PRIVACY POLICY FOR DESENIO AB

Intro and summary

Your privacy is important to Desenio AB (“Desenio” or “we”). In this policy, we want to inform you about how we process your personal data and about your rights. Personal data is any information that can be connected to you as a private person, for example name and contact information.

In short, this is why we process your data:

To the extent necessary for handling and delivering your order.
To give you offers and inspiration both by newsletters, text message and by targeted marketing in social media, and other media online and offline.
To communicate with you and answer your questions.
To ask you about Desenio and your experience with us.
To remind you of an abandoned shopping cart and to provide our picture wall feature.
To create and maintain a customer account (incl. features such as favorites).
To comply with mandatory law (e.g. consumer and accounting law).

You have several rights according to data protection law. For example you always have a right to object against marketing. You can also read about how to affect our processing of your personal data – what rights you have.

Do you want to know more? Please read our detailed explanations below. Below you can read more about how, why and for how long period we process your personal data.

Who is responsible for the processing of your personal data?

Desenio AB, with Swedish company registration number 556763-0693, is responsible for the processing of your personal data. Please note also that some of our providers of payments and logistics process personal data collected through our site or IT system upon purchase and are independently responsible for their processing.

If you want to contact us regarding our processing of your personal data, please contact us at info@desenio.com or give us a call at +46 8 408 80 902. Our postal address is Box 11025, 100 61 Stockholm, Sweden.

Who can gain access to your personal data?

Your personal information is processed primarily by us at Desenio. We will never sell your personal data. In some cases, we share your personal data in order to fulfill our obligations to you in a good and efficient manner:

In order for us to ensure that you pay us, our payment provider(s) will gain access to your personal data.
In order for us to deliver your goods to your home address or to a postal agent, and to handle any returns, we will share your personal data with a carrier.
Your personal information is processed primarily by us at Desenio and companies within Desenio Group.
To collect and publish your reviews on our website we share your personal data with the supplier that provide the technical solution to collect and publish such reviews.
If a friend has referred you to us, we will share a hashed id (text-ID) of your email address with a supplier that have assisted us with enabling friend-referrals. The purpose is to know if we should pay the supplier of the service for referring a new customer or not. Note however that the supplier is not able to convert the text-ID to get access to your actual email address.
To market relevant products and to make our website as relevant as possible we share your personal data with those providing us with a marketing service including such as Google and Facebook.
We will share your personal data with IT suppliers that process the personal data on behalf of us as processors to assist us with IT-services.
In order to print and ship your personalized poster, we must share your personal information, as well as additional information to be printed on the poster, with our printing company.

If you want more detailed information about who we share your personal data with, please feel free to contact us.

Do we transfer your personal data outside of the EU/EEA?

Desenio generally process your personal data within the EU/EEA, but in a few cases we use suppliers from countries outside of the EU/EEA. When transferring your personal data outside of the EU/EEA, Desenio will ensure there is an adequate level of protection.

Desenio may transfer your personal data to the USA and our supplier that provides a service for sending newsletters and our suppliers that provides services for marketing relevant products and to make our website as relevant as possible.

We want to make you aware of that even though we choose the best service providers we can find, and we make sure that these suppliers have signed relevant agreements with the European Union, the data that is transferred to the USA can be processed by US authorities for control and monitoring purposes without effective legal remedies being available. We closely follow the developments of new agreements between European Union and the relevant parties and will make updates according to the outcomes as quickly as possible whenever new standards are in place.

If you have any questions about how we share your personal data or if you want the information appropriate safety measures we have, please contact us.

How can you affect our processing of your personal data?

According to data protection legislation, you are entitled to a variety of rights to affect our processing of your personal data. Read more below.

Right to withdraw consent and to object to processing

You have a right to, entirely or partly, withdraw a given consent for the processing of your personal data. Your withdrawal will have effect from the time of your withdrawal.

You have the right to object to our processing of your personal data. You always have a right to object to marketing from us, such as newsletters.

The right to object generally is applicable when the processing is based on a balance of legitimate interests. Read more about what this means in the tables below. In some cases however, the right to object does not exist (e.g. since we must store your personal data). If we can show compelling legitimate reasons for the processing that weigh heavier than your interests and fundamental rights or if it is for the purpose of determining, practicing or defending legal claims you never have a right to object to the processing.

Right to access

You have the right to obtain confirmation as to whether or not we are processing personal data concerning you. You can gain access to the personal data and obtain a copy of the personal data processed by us.

Right to rectification

You have a right to obtain rectification of any inaccurate personal data concerning you and to ask us to have incomplete personal data completed.

Right to erasure (“the right to be forgotten”) and restriction of processing

Under certain circumstances, you have a right to request erasure of your personal data. This is the case for example where the personal data is no longer necessary for the purposes for which they were collected or otherwise processed, or you withdraw your consent on which the processing is based and where there is no other legal ground for continuance of the processing.

You also have a right to request that Desenio restrict its processing of your personal data. That is the case for example when the accuracy of the personal data is contested by you, or the processing is unlawful and you oppose the erasure of the personal data and instead requests restriction of its use.

Right to lodge a complaint to a supervisory authority

You always have the right to lodge a complaint with a supervisory authority.

You may do this in in particular in the EU/EEA member state of your habitual residence, place of work or of an alleged infringement of the applicable data protection laws. In Sweden, the supervisory authority is the Swedish Data Protection Authority. This right is without prejudice to any other administrative or judicial remedy.

Right to data portability

You have a right to ask us to transfer certain of your personal data we have about you to another company (data portability).This right applies to personal data that you have provided us in a structured commonly used, machine-readable and interoperable format if:

The processing is based on consent or on a contract; and
The processing is carried out by automated means.

In exercising your right to data portability, you have the right to have personal data transmitted directly from Desenio to another controller, where technically feasible.

How and why do we process your personal data?

Our aim is to be as transparent as possible regarding how and why we process your personal data. In the table you can read more detailed information about why we process your personal data (the purposes of processing), what personal data we process, our legal basis for processing your personal data, and how long we process your personal data for each purpose.

We process personal data that you have chosen to share with us.

Processing before making a purchase

In order for us to communicate with you, to save any picture wall that you have created and to receive feedback from you, we need to process your personal data. If you do not provide us with personal data for these purposes, we will not be able to provide you with the service or answer your questions.

For what purposes do we process your personal data?	What personal data do we process?	What is our legal basis for processing your personal data?	For how long do we process your personal data for the specific purpose?
To save your abandoned cart and to remind you of the product you have left in the cart if you have started a purchase by entering your email address.	Information about your cart and your email that you provided to us when starting your purchase.	Our legitimate interest of making it as easy as possible for you to purchase the product you have showed interest in by placing them in the cart.	From the time you place the product in the cart until you make a purchase, however, no more than five (5) days.
To save your picture wall and to receive feedback from you about our picture wall tool.	Your email and the name you choose to save your picture wall and cookies. We also process any information that you provide when giving us feedback.	Processing is necessary for the performance of our contract (for providing the picture wall service) with you.	For one (1) year from when you have created your picture wall.
To answer questions you ask us.	Your name, contact information, pictures that you send us and other information that you provide to us.	Processing is necessary for the performance of our contract with you.	For three (3) years or as long as we are required by law.

Processing necessary for the purchase and our agreement, etc.

In order for us to carry out your purchase, for example to be able to deliver the product, we need to process your personal data. We also need to process your personal data to comply with statutory or other requirements, such as the accounting law's requirement to save data and consumer protection laws. If you do not provide us with personal data for these purposes, we will not be able to complete your purchase with us.

Please note that also our payment provider(s) process personal data in order to administrate your payment of the order. Our payment provider(s) is independently responsible for such processing. Our payment provider(s) also allow you to choose an easier way to make a purchase by automatically filling in your personal data or to be remembered at your device.

For what purposes do we process your personal data?	What personal data do we process?	What is our legal basis for processing your personal data?	For how long do we process your personal data for the specific purpose?
To administrate your purchase, i.e. to know who we enter into an agreement with, to confirm your purchase, to deliver your purchase and communicate with you regarding your delivery and to collect information on your experience.	Your name, contact details, such as email address and delivery address, order information and chosen payment method and IP-address.	Processing is necessary for the performance of our contract with you.	Twelve (12) months from order.
If you want to use your right of withdrawal or change your product and for us to be able to comply with consumer protections laws.	Your name, phone number, email address, postal address and information about your purchase, for example your payment method. We also save the information that you have shared when you use your right of withdrawal or when you change your product.	The processing is necessary for the performance of our contract with you, for us to comply with our return policy and for us to comply with relevant consumer protection laws.	From when you make your purchase and for twelve (12) months thereafter in order for us to comply with consumer protection laws. If you choose to use any of your rights we will process your personal data until we have made a decision regarding the withdrawal or change of product and completed eventual repayment or sent you the new product.
To handle any complaints and/or legal disputes against us.	Your name, contact details, information you have stated which is relevant within the framework of the complaint and/or legal dispute.	The processing is necessary in order for us to comply with relevant consumer protection laws and our legitimate interest to handle complaints and/or defend us against legal claims.	From when your complaint and/or legal dispute comes to our attention and for as long as it is ongoing. If we decline your claim, we always store the information for twelve (12) months in case you would choose to have your legal dispute reviewed by a relevant instance.
In order to comply with legal obligations, i.e. accounting laws and money laundry legislation.	Information on your invoice such as your purchase history, name and contact information.	The processing is necessary in order for us to comply with relevant legislation.	From when you make your purchase and for seven (7) to eight (8) years according to Swedish accounting law and for five to ten (5-10) years according to money laundry legislation.
If a friend has referred you to us, we process your personal data in order to pay our supplier that provide a solution for referring friends.	A hashed id (text-ID) of your email address.	Our legitimate interest is to make sure that we only pay our supplier for the purchases from new customers that they have referred to us.	The email address is never kept by us for this purpose.

Processing to handle reviews

For what purposes do we process your personal data?	What personal data do we process?	What is our legal basis for processing your personal data?	For how long do we process your personal data for the specific purpose?
In order to send emails requesting reviews after your purchase.	Your name, email address and order id.	Our legitimate interest is to contact you with a request to rate or review the customer experience with us for us to make the experience better for both you and other customers.	Until we have sent our request to you.

Processing to manage your customer account

In order to manage your customer account we process your personal data for the performance of our contract with you. If you do not provide us with personal data for this purpose, we will not be able to provide you with your customer account.

For what purposes do we process your personal data?	What personal data do we process?	What is our legal basis for processing your personal data?	For how long do we process your personal data for the specific purpose?
To manage your customer account that you have created. This includes sending you updated information about your account and our privacy policy. It also includes processing in order to take security measures regarding your account.	Your name, personal identification number , email address, mobile number, cookies and IP-address, user name, user name and the postal address you want us to deliver your products to.	Processing is necessary for the performance of our contract to provide you with an account with you, when you have chosen to have an account. Processing in order to send you updates to our privacy policy is necessary in order to comply with data protection legislation and regulations.	We store your personal data from when you make a purchase and for two (2) years from your last login or until you ask us to remove your account.

Processing in order to communicate news, inspiration and relevant offers to you

For what purposes do we process your personal data?	What personal data do we process?	What is our legal basis for processing your personal data?	For how long do we process your personal data for the specific purpose?
To send newsletters and relevant offers to you on your request and to send marketing to you who have made a purchase.	Your email address and purchase history.	When you choose to subscribe to our newsletter, we process your personal data based on your consent. When you have made a purchase, we process your personal data based on our legitimate interest to send relevant direct marketing. We only do this if you have made a purchase from us and not objected from receiving marketing.	If you have chosen to receive newsletters and relevant offers, we will send those to you until you unsubscribe to our newsletter. If we send you newsletter based on our legitimate interest we will send you such marketing for two (2) years after your last purchase, unless you object to receiving marketing from us earlier.
In order to make targeted marketing towards you in social media and at third party web sites.	Your email address, cookies and IP-address.	Our legitimate interest is to use your personal data for direct marketing and to make our marketing relevant for you. We only do this if you have made a purchase from us and not objected from receiving marketing	Your personal data will be processed from when you have made your purchase and for two (2) years, unless you object to our marketing before
To publish a review that you have chosen to write in order to make the customer experience transparent to our site visitors and to market our brand to potential customers.	Your name and the information that you have left in your review.	Our legitimate interest is to publish the review that you have written and shared on a review platform.	Until you remove the review from the review platform.
In order to market our products on our website we may publish your pictures/video of the product that you have shared on your social media profile and tagged #desenio.	The picture/video that you have shared in social media, your user name, and your text. All of these can include personal information about you.	Our legitimate interest is to publish the picture/video that you have tagged #desenio.	Until you declare you no longer want us to show the picture/video at our website.

Cookies

More information about our cookies policy can be read here.

How have we assessed the balancing of interests when the legal basis for processing of your personal data is our legitimate interest?

For some purposes, Desenio processes your personal data relying on our legitimate interest as legal basis for the processing. When assessing the legal basis we rely on a balance of interests test, through which we have determined that our legitimate interest for the processing outweighs your interest and your fundamental right not to have your personal data processed. We have stated what our legitimate interest is in the tables above. You are welcome to contact us if you want to read more about how we have done this test. Our contact details are as stated in the beginning of this privacy policy.

This privacy policy was adopted by Desenio on 24 May 2018.

Privacy policy

Use of personal information

We take your privacy seriously, and take great care to protect your personal information. It is our intention to always follow current privacy laws and regulations. Through this policy, we aim to inform you of the type of information we collect, and how we use this information. In connection with purchases or sharing of personal information, you agree to have your personal information used as outlined below.

Data Controller

Desenio AB, 556763-0693
Högbergsgatan 44 (physical address)
SE-118 26 Stockholm, SWEDEN

is responsible for handling your personal information.

Information we collect

We collect information you give us or have given us at desenio.com, or that we have collected through the use of e.g. cookies to provide you with our services, and to process payments.

The information we have access to includes: gender, name, address, delivery address, telephone number, e-mail address, IP address, order-, payment-, and purchase history, debit- and credit card number.

How we use your information

In addition to the above-mentioned uses, your information may also be used for statistical purposes, direct marketing, customer polls, newsletter distribution, and identification. It may also be used for sending text messages, e-mails, and regular mail, and, unless you have opted out, for marketing and communication of information via phone. If you would like to opt out of Desenio marketing to you as our customer, please contact our customer service department.

Given and collected information may be used to provide you with relevant information and as direct marketing, in addition to improve our website. Use in conjunction with improvements of payment solutions and payment processing includes transfer of your personal information, as outlined above, to outside companies and third-party suppliers for analysis purposes. Your data may be combined with data from other sources, e.g. credit agencies.

With utmost discretion, your information may be merged with that of other system directories, both within and outside the EU. Additionally, your information may be shared with, and processed by, collaboration partners for the purposes outlined previously, in accordance with current legislation and regulations. Moreover, personal information may be shared or merged with various authorities and our collaboration partners for services related to delivery and payment processing.

By agreeing to Desenio’s Privacy Policy in conjunction with purchases or by otherwise providing your information, you are agreeing to have your information shared with countries outside the EEA (European Economic Area).

Sale of corporation

In the event of a transfer of ownership at Desenio, or a merger with another company, we may share your personal information with our advisors, potential buyer(s) and their advisors, as well as the company’s new owner(s).

Google

We use Google’s services for analysis and advertising. For more information on how Google collects, shares, and uses your information, click here.

Protection of personal information

We adhere to security routines and utilize strict data security measures to safely store your personal information. Access to personal information is limited, and employees are required to identify themselves prior to accessing information.

Among other security measures, Desenio uses SSL (Secure Socket Layer) for secure transfer of data over the Internet. Check your browser’s setting to ensure that SSL is not turned off.

Timeline

When you place an order or create an account with Desenio, and thereby agree to share your information with us, we will store your information until you unsubscribe. You can unsubscribe at any time. Any information that we have received without you registering with us will be stored in accordance with time periods established by current regulations, or as long as necessary to fulfill our obligations to you, e.g. for order delivery and warranty fulfilment.

Your information will not be stored longer than allowed by current data protection regulations.

Your personal information

According to Sweden’s Personuppgiftslag (PUL), you have the legal right to request a free report annually outlining how we use your personal information. To request your free report, please send us a written letter. According to PUL, this request cannot be made via e-mail, and will need to to be sent to us signed via regular mail. See Desenio.com for our mailing address.

It is important that the information we have on file for you is correct and up-to-date. Please contact us if you need to make changes to your information. You have the right to request that you personal information is corrected, deleted, or blocked at any time.

You may, and have the legal right to withdraw your permission for our use of your personal information. You can also limit your withdrawal to only certain parts, e.g. information pertaining to direct marketing.

Limitations

Our website links to other sites that are outside our ownership or control. Our Privacy Policy apply solely to Desenio’s sites, and we are only able to take responsibility for the information on our own sites. When leaving Desenio’s websites to access another site, we recommend that you read this site’s corresponding privacy policy.

Changes to our Privacy Policy

We reserve the right to make changes to this policy at any time and to the extent necessary to meet current legislative or technical requirements, as well as to rectify disruptions in service. Any changes to our policy will be posted on our website.