Privacy Policy

Who we are
We are Looft Industries AB, a company incorporated and registered in Sweden and the data controller responsible for your personal data for the purposes of the applicable European Union data protection law. Our registered address is Repslagargatan 15B, 118 46 Stockholm, Sweden. Our corporate identity number is 556673-4330. When we refer to “we”, “us”, or “our” in this policy, we are referring to Looft Industries AB.

We may process the information we collect about you
The basis for processing your personal data is to perform the contract with you related to the purchase, because you have given us your prior consent to use your personal data, because we have a legitimate interest in doing so or because we have a regulatory or legal obligation to do so.

If you give us your personal information on our website we will, with your given consent, use this information to keep you informed of our special events or promotions, to register you with our website and process any orders you may place online. Otherwise, we may use the personal information you provide to us only to review our performance or to communicate with you about your order that you have placed on our website. Such personal information may include your name, address, email address or phone number. This processing is necessary for the administration of our business and the provision of our services, which is necessary for the legitimate interest of our business.

Do we share your personal data with others?
We do not sell any of your personal data. We may share personal data with third party service providers acting as processors in order to be able to provide our services to you and to run our business. The following categories may receive information about your personal data:

• Third parties which are involved in processing purchases, e.g. payment service providers, warehouses, order packers, logistics companies, payment service providers, etc.
• Third parties which provide professional services to us, e.g. advertising partners, marketing agencies, metrics and analytics, web hosting providers, etc.
• Third parties which provide professional advice, including auditors, insurers, lawyers and legal, insurance and accounting services.

We do not authorize any of these service providers to make any other use of your personal data for their own purposes and only permit them to process it in accordance with our instructions.

Will we transfer your data outside EEA?
Many of the external third parties we may share your personal data with are based outside the EEA, meaning that their processing of your personal data will involve a transfer of data outside the EEA. If your personal data is transferred to a third party based outside the EEA we will ensure that a similar degree of protection is afforded to it. This is ensured by us by making sure that:

• the country is considered to have an adequate level of protection for personal data by the European Commission, see European Commission: Adequacy decision
• if the party is based in the US, that they are part of the Privacy Shield. For further details, see European Commission: EU-US Privacy Shield

The third parties we work with that are based outside the EEA that may process your personal data are all based in USA. These are Shopify, Google Analytics, Stripe and Powr and all of them are participants in the above mentioned Privacy Shield.

How long will we store your data?
Your personal data will not be kept longer than necessary. The length of time we will retain your information will depend on any legal obligations we have (such as tax recording and accounting), the existence of your consent, our legitimate interest as a business or the nature of the contract.

Where we anonymize your personal data so that it no longer can be associated with you, we may use this information indefinitely without further notice to you.

Your rights as a data subject
Your rights as a data subject are outlined below:

• The right to be informed – the right to be informed about how we are going to process your personal data. This right is ensured by this Privacy Policy and by informing you how your data will be used.

• The right of access – the right to access your personal data that we hold. You can access your data that we hold by sending us an access request. We are obligated to respond to your request within one month. Please include what personal data about you that you are seeking to obtain as this significantly helps us to process your request.

• The right to rectification – the right to rectify your personal data that we hold. If you think your personal data that we hold is incorrect, please notify us so we can put it right.

• The right to erasure – the right to, under certain circumstances, get your personal data erased. This would apply if your personal data is no longer required for the purposes it was collected, if your personal data has been unlawfully processed by us or if your consent has been withdrawn. If you want us to erase your personal data, contact us and tell us the reason why you want it removed.

• The right to restrict processing – the right to, under certain circumstances, suspend our processing of your personal data. This would apply if you want us to correct your personal data or if our processing is unlawful but you do not want us to erase, for instance due to a dispute or legal claim.

• The right to data portability – the right to request a transfer of your personal data to you or any third party appointed by you. Upon request, we will provide to you, or the third party you have chosen, your personal data in a structured, commonly used, and machine-readable format.

• The right to object – the right to, under certain circumstances, ask us to stop processing your personal data. You always have the right to object our processing of your personal data for direct marketing purposes. You may also object to our processing of your personal data if you find that the processing is inconsistent with the basis for which it was collected.

• Rights in relation to automated decision making and profiling – the right to not be subject to a decision based solely on automated processing, including profiling. This is not something we do. If that ever changes the policy shall be updated accordingly.

Withdrawing your consent
Where we rely on your consent as the legal basis for processing your personal data, you may withdraw your consent at any time.

Acceptance and modifications
By accessing and using our website you consent to our collection, use and disclosure of your information according to this Privacy Policy. We reserve the rights to make changes to this Privacy Policy. If we do so, we will notify you of any changes by posting the modifications on our website.

This version was last updated on 10th May 2019.

Contact
If you want to exercise your right as a data subject, or if you have any concerns or questions regarding our process of your personal data, please contact us by sending an email legal@looftindustries.com