Privacy Policy
Controller. Tintame AB (under formation), org. no. [...], [address], Sweden, [email protected]. We have not appointed a data protection officer; contact us at the same address. UK representative under UK GDPR art. 27: [name, address, email].
What we process, why and on what basis
| Purpose | Data | Legal basis (GDPR art. 6) | Kept for |
|---|---|---|---|
| Taking, producing and delivering your order | Name, delivery address, email, phone, items ordered | Contract, art. 6(1)(b) | Until delivery and any complaint or withdrawal is closed |
| Bookkeeping | Order and payment records | Legal obligation, art. 6(1)(c) (Swedish Bookkeeping Act) | 7 years after the end of the financial year |
| Customer service | Your emails to us and our replies | Legitimate interest in answering you, art. 6(1)(f) | 2 years after the last message |
| Waitlist and launch news | Email address, sign-up time and page | Consent, art. 6(1)(a) | Until you withdraw consent, and at most 12 months after launch |
| Running and securing the site | IP address and technical data in server logs | Legitimate interest in security, art. 6(1)(f) | Up to 30 days (set by our host) |
Where we rely on legitimate interests, those interests are answering your questions, keeping the site secure and defending legal claims; you may object at any time, and we then stop unless we have compelling grounds. We also keep order and correspondence records for three years after delivery (six for UK customers) to handle complaints and legal claims, on the basis of legitimate interest. Giving your name, address and email is necessary to conclude and deliver the order; without them we cannot process it.
We do not use tracking or advertising cookies. The site and checkout use only strictly necessary storage: the shopping cart in your browser's local storage (not sent to us until you check out), and security and payment cookies set by Cloudflare and Stripe. No consent is needed for these, and you can block them in your browser, though checkout may then not work. We do not sell your data or use it for automated decisions with legal effect.
Who receives your data
| Recipient | Role | Where | Safeguard for transfers |
|---|---|---|---|
| Prodigi Group Ltd (print partner) and the carriers it uses | Processor for production and delivery | UK; production sites in the EU, UK, US and Australia depending on your address | UK adequacy decision; EU Standard Contractual Clauses for other countries |
| Stripe Payments Europe Ltd | Payments; independent controller for fraud prevention and legal duties | Ireland and the US | EU–US Data Privacy Framework and Standard Contractual Clauses |
| Cloudflare, Inc. | Hosting and security of the site | EU and the US | EU–US Data Privacy Framework and Standard Contractual Clauses |
| Google Ireland Ltd (Google Workspace) | EU and the US | EU–US Data Privacy Framework and Standard Contractual Clauses |
We have data processing agreements (GDPR art. 28) with our processors. You can get a copy of the transfer safeguards by emailing [email protected]. We may also share data with authorities when the law requires it, and with an accountant or auditor bound by confidentiality.
Your rights
You have the right to access your data, correct it, have it erased, restrict or object to processing, and receive your data in a portable format. You may withdraw consent at any time without affecting earlier processing. Write to [email protected]; we reply within one month. You may complain to the Swedish Authority for Privacy Protection (IMY, imy.se) or to the authority where you live, in the UK the Information Commissioner's Office (ico.org.uk).
Children. Our shop is not directed at children under 16, and we do not knowingly collect their data.
Changes. We do not currently meet the thresholds of US state privacy laws such as the California CPRA, and we do not sell or share personal information as those laws define it; if that changes we will update this policy. We will post changes here and tell you directly if a change affects you significantly. Last updated: [date].