Privatumo strategija

Effective from: 4 November 2026 · Version: 1.4

This Privacy Policy describes how Valeryd AB ("Valeryd", "we", "us") collects, uses, stores and protects your personal data when you visit our websites, place an order, contact our customer service or otherwise interact with us.

We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and other applicable data protection legislation.

1. Data controller

The controller responsible for the processing of your personal data is:

Valeryd AB
Company registration number: 556413-0242
Lindbladsvägen 4B
447 37 Vårgårda, Sweden
Phone: +46 512 81920
Email: info@valeryd.se

2. Personal data we collect

We collect personal data directly from you and, in some cases, from other sources, such as our payment providers and shipping partners. This can include payment status, transaction references, shipment status and delivery updates. We process only the data we need for the purposes described below. Where we receive personal data from a source other than you, we give you the information that Article 14 GDPR requires.

2.1 Information you provide to us

• Name, address, postal code, city, country
• Email address and phone number
• Information you provide in customer service matters or complaints

2.2 Information generated at the time of purchase

• Order history and product choices
• Payment method and limited payment information, such as payment status and transaction references. Full card details are handled by the payment provider and are not stored by Valeryd
• Delivery address and shipping information
• Returns and complaints

2.3 Information collected automatically

• IP address
• Browser and device information
• Information about how you use our website (pages you visit, clicks, searches)
• Cookies and similar technologies (see section 8)

2.4 Which data you must provide

To place an order and enter into the purchase agreement, you must provide the data marked as required at checkout, such as your name, delivery address and necessary contact details. Without them we may not be able to process or deliver your order. Some data we must also process to comply with legal obligations, in particular accounting and tax rules. Providing data for marketing, newsletters or optional cookies is voluntary and is not a condition for buying from us.

3. Why we process your personal data

We process your personal data for the following purposes, on the stated legal basis:

3.1 Managing your order and fulfilling the purchase agreement

Purpose: To process your order, deliver products, handle payment, returns and complaints, and communicate with you about your order.
Legal basis: Performance of a contract (Article 6(1)(b) GDPR).
Data: Name, address, contact details, order information, payment method.

3.2 Accounting and bookkeeping

Purpose: To comply with our legal obligations under the Swedish Bookkeeping Act (1999:1078) and other legislation.
Legal basis: Legal obligation (Article 6(1)(c) GDPR).
Data: Invoice and payment details, order number.
Retention period: until the end of the seventh year after the end of the calendar year in which the financial year ended, under the Swedish Bookkeeping Act.

3.3 Customer service and support

Purpose: To answer your questions and handle your matters.
Legal basis: Legitimate interest (Article 6(1)(f) GDPR) — our interest in providing good customer service.

3.4 Marketing and newsletters

Purpose: To send you offers, product recommendations, campaigns and newsletters by email and SMS. Product recommendations are based on what you have previously bought from us, for example accessories for a product you have bought.
Legal basis: Marketing by email and SMS is based on your consent (Article 6(1)(a) GDPR and applicable rules on electronic direct marketing).

You may withdraw your consent or object to direct marketing at any time by clicking the unsubscribe link in the communication or by contacting us.

3.5 Improvement of our website and services

Purpose: To analyse the use of our websites and improve them. We use Google Analytics for visitor statistics and Microsoft Clarity to see how our pages are used (heatmaps and session recordings). Both are only used if you consent to statistics cookies.
Legal basis: Consent (Article 6(1)(a) GDPR).

3.6 Fraud prevention and IT security

Purpose: To protect our systems and customers against fraud, misuse and unauthorised use.
Legal basis: Legitimate interest (Article 6(1)(f) GDPR) — our interest in protecting our systems, operations and customers against fraud and misuse.

3.7 Handling disputes and legal claims

Purpose: To handle disputes and to establish, exercise or defend legal claims.
Legal basis: Legitimate interest (Article 6(1)(f) GDPR), namely our interest in protecting our legal rights and being able to establish, exercise or defend legal claims.

3.8 Reviews and customer feedback after purchase

Purpose: After delivery, to send a limited request to rate or review the product you have bought, in order to follow up on your experience and improve our products and services. The request contains no offers.
Legal basis: Your consent (Article 6(1)(a) GDPR), together with the applicable rules on electronic messages. We send review requests only to customers who have agreed to receive them at checkout.
Data: Email address, phone number (for SMS, where you have consented) and order information.

You may withdraw your consent at any time, with effect for the future, via the link in the message or by contacting us.

3.9 Online withdrawal function

Purpose: To receive and process withdrawal statements made through our online withdrawal function, to send you an acknowledgement of receipt, and to keep the information needed to follow up your request.
Legal basis: Legal obligation (Article 6(1)(c) GDPR) for receiving and confirming the withdrawal, and legitimate interest (Article 6(1)(f) GDPR) for keeping the evidence needed to establish, exercise or defend legal claims.
Data: Name, email address, order number, the products concerned, any information you choose to add, and technical data needed to run and secure the form.

4. How long we retain your personal data

We retain your personal data only for as long as necessary for the purposes for which it was collected, or for as long as required by law.

• Accounting records: until the end of the seventh year after the end of the calendar year in which the financial year ended, under the Bookkeeping Act
• Order information and customer account: for as long as the customer relationship lasts, and afterwards for as long as needed to handle returns and complaints and to establish, exercise or defend legal claims, unless a longer period is required by law
• Marketing (consent): for as long as your consent is valid and the data is needed for marketing. If you withdraw your consent or object, we stop the marketing and keep only what is needed to respect your choice
• Customer service matters: for as long as needed to handle the matter and for a reasonable time afterwards
• Complaints and claims: for as long as needed to handle the matter and afterwards for as long as necessary to establish, exercise or defend legal claims, taking the applicable limitation periods into account
• Cookies: as specified separately in the cookie policy
• Records covered by the EU One Stop Shop (OSS) VAT scheme: where a transaction is covered by this scheme, we keep the required records for ten years from the end of the calendar year in which the transaction took place.

5. Who we share your personal data with

We share your personal data with the following categories of recipients where necessary to fulfil our purposes:

5.1 Data processors (process data on our behalf)

• Shopify — provides our e-commerce platform and processes customer data on our behalf as a processor for its core store services
• Cookiebot (Usercentrics) — records and manages your cookie choices on our behalf
• Provider of our online withdrawal function (form service)
• Hosting and IT providers
• Email and communication providers
• Email, SMS and marketing platforms for newsletters, review requests and product recommendations (e.g. Klaviyo)
• Business and customer service systems
• Web analytics and user-experience tools (Google Analytics, Microsoft Clarity), used only with your consent to statistics cookies

5.2 Independent controllers

Some providers process personal data for their own purposes and act as independent controllers. Their role depends on the service and on the processing concerned:

• Shopify — acts as an independent controller for certain services, such as Shop and Shop Pay and any additional services that are subject to its own privacy terms. For other store processing, Shopify acts as a processor on our behalf. See Shopify's privacy policy.
• Payment providers such as Stripe — process payments through Shopify Payments, and may act as independent controllers for their own payment, fraud-prevention and legal-obligation processing, depending on the payment method chosen
• Klarna Bank AB — handles payments via Klarna, including pay later and Pay Now (Klarna's own credit checks and invoicing take place at Klarna)
• Apple Pay, Google Pay and Shop Pay — for payments made using those methods
• Carriers and logistics partners such as PostNord and DHL — to the extent they act as independent controllers for transport and delivery of orders

5.3 Authorities

We may disclose personal data to authorities where we are required to do so by law (e.g. the Swedish Tax Agency, the Police Authority).

5.4 Other recipients

• External advisers (lawyers, auditors) where necessary
• In the event of an acquisition or transfer of business, personal data may be transferred to the buyer

6. Transfers outside the EU/EEA

Your personal data is processed within the EU/EEA and, in some cases, may also be transferred to countries outside the EU/EEA. Klaviyo, our email marketing and communications provider, stores customer data in the United States.

For transfers to Klaviyo we rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework, to the extent that decision applies and Klaviyo is certified under that framework. For transfers where that framework does not apply, Klaviyo's data processing agreement provides for the standard contractual clauses approved by the European Commission.

For other transfers outside the EU/EEA we apply the transfer mechanism that is valid for the recipient and the transfer concerned, such as an adequacy decision or appropriate safeguards under Article 46 GDPR.

If you would like to know which countries we transfer your personal data to, which transfer basis and safeguards apply to a specific recipient, or how to obtain a copy of the applicable safeguards, please contact us at info@valeryd.se.

7. Your rights

Under the GDPR you have the following rights:

7.1 Right of access

You have the right to know whether we process personal data about you and, if so, to receive a copy of that data.

7.2 Right to rectification

You have the right to have inaccurate or incomplete personal data corrected.

7.3 Right to erasure ("the right to be forgotten")

You have the right to request that we erase your personal data under certain conditions, e.g. if the data is no longer needed for the purpose for which it was collected.

7.4 Right to restriction of processing

You have the right to request that processing be restricted under certain conditions.

7.5 Right to object

You have the right to object to processing carried out on the basis of legitimate interest, and the right to object to direct marketing at any time.

7.6 Right to data portability

Where the processing is based on your consent or on a contract and is carried out by automated means, you have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, and to have it transferred to another controller where technically feasible.

7.7 Right to withdraw consent

Where processing is based on consent, you have the right to withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

To exercise your rights, please contact us at info@valeryd.se. We normally respond to your request within one month. In complex cases, or where we receive many requests, this period can be extended by up to two further months; we then tell you within the first month and explain why.

8. Cookies

Our websites use cookies and similar technologies. We use Cookiebot (a service from Usercentrics) to manage your consent to cookies. Detailed information about which cookies we use, why, and how you can manage them is available in our cookie policy.

Brief summary:

• Necessary cookies — required for the website to function (e.g. cart, login). Do not require consent.
• Functional/preference cookies — remember your choices and settings.
• Statistics and analytics cookies — help us understand how the website is used.
• Marketing cookies — used for targeted advertising.

For cookies other than strictly necessary ones, we obtain your consent. You can change or withdraw your consent at any time via the cookie settings on the website.

9. Security

We take appropriate technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. These include:

• Encrypted transmission (SSL/TLS) of data between your browser and our servers.
• Access controls so that only staff who need the data for their work have access to it.
• Logging and monitoring of access.
• Regular security updates and reviews.

Valeryd does not store full card numbers or card security codes. Card and payment data is handled by our payment providers in line with the applicable security requirements, including the PCI DSS standard. We may keep limited transaction information, such as payment method, payment status and transaction references, where needed to manage orders, refunds, accounting and legal obligations.

10. Complaints

If you believe that we process your personal data in breach of the GDPR, you have the right to lodge a complaint with the supervisory authority:

Integritetsskyddsmyndigheten (IMY)
Box 8114
104 20 Stockholm, Sweden
Phone: +46 8 657 61 00
Email: imy@imy.se
Web: imy.se

You do not have to contact us first, but we would appreciate it if you do, at info@valeryd.se, so that we have the opportunity to investigate and address your concern. You may also lodge a complaint with the supervisory authority of the EU Member State where you live, work or where the alleged infringement took place.

11. Changes to this policy

We may update this Privacy Policy from time to time. The latest version is always published on our websites. In the event of material changes, we will inform you by email or another appropriate channel.

12. Contact

If you have questions about this Privacy Policy or how we process your personal data, please contact us at:

Valeryd AB
Lindbladsvägen 4B
447 37 Vårgårda, Sweden
Email: info@valeryd.se
Phone: +46 512 81920
Company reg. no: 556413-0242
VAT: SE556413024201

Last updated: 4 November 2026 · Version: 1.4