Privacy Policy – Hasta Eco

1. Introduction

Hasta Eco AB (”Hasta Eco”, ”we”, ”us”) operates this website and associated online store (the ”Services”) with the aim of offering you, as a customer, a secure, transparent and responsible shopping experience.

The Services are provided via Shopify, which acts as the technical platform for e-commerce. This privacy policy describes how we collect, use, store and share personal data when you use our Services, make purchases or otherwise communicate with us.

In the event of any conflict between this privacy policy and our terms of use, this privacy policy shall prevail in matters relating to the processing of personal data.

By using the Services, you confirm that you have read and understood this policy.

2. What is personal data?

Personal data means any information that can directly or indirectly identify you as a person, for example name, contact details, IP address or purchase history.

Data that has been anonymised or de-identified and can no longer be linked to an individual is not considered personal data.

3. What personal data we collect

Depending on how you use the Services, we may collect the following categories of personal data:

a) Contact details

Name, address, delivery address, billing address, telephone number and email address.

b) Payment and transaction data

Payment method, payment status, order information and transaction history.

(Credit card details are handled securely by our payment providers and are not stored by us.)

c) Account information

Username, password (encrypted), settings and preferences.

d) Purchase behaviour

Products you view, add to the shopping cart, purchase, return or enquire about.

e) Communication

Information provided when contacting customer support or in other communication.

f) Technical information

IP address, browser, device type, operating system and cookies.

g) Usage data

How you navigate and interact with the website.

4. Sources of personal data

We collect personal data from:

• You directly (when making a purchase, creating an account, contacting us)
• Automatically via the website (cookies, logs)
• Our service providers (e.g. payment, shipping)
• Partners (where permitted)

5. Legal basis for processing

We process personal data on the following legal grounds (GDPR Article 6):

• Performance of a contract – for purchases, payment, delivery and customer service
• Legal obligation – accounting, consumer protection
• Legitimate interest – improvement of services, security, fraud prevention
• Consent – marketing, cookies and certain analytics

6. How we use personal data

a) Provision of the Services

To manage orders, payments, deliveries, returns, accounts and customer support.

b) Marketing

Marketing communications via email or SMS are sent only with your consent or where permitted by law (existing customer relationship).

You can unsubscribe at any time.

c) Security and fraud prevention

To protect you, us and our systems.

d) Communication

To answer questions and maintain the customer relationship.

e) Legal requirements

To comply with laws, handle disputes and respond to requests from authorities.

7. Cookies and similar technologies

We use cookies and similar technologies for functionality, analytics and marketing.

You can manage your consent via the cookie settings.

More information can be found in our Cookie Policy.

8. How we share personal data

We share personal data only when necessary, for example with:

• Shopify (e-commerce platform)
• Payment providers
• Shipping and logistics partners
• IT and cloud service providers
• Authorities (where there is a legal obligation)

Personal data is never sold on.

 

9. Shopify as a data processor

Shopify provides the technical platform and processes personal data on our behalf.

Data may be processed outside the EU/EEA in accordance with approved safeguards.

More information: Shopify's privacy policy.

10. International transfers

When transferring personal data outside the EU/EEA, we use the European Commission's standard contractual clauses or equivalent safeguards.

11. Retention period

We store personal data only for as long as is necessary:

• Order and accounting data in accordance with legal requirements
• Account data until the account is closed
• Marketing consents until they are withdrawn

12. Children's data

The Services are not directed at children. We do not knowingly collect data about persons under 18 years of age.

13. Your rights

You have the right to:

• Request access to your data
• Request rectification or erasure
• Object to processing
• Request data portability
• Withdraw consent

Requests are made via the contact details below.

14. Security

We use technical and organisational security measures to protect your data, but no transmission is entirely free of risk.

15. Changes to the policy

This policy may be updated. The latest version is always published on the website.

16. Contact details

Data controller: Hasta Eco AB

Email: info@hastaeco.se