Powder House Sweden AB ("PH", "we", "us", "our") is committed to protecting your personal data and processing it responsibly and transparently. This policy explains how we collect, use and protect your personal data in accordance with the EU General Data Protection Regulation (GDPR) (EU) 2016/679 and applicable Swedish law.

1. Data Controller

Powder House Sweden AB ("PH")

Hornsgatan 29B, 118 49 Stockholm, Sweden

Contact: support@powderhouse.store

2. Data We Collect

We may collect and process the following categories of personal data:

• Identity and contact data: name, postal address, email address, telephone number
• Transaction data: products purchased, order value, payment method and transaction records
• Payment data: processed securely by our payment providers — we do not store full card details
• Delivery data: delivery address and delivery preferences
• Communications data: records of communications between you and us, including customer service inquiries
• Marketing data: your preferences regarding marketing communications and your interaction with our marketing materials
• Technical data: IP address, browser type, device information, pages visited, time spent on pages, and referring website
• Location data: general location information based on IP address (not precise GPS data)

3. Children's Data

Our Services are not intended for use by children, and we do not knowingly collect personal information from children under the age of majority in their jurisdiction. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@powderhouse.store so that we can delete it.

4. Legal Basis for Processing

We process your personal data on the following legal bases:

• Contract Performance: processing necessary to fulfil your purchase orders and provide customer service
• Legitimate Interests: our legitimate business interests in marketing, fraud prevention, and improving our services
• Consent: where you have explicitly consented to marketing communications or other processing activities
• Legal Obligation: where required by Swedish law or other applicable regulations

5. How We Use Your Data

We use your personal data for the following purposes:

• Processing and fulfilling your orders
• Providing customer service and support
• Sending order confirmations and delivery updates
• Marketing and promotional communications (with your consent)
• Improving our website and services
• Fraud prevention and security
• Complying with legal obligations
• Analysing customer behaviour and preferences to enhance our offerings

6. Data Sharing

We may share your personal data with:

• Payment Processors: to process your payments securely
• Shipping Partners: to deliver your orders
• Customer Service Providers: to assist with customer inquiries
• Marketing Partners: for email marketing and promotional activities (only with your consent)
• Legal Authorities: when required by law or to protect our rights

We do not sell your personal data to third parties.

7. Our Relationship with Shopify

Our website and store are hosted by Shopify Inc., which processes personal information on our behalf to provide and improve the Services. Shopify may also use data collected across its platform, including from your interactions with our store, to provide certain enhanced features. In these circumstances, Shopify acts as an independent data controller for those specific purposes. To learn more about how Shopify processes personal information, you can review the Shopify Consumer Privacy Policy.

8. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes outlined in this policy, or as required by law. Generally:

• Order and transaction data: retained for 7 years (for accounting and tax purposes)
• Customer service records: retained for 3 years
• Marketing data: retained until you unsubscribe
• Technical data: retained for up to 12 months

9. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of Access: you can request a copy of the personal data we hold about you
• Right to Rectification: you can request correction of inaccurate or incomplete data
• Right to Erasure: you can request deletion of your data (subject to legal obligations)
• Right to Restrict Processing: you can request that we limit how your data is used
• Right to Data Portability: you can request your data in a structured, commonly used format
• Right to Object: you can object to marketing communications and certain processing activities
• Right to Withdraw Consent: where we rely on consent to process your personal data, you may withdraw this consent at any time. This will not affect the lawfulness of processing carried out before withdrawal
• Right to Lodge a Complaint: you can file a complaint with the Swedish Data Protection Authority (Integritetsskyddsmyndigheten, IMY) at imy.se

Managing Communication Preferences. You may opt out of receiving promotional emails at any time by using the unsubscribe link included in our marketing emails. If you opt out, you may still receive non-promotional communications from us, such as order confirmations and account-related updates.

Authorised Agents. In accordance with applicable law, you may designate an authorised agent to exercise your rights on your behalf. Before accepting such a request, we may require the agent to provide proof of authorisation, and we may still require you to verify your identity directly with us.

To exercise any of these rights, please contact us at support@powderhouse.store with your request.

10. International Data Transfers

We primarily process data within the EU/EEA. If data is transferred outside this region, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions.

11. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. These measures include:

• Encryption of sensitive data (e.g. payment information)
• Secure server infrastructure
• Regular security audits and updates
• Restricted access to personal data (only authorised personnel)
• Employee training on data protection

However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

12. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your browsing experience. Strictly necessary cookies are always active. Analytics and marketing cookies are only activated with your consent, which you can manage via our cookie settings.

13. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies before providing any personal data.

14. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or applicable laws. We will notify you of significant changes by posting the updated policy on our website and updating the "Last Updated" date.

15. Contact Us

If you have questions about this privacy policy or how we handle your personal data, please contact us at:

Powder House Sweden AB Hornsgatan 29B, 118 49 Stockholm, Sweden Email: support@powderhouse.store