Privacy policy

Privacy Policy

Last updated: 21 September 2026

This policy explains how we handle your personal data when you visit vemod.studio, join a waitlist, subscribe to our emails, shop with us or contact us. We process personal data in line with the EU General Data Protection Regulation (GDPR) and the data protection laws of Sweden and Norway.

1. Who is responsible

Vemod Store AB is the controller of your personal data. You can reach us about anything in this policy at:

2. The data we collect

• Contact details: name, email address, phone number, and delivery and billing address.
• Order information: the items you buy, prices, order history, returns and complaints. Payment is handled by our payment providers, and we never see your full card number.
• Waitlist and newsletter: your email address, the products and sizes you ask to hear about, a record of your consent, and whether you open or click our emails.
• Your messages: what you write to us, and our replies.
• Technical and usage data, collected with your consent where required: IP address, device and browser type, the pages you view, how you reached our website (for example, through an ad), and the identifiers stored in cookies.

3. Why we use your data, and on what legal basis

• To handle your order: payment, delivery, returns, refunds and complaints. Legal basis: performing our contract with you.
• To answer your questions and give customer service. Legal basis: our legitimate interest in helping you, or performing our contract.
• To tell you when a waitlisted piece is available. Legal basis: your consent.
• To send our newsletter and other marketing emails. Legal basis: your consent. You can unsubscribe at any time using the link in every email.
• To understand how our website is used and measure our advertising, through Google Analytics, Google Ads, Meta (Instagram and Facebook), TikTok and Pinterest. Legal basis: your consent through our cookie banner.
• To prevent fraud and keep the website secure. Legal basis: our legitimate interest in protecting our customers and our business.
• To keep accounts and meet other legal duties, such as the Swedish Accounting Act (bokföringslagen). Legal basis: legal obligation.
• To establish, exercise or defend legal claims. Legal basis: our legitimate interest.

4. Cookies and similar technologies

Cookies are small files stored in your browser. We use:

• Necessary cookies, which make the shopping bag, checkout, security and your cookie choice work. These are always on.
• Analytics cookies (Google Analytics), which show us how visitors use the website. These are used only if you accept them.
• Marketing cookies and pixels (Meta, TikTok, Pinterest and Google Ads), which measure whether our ads work and help show our ads to people likely to be interested. These are used only if you accept them.

When you first visit, our cookie banner lets you accept or decline. You can change your choice at any time through the Cookie preferences link at the bottom of the website. The waitlist also remembers in your browser which sizes you have already joined, so it does not ask twice. This information stays on your device.

5. Who we share data with

We share personal data only when it is needed for the purposes above. We never sell your personal data. The recipients are:

• Shopify, which runs our online store, checkout and hosting.
• Payment providers, which process your payment. When you use a service such as Shop Pay, Apple Pay, Google Pay or an invoice service, that provider may also act as a controller under its own privacy policy.
• Carriers, and for Norway customs agents, who receive your name, address, phone number, email and parcel details so they can deliver your order.
• Klaviyo, which sends our waitlist and newsletter emails.
• Google (Analytics, Ads and Workspace email), Meta, TikTok and Pinterest, for analytics and advertising, and only with your consent. For the collection of data through their pixels, we may be joint controllers with these companies. Each company is responsible for its own further use of the data under its own privacy policy.
• Accountants, legal advisers and public authorities, when this is needed or required by law.

6. Transfers outside the EU/EEA

Some of our providers, such as Shopify, Klaviyo, Google, Meta, TikTok and Pinterest, may process data outside the EU/EEA, including in the United States. When they do, the transfer is protected by an adequacy decision of the European Commission, such as the EU–US Data Privacy Framework for certified companies, or by the Commission's Standard Contractual Clauses.

7. How long we keep data

• Orders and accounting records: seven years after the end of the financial year, as required by Swedish accounting law.
• Customer service and complaints: as long as needed to handle the matter, and normally no longer than the three-year complaint period.
• Waitlist: until we have told you the piece is available, or until you ask us to remove you. If a piece never becomes available, we delete your waitlist data after 24 months.
• Newsletter: until you unsubscribe.
• Analytics data: no more than 14 months.
• Cookies: for the lifetime of each cookie, or until you delete them in your browser.

8. Your rights

Under the GDPR, you have the right to:

• access the personal data we hold about you and get a copy of it;
• have incorrect data corrected;
• have your data deleted, unless we must keep it by law, for example for accounting;
•  restrict how we use your data;
• receive your data in a machine-readable format (data portability);
• object to processing based on our legitimate interest, and always object to direct marketing; and
• withdraw your consent at any time. This does not affect processing that took place before you withdrew it.

To use any of these rights, email clientservices@vemod.studio. We reply within one month. We may ask you to confirm your identity first.

If you think we handle your data incorrectly, please tell us. You also have the right to complain to a data protection authority. In Sweden, that is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se). In Norway, it is Datatilsynet (datatilsynet.no).

You can also complain to the authority in the EU country where you live.

9. Security

We use trusted providers and appropriate technical and organisational measures to protect your data. Access is limited to the people and services that need it.

10. Children

Our shop is for adults. We do not knowingly collect personal data from children under 16.

11. Changes to this policy

We may update this policy when our services or the law change. The latest version is always published here, with its date. If a change is significant, we will tell you by email or on the website.