Privacy Policy
How we collect, use, and protect your data
Last updated: 2026-08-12
1. Data Controller and Contact
CardHaven is operated by Skeja Consulting AB, company reg. no. 559248-6129, VAT no. SE559248612901, Fiskargränd 3A, 553 20 Jönköping, Sweden. Skeja Consulting AB is the data controller for the processing of your personal data. For questions about this policy or to exercise your rights, contact us at info@cardhaven.se.
2. Personal Data We Process
When you shop with us or create an account, we process the data you provide: name, email address, delivery and billing address, phone number, and order history. Payment is handled by our payment provider – we do not store full card numbers. We also collect certain technical data automatically, such as your IP address, device and browser type, and how you use the site (via cookies, see section 8).
3. Purposes and Legal Basis
We process your data for the following purposes and legal bases: (a) to process and deliver your order and provide customer service – performance of a contract (art. 6.1 b GDPR); (b) accounting and other legal obligations – legal obligation (art. 6.1 c); (c) security and fraud prevention – legitimate interest (art. 6.1 f); (d) newsletters and analytics/marketing cookies – your consent (art. 6.1 a), which you may withdraw at any time.
4. Recipients of Personal Data
We never sell your personal data. We share it only with recipients who need it for the purposes above: payment providers (to process payment), shipping carriers (to deliver your order), and – if you have consented – the analytics and marketing providers Google, Meta, and TikTok. We also use IT, hosting, and email providers that process data on our behalf. Such providers are data processors bound by data processing agreements. We also disclose data to authorities where required by law.
5. Transfers to Third Countries
Some providers, in particular the analytics and marketing providers Google, Meta, and TikTok, may process data in the USA or other countries outside the EU/EEA. Such transfers are made with appropriate safeguards – the European Commission's standard contractual clauses and/or the EU–US Data Privacy Framework. Contact us for more information about the safeguards.
6. Retention and Security
We keep your data only as long as needed for the purpose. Order data is kept for the duration of the customer relationship and thereafter for as long as the Accounting Act requires (7 years). Account data is kept until you delete your account, and newsletter data until you unsubscribe. Cookies are stored for the periods stated in our cookie policy. Data is protected with appropriate technical and organizational security measures.
7. Your Rights
Under GDPR you have the right to request access to your personal data as well as rectification or erasure, to request restriction of or object to processing (including to direct marketing), to receive and port data you have provided (data portability), and to withdraw any consent at any time. We do not use automated decision-making with legal effect; marketing cookies may involve profiling, which you control via your consent. Contact info@cardhaven.se to exercise your rights.
8. Cookies
We use necessary cookies to make the site work and – with your consent – analytics and marketing cookies. You choose in our cookie banner and can change your choice at any time. Read more in our cookie policy.
9. Complaint to the Supervisory Authority
If you believe we process your personal data unlawfully, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), Box 8114, 104 20 Stockholm, imy@imy.se, www.imy.se.
10. Changes to This Policy
We may update this privacy policy from time to time. Changes will be published on this page with an updated date. We encourage you to review this policy periodically.