Privacy Notice
1. Introduction
Your privacy is important to us at Venture Design AB, and we have therefore created this privacy notice to provide you with information about, among other things, how and why we process your personal data and how you can exercise your rights regarding personal data.
References to "we", "our" or "us" refer to Venture Design AB, and "you", "your" or "yours" refer to the data subject whose personal data we process.
2. Definitions
In this privacy notice, definitions are used that correspond to those found in the EU's General Data Protection Regulation 2016/679 ("GDPR"), such as "personal data", "processing", "data subject", "supervisory authority", "data controller", "data processor", and others. Each of these definitions has the same meaning as stated in Article 4 of the GDPR. For a complete list and exact definitions, please see this article.
In addition to the definitions stated in Article 4 of the GDPR, the following are also used in this privacy notice:
Third-party services: refers to third-party information, services, products, systems, websites, software, networks, databases, and platforms that the website links to, or that an individual connects to or enables integration with when the individual uses the website.
Website: refers to www.venturedesign.se, www.vindcollection.se, and any subdomains.
3. Data Controller
We are the data controller for the processing of personal data, to the extent that we determine the means and purposes of the processing (according to the principle of accountability). Our processing of personal data is carried out in accordance with the GDPR and the fundamental data protection principles, in the manner described in this privacy notice. This privacy notice also applies to services related to our website and our social media. However, there may be links to other websites, and when you choose to follow these links, our data protection policy no longer applies.
In some cases, we may process personal data as a data processor, for example, in cases where we deliver goods to one of our resellers' customers (hereinafter referred to as "end customer"). In such cases, our processing of the end customer's personal data is carried out in accordance with the data processing agreement we have entered into with the reseller, and it is the reseller who is the data controller. The information provided in this privacy notice therefore does not apply to such situations.
Unless otherwise expressly stated, we are the data controller for the processing described in this privacy notice.
4. How we obtain personal data
We usually receive personal data when:
· someone contacts us,
· we enter into an agreement with you or another third party,
· we deliver our products to our customer or an end customer,
· someone signs up to receive our newsletter,
· someone visits our website.
5. Categories of personal data we process
We only process personal data that is adequate, necessary, and relevant to fulfill the purpose for which it was collected (according to the principle of data minimization).
· Customer and contact information: This includes details such as your first and last name, email address, phone number, delivery address (residential address), username, and your user ID for your account on the website. We collect this information when you place an order for goods from us. We may also process your username for social media if you contact us there.
· Order information: Delivery and billing address and other details about the goods you have purchased from us, as well as receipts for completed purchases. We process this data to fulfill the delivery to you and comply with accounting law requirements.
· Purchase history: We store your purchase history regarding our goods to handle any questions or issues that may arise and to tailor our offers and recommendations based on your previous purchases from us.
· Case data: This includes your communication with our customer service, for example, via email, chat, or phone calls, regarding various matters such as complaints, support cases, and similar.
· Consent data: This category includes information about any consents you have given, for example, regarding direct marketing or the use of cookies on our website.
· Other: Other personal data provided to us, for example, when contacting our customer service.
6. Legal basis for processing personal data
In accordance with the principle of purpose limitation, we only process personal data for specific, explicitly stated, and legitimate purposes. Additionally, each processing activity is legally based in accordance with the provisions of the GDPR.
We primarily process personal data based on one of the following legal grounds:
· Consent: You have given your consent for your personal data to be processed for one or more specific purposes (Article 6.1.a GDPR).
· Contract: The processing is necessary to fulfill a contract to which you are a party or to take steps at your request before entering into such a contract (Article 6.1.b GDPR).
· Legal obligation: The processing is necessary to fulfill a legal obligation to which we are subject (Article 6.1.c GDPR).
· Legitimate interest: The processing is necessary for purposes related to our or a third party's legitimate interests, unless your interests or fundamental rights and freedoms outweigh and require the protection of personal data (Article 6.1.f GDPR).
In some cases, it is optional for you to provide your personal data to us. However, if you do not provide your personal data, we may not be able to handle the matter in question. You may need to provide certain personal data to enter into a contract with us or for us to fulfill legal or contractual obligations.
When the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of the processing based on the consent before it was withdrawn.
When the processing of personal data is based on legitimate interest as a legal basis, our assessment is that the processing does not constitute an intrusion into your right to privacy and integrity. We have reached this conclusion after balancing, on the one hand, what the processing in question means for your interests and right to privacy, and on the other hand, the legitimate interest in the processing in question.
7. Specific processing activities
Below you can read more about the legal basis and purpose of the processing of personal data.
7.1 When you visit the website
The website uses cookies. The use of non-essential cookies only occurs if you give your consent. You can withdraw a given consent at any time (without affecting the legality of the processing carried out based on the consent before it was withdrawn). Legal basis for the above processing: Consent. You can read more information about how cookies are used in the cookie notice published on the website.
7.2 When you contact us
When you contact us, for example via email, contact form on the website or social media, we only process the personal data needed to answer your question or help you with your case, such as your name, email address, phone number, delivery address or similar.
In our assessment, we have a legitimate interest in processing the personal data to know who we are talking to and to keep in touch regarding the matter.
Our assessment is also that the processing is necessary for a purpose related to a legitimate interest, and that your interest in protecting your personal data does not outweigh, and that the processing in question does not infringe on your fundamental rights and freedoms.
Legal basis for the above processing: Legitimate interest.
7.3 When we enter into a purchase agreement with a customer in the performance of the agreement
We process the following personal data belonging to our customer as a consumer in connection with entering into a purchase agreement and in the performance of the agreement:
· First name
· Last name
· Personal identification number
· Residential address
· Delivery address
· Billing address
· Email address
· Phone number
If the customer is a business operator/legal entity, we may process the following personal data belonging to the customer's representative who places the order:
· First name
· Last name
· Email address
· Phone number
The above personal data is processed to the extent necessary to enter into and perform the agreement.
Legal basis for the above processing: Agreement.
Order ID and order history are processed by us each time a customer places an order for goods from us, to be able to follow up on the matter, safeguard our contractual rights and our other legitimate interests. The processing also takes place to be able to recommend similar products that may be of interest to the customer.
Legal basis for the above processing: Legitimate interest.
In the event of complaints regarding our goods or a consumer's invocation of the right of withdrawal, we process order ID and order history as well as necessary personal data belonging to the customer in question, to handle the matter and otherwise fulfill our obligations under applicable legislation.
In the event that we make a payment to a customer due to an approved complaint case or right of withdrawal, we need to process the personal data to meet accounting requirements under the Accounting Act. Processing of a consumer's personal data also takes place to fulfill their rights under, among other things, the Distance Contracts Act and the Consumer Purchase Act.
Legal basis for the above processing: Legal obligation.
We process the following accounting documents within the framework of our business: invoices, receipts, and other accounting documents that we are required to process and store according to the Tax Agency's requirements and/or applicable legislation, such as the Accounting Act. Accounting documents and verifications may in some cases contain personal data, such as name, delivery address, and any other contact details belonging to physically living persons (e.g., consumer, reference persons, signatories, etc.). Such documents are stored as long as the law and/or the Tax Agency require it.
Legal basis for the above processing: Legal obligation.
7.4 Marketing
In connection with your purchase of one or more items from our range, we process your personal data for marketing purposes to maintain good customer care. The legal basis for processing your data is your consent given in connection with the completion of the purchase. You can always withdraw your consent by clicking the unsubscribe button at the bottom of a newsletter. The terms under this point only apply to you who have made a purchase via our websites.
7.5 Newsletter
You can consent to receive newsletters from us by giving your active consent to us processing your email address to send newsletters to you. It is voluntary to provide your email address to us for this purpose, which means that it is not a statutory or contractual requirement or a requirement necessary to enter into an agreement with us, and you are not obliged to provide your email address, but the possible consequences of not providing your email address to us are that we will not send our newsletters to you.
You can unsubscribe from the newsletters at any time by clicking the unsubscribe link in the newsletter and thereby withdraw your consent. If you withdraw your consent, we will not continue to send newsletters to you.
Legal basis for the above processing: Consent.
If you unsubscribe from the newsletters, you will be removed from the email list for newsletter recipients, but your email address will remain in the database with a block for receiving newsletters. The purpose of this is to ensure that you do not receive multiple newsletters from us.
If you want your email address to be deleted from the block list as well, you can contact our customer service via email and request this. You are hereby informed that if your email address is deleted from the block list, it means that you may receive newsletters from us again if you or someone else registers your email address to receive newsletters again.
In our assessment, we have a legitimate interest in processing the personal data for the above-mentioned purposes. The processing is necessary for a purpose related to a legitimate interest, and that your interest in protecting your personal data does not outweigh. Our assessment is that the processing in question does not infringe on your fundamental rights and freedoms.
Legal basis for processing personal data: Legitimate interest.
7.6 When we manage our customer relationships
Our customers may receive a request from us to participate in a survey or leave a review regarding our goods, and in such cases, the customer's name and email address are processed. If the customer chooses to participate, the personal data provided by the customers in connection with the survey or review are processed. For example, name, email, responses to the survey, and/or the written review. The processing is based on our legitimate interest in analyzing and developing our business. Legal basis for processing personal data: Legitimate interest.
If we are required by applicable law to notify you of changes to our privacy notice, terms of use, or similar, we will process the following personal data belonging to you: name, email address, phone number, order history. The processing is necessary to fulfill a legal obligation. Legal basis for processing personal data: Legal obligation.
7.7 Other purposes for our processing of personal data
Based on our legitimate interest as a legal basis, we may process personal data to:
· carry out direct marketing of our products by sending emails with information, campaigns, and/or offers to our customers via email or other means of communication.
· ensure the technical functionality of the website, by hiring developers or specific programs to test its functions.
· protect us against misuse, crime, fraud, intrusion, or other damage to our property, by reporting such incidents and providing necessary information to relevant authorities, such as the Police.
8. Storage of Personal Data
We take various security measures to protect the personal data we process and have established internal routines for our handling of personal data, including personal data incidents.
Storage Location
We always strive to process personal data within the European Union (EU) or the European Economic Area (EEA) to maintain high standards of data protection. In some cases, however, personal data may need to be transferred and processed outside the EU/EEA. To ensure adequate protection for your personal data during such transfers, we take appropriate safeguards. This may include, for example, using standard contractual clauses approved by the European Commission or ensuring that the recipient country has adequate data protection laws in place.
Storage Duration
We retain personal data for as long as required for the purpose of the processing or according to applicable legal requirements, in accordance with the principle of storage minimization. The exact duration of the storage period depends on the type of personal data and the purpose for which it was collected.
In the event of a claim being made against us, we may retain personal data until the end of the statutory limitation period. Similarly, in the event of an ongoing dispute, relevant personal data will be stored until the dispute is resolved. We ensure compliance with applicable laws and regulations regarding the storage of personal data under these circumstances.
When personal data is no longer needed for the purpose for which it was collected, it is either deleted or anonymized.
9. Sharing of Personal Data
We may share personal data with other companies, but only when it is permitted by law and necessary to fulfill our part of the agreement with you as a customer, or if there is a legitimate interest in the transfer of personal data. This may include, for example, transferring information to our suppliers, including data processors, to protect our interests, fulfill contractual and legal obligations, detect and prevent problems, and improve our services and digital channels. Legal basis for these processing activities: Legitimate interest.
Our suppliers include logistics companies, accounting firms, cloud service providers, booking system providers, and others who support our operations. Before sharing personal data with a data processor, we enter into a data processing agreement with them to ensure proper processing and security in accordance with Article 28 of the GDPR.
We act as a data processor for many of our resellers and have established data processing agreements between us and our resellers.
We may provide necessary information to authorities, such as the police, tax authorities, or other authorities if we are legally obliged to disclose or share personal data to fulfill our legal obligations. Legal basis for these processing activities: Legal obligation.
Personal data may also be disclosed to authorities when necessary to prevent, detect, or investigate crimes. This is done to protect our and other relevant parties' property, interests, and safety. Legal basis for these processing activities: Legitimate interest.
In connection with or during negotiations for a transfer of our company's assets, merger, sale, financing, or acquisition of all or part of our business, personal data may be disclosed to parties involved in such transactions. Legal basis for these processing activities: Legitimate interest.
In some cases, we may share certain personal data with a third party if the third party has a legitimate interest in processing the personal data in question. It is important to note that the third party in such cases is considered an independent data controller with respect to their own processing of the shared personal data in question, and the third party is responsible for complying with all relevant data protection laws regarding their processing of personal data, including informing the data subject about their processing activities. Legal basis for these processing activities: Legitimate interest.
10. Your Rights under GDPR
Below is a summary of the rights you have as a data subject under the GDPR:
Right to information: You have the right to receive information about our collection and use of your personal data. This includes information about the purposes of the processing, the categories of personal data concerned, and any third parties with whom your personal data may be shared. We provide information about our collection and use of personal data in this privacy notice.
Right of access: You have the right to access your personal data held by us. You can request information about the processing of your personal data, obtain a copy of the personal data in a machine-readable format (provided there is no applicable exception to the right of access), and be informed about the safeguards in place for cross-border transfers. However, this does not mean that you have the right to obtain the documents containing the processed personal data.
Right to rectification: You have the right to request the rectification of inaccurate or incomplete personal data about you that we process. If we process personal data about you that is inaccurate or incomplete, we will, at your request or on our initiative, complete, correct, or delete the personal data in question. If you request that your personal data be corrected, we will inform all recipients of these data about the correction, provided this is possible or not unduly burdensome for us. You also have the right to know who has received your personal data.
Right to erasure: Under certain circumstances, you have the right to have your personal data erased. This applies, for example, if the data is no longer necessary for the purpose for which it was collected, or if you withdraw your consent and there is no other legal basis for the processing. Legal obligations may, however, prevent us from immediately deleting parts of the personal data. If you request that your personal data be erased, we must inform all parties who have received the data about the erasure, provided this is possible or not unduly burdensome for us.
Right to restriction: You have the right to restrict the processing of your personal data under certain conditions. This means that your data can only be stored and not further processed, or only processed for specific and limited purposes. An example of when this right applies is when the personal data we process needs to be corrected. If you request that we correct your personal data, you can also ask us to restrict the processing of the specific data until it has been corrected. We will inform you when the restriction is lifted.
Right to data portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format. You can also request the transfer of your data to another data controller, where it is technically feasible. This right only applies if the processing of personal data is carried out automatically and only if our processing is based on the performance of a contract to which you are a party or based on your consent.
Right to object: You have the right to object when your personal data is processed based on a legitimate interest. If you object under this right, we will cease the processing unless our interest outweighs your interests, rights, and freedoms. However, you always have the right to request that your personal data not be processed for direct marketing purposes. Such objections can be made at any time. If an objection is made to direct marketing, the personal data can no longer be processed for such purposes, and we will inform you when we have deleted the personal data if you request it.
Right not to be subject to automated decision-making: You have the right not to be subject to decisions based solely on automated processing, including profiling, if these decisions significantly affect you. Exceptions apply if the decision is necessary for the performance of a contract or is permitted by law. If an automated decision has been made, with or without profiling, you can request that it be reviewed or contested. We do not carry out automated decisions, whether with or without profiling.
11. How to exercise your rights
You are warmly welcome to contact us via the contact details provided at the end of this privacy notice, if you would like to invoke any of the above-mentioned rights regarding your personal data that we process.
It is free of charge to exercise the rights, provided that your requests are not excessive, repetitive, or manifestly unfounded. In such cases, we have the right to charge a reasonable fee to handle your request or the right to refuse to execute your request.
Before we handle or respond to your request, we may request additional information from you if necessary to confirm your identity.
We will inform you of our handling of your request without delay and no later than one month after we receive the request. If the request is complex or if we have received a large number of requests, this period may be extended by an additional two months. In such cases, we will notify you of the extension within the first month after we receive your request.
It is important to note that the rights are subject to certain limitations and conditions under the GDPR. Some of the rights only apply in certain situations and only if it is legal and possible for us to fulfill your request.
If we cannot fulfill your request due to applicable legislation or other exceptions, we will notify you of this and inform you of the reasons why we cannot fulfill your request with the limitations provided by law.
12. Changes
We regularly review the content of this privacy notice to ensure that the information is accurate and up-to-date. The content may be updated as needed, with or without prior notice. You are responsible for reading the content of the current privacy notice and keeping yourself updated on any changes.
We will notify you if we make significant changes, provided that such an information obligation is mandatory under applicable law.
The applicable version of our privacy notice is always published on the website.
13. Questions or complaints
If you have any questions regarding the content of this privacy notice or our processing of personal data, or if you are dissatisfied with our processing of your personal data, you are always welcome to contact us via the following contact details:
Company: Venture Design AB
Org. no.: 556787-4424
Email: gdpr@venturedesign.se
Postal address: ,Deltavägen 12, 352 45 Växjö
Supervisory Authority
If you are not satisfied with how we process your personal data, you also have the right to file a complaint with the relevant supervisory authority. Our supervisory authority is the Swedish supervisory authority:
Name: Swedish Authority for Privacy Protection (IMY)
Phone: 08-657 61 00
Email: imy@imy.se
Postal address: Swedish Authority for Privacy Protection, Box 8114, 104 20 Stockholm
Please note that depending on your country of residence, there are different supervisory authorities that you can contact regarding questions or complaints about the processing of your personal data. You can find the various supervisory authorities in the EU member states via the following link:
https://edpb.europa.eu/about-edpb/about-edpb/members_en