Last updated: 27 October 2026
Who is responsible for your data?
Växtbutiken is responsible for the processing of your personal data in the shop. Contact us at info@vaxtbutiken.eu.
What data do we use and why?
We use the data you provide when you shop or contact us: name, email address, phone number (if you provide it), delivery and billing address, chosen pickup point, ordered items, payment method and order status. When the parcel is shipped, tracking details also become part of the order.
- Order, payment, delivery, order emails and matters concerning your purchase – the data is needed to enter into and perform the purchase contract with you.
- Accounting – records of the purchase are kept because we are required to do so under the Swedish Accounting Act.
- Reviews – if you write a review, we store your name, email address, rating, text and time. Name, rating and text are shown publicly once we have approved the review; the email address is never shown and is only used to check whether you have bought the product and, if so, mark the review “verified buyer”. This is based on our legitimate interest in showing genuine reviews. We do not store an IP address for reviews.
- Review request email – if the box at checkout is ticked, we send an email about ten days after the order is completed asking for a review of the items you bought. This is based on our legitimate interest and the rules on existing customers in the Swedish Marketing Act. You can untick the box or unsubscribe via the link in the email; we then store only a checksum of your email address, not the address itself, so that we do not email you again.
- Other enquiries, and operations and security – our legitimate interest in answering questions and keeping the shop working and protected. The web server may then record technical data such as IP address.
The data comes from you. Payment and delivery status comes from whoever handles the payment or transport. Without contact and delivery details we cannot complete your order. You can shop as a guest; we do not create customer accounts and do not use the data for automated decisions or profiling.
Who receives the data?
- Inleed – web host where the shop and its database are located.
- Resend – sends order emails and receives your email address and the content of the email, which may include order and delivery details. Resend stores messages and delivery logs in the USA and relies on the EU Standard Contractual Clauses and the EU–US Data Privacy Framework to protect the transfer. Read more in Resend's GDPR information.
- Google Workspace – our email, where customer enquiries are handled.
- SumUp – when you pay by card, SumUp receives the card details directly in its payment form (we never see or store them), as well as name, email address, phone number, billing address, amount and order reference in order to carry out and protect the payment. SumUp is a payment institution and is itself responsible for its processing; read more in SumUp's privacy policy.
- Shipit and the carrier (DSV, PostNord or DHL) – receive name, address, phone or email for notification, chosen pickup point and shipment details so that the parcel can be delivered. The carriers have their own privacy information.
We never sell your data and do not disclose it for others' marketing.
How long do we keep the data?
- Order data is part of our accounting records and is therefore kept until the end of the seventh year after the end of the calendar year in which the financial year ended (Swedish Accounting Act). After that it is anonymised.
- Emails and other customer enquiries are kept for as long as the matter is ongoing and thereafter for a maximum of three years.
- Reviews are shown for as long as the product is in the shop, or until you ask us to remove your review.
- The shopping cart session expires after at most two days.
Cookies
The shop only uses cookies and browser storage that are needed for the service you request. They do not require consent. We do not use cookies for analytics or marketing.
wp_woocommerce_session_…– keeps your shopping cart together, for at most two days.woocommerce_items_in_cartandwoocommerce_cart_hash– show that the cart has content; removed when the browser is closed.- Browser storage of cart data, searched postcode and chosen pickup point, so that checkout remembers your choices.
You can block cookies in your browser, but then the shopping cart will not work.
Your rights
You have the right to know what data we hold about you and to receive a copy, to have incorrect data corrected and in some cases to have data erased, restricted or transferred. You can object to processing based on legitimate interest. The rights have exceptions, for example when data must be kept under the Swedish Accounting Act.
Email info@vaxtbutiken.eu. We reply within one month. If there is reasonable doubt about your identity, we may need to ask for additional information. You can also lodge a complaint with the Swedish Authority for Privacy Protection (IMY).