Privacy policy

Who is responsible

Ekovital Norden AB, company registration number 559588-0187, is the controller for the processing described here. Contact: support@vitamio.eu. Full details are at the bottom of this page.

What we process, and why

To deliver your order — name, email, phone, delivery address and what you bought. Legal basis: performance of the contract, Article 6(1)(b) GDPR. Without these we cannot ship anything.

To keep accounts — the order as an accounting record. Legal basis: legal obligation, Article 6(1)(c). This is why order data survives a deletion request.

To answer you — your address and whatever you write, for as long as the case is open. Legal basis: legitimate interest, Article 6(1)(f).

We do not profile you, we do not sell data, and we run no advertising or analytics trackers on this site.

Cookies

Cookies on this site come in two kinds. The 6 listed below are strictly necessary for the shop to work and need no consent — the ePrivacy exception applies. Beyond those, we measure our advertising with Google Ads, Microsoft Advertising and Partner-ads, but only if you agree in the bar at the bottom of the page.

If you agree, Google, Microsoft and Partner-ads sets cookies, among them _gcl_au, _uetsid, _uetvid, paid, pacid, that show whether a purchase came from an ad. What we send to Google and Microsoft is the order number, the amount and the currency — not what you looked at in the shop. What we send to Partner-ads is the order number, the amount and the codes paid, pacid — not what you looked at in the shop. If you decline, nothing is loaded from Google, Microsoft and Partner-ads at all. You can change your choice at any time through Cookie choice in the footer.

vitamio_cart

30 days · not readable by page scripts · carries supplierSku, quantity

vitamio_checkout

2 days · not readable by page scripts · carries email, phone, firstName, lastName, shippingLine1, shippingLine2, shippingPostalCode, shippingCity, shippingCountry, customerNote

vitamio_locale

365 days · carries language

vitamio_market_hint

365 days · carries dismissed

vitamio_consent

180 days · carries granted eller denied

vitamio_admin

Session cookie · not readable by page scripts · carries adminSession

Who else sees the data

These are our processors. Each receives only what it needs to do its job.

Railway Corp.

EU (Amsterdam) · receives server logs, IP address, order data while it is being processed

Railway Postgres

EU (Amsterdam) · receives order data, contact details, delivery address

Resend, Inc.

USA (SCC + DPF) · receives email address, name, order number, order contents

Kustom (Kustom Kredit AB)

EU (Sweden) · receives amount, order number, name, email address, billing address

Our logistics partner

order handling, picking, packing and dispatch from the partner's warehouse at Logicas Sp. z o.o., Swadzim, Poland · United Kingdom (European Commission adequacy decision) / EU (Poland) · receives name, delivery address, phone number, order contents

UPS

EU / third country depending on the route · receives name, delivery address, phone number, parcel weight

Transfers outside the EU are covered by the standard contractual clauses, and where noted by the EU–US Data Privacy Framework.

Our logistics partner is established in the United Kingdom. Transfers there rest on the European Commission's adequacy decision for the United Kingdom, which finds that the country provides a level of protection essentially equivalent to that of the EU.

Payment

Card and account details never reach us. They go straight to Kustom, our payment service provider, which is the controller for that part. We see the amount, the order and whether the payment was approved.

How long we keep it

Order records: 7 years, because accounting law requires it. Support correspondence that is not an accounting record: 24 months. The checkout cookie's contents disappear on their own after 2 days.

Your rights

You have the right of access (Article 15), rectification (16), erasure (17), restriction (18), data portability (20) and to object (21). Email support@vitamio.eu and we answer within one month.

Erasure does not extend to what accounting law requires us to keep. We will say which data that is rather than refuse the whole request.

You may also complain to a supervisory authority — in Sweden that is Integritets­- skyddsmyndigheten (IMY), and you may equally turn to the authority in your own country of residence or place of work (Article 77).

Automated decision-making

We make no automated decisions producing legal effects concerning you. If you choose a payment method involving credit, the provider may make such an assessment — that processing is theirs, and their terms and privacy notice are shown before you confirm.