Privacy Policy
Privacy Policy of Royal Design
Welcome to our Privacy Policy!
This Privacy Policy provides you with information about how we at Royal Design Group AB (Royal Design) look after your personal data when you make a purchase, visit our website, participate in competitions, receive our newsletters and when we communicate with you. The privacy policy also gives you information about your personal data rights and how the law (GDPR) protects you. Click on the links in the summary to read more about our processing of personal data for your specific situation.
Royal Design is responsible for processing of your personal data
Royal Design Group AB, Porfyrvägen 2, 382 92 Nybro, CVR no 556573-2426, is the data controller (herein referred to as “Royal Design”, "we", "us" or "our"). This means that we are responsible for your personal data.
For processing to determine what is relevant offers for you, Egmont Story House AB, 556046-9206, which owns Royal Design will process your personal data as described in a separate table below.
If you have any questions regarding our processing of your personal data or if you wish to exercise any of your rights, please use the contact information below.
A summary – why do we process your personal data?
If you make a purchase from us, we process your personal data to
· Manage your purchases
· Send you newsletters and other marketing (if you have not objected). This includes to tailor our newsletters according to your interests and gathering of personal data to improve email newsletters. If you unsubscribe, we store your contact information to make sure that we do not send any further marketing, i.e. to comply with marketing legislation,
· Send requests for you to review your purchase
· Comply with accounting legislation
If you visit our website, we process your personal data to
· Personalise your shopping experience,
· Show you marketing from us on other websites and social media (if you consent),
· Analyse and optimise the user experience (if you consent)
· Ensure necessary functionality for the website to work
Processing by Egmont Story House AB to be able to determine the most relevant offers to show you in newsletters and ads based on your website visits and purchases made from companies within the Story House Egmont Group.
If you participate in a competition, we process your personal data to manage your participation and contact you regarding the competition.
If you subscribe to our newsletters, we process your personal data to send you newsletters and improve our emails. If you unsubscribe or withdraw your consent, we store your contact information to make sure that we do not send any further marketing, i.e. to comply with marketing legislation.
If you contact us or we otherwise communicate, we process your personal data to provide customer service and communicate with you, and improve our customer service provided via phone.
To handle complaints, claims, legal rights and fraud, we process your personal data to handle your complaints, claims and legal rights, and to protect ourselves against fraud.
Your rights
In short you have the following rights:
o The right to lodge a complaint with a supervisory authority,
o The right to withdraw your consent
o The right of access
o The right to object
o The right to erasure
o The right to rectification of processing
o The right to restriction of processing
o The right to data portability
If you have any questions about your rights, or want to exercise anyone of your rights, you are more than welcome to contact us.
Contact information
You can contact Royal Design, [email protected], or Porfyrvägen 2, 382 92 Nybro
For any questions regarding the processing performed by Egmont Story House, you can contact Egmont Story House through the form here or by post to Egmont Story House AB, 205 07 Malmö.
In this policy, you can read more about the following:
Detailed description about how we process and store your personal data
Who can gain access to your personal data and why?
Transfer of personal data to countries outside of the EU/EEA
Balancing of interests assessment
Securing your personal data
Your rights when we process your personal data
Description of the processing of personal data
In this section you will find a detailed description of how we process your personal data.
If you make a purchase
Purpose: To manage your purchases
· Receive, register, and manage your order.
· Sending you information about your order via email, such as order confirmation and delivery information
· Process your payment, including sharing your personal data with payment service providers.
· Deliver your products, including sharing your personal data with our delivery partners, as chosen by you.
Categories of personal data
· Name
· Contact information (such as address, email
· and telephone number)
· Order information, such as what product you have ordered
· Payment information
· If you have purchased a gift card for another person we process that persons information needed to deliver the gift card and any personal message you include in the gift card
Legal basis for the processing
Necessary for the performance of the contract between you and us, GDPR article 6.1.b.
The processing is necessary for us to fulfil the agreement and deliver your purchased products. The information you provide is necessary for us to enter into a contract with you and without your personal data we cannot process your purchase.
Source of the personal data: We receive the personal data directly from you in connection with your purchases.
Data retention: The personal data will be stored after you have received your order so that we can handle any questions about your purchase, returns, guarantees and complaints in a seamless manner and in accordance with applicable consumer legislation as described below. Some personal data is stored for a longer period for other purposes, such as complying with accounting legislation as described below. Read more about this below.
Purpose: Send newsletters and other marketing after a purchase
· We send information via email and/or SMS about news, marketing, offers, discounts and invitations (“newsletters”) to you who have made a purchase. We only send you newsletters if you have not objected to receiving them when we collected your personal data or later.
· We use data from your previous orders and browsing activity to tailor individual product recommendations based on your interests, so called profiling*.
· We improve and develop our email newsletters by analysing how you open them and what you click on in the newsletters. However, we always perform such analysis on an aggregate level i.e. do not look at how you specifically interact with our newsletters.
· We use your personal data to adapt our marketing based on what Egmont Story House AB has determined are relevant offers for you (as described here). We need to share your personal data with Egmont Story House AB for this purpose.
Categories of personal data
To send you newsletters
· Name
· Phone number
To tailor our newsletters to your interests (profiling)
· Browsing history
· Purchase history
· Device type
· Location of IP address, e.g. the zip code where the IP address is located
· Shipping address chosen by you as a customer
· Information regarding which products you show interest in at our website
· Demographic data
· Conclusions that we receive from Egmont Story House AB us as described here
To improve our email newsletters
· Name
· Information about how you open our newsletters and what you click on
· IP-address
Legal basis for the processing
Legitimate interest, GDPR article 6.1.f.
The processing is based on our legitimate interest in
· being able to send you newsletters tailored to your interests after your purchase. You have the possibility to object to such marketing when you make your purchase and anytime after that, and
· improving our email newsletters through analysis.
Without your consent we only send you newsletters regarding same or similar products in accordance with the marketing legislation.
If you do not wish to receive individual product recommendations or other marketing e-mails from us via SMS or email, you can object to this at any time by clicking on the unsubscribe link in each email or by replying to the SMS as instructed in the SMS, or by sending an email to our customer service ([email protected]).
Source of the personal data: The personal data is collected directly from you.
Data retention: You will continue to receive newsletters for two years after your purchase unless you opt out of receiving our marketing (object) before then. If you object or withdraw your consent, your contact information will be stored in our unsubscribe register until further notice, see below.
Some information will be retained for statistical purposes.
* Profiling: We use so called profiling to be able to show you offers that are relevant to you and to provide you with customized newsletters. We use profiling because without it, you would see offers and information which you probably are not interested in. You have the right to object to profiling as described below under the section explaining your rights.
Purpose: To send you a request to review your purchase and publish your review
· Send you requests via email to review the product you have purchased and the purchase experience.
· Publish your review, for example on our websites.
Categories of personal data
· Name
· Information you leave in your review
· Information about the product you bought for the purpose of your review
Legal basis for the processing
Legitimate interest, GDPR article 6.1.f.
The processing is based on our legitimate interest in being able to contact you with a request to evaluate us and our products in order to improve our products and our offer and to be able to publish reviews that you leave.
When you review our products, you give your consent to the publishing of your name according to the legislation about name and picture in marketing.
Source of the personal data: We receive the personal data directly from you in connection with your reviewed.
Data retention: We will send a request for you to submit a customer review after your purchase. You only receive such requests during a limited time after your purchase and no longer than two months after your purchase. Any reviews that you provide will be published until you ask us to remove them.
Purpose: To comply with accounting legislation
This includes storing information in bookkeeping and accounting.
Categories of personal data
Legal basis for the processing
Payment history, transactions, name and other materials if such personal data forms a part of the accounting records.
Legal basis for the processing
Legal obligation, GDPR article 6.1c.
The processing is necessary to comply with legal obligations to which we are subject, i.e., accounting legislation.
Most of the information that could be a part of accounting records is information that you need to provide to us. Otherwise, we will not be able to administrate our relationship with you.
Source of the personal data: We receive the personal data directly from you in connection with your purchases.
Data retention: We will retain any documents considered accounting material, along with the personal data contained within them until and including the seventh year after the end of the calendar year for the fiscal year to which the personal data relates (according to Swedish regulation).
If you use our website
Purpose: Shopping personalisation
We process your personal data to provide comfortable and useful services that best meet your and other visitors needs and interests. Since we offer thousands of products and hundreds of brands, it is necessary for us to present our content and offers in a tailored manner so that you can find the products you are truly interested in, ensuring a more comfortable and less tedious experience for you. For example, we develop solutions that can suggest products perfectly tailored to your interests and needs. This requires a user-specific assessment of the relevance of products and content on the website.
We use the personal data to adapt our marketing based on what Egmont Story House AB has determined are relevant offers for you (as described here). We need to share your personal data with Egmont Story House AB for this purpose.
Categories of personal data
· Information about your interests, e.g. browsing history, purchase history as well as information about what products you have marked as “favourites” and which products you show interest in at our website
· Technical about, e.g. device type
· Location of IP address, e.g. the zip code where the IP address is located
Legal basis for the processing
Legitimate interest, GDPR article 6.1.f
The processing is necessary for our legitimate interest in ensuring onsite optimization and personalization for you and other users.
Source of the personal data: The personal data is collected by your use of our website.
Data retention: Your personal data is only used in an aggregated form, i.e. we never store them in a clear format.
Purpose: Marketing and online ads
Market our products by displaying offers and new products we believe you are interested in. We show you personalised marketing on other websites and social media pages you visit.
We may display offers using marketing services from e.g. Meta (Facebook and Instagram), and Google. We do this based on analysis of our website, through cookies or similar technologies, and information that these companies already have about you (so called profiling*).
Categories of personal data
· An encrypted version of your IP-address which we cannot connect to you as an individual
You will see search results and ads based on:
· An analysis of how you use our website
· Information that the marketing services we use have about you from before, e.g., information about from which site you found us
Legal basis for the processing
Consent, GDPR article 6.1.a.
The personal data will be processed based on your consent. You can withdraw such consent at any time. Your withdrawal of consent does not affect the lawfulness of processing, before the withdrawal of consent.
Here on Facebook under the heading “Facebook Ads Controls” you can choose which marketing you want to see from Meta. Here on Instagram you can find more information about your choices. Here you can choose which marketing you want to see on TikTok.
Source of the personal data:
The personal data is collected directly from you, your purchase history, browsing behaviour or from online sources that are publicly available, e.g. social media.
Data retention: You will see marketing from us on other websites and on social media channels for a period of the longest two (2) years after you visit on our website.
The marketing services we use will continue to process your personal data and will be independently responsible. Information on how long they store your personal data can be found in their respective privacy information.
* Profiling: We use so called profiling to be able to show you offers that are relevant to you and to provide you with customized marketing. We use profiling because without it, you would see offers and information which you probably are not interested in. You have the right to object to profiling as described below under the section explaining your rights.
Purpose: User Analytics & Optimization of user experience on website
Analyse how you use our websites with the help of cookies. We do this to improve the functionality of our websites, to customise our websites to suit our visitors and to draw conclusions about how our users generally interact with our offerings.
To do this we mainly use an analytic service from Google Analytics. The analytic service means that Google place a random ID on your device to distinguish your device from other visitors and to acknowledge patterns in how our website is used. We are only interested in how visitors interact with us on an aggregate level. We will however not know who you are, and don’t take any measures to find out.
Categories of personal data
· An encrypted version of your IP- address which we cannot connect to you as an individual
· Information about how you use our websites, such as what you click on, how long you stay on our websites and information about how many times your device has visited our websites, which allows us to count the total number of visitors to our websites
· Which area in the country you use our website from
· Information about your device/browser (e.g., which screen resolution you have)
· Other information Google have about you, e.g., information about from which site you found us
Legal basis for the processing
Consent, GDPR article 6.1.a.
For the personal data we process to analyse your use of our websites, we obtain your consent when you visit our websites.
You have the right to withdraw your consent at any time. Your withdrawal of consent does not affect the lawfulness of processing before consent is withdrawn.
You can avoid Google Analytics by, for example, downloading and installing this browser application.
Source of the personal data: The personal data is collected by your use of our website.
Data retention: We will continue to use your personal data only in some sort of anonymised form after your visit on our website. Google will continue to use your personal data for their own purposes and Google will inform you separately about their use.
Purpose: Necessary functionality for the website to work
Ensure that our website functions properly and securely and remember your choices.
Categories of personal data
· Information about your device, such as IP address and the type of device you use (mobile, computer or tablet)
· Your geographical location (to save your language and currency preferences)
· Any information about your choices on the website, such as which products you added to your basket or marked as liked or your consent choice, including information about when you responded to our consent
Legal basis for the processing
Legitimate interest, GDPR article 6.1.f
The processing is necessary for our legitimate interest to provide a well-functioning website
.
The processing is also necessary for our legitimate interest to remember your choices.
Source of the personal data: The personal data is collected by your use of our website.
Data retention: Personal data ceases to be used when you close your browser. We never "store" it with us.
The personal data collected to remember your choices is used for a maximum of six (6) months after you have done your choice, thereafter we ask you again.
Processing by Egmont Story House AB
Purpose: Determine the most relevant offers to show you in newsletters and ads based on your website visits and purchases made from companies within the Story House Egmont Group
Royal Design is a part of the Story House Egmont Group. To be able to provide you with as relevant offers as possible, Egmont Story House AB processes information about how you have used the website and your purchases to determine what offers that is relevant to show you in newsletters and ads (profiling*). For this purpose, Egmont Story House AB also uses information from other companies within the Story House Egmont Group.
We have determined that this processing is safer than to handle this type of profiling through a third party. Instead, we keep the personal data within the Story House Egmont Group. To further protect your personal data, we have set up relevant technical and organizational security measures – the most important being that your personal data from Royal Design is handled separately from personal data which Egmont Story House AB receives from other companies within the Story House Egmont Group.
Other companies within the Story House Egmont Group will not receive any of your personal data from Egmont Story House AB in clear text. The personal data is only used to add clues and conclusions regarding the offers that you probably will be interested in.
Egmont Story House AB is responsible (data controller) for the processing of personal data described in this table.
Categories of personal data
· Information about your interests, e.g. browsing history, purchase history as well as information about what products you have marked as “favourites” and which products you show interest in at our website
· Demographic data
· Shipping address chosen by you as a customer
· Purchase history from other companies within the Story House Egmont Group
Legal basis for the processing
Legitimate interest, GDPR article 6.1.f
The processing is necessary for our legitimate interest in determining the most relevant offers for you.
Source of the personal data: The personal data is collected through your use of the website together with profile data and purchase history from Royal Design and other companies within the Story House Egmont Group.
Data retention: We delete the personal data regularly.
* Profiling: Egmont Story House AB use so called profiling to be able to determine the most relevant offers for you. Without the profiling, you would see and receive offers which you probably are not interested in. You have the right to object to profiling as described below under the section explaining your rights.
If you participate in a competition
Purpose: Participation in competitions
We process your personal data when you register for one of our competitions to manage your participation and to be able to contact you if you win the competition.
Categories of personal data
· Name
· Phone number
· Information provided in the competition entries
Legal basis for the processing
Legitimate interest, GDPR article 6.1.f.
The processing is based on our legitimate interest in administering your participation in a competition.
Source of the personal data: The personal data is collected directly from you.
Data retention: We will retain personal data processed for this purpose for 36 months after the competition you participated in has been concluded.
If you subscribe to our newsletters
Purpose: Send newsletters
· We send information via email about news, marketing, offers, discounts and invitations (“newsletters”) to you if you have chosen to subscribe to our newsletters. For example, if you sign up at our website or if you sign up when you make a purchase from a company in the Story House Egmont Group.
· We use data from your previous orders and browsing activity to tailor individual product recommendations based on your interests, so called profiling*
· We improve and develop our newsletters by analysing how you open them and what you click on in the newsletters. However, we always perform such analysis on an aggregate level and therefore do not look at how you specifically interact with our newsletters.
Categories of personal data
To send you newsletters
· Name
To tailor our newsletters to your interests (profiling)
· Browsing history
· Purchase history
· Device type
· Location of IP address, e.g. the zip code where the IP address is located
· Shipping address chosen by you as a customer
· Information regarding which products you show interest in at our website
· Demographic data
To improve our newsletters
· Name
· Information about how you open our newsletters and what you click on
· IP-address
Legal basis for the processing
Consent, GDPR article 6.1.a.
The personal data will be processed based on your consent. You can withdraw such consent at any time or unsubscribe to our newsletters. Your withdrawal of consent does not affect the lawfulness of processing before the withdrawal of consent.
Source of the personal data: The personal data is collected directly from you.
Data retention: You continue to receive our newsletters until you opt out (object) or withdraw your consent. If you object or withdraw your consent, your contact information will be stored in our unsubscribe register until further notice, see below.
* Profiling: We use so called profiling to be able to show you offers that are relevant to you and to provide you with customized newsletters. We use profiling because without it, you would see offers and information which you probably are not interested in. You have the right to object to profiling as described below under the section explaining your rights.
Purpose: To comply with marketing legislation
If you have told us that you do not wish to receive marketing, we will store your email address and phone number in an "unsubscribe register" to ensure that we do not market to you. This is not personal data we actively handle, so we do not look at your contact information and do not use it for anything else.
Categories of personal data
· Name
· Phone number
· Information that you no longer wish to receive marketing from us or that you have withdrawn your consent to marketing.
Legal basis for the processing
Legal obligation, GDPR article 6.1c.
The processing is necessary to comply with legal obligations to which we are subject, i.e., marketing law which requires us to not send marketing material to individuals who have objected to receiving such marketing.
We cannot make sure you will not receive marketing from us without processing your personal data for this purpose and you are therefore required to provide your personal data to us.
Source of the personal data: The personal data is collected directly from you.
Data retention: You will be listed in our “unsubscribe-list” until further notice.
If we communicate
Purpose: Providing customer service and communicate with you
We process your personal data when you contact us through our customer service or if we need to contact you e.g. to recall any products, inform about significant changes to this Privacy Policy, when you sign up for information on specific products etc.
Categories of personal data
· Name
· Phone number
· Other information you provide to us
· If you contact us through social media (e.g. our Facebook), we also process information from your profile (username and the picture you have chosen on your account)
Legal basis for the processing
Legitimate interest, GDPR article 6.1.f.
The processing is based on our legitimate interest in being able to respond to your inquiry or request or to inform you about matters of importance.
Source of the personal data: The personal data are collected directly from you.
Data retention: We will retain personal data processed for this purpose for as long as you are deemed a customer of ours and until the matter is handled. Thereafter we will continue to process your personal data for a maximum of 36 months.
Purpose: Improve our customer service provided via phone
We process your personal data and record your call with us when you contact our customer service by phone. We do this for quality and training purposes.
Categories of personal data
· Information you provide to us during our communication, e.g., name and order number
Legal basis for the processing
Consent, GDPR article 6.1.a.
Recording of your telephone conversation will be based on your consent.
Source of the personal data: We receive the personal data directly from you during our phone call.
Data retention: We will retain recorded telephone conversations for 3 months.
To handle complaints, cancellations, claims and fraud
Purpose: Handle any complaints, claim and your legal rights
We use your personal data to handle any complaints, claims and your legal rights, e.g. the right of withdrawal.
Categories of personal data
· Name
· Contact details
· Information from our communication with you in relation to the complaint, claim or your legal rights, e.g. order number and other information about your purchase
Necessary for the performance of the contract between you and us, GDPR article 6.1.b.
Processing is necessary for the performance of our contract.
Legal basis for the processing
Legal obligation, GDPR article 6.1c.
When your claim follows from your legal rights, such as requests of withdrawal or complaint, the processing is also necessary for us to be able to act in accordance with consumer law and therefore to comply with a legal obligation.
Legitimate interest, GDPR article 6.1.f.,
The processing is based on our legitimate interest in handling complaints or claims, including protecting other users and ourselves against any claims.
Source of the personal data: We receive the personal data directly from you in connection with your contact and/or purchases.
Data retention: We will retain personal data processed for this purpose for 24 months, unless a claim or complaint comes to our attention or you use your legal rights, where we will retain the personal data for as long as the matter is ongoing.
Purpose: Anti-fraud
We use data to detect and prevent fraud (such as the misuse of offers).
Categories of personal data
· Information to identify you if you try to purchase from us again, i.e. name, email addresses and delivery address
· information about your purchases
· information about your account
Legal basis for the processing
Legitimate interest, GDPR article 6.1.f.,
The processing is based on our legitimate interest in protecting other users and ourselves against fraud and fraud attempts.
Source of the personal data: We receive the personal data directly from you in connection with your contact and/or purchases.
Data retention: We will retain personal data processed for this purpose for 24 months after a purchase, unless a fraud attempt is detected, in which case we will retain the personal data for as long as it is ongoing.
Who can gain access to your personal data and why?
As a main rule, your personal data is processed by us at Royal Design. Any sharing of your personal data outside the EU/EEA is made to trusted subsidiaries, partners and suppliers as described below. We always want to be transparent and make you feel sake, do not hesitate to contact us if you would like more information about how we share your personal data.
Transfer of personal data takes place in accordance with applicable data protection legislation, including by entering into data processing agreements with our data processor in order to ensure that personal data is processed solely for the stated purposes and ensure appropriate security measures.
Transfer of personal data in specific situations
· If you use our website and have given your consent, the following parties will process your personal data:
- The service we use to analyse the website (mainly Google), and
- The companies which provide the marketing services we use, such as Google (including YouTube), Microsoft, Meta, Pinterest, TikTok, and similar services.
These recipients process personal data on our behalf as our data processors but also process your personal data as independent data controllers. These providers will inform you separately about the personal data processing they are responsible for themselves. Click on the names to read more.
· If you make a purchase with us:
- Your personal data will be processed by the payment service provider you choose in the checkout, e.g. Klarna. The payment provider is independently responsible for the processing of your personal data and will inform you separately about how your personal data is processed.
- Your personal data will be processed by the carrier of your choice, indicated in the selection you make at checkout. The carrier is independently responsible for the processing of your personal data and will inform you separately about how your personal data is processed.
- We will store information necessary to comply with bookkeeping and accounting law with the use of a company that helps us archive such information. The information contains personal data but will only be processed on our behalf and on our instructions as stated in the parties’ data processing agreement.
· When Egmont Story House AB processes your personal data after a visit to the website and a purchase, Royal Design shares your personal data with Egmont Story House AB which is independently responsible (data controller) when processing your personal data. The processing is done to provide the companies within the Story House Egmont Group with conclusions regarding which offers you are interested in. Personal data is not shared with other companies within the Story House Egmont Group. Instead, Egmont Story House AB only share conclusions with the other companies in the Story House Egmont Group.
· If you receive our newsletters, we will share your personal data with the company which helps us send newsletters. The information contains personal data but will only be processed on our behalf and on our instructions as stated in the parties’ data processing agreement.
· If you interact with us on social media or visit our social media accounts, the social media platform that you use will process personal data about you as a user. The social media platforms are independently responsible for the processing of your personal data and will inform you separately about how they process your personal data.
Transfer of personal data in general
· Our IT suppliers will get access to personal data within our systems. However, these suppliers only process the personal data on our behalf and on our instructions to ensure good and secure IT operations. We only share your personal data with our IT suppliers if it is necessary for them to fulfil their obligations towards us according to the contract that we have with them and the data processing agreement. If you only use our social media platforms, our IT suppliers will not process your personal data.
· Roayl Design Group AB is a company within the Story House Egmont Group that consists of multiple companies. Within the Story House Egmont Group, many systems and technologies are shared. Therefore, our owner Egmont Story House AB has access to your information, to fulfil our contractual and legal obligations or to perform their respective functions within the Story House Egmont Group. We do this to be able to ensure a good and efficient business operation.
Transfer of personal data to countries outside the EU/EEA
As a general principle, we only process your personal data within the EU/EEA. If your personal data is processed outside the EU/EEA, we will make sure that such processing is either based on a decision from the EU Commission establishing that the country in question ensures an adequate level of protection or appropriate safeguards that ensure that your rights are protected or if we conclude that such processing can be based on another ground for transfer in accordance with GDPR.
Your personal data will be transferred outside the EU/EEA in the following cases:
· To our IT-suppliers that are located outside of the EU/EEA. However, to protect your personal data and minimize the risk of it being transferred outside the EU/EEA, we ensure that your personal data is stored exclusively on servers of our IT suppliers that are situated within the EU/EEA.
· If you visit and communicate with us on our social media channels (e.g. Facebook and YouTube), your personal data will be transferred outside the EU/EEA. One reason being that many of these companies are based in the United States.
· If you visit our websites and have consented to analytics and marketing, your personal data may be transferred outside the EU/EEA to the companies which provide the service to analyse the website and provide the marketing services, e.g. Google (including YouTube), Microsoft, Meta, Pinterest and TikTok.
We also rely on an adequacy decision regarding most transfers to the US, when our American suppliers are certified under the EU-US Data Privacy Framework. You can find the adequacy decision for the US here. For example Google and Meta are certified under the EU-US Data Privacy Framework. You can find their certifications by searching for their names on the Data Privacy Framework website.
In the absence of an adequacy decision, or when our transfer is not protected under an adequacy decision, we and our suppliers will instead rely on Standard Contractual Clauses (Article 46.2 c GDPR) module 1 and module 2, and supplementary security measures for the transfer of personal data outside of the EU/EEA. We will rely on the Standard Contractual Clauses when your personal data is processed through for example TikTok which can transfer your personal data to China. The use of Standard Contractual Clauses is an effort to provide a safe transfer of your personal data. You can find the Standard Contractual Clauses here.
If you want to know more about wher your personal data will be processed, please feel free to contact us.
Balancing of interests assessments when processing personal data based on the legal basis “legitimate interests”
As we state in the tables above, for some purposes, we process your personal data based on our “legitimate interest”. By carrying out a balancing of interests’ assessment concerning our processing of your personal data, we have concluded that our legitimate interest for the processing outweighs your interests or rights which require the protection of your personal data.
If you want more information in relation to our balancing of interests’ assessments, please do not hesitate to contact us. Our contact information can be found at the beginning of this Privacy Policy.
Securing your personal data
We will take care of your personal data by taking the necessary technical and organizational security measures against the information being accidentally or illegally destroyed, lost or impaired, as well as against it coming to the knowledge of unauthorized persons, being misused or otherwise processed in violation of the data protection legislation in force at any time.
Your rights
In accordance with the GDPR, you have certain rights that you can exercise to affect how we process your personal data– see below for more information.
If you have any questions regarding your rights or want to exercise any of your rights, please contact us by using the contact details above. You can also find more detailed information about your rights and when they apply at The Swedish Authority for Privacy Protection (IMY).
For the processing which Egmont Story House AB is responsible for, the following rights apply: the right to complain, the right of access, the right to object, the right to rectification, the right to erasure and the right to restriction of processing.
Right to complain – Article 77 of the GDPR
You have the right to lodge a complaint with the competent supervisory authority if you consider that the processing of your personal data violates the GDPR. In Sweden, the competent supervisory authority is The Swedish Authority for Privacy Protection (IMY).
· In Norway, the competent supervisory authority is Datatilsynet.
· In Finland, the competent supervisory authority is Dataombudsmannens byrå/Tietosuojavaltuutettu.
· In Denmark, the competent supervisory authority is Datatilsynet.
Right to withdraw your consent – Article 7.3 of the GDPR
You have the right to withdraw your consent at any time by contacting us. You can always withdraw any consent you give on the website directly on the website.
Right of access – Article 15 of the GDPR
You have the right to obtain confirmation as to whether we are processing your personal data or not. You can make a request by contacting us. If we are processing your personal data, you also have the right to obtain a copy of the personal data processed by us as well as information about our processing, such as the purposes of the processing and for how long your personal data is stored.
Right to object – Article 21 of the GDPR
You have the right to at any time object to our processing of your personal data for direct marketing purposes (including profiling) and to processing of your personal data that is based on a legitimate interest (including profiling).
Right to rectification of processing – Article 16 of the GDPR
You have the right to have inaccurate personal data concerning you rectified without undue delay. You also have the right to have incomplete personal data completed.
Right to erasure (“the right to be forgotten”) – Article 17 of the GDPR
Under certain conditions, you have the right to have your personal data erased by us without undue delay. For example, if you withdraw your consent and there is no other legal basis for the processing or if the personal data is no longer necessary for the purposes for which they were collected or processed.
Right to restriction of processing – Article 18 of the GDPR
Under certain conditions, you have the right to request that we restrict our processing of your personal data. For example, if you contest the accuracy of the personal data, or if the processing is unlawful and you oppose the erasure of the personal data and instead request the restriction on the use of the personal data.
Right to data portability – Article 20 of the GDPR
If we process your personal data based on your consent or to fulfil a contract, you have the right to receive personal data concerning you. This right applies to personal data that you have provided to us in a structured, commonly used and machine-readable format. You also have the right to transmit those personal data to another controller, where technically feasible.
Updating the Privacy Policy
We may update or change this Privacy Policy. Please note that we will, in case we make any substantial or material changes, inform you prior to those changes entering into force.
The privacy policy was last updated on January 10, 2024.