Privacy policy
Who is responsible for your data?
We Are Digital Brands AB, organisation number 559363-4388, Fidicinstrasse 44, 10965 Berlin, Germany, is the controller of the personal data described in this policy. You can contact us about privacy through the support email displayed in the shop footer.
Data we process
We process information needed to run the shop and fulfil an order: your name, contact details, billing and delivery address, order, return and refund information, customer-service messages, payment status and fraud or security signals. We also process technical information such as IP address, browser and device details, event time, pages viewed, product and cart interactions, referrer and campaign parameters when analytics has been permitted.
Stripe processes card and other payment credentials in its secure checkout. We do not receive or store full card numbers or card security codes.
Why we use it and our legal bases
- Orders and support: to take payment, fulfil delivery, manage returns and answer enquiries; this is necessary to perform our contract with you.
- Tax, accounting and consumer-law records: to meet our legal obligations.
- Security and fraud prevention: to protect the shop, customers and payment process; this is in our legitimate interests and, where applicable, necessary for legal obligations.
- Analytics: to understand how the shop is used and improve it. This runs only after your opt-in consent. Declining analytics does not affect shopping or payment.
- Consent records: to remember and respect your choices and demonstrate compliance; this is necessary for our legitimate interests and legal accountability obligations.
Services that receive data
We use carefully selected service providers acting on our instructions where applicable. These include Stripe for payment, authentication and fraud prevention; ConsentOS to present, store and manage consent choices; and Google Analytics 4 and Google Tag Manager Server for opt-in analytics. Other providers may process the minimum data needed for hosting, fulfilment, delivery, customer service, security or email.
When you consent to analytics, website event data is sent through our server-side Google Tag Manager setup to Google Analytics 4. Using a server-side tag manager does not make analytics necessary and does not override your choice. We do not enable analytics before consent.
International transfers
Some providers may process personal data outside the European Economic Area. Where this occurs, we use a lawful transfer mechanism, such as an adequacy decision or the European Commission’s standard contractual clauses, and apply supplementary safeguards where required.
How long we keep data
We retain order, refund and accounting data for the period required by applicable tax, accounting and consumer-protection law. We keep operational order and support records only for as long as needed to provide the service, handle claims and prevent fraud. Consent records are retained only as long as needed to respect and evidence your choice. Analytics data is retained only for the configured analytics retention period and is not collected if you decline analytics.
Your choices and rights
You can change or withdraw analytics consent at any time through the on-site consent settings. Depending on the circumstances, you can ask us for access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. We may ask for information needed to verify your identity and may retain information that the law requires us to keep.
You may complain to the Swedish Authority for Privacy Protection or to the supervisory authority in your usual place of residence or work. Swedish Authority for Privacy Protection.
This policy should be read with our Cookie and consent policy.