Privacy policy.

1. Controller

26Bespoke is the controller for the processing described here. Contact: +46 73 850 60 90.

2. Data we process, and why

Waiting list. When you join the list for a drop we store your email address, your mobile number if you provide one, which drop you signed up for, the time of signup and the IP address the request came from. The data is used to send you the key that opens the order for that drop, and to prevent abuse of the form. Legal basis: our legitimate interest in running the drop and protecting the service. Entries that do not lead to an order are deleted after twelve months.

Orders. When you order a piece we process name, delivery address, phone number, email address, payment details and the specification of the piece. The data is used to fulfil the contract. Legal basis: performance of a contract. Accounting records are retained for seven years as required by the Swedish Bookkeeping Act; the specification is retained for as long as the piece exists, since it forms part of the passport.

Passport. Every numbered piece has a passport containing its serial number, specification and the name of its registered owner. The passport is shown to anyone who holds the card against a phone. You may ask us to display only the serial number and registration date instead of your name.

Server logs. Our servers and our security provider log IP address, time and the page requested, for security and troubleshooting. Legal basis: legitimate interest. Logs are kept for no longer than thirty days.

3. Recipients

The workshop that casts your piece receives its technical specification — measurements, metal, stone — and your name only where an engraving requires it. Carriers receive delivery details. Payment providers receive what is needed to process the payment. Authorities receive data when the law requires it.

Cloudflare, Inc. (USA) delivers the site and protects it against attacks. Cloudflare processes IP address and request metadata on our behalf as a data processor under a data processing agreement incorporating the EU standard contractual clauses, and is certified under the EU–US Data Privacy Framework.

Visit statistics are collected with Cloudflare Web Analytics, which counts page views without cookies, without local storage and without identifying you.

We never sell personal data.

4. Cookies and similar storage

The site sets the following.

__cf_bm	Cloudflare. Distinguishes people from automated traffic. Strictly necessary. Expires after 30 minutes.
cf_clearance	Cloudflare. Set only if a security check has been passed. Strictly necessary. Expires after 30 minutes.
juv-samtycke	Our own, in the browser's local storage. Remembers that you have seen the cookie notice so it is not shown again. Strictly necessary.

All of these are strictly necessary for the site to work and require no consent. The site sets no cookies for statistics, marketing or profiling.

5. Transfers outside the EU

Cloudflare may process data outside the EU. The transfer is covered by the EU standard contractual clauses and the EU–US Data Privacy Framework. No other recipient processes your data outside the EU.

6. Your rights

You have the right to access the data we hold about you, to have it corrected, to have it deleted once we no longer need it, to restrict or object to processing based on legitimate interest, and to receive the data you have given us in a portable format. Contact us on +46 73 850 60 90; we respond within a month. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection, imy.se.

7. Changes

If this policy changes, the new version is published here with a new date.