Privacy Policy

Halmstad – Revised 23 August 2026

This policy describes what we collect when you visit idyllskincare.com, what we do with it, which other companies are involved, and what you can ask of us. If anything here is unclear, get in touch.

It covers all of idyllskincare.com. The basket, the checkout and My Account are rendered by our WooCommerce installation but served on this address, so they are covered too.

1. Introduction

1.1 What is personal data, and what counts as processing it?

Personal data is any information that can be attributed, directly or indirectly, to a living person. Images and audio recordings handled by a computer can be personal data even if no name is mentioned. Encrypted data and electronic identifiers such as IP addresses are personal data if they can be connected to a person. Every operation performed on personal data is processing, whether or not it is automated — collection, recording, organisation, structuring, storage, alteration, transfer and erasure are all common examples.

1.2 Who is responsible for the personal data we collect?

Idyll Sweden AB, company registration number 559262-1717, Kristinebergsvägen 15, 302 41 Halmstad, Sweden, is the data controller for the processing described here. You can reach us at info@idyllsweden.com.

2. What we use your personal data for

2.1. To handle your orders

Which includes:

Delivery (including notifications and contact about the delivery).
Identification and age verification.
Handling payment (including assessing which payment options are available, which can involve a check against payment history and a credit report obtained via Kustom).
Handling complaints and warranty claims.

For this we process:

Name
Swedish personal identity number
Contact details (such as address, email and phone number)
Payment history
Payment information
Credit reports from credit reference agencies
Order information (such as which item was ordered, or whether it is to be delivered to a different address)
My Account login details (if you have an account)

Payment is taken in Kustom Checkout (formerly Klarna Checkout), embedded in our checkout page. Kustom is its own data controller for what happens there — including identification and any credit check — and processes the data under its own privacy policy.

Legal basis: Performance of the purchase agreement. We need this data to meet our obligations under that agreement. If it is not provided we cannot meet them, and we have to decline the purchase.

Retention: Until the purchase is complete (including delivery and payment), and for 36 months after that, so that we can handle any complaint or warranty claim.

2.2. So that you can manage and follow up your purchases

When you buy from us, a customer account is created. Signed in, you will find My Account, where you can:

See your order history.
Change your personal details and settings.

2.3. To meet the company’s legal obligations

Processing necessary to comply with legal requirements, court decisions or decisions by public authorities — for example the Swedish Bookkeeping Act and the Money Laundering Act, or the rules on product liability and product safety, which can require us to communicate with the public and with customers about, say, a defective or unsafe product.

For this purpose we process:

Name
Swedish personal identity number
Contact details (such as address, email and phone number)
Payment history
Payment information
Your correspondence with us
Details of the purchase — when, where, and any fault or complaint
My Account login details (if you have an account)

Legal basis: Legal obligation. This data is required by law. If it is not provided we cannot meet our legal obligation, and we have to decline the purchase.

Retention: Until the purchase is complete (including delivery and payment), and for 36 months after that, or up to seven years for data covered by the Bookkeeping Act.

2.4. To handle customer service matters

Which includes:

Communicating with you and answering questions to customer service (by phone or in digital channels, including social media).
Identification and questions about your account.
Investigating complaints and support cases (including technical support).
Questions and advice before and after a purchase, questions about products, returns, changes to an order and similar matters.

For this we process:

Name
Swedish personal identity number
Contact details (such as address, email and phone number)
Your correspondence with us
Details of the purchase (when, where, and any fault or complaint)
My Account login details (if you have an account)

Legal basis: Legitimate interest, and explicit consent where we process sensitive data. The processing is necessary to serve our and your legitimate interest in resolving customer service matters.

Retention: 36 months after the customer service matter is closed.

If you sign up for the newsletter, your email address is sent to our own customer database. Three things are stored: the address, the fact that the consent covers marketing by email, and the time and the page where you signed up. That last part is the evidence that you said yes. The form does not take anything else — it sends the address and the path of the page, and nothing more.

The address is also added to Resend, the service that sends the emails. So that the form cannot be abused, a salted hash of your IP address — not the address itself — is stored briefly and then deleted automatically.

Legal basis: Consent. You can unsubscribe at any time using the link in every email, or by emailing us.

2.6. To see how the site is used

We measure visits with Umami, which we run ourselves and which answers from this domain. Umami sets no cookies and does not follow you between sites. The statistics stay with us — no third party receives them. What we see is page views and a few shop events: that a product page was viewed, that something was added to the basket, that the checkout was opened.

Because Umami stores nothing on your device, it runs regardless of how you answer the cookie question.

Legal basis: Legitimate interest in knowing what does and does not work on our own website.

2.7. For marketing, and to measure it

If you accept cookies, we load Google Tag Manager (container GTM-PGFQV9GM), and through it Google Analytics 4 (G-ZM5EJEBHPP) and the Google Ads conversion tag (AW-16722183896). We also store the advertising identifiers that came with your click.

Concretely: if you click an ad on Google, Meta, Microsoft, TikTok, Pinterest or Snapchat, a click identifier travels with the link. We put it in a first-party cookie together with any utm parameters, the page you landed on and the page you came from, plus a randomly generated visit id. We also set Meta’s two identifiers in Meta’s own format. Which cookies these are, and how long they last, is in section 5.2.

What it is used for: connecting an order to the ad that led to it, so we know which marketing is worth the money, and being able to show you relevant ads rather than random ones.

Legal basis: Consent. If you say no, none of the cookies above are set. Google’s tags still load, but with the signal that they may neither store anything on your device nor use data for advertising (Google Consent Mode v2). See section 5.

2.8. To prevent misuse and crime against the company and its customers

Preventing and investigating fraud and other offences. Preventing spam, phishing, harassment, attempts to sign in to accounts without permission, and other actions prohibited by law or by our terms of purchase and service. Protecting and improving our IT environment against attack and intrusion.

For this purpose we process:

Swedish personal identity number
Purchase and usage data (for example click and visit history)
Technical data about the devices used and their settings (for example language setting, IP address, browser settings, time zone, operating system, screen resolution and platform)
Data about how our digital services are used

Legal basis: Compliance with a legal obligation where one exists, otherwise legitimate interest. Where no legal obligation applies, the processing is necessary to serve our legitimate interest in preventing misuse of a service and in preventing and investigating crime against the company.

Retention: From collection, and for 36 months after that.

2.9. For recruitment and personnel administration

Handling job applications and any subsequent hire, ending employment, and administering any rehabilitation or discrimination matters. For this we process:

CV
Name
Phone number
Email address
Postal address
Swedish personal identity number
Covering letter, which may contain medical history or similar
Email correspondence between us and the candidate
Our notes from interviews
Contact details for references

If you have given us contact details for references, we store only their name, phone number and email address, and only until the recruitment process is finished.

Legal basis: Legitimate interest in completing or ending recruitment processes and, where applicable, retaining information as evidence in discrimination matters or similar. Explicit consent where sensitive information may occur.

Retention: 60 months from collection or from the end of the recruitment process.

3. Where we collect the data from

Besides what you give us yourself, and what we collect from your purchases and how you use the site, we may also collect personal data from a third party. What we collect from third parties is:

Address details from public registers, to make sure we have the right address for you
Creditworthiness data from credit rating institutes, banks or credit reference agencies — in practice via Kustom in the checkout

4. Which services are involved

4.1. The services the site is built from

The site is made of several parts hosted by different providers. You reach several of them through this domain because the request is passed on behind the scenes — which is why the address in your browser is always idyllskincare.com. Here is everyone who can see something about you, and what they do:

Vercel — hosting and CDN. The pages are static files that Vercel delivers. Vercel sees the ordinary web server details, such as IP address and browser, when your browser fetches them.
WordPress with WooCommerce — our own shop installation, which renders the basket, the checkout and My Account. It runs, with its database, on a hosting provider inside the EU. It sets its own session cookies on those pages; without them there is no basket and no checkout.
Kustom (formerly Klarna Checkout) — payment. Kustom is an independent data controller for what happens in the checkout, including identification and credit checks, and processes the data under its own privacy policy.
Our customer database — newsletter signups are written to a database we run ourselves: a managed Postgres at Neon in the EU (region eu-central-1).
Resend — sends the newsletter. We send it the email addresses of people who have signed up. Resend never reads from the database.
Umami — our own installation for visit statistics, see section 2.6.
Google — Tag Manager, Google Analytics 4 and Google Ads, only if you have accepted cookies, see section 2.7.
Google Customer Reviews — the survey Google offers you on the order confirmation page. When that page loads, your order number, e-mail address, delivery country and an estimated delivery date are passed to Google. A survey is only sent if you tick the box yourself, and Google is an independent data controller for it under its own terms.

4.2. Other recipients

Where it is necessary for us to provide our services, we share your personal data with companies acting as our data processors. A data processor handles the information on our behalf and on our instructions. We use data processors for:

Transport (logistics companies and freight forwarders)
Payment solutions (card acquirers, banks and other payment service providers)
Marketing (print, social media, media agencies and advertising agencies)
IT services (companies handling the operation, technical support and maintenance of our IT solutions)

When your personal data is shared with a data processor, it happens only for purposes compatible with those we collected the information for.

We also share personal data with certain companies that are independent data controllers. That means we do not decide how they process the information. Such recipients are:

Public authorities (the police, the Swedish Tax Agency or others) where we are required to do so by law or where a crime is suspected
Companies providing general goods transport (logistics companies and freight forwarders)
Companies providing payment solutions (card acquirers, banks and other payment service providers)

When your personal data is shared with an independent data controller, that company’s own privacy policy and data handling apply.

We will never share your personal data with a third party so that they can market their own products or services to you without your consent.

4.3. Business transfers

As we continue to develop the business we may sell some of our assets. In such transactions, user information, including personal data, is generally one of the business assets transferred.

4.4. Where the data is processed

We aim for your personal data to be processed within the EU/EEA. Our own customer database is in the EU. The shop installation and its database run on a hosting provider inside the EU, and our Umami installation we run ourselves.

The other providers above — Vercel, Resend and Google among them — are US companies and may process data outside the EU/EEA. What applies to that transfer follows from each provider’s own terms. Wherever the data is processed, we take reasonable legal, technical and organisational measures so that the level of protection matches the one inside the EU/EEA.

The first time you visit, we ask. Until you answer, everything to do with statistics and advertising is off: Google Consent Mode v2 is set to "denied" for all four signals — ad_storage, ad_user_data, ad_personalization and analytics_storage. It is set in the page head before any tag can load, so it is not a state that gets skipped past.

The banner has two buttons, "Accept" and "Essential only", with the same size, the same border and the same contrast. Say no and the shop works exactly as before — we just measure less.

Your answer is stored in your own browser, under the key idyll.consent.v1 in localStorage. It is not a cookie and it is not sent to us; it holds your answer and the time you gave it, nothing else.

You can change your mind at any time. Click "Cookie settings" at the bottom of any page and the choice is cleared and the question comes back.

5.2. What is stored on your device

Essential — always set, because the shop does not work without them:

idyll.consent.v1 (localStorage) — your cookie choice and when you made it.
idyll.cart.v1 (localStorage) — the contents of your basket.
idyll.cart.nonce (sessionStorage) — a single-use key for the shop API, which disappears when you close the tab.
WooCommerce’s own session cookies — set on the basket, the checkout and My Account, and what holds your session together there.

Marketing and measurement — set only if you have accepted:

idy_attr (cookie, 90 days) — advertising click identifiers, utm parameters, the page you landed on and the page you came from.
idy_sid (cookie, 90 days) — a randomly generated visit id, not linked to any detail about you.
_fbp and _fbc (cookies, 90 days) — Meta’s advertising identifiers. _fbc is only set if you actually arrived via a Meta click.
Google’s own cookies — set by Google Tag Manager and Google Ads, under Google’s own terms.

If you say no — or change your mind to no — idy_attr, idy_sid, _fbp and _fbc are deleted if they are still there from before. Those four are set from the page, and in Safari the browser itself shortens such cookies to seven days regardless of what we ask for. Umami sets no cookies at all.

5.3. You can also control this in your browser

Your browser or device lets you change the settings for how and how widely cookies are used. You can, for example, block all cookies, accept first-party cookies only, or delete cookies when you close the browser. Bear in mind that parts of the shop will not work if you block or delete everything — the basket is one of them. You can read more about cookies in general on the Swedish Post and Telecom Authority’s website, pts.se.

6. How long we keep your personal data

We never keep your personal data longer than is necessary for each purpose. The specific retention periods are given under each purpose in section 2. In addition:

The cookies in section 5.2 last as long as stated there, and you can delete them yourself in your browser at any time.
Newsletter: the address and the consent record are kept for as long as you are subscribed. Unsubscribe with the link in any email and we stop writing to you; email deleteme@idyllskincare.com and we remove you from both the database and Resend.

7. Your rights

Right of access. If you want a fuller picture of which personal data we process about you, you can ask for access to it. The information is provided as a register extract stating the purposes, the categories of personal data, the categories of recipients, the retention periods, where the information was collected from, and whether any automated decision-making takes place. Note that we may ask for further details to make sure the information goes to the right person.

Right to rectification. You can ask us to correct your personal data if it is wrong. Within the stated purpose you also have the right to complete data that is incomplete.

If you have an account on idyllskincare.com you can change some details yourself under My Account. You also have the right to withdraw a consent you have given us at any time — for example your consent to the newsletter, or to cookies.

Right to erasure. You can request erasure of personal data we process about you if:

The data is no longer necessary for the purposes for which it was collected or processed.
You object to a balancing of interests we have made on the basis of legitimate interest and your reason for objecting outweighs our legitimate interest.
You object to processing for direct marketing purposes.
The personal data is processed unlawfully.
The personal data has to be erased to comply with a legal obligation we are subject to.
The personal data was collected about a child (under 13) for whom you have parental responsibility, and the collection took place in connection with the offer of information society services.

To have everything erased, email deleteme@idyllskincare.com. That request covers your contact record, your marketing consent and your entry with Resend, the service that sends the newsletter. We confirm when it is done, and at the latest within a month of the request.

Note that we may be entitled to refuse your request if legal obligations prevent us from erasing certain personal data immediately. Those obligations come from accounting and tax law, banking and anti-money-laundering law, and also from consumer law. The processing may also be necessary for us to establish, exercise or defend legal claims. If we are prevented from meeting a request for erasure, we will instead block the personal data from being used for any purpose other than the one preventing the erasure.

Right to restriction. You have the right to ask us to restrict our processing of your personal data. If you contest that the data we process is accurate, you can ask for restricted processing while we check it. If we no longer need the data for the stated purposes but you need it to establish, exercise or defend legal claims, you can ask us not to erase it. If you have objected to a balancing of interests, you can ask for restricted processing while we check whether our legitimate interests outweigh yours.

If processing has been restricted under any of the situations above, then apart from storing it we may only process the data to establish, exercise or defend legal claims, to protect someone else’s rights, or where you have given your consent.

Right to object to certain processing. You always have the right to be spared direct marketing, and to object to any processing of personal data based on a balancing of interests.

Legitimate interest: where we use a balancing of interests as the legal basis, you may object to the processing. To continue processing your personal data after such an objection, we need to show compelling legitimate grounds that outweigh your interests, rights or freedoms. Otherwise we may only process the data to establish, exercise or defend legal claims.

Direct marketing (including analysis carried out for direct marketing purposes): you may object to your personal data being processed for direct marketing. The objection also covers the analysis of personal data — profiling — carried out for that purpose. Direct marketing means any outbound marketing activity, for example by post, email and SMS.

If you object to direct marketing, we will stop processing your personal data for that purpose and stop all direct marketing activity. You can change this through the settings under My Account, through the unsubscribe link in marketing emails, or by contacting customer service.

Right to data portability. Where our right to process your personal data is based either on your consent or on the performance of a contract with you, you have the right to ask for the data concerning you that you have provided to us to be transferred to another data controller. This requires the transfer to be technically possible and capable of being performed automatically.

8. How we handle Swedish personal identity numbers

We only process your Swedish personal identity number where it is clearly warranted given the purpose, necessary for secure identification, or where there is another significant reason. We always minimise the use of it as far as possible.

9. How your personal data is protected

We use IT systems to protect the confidentiality, integrity and availability of personal data. We have taken specific security measures to protect your personal data against unlawful or unauthorised processing (such as unlawful access, loss, destruction or damage). Only the people who genuinely need to process your personal data in order for us to meet the stated purposes have access to it.

10. #IDYLLSWEDEN

We are glad when you share your results and experiences with our products — and we love seeing our products in people’s homes. So much so that we may ask whether we can use your photos in our own channels, such as Instagram, the newsletter and idyllskincare.com. If you get such a request from us and want to share, you can reply to it. The following then applies.

The Nordics and other countries: You grant Idyll Sweden AB (a Swedish company, registration number 559262-1717) a non-exclusive, royalty-free, worldwide licence to use your images at Idyll Sweden’s own discretion and without any obligation towards you, for use in its marketing and/or advertising, including but not limited to the right to reproduce, distribute, alter and edit your images. You also give Idyll Sweden your consent to use photographs in which you can be identified for marketing and/or advertising purposes, under the Swedish Act on Names and Pictures in Advertising (1978:800).

You represent and warrant that you own or control the rights to the material you have submitted, and that you have permission from everyone appearing in the images. You further confirm that you are an individual (that is, not a company), that you are at least 18 years old or have parental consent, and that Idyll Sweden’s use of your images will not infringe any third party’s rights or any law.

You hereby release Idyll Sweden from any obligation to pay you for the use of your images and for the intellectual property rights in them in connection with the uses described above, and you agree to hold Idyll Sweden and everyone acting on Idyll Sweden’s behalf harmless from any claims, demands and liabilities of any kind in connection with the use of the images as described above.

Swedish law governs these terms, and the competent courts in Stockholm shall have exclusive jurisdiction over any dispute arising from them.

If you want to withdraw your consent to share your images with Idyll Sweden, contact us at info@idyllsweden.com.

11. Links to other websites

This website may contain links to or from other websites. Note that we are not responsible for the privacy practices of other sites. This privacy policy covers only the information we collect on our own. We encourage you to read the privacy policy of any site you reach from ours, or otherwise visit.

12. Keeping your details up to date

We take reasonable steps to keep an accurate record of the information you have given us through this website, but we cannot verify that your information is still current. You can review and change the details you have given us at any time by signing in to My Account, or by getting in touch.

13. Supervisory authority

The Swedish Authority for Privacy Protection (IMY, formerly Datainspektionen) is responsible for supervising the application of data protection law in Sweden. Anyone who believes a company is handling personal data incorrectly can lodge a complaint with IMY.

14. Questions and changes

If you have questions about data protection, or want to use any of the rights in section 7, email us at info@idyllsweden.com. If what you want is erasure, write to deleteme@idyllskincare.com instead — see section 7. We answer in English or Swedish.

We may make changes to this policy. The latest version is always here on the website, with the revision date at the top. Where an update is significant for our processing of personal data — for example changed purposes or new categories of personal data — we will say so here and by email, if you have given us an address, in good time before it takes effect, and explain what the change means for you.