PRIVACY POLICY
LAST UPDATED 2026-09-24
This policy explains how KANSLIET STUDIO AB handles personal data when you visit kansliet.co, contact us or buy from the store.
WHO IS RESPONSIBLE
KANSLIET STUDIO AB (org.nr 559581-6033), Allévägen 30C, 311 45 Falkenberg, Sweden, is the controller for your personal data. Questions or requests: desk@kansliet.co.
WHAT WE COLLECT AND WHY
| PURPOSE | DATA | LEGAL BASIS | KEPT FOR |
|---|---|---|---|
| Placing and delivering orders | Name, email, shipping address, what you bought, payment status (not card details) | Contract (GDPR art. 6.1 b) | 7 years after the end of the financial year (Swedish Bookkeeping Act) |
| Handling returns and complaints | Order details and what you tell us | Contract and legal obligation (art. 6.1 b, c) | Until settled, then as accounting records |
| Answering the contact form or email | Name, email, company, your message | Legitimate interest in replying (art. 6.1 f) | Up to 2 years after our last contact |
| Site analytics (only if you accept) | Pages visited, device and browser, approximate location, a random ID | Consent (art. 6.1 a) | Up to 14 months in Google Analytics |
We don't sell personal data, use it for automated decisions, or send marketing without asking.
WHO WE SHARE IT WITH
Only the services needed to run the site and the store:
- Stripe processes payments. For fraud prevention and its legal duties as a payment provider, Stripe is also an independent controller (stripe.com/privacy).
- Vercel hosts the site and its database.
- Resend sends order confirmations and delivers contact form messages to us.
- Google provides Google Analytics, only if you accept analytics cookies.
- The carrier delivering your parcel gets your name, address and, where needed, email for delivery notices.
- Our accountant and authorities, where the law requires it.
Some of these providers are based in the US. Transfers there rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.
YOUR RIGHTS
Under the GDPR you can ask us to:
- give you a copy of the personal data we hold about you (access)
- correct data that is wrong (rectification)
- delete your data, where we are not required to keep it (erasure)
- limit how we use it (restriction)
- hand it over in a machine-readable format (portability)
- stop using it where we rely on legitimate interest (objection)
You can withdraw consent to analytics at any time; this doesn't affect processing before you withdrew it. Email desk@kansliet.co; we reply within one month. Order records we must keep for accounting can't be deleted before the legal period ends.
You can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), imy.se, or the data protection authority where you live.