Privacy Policy

Last updated: 2026-10-05

General
Personal data collected via the Website
Storage of personal data
Protection and sharing of personal data
Your rights
Other

This Privacy Policy (the “Privacy Policy”) describes how we process personal data collected from individual users (“you” and “your”) via the e-commerce website bozetto.se (the “Website”), including when suppliers process personal data on our behalf in connection with providing the Website. Third parties may also process personal data for their own purposes and are then themselves responsible for providing information about such processing.

1. General

1.1 What is personal data?

Personal data means any information that can be linked, directly or indirectly together with other information, to a living natural person. Some examples are provided below:

Name
Order number
Delivery address
Telephone number
Email address
Order history
User data

1.2 What does processing personal data mean?

Processing of personal data includes every action carried out with the personal data, regardless of whether it is performed automatically or not. This means that the following actions, among others, are covered:

Collection
Registration
Combining
Transfer
Deletion

1.3 Who is responsible for your personal data?

The Website is owned and operated by:

Bozetto Solutions AB (hereinafter referred to as “Bozetto”)
Corporate identity number: 559516-6298
Askims Industriväg 1B, 436 34 Gothenburg, Sweden
info@bozetto.se

Bozetto Solutions AB is responsible for the processing of your personal data via the Website and is therefore defined as the data controller.

1.4 Why are we permitted to process personal data?

For the processing of personal data to be permitted, there must always be a basis in the GDPR, known as a legal basis. Such a legal basis includes, among other things:

your consent,
that the processing of personal data is necessary to perform a contract (in this case, the Website's terms of use and your purchase of products),
to comply with a legal obligation, for example, to retain data due to an obligation to keep accounting records,
that, following a balancing of interests, we assess that our interest in processing personal data outweighs your interest in protecting it.

2. Personal data collected via the Website

2.1 What personal data do we collect?

As a general rule, we collect only the amount of personal data necessary for your use of the Website. We use your personal data for limited, specified and legitimate purposes expressly stated in this Privacy Policy. In general, your personal data is used to give you access to the Website, maintain and improve the Website, process your orders, facilitate customer care and respond to your inquiries, compile statistics on use of the Website and pursue our legitimate interests.

Below is a more detailed summary of the types of personal data we collect, the purposes for which we use them and the legal bases on which we rely when processing them.

Orders

Type of personal data: When you place an order on the Website, we collect your first name, surname, address, email address and telephone number.
Purpose: We use this information to send you an order confirmation and receipt, deliver your orders, contact you when necessary and maintain our customer care.
Legal basis: When information is processed for accounting purposes, the legal basis is a legal obligation. When information is processed after fulfilment of the purchase to establish, assert or defend legal claims, the legal basis is our legitimate interest in doing so.
Retention period: We retain the order information needed to fulfil your purchase and handle complaints for three years from the date the item was delivered. Information not needed for these purposes is deleted earlier. If a specific legal claim is still pending when the ordinary retention period expires, we retain only the information needed for that claim. We review the need at least once a year and delete the information when the claim has been finally settled and the information is no longer needed to enforce or defend the outcome. Information constituting accounting records is retained until the end of the seventh year following the end of the calendar year in which the financial year ended.

Payments

Type of personal data: When you make a payment, our payment service providers collect your personal data, such as your first name, surname, billing and delivery addresses, and payment information (depending on the payment method selected). Please note that the personal data you need to provide depends on the payment service provider you have selected. We do not have access to your complete payment information; only some of your personal data is made available to us by the payment service providers.
Purpose: Your payment information is used to process payments and manage our accounting.
Legal basis: The legal basis for processing your payment is our agreement with you. The legal basis for processing required for our accounting is a legal obligation.
Retention period: We retain the payment information needed to process and follow up on the payment and handle refunds for twelve months after the payment or the most recent refund was completed. Information that is still needed for a complaint is retained together with the case in accordance with the rules for inquiries. If a specific legal claim is still pending when the ordinary retention period expires, we retain only the information needed for that claim. We assess the need at least once a year and delete the information when the claim has been finally resolved and the information is no longer needed to enforce or defend the outcome. Information constituting accounting information is retained until the end of the seventh year after the end of the calendar year in which the financial year ended.

Inquiries

Type of personal data: When you contact us by email, contact form or chat, we process the contact details you provide and the content of your message, including any attachments. If your inquiry concerns a purchase, we also process the order details needed to handle the matter.
Purpose: We use this information to respond to and handle your inquiries and provide you with the requested information.
Legal basis: When processing is necessary to perform our contract with you, or to take steps at your request before a purchase, the legal basis is performance of a contract. For other general inquiries, the legal basis is our legitimate interest in being able to answer questions and provide customer service. When processing is required to comply with a legal obligation, the legal basis is a legal obligation. If the information is needed to establish, exercise or defend legal claims, we rely on our legitimate interest in doing so as the legal basis for processing.
Retention period: General inquiries and customer service messages are retained for six months after the matter has been closed so that we can follow up on our response if you contact us again. Information that is no longer needed is deleted earlier. For complaints, we retain the necessary case documentation until three years after delivery or for six months after the matter was closed, whichever occurs later. If a specific legal claim is still pending when the ordinary retention period expires, we retain only the information needed for that claim. We assess the need at least once a year and delete the information when the claim has been finally resolved and the information is no longer needed to enforce or defend the outcome. For health data, the more limited retention period in section 2.5 applies. Accounting information is retained in accordance with section 3.3.

Reviews

Type of personal data: When you submit a review of the products you have purchased, we collect your name and all information that you choose to include in your review.
Purpose: We use this information to display your review on the Website and provide other customers and potential customers with an objective opinion of our products.
Legal basis: The legal basis for publishing your review and the personal data displayed alongside it is your consent. You may withdraw your consent at any time by contacting us in accordance with section 6.5. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Retention period: We store this data until you ask us to delete your review or until we determine that it is no longer relevant (for example, if the reviewed product has been discontinued from our range).

Technical data and use of the Website

Type of personal data: We process IP address, device and browser data, as well as technical events and error messages, for operations and security. When you consent to visit analysis, we also process cookie identifiers, which pages and products you visit and how you use the Website.
Purpose: Technical data is used to ensure that the Website functions, for troubleshooting and to detect misuse. Visit analysis is used to understand how the Website is used and to improve content and functions.
Legal basis: Processing necessary for operations and security is based on our legitimate interest in providing a secure and functioning website. Visit analysis using personal data is based on your consent.
Retention period: Operational and security logs are normally stored for no more than 30 days. Data needed to investigate a specific security incident is stored until the investigation and necessary measures have been completed; the need is reassessed at least every three months. Personal data for visit analysis is stored for no more than six months from collection. Thereafter, it is deleted or anonymised.

Customer account

Type of personal data: When you create a customer account, we process your name, email address, telephone number, address and the order and return details displayed in the account.
Purpose: We use the data to create and administer your customer account, display order history, handle returns and answer questions about your purchases.
Legal basis: Processing necessary to provide the customer account and its functions is based on our agreement with you. Processing necessary to protect the account against misuse is based on our legitimate interest in security.
Retention period: The account details are stored for as long as the account is active. When the account is closed, data that is no longer needed is deleted without undue delay. Order, complaint and accounting data needed for other purposes are stored separately for the retention periods specified above.

2.2 Commercial communications

We send commercial communications by email and SMS when you have consented to receive such communications through the relevant channel. The legal basis is your consent.

If we have received your email address in connection with a purchase, we may also send information about our own similar products. The legal basis for this processing of personal data is our legitimate interest in marketing our own similar products to existing customers.

You may withdraw your consent or object to direct marketing at any time through the unsubscribe function in the message or by contacting us in accordance with section 6.5. There is no charge, and this does not affect your purchase. We will then cease processing for direct marketing.

For consent-based communications, we use the contact details for no more than 24 months from the time you last provided or actively confirmed your consent. Communications sent under the customer exception end no later than twelve months after your most recent purchase. Both periods end earlier if you unsubscribe. After you unsubscribe, we retain only the contact detail and suppression flag needed to prevent new communications from being sent. This data is not used for marketing and is deleted when we no longer have any basis that could result in you being added to the mailing list again. The need is reviewed at least once a year. The processing is based on our legal obligation to respect your objection or withdrawal. Limited documentation of the content and date of the consent, and of any withdrawal, is retained for three years after the consent ended, based on our legitimate interest in being able to demonstrate that the communications were permitted and in handling legal claims. In the event of an ongoing dispute, only necessary documentation is retained until the dispute has been finally resolved.

2.3 Transaction messages

We may send transaction messages by email or SMS when necessary to manage your purchase, such as order updates, payment receipts, invoices and shipping information. The processing is based on our agreement with you or, where the message is required by law, a legal obligation. You cannot opt out of messages that are necessary for these purposes. Commercial communications are handled in accordance with section 2.2.

2.4 Feedback and questions

If you contact us, we may record any questions, responses, complaints, recommendations or compliments from you. We limit the personal data stored to what is necessary for the purpose. If the data can still be linked to you, including with the help of supplementary information, we treat it as personal data under this Privacy Policy. Data that has been anonymised so that it can no longer be attributed to an identified or identifiable person is not personal data.

2.5 Uploaded designs and sensitive personal data

If you order a product with your own uploaded design, we process the file you provide to accept the order, manufacture the product and handle questions concerning it. A design may contain personal data about you or others. The processing necessary for the order is based on our contract with you. We retain the file only for as long as necessary for manufacturing, delivery and any specific complaints or legal claims. Do not upload health data or other sensitive personal data unless necessary. We do not use such content for marketing. Irrelevant sensitive data is deleted without undue delay.

2.6 Where we collect your personal data

We collect your personal data from the following sources:

Directly from you - for example, when you provide information when making a purchase, create a customer account, upload your own design or contact us.
Directly or indirectly through your activity on the Website - when you use the Website, we automatically collect technical information about your use of the Website.
From third parties - we receive information about payment status, transaction numbers, payment amounts and refunds from payment service providers. From carriers and warehousing or logistics providers, we receive information about shipment status, deliveries and returns. We use the information to process and follow up on your purchase, deliver your goods and handle refunds. The legal basis is our contract with you. For information that must be processed for accounting purposes, the basis is a legal obligation. Retention periods are specified under Orders and Payments in section 2.1. When we receive personal data from another person, we provide the information required under data protection regulations within the applicable time limit, unless an exception to the obligation to provide information applies.

2.7 Consequences of failing to provide personal data

If you choose not to provide us with your personal data when we request it, we may be unable to carry out certain requested processes (for example, process your order), and you may be unable to use all of the Website's features, receive the requested information or receive our response.

3. Retention of personal data

3.1 Retention period (personal data)

We retain your personal data only for as long as necessary for the purposes described in this Privacy Policy. Retention periods or criteria for determining retention periods are stated for each processing activity in section 2. If you request rectification or erasure, we handle your request in accordance with section 5. Certain data may need to be retained even after a request for erasure, for example to comply with a legal obligation or to establish, exercise or defend legal claims. When your personal data is no longer necessary for its purpose and we have no other legal basis for retaining it, we immediately delete it securely from our systems. As a general rule, we do not retain personal data longer than absolutely necessary.

3.2 Retention period (data)

We may retain anonymous data, meaning data that can no longer be attributed to an identified or identifiable person, for the purposes described in this Privacy Policy. This means retaining data for the period needed to enable us to manage our business operations, fulfill our contractual obligations, pursue our legitimate interests, conduct audits, comply with laws and regulations, and resolve any disputes.

3.3 Retention period required by law

When we are legally required to retain personal data, we retain the data covered by the obligation for the prescribed period. Accounting information is retained until the end of the seventh year after the end of the calendar year in which the financial year ended. When the retention period has expired, we delete or anonymize the data unless it is still needed for another specified purpose that has a legal basis.

4. Protection and sharing of personal data

4.1 How we protect your personal data

We implement adequate technical and organizational security measures that protect your personal data from, among other things, loss, misuse, unauthorized access and disclosure. The security measures we take include secure networks, strong passwords, restricted access to your personal data for our personnel, multifactor authentication, anonymization of personal data (where possible), regular updates, security updates and careful qualification of our data processors.

4.2 When we share your personal data

We only share the personal data necessary for the purposes described in this Privacy Policy. Recipients include providers of e-commerce platforms and IT operations, payment services, warehousing and logistics, transport, customer service, mailings, and consent-based visitor analytics and advertising.

Upon delivery, necessary information, such as name, address, contact details and delivery information, is provided to our carriers depending on the delivery option.

Providers that process data on our behalf and according to our instructions are data processors. This includes, for example, the services we use for IT operations, customer service and mailings when they handle the data solely on our behalf. Payment service providers may be independent data controllers for, for example, credit assessments, fraud prevention and their own statutory obligations. Carriers may have corresponding independent responsibility for the parts of the processing where they themselves determine the purposes and means. For these parts, the recipient's own privacy information applies.

We may also share cookie and device identifiers, as well as information about product views and purchases, with digital analytics and advertising providers to tailor and measure advertisements. We do not sell your personal data to other companies for their own direct marketing.

Disclosure is limited to what is necessary for the following purposes:

ensure that the Website functions properly,
deliver the products you have ordered,
process your payments,
respond to your enquiries,
protect our rights and security and prevent and combat fraud,
fulfil our contractual obligations,
provide data to competent authorities when required by law or when the disclosure otherwise has a legal basis.

4.3 Transfer outside the EEA

Although our company and most of our partners are based in Sweden, that is, within the European Economic Area (EEA), some of our data processors are based outside the EEA. We may therefore need to transfer your personal data outside the EEA. If such a transfer is necessary, we ensure that the country where our data processor is located guarantees an adequate level of protection for your personal data, or we enter into an agreement with the data processor that ensures such protection (for example, a data processing agreement based on pre-approved standard contractual clauses).

5. Your rights

5.1 Monitoring of processing

You always have the right to check how we process your personal data. Subject to any limitations under law, you have the following rights:

Right of access - you may obtain a copy of the personal data that we store in our systems, as well as a list of the purposes for which your personal data is processed.
Right to rectification - you may ask us to correct inaccurate or incomplete data that we process about you.
Right to erasure - you may ask us to erase your personal data from our systems.
Right to restriction - you may ask us to restrict the processing of your personal data.
Right to data portability – you may ask us to provide you with a copy of your personal data in a structured, commonly used and machine-readable format and to transfer that personal data to another controller.
Right to object – if we process your personal data on the basis of a balancing of interests, you have the right to object to the processing on grounds relating to your particular situation. We may then continue the processing only if we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or if the processing is necessary for the establishment, exercise or defence of legal claims. You always have the right to object to processing for direct marketing, including profiling related to such marketing. We will then cease processing for these purposes.
Right to withdraw consent – if the processing is based on your consent, you have the right to withdraw it at any time. You can do this through the function where consent is managed, for example by unsubscribing from a mailing or through the Website’s cookie settings, or by contacting us in accordance with section 6.5. It must be as easy to withdraw consent as it is to give it. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Right to lodge a complaint – you may lodge a complaint regarding our processing of your personal data.

5.2 Exercise of rights

If you wish to exercise any of your rights as set out above, you can contact us by email at info@bozetto.se. Please use the subject line “GDPR – request” and describe which right you wish to exercise. You do not need to use any specific wording for your request to be processed.

If we have reasonable grounds to doubt your identity, we may request the additional information necessary to confirm it. We will not request more information than is necessary.

We will handle your request without undue delay and respond no later than one month after receiving it. If necessary, taking into account the complexity of the request or the number of requests, the period may be extended by a maximum of two additional months. If so, we will inform you of the extension and the reasons for it within the first month. If we do not take the action you have requested, we will inform you of the reasons and of the possibility of lodging a complaint with a supervisory authority and seeking judicial review.

You have the right to lodge a complaint with the Swedish Authority for Privacy Protection, imy.seYou do not need to contact us before lodging a complaint. However, for smooth and efficient handling, we recommend that you contact us first so that we can assist you with any questions or concerns.

6. Miscellaneous

6.1 Validity

This Privacy Policy enters into force on the date stated at the top of the Privacy Policy (“Last updated”) and remains in force until terminated or updated by us.

6.2 Changes and updates

We may revise this Privacy Policy from time to time. The current version is published on the Website, and the date of the latest update is stated at the top of the Privacy Policy. In the event of material changes, we will inform you in an appropriate manner. If we intend to process your personal data for a purpose other than the purpose for which the data was collected, we will provide information about the new purpose and other relevant information before such processing begins. If the amended processing requires your consent, we will request it before the processing begins.

6.3 Personal data of minors

If we process personal data concerning persons under the age of 18, we pay particular attention to their need for protection and adapt the information about the processing so that it is clear and understandable. If consent from a guardian is required under applicable data protection regulations, we obtain such consent before the processing begins. If you, as a guardian, believe that we are processing your child's personal data incorrectly, you may contact us in accordance with section 6.5. We will then investigate the processing and delete data that we have no right to process. Data that must be retained to comply with a legal obligation or to establish, exercise or defend legal claims may need to be retained.

6.4 Cookies and similar technologies

We use cookies and similar technologies on the Website. Cookies that are necessary for the Website and the services you request to function may be used without your consent. Cookies for purposes such as visitor analytics, personalisation and marketing are used only when you have given the required consent.

An up-to-date list of the cookies used, including their names, providers, purposes, categories and storage periods, is available in our cookie settings. There you can also choose which categories you consent to and change or withdraw previously given consent at any time. Withdrawing consent must be as easy as giving it.

6.5 Contact

Please do not hesitate to contact us if you have any questions about this Privacy Policy or the processing of your personal data, or if you wish to request a data subject access report.

Bozetto Solutions AB
Corporate identity number: 559516-6298
Askims Industriväg 1B, 436 34 Gothenburg, Sweden
info@bozetto.se