Legal
Privacy policy
This text is a working draft for review by someone qualified in Sweden, Denmark and Finland. It is not legal advice, and the shop must not take real orders until each page has been checked and completed.
Who is responsible for your data
Furahem AB, Kungsgatan 1, 111 22 Stockholm, Sweden ("we") is the controller of personal data processed through this shop.
What we collect
When you browse: technically necessary data (IP-derived session ID, pages requested).
When you place an order: name, email, delivery address, and the contents of your order.
When you register an account: name, email and a password (stored only as a scrypt hash).
If you arrive via a sales partner's link (/r/CODE), we store which partner referred the order, so payments can be routed correctly.
Why, and on what legal basis
To perform the contract you place (Art. 6(1)(b) GDPR): your address to deliver, your email to confirm.
For our legitimate interest in operating and securing the shop (Art. 6(1)(f)): session logs, rate limiting, fraud prevention.
Legal obligations such as bookkeeping rules (Art. 6(1)(c)) set how long order data must be kept.
How long we keep it
Order data: as long as accounting law requires (typically 7 years).
Accounts: until you ask us to delete them (we may keep what bookkeeping law requires).
Session data: the session cookie expires automatically; anonymous session records are deleted after 30 days.
Who else sees it
The hosting provider that runs this server, and the bank that receives your transfer. We do not sell data, run ad networks or embed third-party trackers — the shop loads nothing from other companies.
Your rights
You can ask for a copy of your data, have it corrected, deleted or exported, and object to processing. Email hej@furahem.com and we will answer within a month.
You may also complain to a supervisory authority: in Sweden the IMY, in Denmark the Datatilsynet, in Finland the Office of the Data Protection Ombudsman.
Cookies
The shop sets one cookie when you log in or open a form (a session identifier, HTTP-only), and one cookie when you arrive via a partner link (/r/CODE). Both are strictly necessary, so no consent banner is shown.