Privacy Policy
xirBX AB, registration number 559136-5068, is the data controller for the personal data processing described in this policy. Contact us at info@ceshop.se with questions about our processing.
1. Data Controller
xirBX ABRegistration number: 559136-5068
Långvinkelsgatan 14
265 71 Kvidinge
Sverige
info@ceshop.se
2. What personal data we collect
We collect personal data that you provide to us or that arises in connection with your purchase or contact with us. This may include:
- Identity data: name, username
- Contact data: email address, phone number
- Delivery data: delivery address, postcode, city, country
- Order data: ordered products, order number, order date, price
- Payment information: payment method, transaction status (card details are handled by Stripe and not stored by us)
- Communications: messages you send to us via contact forms or email
- Technical data: IP address and session data collected automatically
3. Purposes and legal basis
We process your personal data for the following purposes:
| Purpose | Legal basis |
|---|---|
| Manage orders and carry out deliveries | Performance of contract (purchase agreement) |
| Send order confirmation and delivery notifications by email | Performance of contract |
| Forward delivery details to PostNord and DHL | Performance of contract |
| Process payment via Stripe | Performance of contract |
| Manage customer accounts and login | Performance of contract / Legitimate interest |
| Handle complaints, returns and withdrawal notices | Legal obligation / Performance of contract |
| Accounting and bookkeeping | Legal obligation (Bookkeeping Act) |
| Security and logging to prevent misuse | Legitimate interest |
4. Recipients of personal data
We share personal data with the following recipients when necessary:
- PostNord – for parcel delivery (name, address, phone, email)
- DHL – for parcel delivery (name, address, phone, email)
- Stripe – for payment processing (payment information is handled directly by Stripe)
- Telia/mailhost – SMTP server for outgoing email (sender information)
We do not sell your personal data to third parties for marketing purposes.
5. Transfers outside the EU/EEA
PostNord and DHL operate within the EU/EEA. Stripe Inc. is a US company that processes payment data; Stripe maintains appropriate safeguards under GDPR. We take measures to ensure that any transfers outside the EU/EEA are subject to an adequate level of protection.
6. How long we retain data
| Category | Retention period |
|---|---|
| Order data | 7 years (Bookkeeping Act requirements) |
| Customer account (upon registration) | Until the account is closed, then 1 year for complaints purposes |
| Communications (email, contact forms) | Up to 3 years or until the matter is resolved |
| Technical logs | Normally 30–90 days |
7. Your rights
Under GDPR you have the right to:
- request access to the personal data we process about you (subject access request),
- request correction of inaccurate data,
- request erasure of data under certain conditions,
- request restriction of processing,
- object to processing based on legitimate interest,
- request data portability for data you have provided to us,
- withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
Contact us at info@ceshop.se to exercise your rights.
If you believe we are processing your personal data incorrectly, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), www.imy.se.
8. Security
We take technical and organisational measures to protect your personal data against unauthorised access, loss and misuse. Payments are handled by Stripe over encrypted connections (HTTPS/TLS). Passwords are stored using approved hashing. System logs are protected and access is restricted to authorised personnel.