Privacy policy
Last updated 10 September 2026
In short
- We process what we need to deliver your order, keep our accounts and – if you want – send newsletters and show relevant ads.
- Marketing cookies are only used if you accept them.
- We do not sell your personal data.
- You can ask to access, correct or delete your data at any time.
Who is responsible
Poppie Collection AB (reg. no. 559587-2473), Sparregatan 5, 582 21 Linköping, Sweden, is the data controller. Questions about your data: hello@poppiecollection.com.
What we process, why and for how long
When you shop. Name, address, email, phone number, what you bought and payment details. We use them to deliver, handle returns and claims, and provide customer service. Legal basis: our contract with you. We keep them for three years after the purchase, because the right to claim for faults lasts that long. Card details are handled by the payment provider.
Bookkeeping. Receipts and records of the purchase. Legal basis: legal obligation. Kept for seven years under the Swedish Bookkeeping Act.
Customer account. If you create one. Legal basis: our contract with you. Kept until you ask us to delete it.
Customer service. What you write to us. Legal basis: our legitimate interest in helping you. Kept for up to three years after the matter is closed.
Newsletter. Your email address, how you interact with our emails and – if you leave an order unfinished – what was in your cart, so that we can remind you. Legal basis: your consent. Kept until you unsubscribe – the link is in every email.
Reviews. Name or initials, text and images you submit. Legal basis: your consent. Kept until you ask us to remove them.
Security and fraud prevention. IP address, device and payment data. Legal basis: our legitimate interest in protecting you and us. Kept for as long as needed for that purpose.
Where the data comes from
Most of it we receive directly from you, or from your device when you use the website. Some we receive from others: payment providers and carriers (for example whether a payment went through and where your parcel is) and, if you have consented, advertising platforms (for example that you clicked on an ad).
Cookies
Necessary cookies make the cart, checkout and security work and do not require consent. Analytics and marketing cookies – including the Meta and TikTok pixels – are only used if you accept them in the cookie banner. You can change your choice at any time via Cookie settings at the bottom of the page.
For data collected through the Meta and TikTok pixels, we share controllership with each platform. How they then use the data is set out in their own privacy policies.
Who receives your data
We only share what is needed with those who help us run the store:
- Shopify – e-commerce platform and payments
- the payment providers and carriers you choose at checkout
- Klaviyo – email and newsletters
- Loox – reviews
- Meta and TikTok – advertising, only with your consent
- Fortnox – bookkeeping
- Microsoft – email
- authorities, where the law requires it
- whoever takes over the business, if it is sold or transferred
Suppliers who process data on our behalf may only use it to provide their service to us.
Shopify's own processing
The store runs on Shopify. For certain services – such as Shop Pay, the Shop app and features that draw on data from several stores, like fraud prevention – Shopify uses information about how you shop with us and with other stores. In those cases Shopify is itself responsible for the processing. Read more and exercise your rights with Shopify at privacy.shopify.com.
Outside the EU/EEA
Some suppliers, including Shopify, Klaviyo and Meta, may process data outside the EU/EEA. In that case an adequacy decision by the European Commission applies, such as the EU–US Data Privacy Framework, or the EU's standard contractual clauses.
Your rights
You have the right to know what data we hold about you, to have it corrected or deleted, to restrict or object to processing, to receive it in a machine-readable format and to withdraw your consent. Data we are required by law to keep, such as bookkeeping records, cannot be deleted early.
Email hello@poppiecollection.com – we reply within one month. We may need to verify your identity before we disclose, change or delete any data.
If you want to complain, you can contact the Swedish Authority for Privacy Protection (IMY), imy.se, or the data protection authority in your country.
Changes
We update this policy when we change how we process data. The date at the top shows the latest version.