Privacy policy
Privacy Policy
Who we are
C it all ("we", "our", "us") is an online store. We are the data controller for the personal data we collect and process in connection with your visit and your purchases.
Contact
C it all Customer Service
citallshop@gmail.com
Personal data we collect
- Identity and contact details: name, email address, phone number, delivery/billing address
- Order and payment details: order contents, total amounts, transaction references (payment providers handle full payment details)
- Delivery details: delivery method, tracking, delivery status
- Support details: messages and attachments you send to our support
- Technical details: IP address, device/browser information, log data
- Usage and marketing data: pages viewed, cart activity, marketing preferences via email/SMS
- Optional data: product reviews, survey responses
How we use your data (legal bases)
- Process and deliver your orders, provide support, handle returns/refunds (contract)
- Fraud prevention, account and website security, prevention of misuse (legitimate interests)
- Compliance with legal obligations (tax, accounting, consumer rights)
- Improve products, website performance and customer experience (legitimate interests)
- Send service notifications about your orders (contract/legitimate interests)
- Send marketing emails/SMS if you have opted in; you can unsubscribe at any time (consent/legitimate interests)
Cookies and tracking
- We use cookies and similar technologies for essential functions (cart, checkout), analytics and marketing (including cart reminders if you have opted in to SMS or email).
- You can manage cookies in your browser. Blocking certain cookies may affect site functionality.
- See our cookie policy for more information.
Data processors and partners
We share personal data with the following categories of data processors (all with DPA agreements under GDPR):
- Platform provider: Shopify Inc. (Canada/USA) — hosts the online store
- Payment processors: Stripe, Klarna, PayPal — handle payments and refunds (they process full payment details)
- Delivery partners: PostNord, DHL and others — pack, ship and deliver orders
- Email and withdrawal handling: Shopify Email, 401layers UG (EU Widerruf Button & Form, via AWS SES) — send transactional emails, order confirmations and withdrawal confirmations
- Translation: Translate & Adapt (Shopify) — translates store content
- Analytics and fraud prevention: Shopify Analytics, Shopify Fraud Protection
We do not sell personal data. All processors handle your data only according to our instructions.
International transfers
Some partners may process data outside the EU/EEA. Where applicable, we rely on lawful transfer mechanisms (e.g. Standard Contractual Clauses) and require appropriate safeguards.
Retention
We retain your personal data as follows:
- Orders, invoices and accounting records: 7 years (Swedish Bookkeeping Act)
- Withdrawal requests: 6 months in the app database, plus archive according to bookkeeping requirements
- Customer support conversations: 2 years after last contact
- Marketing data: until you unsubscribe or request deletion
- Technical logs: 90 days
- Inactive accounts: 3 years after last activity, then deleted or anonymised
You can request deletion at any time via citallshop@gmail.com.
Your rights (EU/EEA and applicable local laws)
- Access: request a copy of your data
- Rectification: correct inaccurate data
- Erasure: request deletion when we no longer need the data or where required by law
- Restriction: ask us to restrict processing in certain cases
- Objection: object to processing based on legitimate interests, including direct marketing
- Portability: receive data you have provided in a portable format where applicable
To exercise your rights, email citallshop@gmail.com. We may need to verify your identity.
Right of withdrawal (EU Directives 2011/83 and 2023/2673)
As a consumer in the EU/EEA, you have the right to withdraw from your purchase within 14 days of receiving the goods, without giving any reason.
To exercise your right of withdrawal:
- Use our withdrawal form at citall.store/pages/ångerrätt
- Or contact us at citallshop@gmail.com
You will receive automatic confirmation by email when we receive your request. Refunds are processed within 14 days from when we receive the goods, to the same payment method you used at purchase.
Some goods are exempt from the right of withdrawal by law (e.g. custom-made goods, hygiene items with broken seal). See our Refund Policy for details.
Complaints to supervisory authority
If you believe we are handling your personal data incorrectly, you have the right to file a complaint with the Swedish Authority for Privacy Protection (IMY):
- Web: imy.se
- Email: imy@imy.se
- Post: Box 8114, 104 20 Stockholm, Sweden
Marketing choices
- Email: use the unsubscribe link in any message
- SMS: reply STOP or follow the instructions in the message
- You can also contact us to update your preferences
Security
We use appropriate technical and organisational measures to protect personal data. No method of transmission or storage is 100% secure, but we continuously work to improve our safeguards.
Automated decision-making and profiling
We do not use automated decision-making or profiling that produces legal or similarly significant effects on you. Personalised product recommendations are based on general behavioural patterns and have no legal consequences.
Children
Our store is not intended for children under 16. We do not knowingly collect data from children under 16.
Third-party links
Our website may link to third-party websites. We are not responsible for their privacy practices. Please review their policies.
Updates to this policy
We may update this policy to reflect legal changes or changes in our practices. Material changes will be posted here with an updated effective date.
Effective date: 12 June 2026
Previous version: 14 November 2025