Privacy Policy

Your privacy is important to us. This privacy policy explains how Jewellery by Märta Hillfon collects, uses, and protects your personal data in accordance with the EU General Data Protection Regulation (GDPR).

1. Data Controller

The data controller for the processing of your personal data is:

Märta Hillfon (Sole Proprietorship)
Organisation number: 840712-3606
VAT number: SE840712360601
Address: Olserödsvägen 138, 297 95 Degeberga, Sweden
Email: martahillfon@gmail.com

2. What Data We Collect

We collect the following personal data when you shop with us or use our website:

When Making a Purchase

• Name and contact details (email, phone number)
• Delivery address and billing address
• Order history and purchase information
• Payment details, which are handled by our checkout provider Kustom. We never see or store your card number or bank details.

When Visiting the Website

• IP address, browser and device information, which are recorded in the server logs of our hosting provider every time a page is requested
• Technical details about errors, if something goes wrong while you are using the site (page, browser, and the error message itself)
• A small number of cookies and browser storage entries, listed in full in section 7
• Anonymous, aggregated visitor statistics and, in the event of an error, a recording of the last moments before it – but only if you have accepted this in the cookie banner

When Subscribing to Newsletter

• Your email address. The sign-up form asks for nothing else, and the address is stored as a subscriber record in Shopify

3. How We Use Your Data

We process your personal data for the following purposes:

Fulfilling Agreements (Legal Basis: Contract)

• Processing and delivering your order
• Communicating with you about your order
• Handling returns and complaints
• Invoicing and payment

Legal Obligations (Legal Basis: Law)

• Accounting and tax purposes
• Compliance with consumer legislation

Running and Securing the Website (Legal Basis: Legitimate Interest)

• Delivering the website and keeping server logs so that pages, images and orders can be served to you
• Detecting and fixing technical errors so that the shop keeps working. Error reports are collected automatically when something breaks
• Protecting the site against abuse, such as limiting how often the contact and newsletter forms can be submitted from the same IP address
• Remembering the country and currency you are shopping in, so that prices and shipping are shown correctly

Our interest in these purposes is to be able to run a functioning, secure web shop. We only process what is needed for that, and you can object to this processing (see section 5).

Marketing (Legal Basis: Consent)

• Sending newsletters and offers if you have signed up for them

Statistics and Session Replay (Legal Basis: Consent)

• Anonymous visitor statistics, so that we can see which pages are used and improve them
• Session replay, which records the last moments before an error occurs so that we can reproduce and fix the problem
• Neither of these is activated until you choose “Accept All” in the cookie banner, and you can change your mind at any time (see section 7)

4. Sharing with Third Parties

We never sell your personal data. We do share it with the suppliers below, who process it on our behalf so that the shop can work. Each of them is bound by a data processing agreement, unless stated otherwise. Most of the data stays within the EU/EEA. Where a supplier is established outside the EU/EEA – Vercel and Resend in the United States – the transfer is based on the European Commission's standard contractual clauses together with additional technical safeguards such as encryption in transit and at rest.

Shopify – e-commerce platform

Shopify is the platform behind our products, shopping cart, customer accounts and orders. It receives your name, email address, delivery and billing address, order history and, if you subscribe, your newsletter sign-up. Data is stored on Shopify's servers; Shopify Inc. is based in Canada, which the European Commission has recognised as offering an adequate level of data protection, and transfers to other countries outside the EU/EEA are covered by standard contractual clauses. Legal basis: performance of a contract, and consent for the newsletter. Read Shopify's Privacy Policy

Kustom – checkout and payments

All payments are made through Kustom Checkout (formerly Klarna Checkout). Kustom receives your name, email address, phone number, billing and delivery address and the contents and amount of your order in order to process the payment. Payment data is processed within the EU/EEA. Some payment methods in the checkout are provided by Klarna Bank AB (publ), Sweden. For those methods Klarna Bank AB is the data controller for its own part of the processing, including any identity or credit checks, and handles your data under its own privacy policy. Legal basis: performance of a contract, and for Klarna Bank AB also legal obligations under financial regulations. Read Klarna's Privacy Policy

Shipping Carriers

To deliver your order, we share your name, delivery address and contact details with our shipping partners (PostNord, DHL). They process the data within the EU/EEA, and outside the EU when your parcel is delivered there. Legal basis: performance of a contract.

Vercel – hosting

The website is hosted by Vercel. Every time you load a page, Vercel processes your IP address, browser type and the address of the page you requested, in server logs used for delivery, performance and security. Pages are served from Vercel's European infrastructure, but Vercel Inc. is established in the United States, so the transfer is covered by the EU Commission's standard contractual clauses in our data processing agreement. Legal basis: legitimate interest in delivering and securing the website. Read Vercel's Privacy Policy

Sentry – error monitoring

Sentry collects technical error reports when something goes wrong on the site: the error message, the page you were on, your browser and device type and your IP address. We use Sentry's EU region, so the data is stored in Frankfurt, Germany, and is not transferred outside the EU. If – and only if – you have chosen “Accept All” in the cookie banner, Sentry also saves a session replay: a reconstruction of the last moments before the error, so that we can see what went wrong. Legal basis: legitimate interest in a working, secure shop for the error reports, and consent for the session replay. Read Sentry's Privacy Policy

Fathom Analytics – visitor statistics

Fathom Analytics gives us anonymous, aggregated statistics about which pages are visited. Fathom is cookie-free, does not create a profile of you and does not store your IP address. It is provided by Conva Ventures Inc. in Canada, a country the European Commission has recognised as offering an adequate level of data protection. Statistics are only loaded after you have chosen “Accept All” in the cookie banner. Legal basis: consent. Read Fathom's Privacy Policy

Resend – email delivery

When you use our contact form, the message is delivered to us by email through Resend. Resend processes your name, email address and the content of your message. Resend Inc. is established in the United States, so the transfer outside the EU/EEA is covered by the EU Commission's standard contractual clauses in our data processing agreement. Legal basis: legitimate interest in being able to answer enquiries, and performance of a contract when the message concerns an order. Read Resend's Privacy Policy

Other Services

Typefaces from Google Fonts are downloaded when we build the site and are served from our own domain, so your browser never contacts Google. Exchange rates for prices shown in euro are fetched by our server from the Frankfurter API, which is based on European Central Bank rates – no data about you is sent there.

5. Your Rights Under GDPR

As a data subject, you have the following rights:

• Right of Access - You can request a copy of the personal data we hold about you.
• Right to Rectification - You can request that incorrect data be corrected.
• Right to Erasure - You can request that your data be deleted (with certain exceptions, e.g., accounting requirements).
• Right to Restriction - You can request that the processing of your data be restricted.
• Right to Data Portability - You can request to receive your data in a machine-readable format.
• Right to Object - You can object to processing based on legitimate interest.
• Right to Withdraw Consent - You can withdraw consent at any time, e.g., for newsletters, statistics or session replay. Withdrawing consent does not affect processing carried out before you did so.
• Right to Complain - You can lodge a complaint with the Swedish supervisory authority, IMY (see section 9).

To exercise your rights, contact us at martahillfon@gmail.com. We will respond to your request within 30 days, and the service is free of charge.

6. How Long We Keep Your Data

We retain your personal data only as long as necessary for the purposes for which it was collected:

• Order and accounting information: 7 years, as required by Swedish accounting law
• Customer account: Until you ask us to delete it
• Newsletter subscription: Until you unsubscribe or ask to be removed
• Contact form messages: For as long as we need them to handle your enquiry and any follow-up questions
• Error reports and session replays in Sentry: Deleted automatically after 90 days, in line with Sentry's standard retention
• Server logs at our hosting provider Vercel: Kept for a short period, a few days at most, and then deleted automatically
• Cookies and browser storage: See section 7

7. Cookies

We use as few cookies as possible. Below is the complete list of what we store in your browser and why.

Necessary Cookies

These are needed for the shop to work and are set without consent. They are not used for tracking or marketing.

• cookie_consent - Remembers the choice you made in the cookie banner, so you are not asked again. Stored for 12 months.
• country - The country you are shopping from, which determines shipping options and the currency shown. Stored for 12 months.
• currency and currency_manual - The currency displayed, and whether you selected it yourself rather than letting us suggest one. Stored for 12 months.
• mh_customer_token - Keeps you signed in to your customer account. It is an HttpOnly cookie, which means scripts in your browser cannot read it. It is removed when you sign out or when the session expires.

We also store two entries in your browser's local storage: shopify_cart_id, which links your browser to your shopping cart so it survives a page reload, and preferred_currency, which remembers your currency choice. They stay until you clear your browser data.

On the checkout page the payment form is loaded from Kustom. Kustom may set its own cookies there, which are necessary for the payment to work and are described in Kustom's and Klarna's own privacy policies. We have no access to them.

Statistics and Session Replay (Only With Your Consent)

If you choose “Accept All” in the cookie banner, we also load anonymous visitor statistics from Fathom Analytics and session replay from Sentry. Fathom sets no cookies at all. Sentry's session replay is kept in your browser's session storage and is only sent to us when an error occurs. Neither of them is loaded if you choose “Necessary Only” or make no choice at all.

Changing Your Mind

You can change your choice at any time by deleting the cookies for this site in your browser settings. The cookie banner then appears again and you can make a new choice, which takes effect immediately. You can also email us at martahillfon@gmail.com and we will help you. Please note that if you block the necessary cookies listed above, the shopping cart, sign-in and currency selection will stop working.

8. Security

We take appropriate technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. All communication with our website is via encrypted connection (HTTPS).

9. Complaints to Supervisory Authority

If you believe we are processing your personal data incorrectly, you have the right to file a complaint with the Swedish Authority for Privacy Protection (IMY):

Swedish Authority for Privacy Protection (IMY)
Box 8114, 104 20 Stockholm, Sweden
www.imy.se

10. Contact

Do you have questions about our privacy policy or how we handle your personal data? Contact us:

Email: martahillfon@gmail.com
Address: Olserödsvägen 138, 297 95 Degeberga, Sweden