), Scrive (electronic signing of agreements), Visma (finance and accounting) and Slack, WhatsApp and Apple (older messages and SMS). They process the data on our behalf and according to their data protection terms.
- Our client in the assignment, when needed for practical coordination, for example your name and phone number before a shoot. We never disclose what you are paid.
- Accounting consultant, auditor and lawyer, when they help us.
- Authorities, for example the Swedish Tax Agency, when required by law.
- Another company that takes over the agreement under section 13.2 of the framework agreement. In that case you will be notified in advance.
We never sell your data.
5. Transfers outside the EU/EEA
Some of our IT providers, for example Google, ClickUp, Slack, WhatsApp and Apple, may process data outside the EU/EEA, including in the USA. We then ensure that the transfer is supported by the GDPR, for example through the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses. 46elks and Make process the data within the EU/EEA.
6. How long we keep the data
| Data | How long |
|---|---|
| Framework agreement and approvals | The term of the agreement and 10 years thereafter, since claims can be made for that long |
| Requests, bookings, cancellations and messages about assignments | 3 years after the assignment, longer if a dispute is ongoing |
| Invoices and other accounting records | 7 years after the end of the calendar year in which the financial year ended |
| Documentation of illness or injury | Until the penalty claim is settled, or at most 3 months after the cancelled occasion if no claim is made. Longer only if a legal claim is ongoing |
| Data relating to client protection | The term of the agreement and 12 months thereafter, longer if a dispute is ongoing |
| Contact details in our channels | Until the collaboration ends; you are then removed from Slack, WhatsApp groups, ClickUp and contact lists within 3 months |
7. Your rights
You have the right to:
- know what data we hold about you and receive a copy of it,
- have incorrect data corrected,
- have data erased when we no longer need it or are not entitled to process it,
- request that processing be restricted, for example while a matter is being investigated,
- object to processing based on legitimate interest,
- receive data you have provided yourself in a machine-readable format, when the processing is based on contract or consent,
- withdraw consent at any time, without affecting what has already been done.
We respond within one month. Some rights do not apply in full; for example, we may not erase invoices that the Bookkeeping Act requires us to keep.
If you think we handle your data incorrectly, you can lodge a complaint with the Swedish Authority for Privacy Protection (IMY), www.imy.se. Please contact us first, and we will try to resolve it.
8. Changes
We may update this policy. For major changes we will notify you in one of our assignment channels. The latest version is always available at https://alour.se/en/kreator-policy, and the date of the latest update is shown at the top of the policy.