PRIVACY POLICY

This Privacy Policy describes how your personal information is collected, used, and shared when you visit or make a purchase from wornvintage.se (the “Site”). Last updated: 27 February 2026

1. Data Controller 

Worn Vintage Lovisa AB
Organisation number: 559388-4363
Registered address: Sankt Eriksgatan 94, 113 62 Stockholm
Sweden
Email: info@wornvintage.se

Worn Vintage Lovisa AB (“we”, “us”, “our”) is the data controller responsible for the processing of personal data described in this Privacy Policy.

2. What personal data we collect

When you visit wornvintage.se (the “Site”), place an order, or interact with us, we may collect the following personal data:

Information you provide directly:
– Name
– Billing and shipping address
– Email address
– Phone number
– Payment details
– Order history
– Information provided when contacting customer service

Information collected automatically:
– IP address
– Browser type and device information
– Time zone
– Pages viewed and interactions on the Site
– Referral source
– Cookie identifiers and tracking data

3. Purpose and legal basis for processing

We process personal data for the following purposes:

To process and fulfil orders
Legal basis: Contract

To manage payments, shipping and customer service
Legal basis: Contract

To comply with accounting and legal obligations under Swedish law
Legal basis: Legal obligation

To prevent fraud and secure our website
Legal basis: Legitimate interest

To analyse website usage and improve performance (Google Analytics 4)
Legal basis: Consent

To deliver targeted advertising (Meta and other advertising partners)
Legal basis: Consent

To send marketing emails and automated communications via Klaviyo
Legal basis: Consent

You may withdraw your consent to marketing at any time by clicking the unsubscribe link in emails or by contacting us.

4. Sharing of personal data

We share personal data only with trusted third parties when necessary for the purposes described above, including:

– Shopify (e-commerce platform provider)
– Payment service providers
– Shipping and logistics partners
– Google (Google Analytics 4)
– Meta (advertising services and pixel tracking)
– Klaviyo (email marketing and customer communication provider)
– Cookiebot (cookie consent management platform)

These providers process personal data on our behalf under data processing agreements in accordance with Article 28 of the GDPR.

5. International transfers

Some of our service providers process personal data outside the EU/EEA, including in the United States and Canada.

Where personal data is transferred outside the EU/EEA, we ensure appropriate safeguards are in place through:

– European Commission adequacy decisions (where applicable)
– Standard Contractual Clauses approved by the European Commission

6. Data retention

We retain personal data only for as long as necessary:

– Order and accounting data: in accordance with Swedish accounting law (currently 7 years)
– Marketing data: until consent is withdrawn
– Customer service correspondence: as long as necessary to manage the case

7. Your rights

If you are located in the EU/EEA, you have the right to:

– Request access to your personal data
– Request correction of inaccurate data
– Request deletion of your data
– Request restriction of processing
– Object to processing based on legitimate interest
– Request data portability
– Withdraw consent at any time

To exercise your rights, contact us at info@wornvintage.se.

If you believe your personal data is processed in violation of applicable law, you have the right to lodge a complaint with:

Integritetsskyddsmyndigheten (IMY)
www.imy.se

8. Cookies and tracking technologies

We use cookies and similar technologies to enable website functionality, analyse traffic, and provide marketing and advertising.

Non-essential cookies are only set after you have given your consent through our cookie banner.

We use Cookiebot to manage and document user consent in compliance with EU cookie regulations.

You can change or withdraw your consent at any time via the cookie settings on our website.

9. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The latest version will always be available on our website.