Privacy Policy

This Privacy Policy explains how Dunkelheit Studio collects and processes personal data when you visit our website, make a purchase, contact us or otherwise interact with our online shop.

Under the GDPR, customers must be given clear information about what personal data is collected, why it is used, how long it is retained, who receives it, the legal basis for processing and their rights. IMY

1. Data Controller

The data controller is:

Dunkelheit Studio
Skarpnäcks torg 5
128 33 Skarpnäck, Sweden
Organisation number: 9212260906
Email: studiodunkelheit@gmail.com
Phone: +46 73 901 22 84

2. Personal Data We May Collect

Depending on how you use our website, we may process information such as:

  • Name

  • Billing and delivery address

  • Email address

  • Telephone number

  • Order and purchase history

  • Payment-related information

  • Communications with us

  • IP address and technical information

  • Cookie and website usage information

Names, addresses, email addresses, phone numbers, IP addresses and certain payment information can constitute personal data under GDPR. IMY

We do not normally receive or store your full payment-card details when payment is processed directly by an external payment provider.

3. Why We Process Your Data

We may process your personal data to:

  • Process and deliver your order

  • Take and administer payments

  • Send order and delivery information

  • Handle returns, withdrawals and complaints

  • Provide customer service

  • Comply with accounting, tax and other legal requirements

  • Prevent fraud and protect our business

  • Maintain and improve our website

  • Send marketing communications where permitted

4. Legal Basis

Depending on the processing, we rely on one or more legal bases under GDPR.

This may include:

Contract — when processing is necessary to fulfil your order or provide a requested service.

Legal obligation — when we must keep or process information to comply with Swedish law, for example accounting requirements.

Legitimate interests — where necessary for legitimate business purposes, such as security, fraud prevention or certain website administration, provided your rights do not override those interests.

Consent — where consent is required, for example for certain marketing or non-essential cookies.

GDPR requires a valid legal basis for every processing activity; processing needed to fulfil a customer contract can rely on the contract basis. IMY

5. Who We May Share Data With

We may share necessary personal data with service providers involved in operating the webshop, such as:

  • Squarespace

  • Payment providers

  • Shipping and delivery providers

  • Accounting and bookkeeping providers

  • Email and communication providers

  • IT and website service providers

  • Authorities where legally required

We only share information that is necessary for the relevant purpose.

6. International Transfers

Some service providers may process personal data outside Sweden or outside the EU/EEA.

Where required, appropriate safeguards will be used in accordance with applicable data-protection law.

7. How Long We Keep Your Data

We retain personal data only for as long as necessary for the purpose for which it was collected or for as long as required by applicable law.

For example, information required for accounting purposes may need to be retained for the period required by Swedish accounting legislation.

Customer-service or correspondence data may be retained for as long as reasonably necessary to manage the matter and any subsequent claims.

8. Marketing

We will only send electronic marketing where we have an appropriate legal basis.

Where marketing is based on consent, you may withdraw your consent at any time.

You can also unsubscribe using the link provided in marketing emails where available.

9. Cookies

Our website may use cookies and similar technologies for necessary website functions, analytics and other purposes.

Where required by law, non-essential cookies will only be used after you have given consent.

Please see our Cookie Policy or cookie settings for more information.

10. Your Rights

Depending on the circumstances, you may have the right to:

  • Request access to your personal data

  • Correct inaccurate information

  • Request deletion of your personal data

  • Request restriction of processing

  • Object to certain processing

  • Receive certain personal data in a portable format

  • Withdraw consent where processing is based on consent

  • Lodge a complaint with a supervisory authority

GDPR provides these rights to data subjects, although individual rights can be subject to legal conditions and exceptions. IMY

To exercise your rights, contact us at studiodunkelheit@gmail.com

In Sweden, the supervisory authority is Integritetsskyddsmyndigheten (IMY).

11. Changes to This Privacy Policy

We may update this Privacy Policy when our services, systems or legal obligations change.

The latest version will always be available on our website.