Privacy Policy

1. Data Controller

Your personal data is controlled by:

Layraton Handelsbolag
Org.nr: 969801-0940
Lövtäktsvägen 5
141 42 Huddinge, Sweden
Email: smedja.kontrast@gmail.com

We are committed to protecting your personal data and handling it in accordance with the EU General Data Protection Regulation (GDPR) and applicable Swedish law.

2. Data We Collect

When you place an order or contact us, we collect:

• Full name
• Email address
• Phone number
• Delivery address
• Order details (items, quantities, personalisation data such as player name and number)
• Payment reference (we do not store card details — these are handled by Stripe)
• Any messages or notes you send us

We do not collect data beyond what is necessary to fulfil your order and communicate with you.

3. How We Use Your Data

We use your personal data to:

• Process and fulfil your order
• Send order confirmation and shipping notifications
• Respond to enquiries and support requests
• Comply with legal obligations (e.g. Swedish bookkeeping law)

We do not use your data for marketing without your explicit consent, and we do not sell your data to third parties.

4. Legal Basis (GDPR)

We process your data on the following legal bases:

• Contract (Article 6(1)(b)) — processing necessary to fulfil your order
• Legal obligation (Article 6(1)(c)) — accounting and tax requirements under Swedish law
• Legitimate interest (Article 6(1)(f)) — responding to enquiries and preventing fraud

5. Third-Party Processors

We share your data with the following third parties, only to the extent necessary to operate our service:

• Stripe, Inc. — payment processing. Stripe may transfer data outside the EEA under Standard Contractual Clauses. See stripe.com/privacy.
• Resend — transactional email delivery (order confirmations). See resend.com/privacy.
• Netlify, Inc. — website hosting and form processing. See netlify.com/privacy.
• Shipping carriers — your name and address are shared with the carrier responsible for delivering your order.

All processors are required to handle your data in accordance with GDPR and our instructions.

6. Data Retention

We retain your personal data for as long as necessary for the purposes set out above:

• Order data — kept for 7 years in accordance with Swedish bookkeeping law (Bokföringslagen)
• Support correspondence — kept for up to 2 years after the case is closed
• Data no longer needed — deleted or anonymised when no longer required

7. Your Rights

Under GDPR you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate data
• Erasure — request deletion of your data, where permitted by law
• Restriction — request that we limit how we use your data
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interest

To exercise any of these rights, email us at smedja.kontrast@gmail.com. We will respond within 30 days.

8. Cookies

Our website uses only functional browser storage (localStorage) to remember your cart and currency preference. We do not use tracking cookies or third-party advertising cookies.

9. Complaints

If you believe we are handling your data unlawfully, you have the right to lodge a complaint with the Swedish data protection authority:

Integritetsskyddsmyndigheten (IMY)