Privacy policy

We care about your privacy. Here we describe what personal data we process, why, for how long, and your rights under the General Data Protection Regulation (GDPR).

Last updated: 2026-04-15

Data controller

What data we collect

• Contact and delivery details: name, address, postcode, town, email and phone number – so that we can deliver your order.
• Order details: products, size, chosen design and order number.
• Payment details: the phone number used for the Swish payment. The account information itself is handled by Swish and your bank, not by us.
• Correspondence: the contents of emails and messages you send us.
• Technical data: IP address, browser type, device and how you use the site – through cookies, and only if you consent.

Purpose and legal basis

• Performance of the purchase contract (art. 6(1)(b) GDPR): taking payment, producing and delivering the order, handling complaints.
• Legal obligation (art. 6(1)(c) GDPR): accounting under the Swedish Accounting Act (7 years).
• Legitimate interest (art. 6(1)(f) GDPR): security, fraud prevention and basic customer service.
• Consent (art. 6(1)(a) GDPR): analytics cookies, marketing cookies and any newsletter. You can withdraw your consent at any time.

Recipients of data

To be able to deliver the service we share data with processors acting on our behalf:

• Payment: Swish (Getswish AB) handles the transaction.
• Shipping:PostNord for delivery.
• Printing and production: tryckpartner i Sverige.
• IT operations and hosting: cloud providers within the EU/EEA.
• Analytics and advertising: Google (Analytics, Ads), Meta and Microsoft (Clarity, for anonymised session recordings) – only if you have consented to cookies.

We never sell your personal data. If a supplier processes data outside the EU/EEA, it is done under lawful transfer mechanisms (for example the EU standard contractual clauses).

Retention period

• Order data: for as long as it is needed to handle the order and any complaints.
• Accounting records: 7 years, as required by the Swedish Accounting Act (bokföringslagen).
• Support correspondence: up to 24 months.
• Analytics data via cookies: according to your cookie settings, normally up to 14 months.

Your rights

Under the GDPR you have the right to request access to, correction of or erasure of your personal data, the right to restrict or object to processing, the right to data portability, and the right to withdraw your consent. Contact us at support@pinshirt.me if you would like to exercise any of these rights.

You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), www.imy.se.

Cookies

We use necessary cookies to make the site work and, if you consent, analytics and marketing cookies (including Google Analytics, Microsoft Clarity and Meta). You can change your choices in the cookie banner at any time.

Changes to this policy

We may update this policy. The latest version is always on this page, with the date stated.