Privacy Policy - Yumea Cosmetics AB
Last updated: 2025-11-27
Introduction
This is the Privacy Policy of Yumea Cosmetics AB. We care about your personal privacy and strive for a high level of data protection. Correct handling of personal data is extremely important to us, and we process your personal data in accordance with applicable data protection laws, including the GDPR. This Privacy Policy explains which personal data we collect when you visit our website or purchase from us, as well as the purpose and legal basis for our processing. It also describes your rights and how you can exercise them.
Who is the data controller?
The data controller is Yumea Cosmetics AB, corporate ID no. 559504-8678, with registered address Göteborgsvägen 68, 445 57 Surte, Sweden, and email hej@yumea.se. We determine the purposes and means of the processing of your personal data. If you have questions about how we handle personal data or wish to exercise your rights (see below), you can always contact us using these details.
What data do we collect?
We collect different types of personal data about you as a customer or visitor, mainly:
Contact and identification details: Name, address, email address, phone number.
Order details: Products ordered, order number, payment method, delivery address, billing address. (However, we do not handle your full payment information such as card number – this is handled securely by our payment partner.)
Payment information: Payment method and necessary transaction data (handled via our payment provider).
Account details: If you create an account with us, we collect login details (username/password) as well as the history of your orders and your account settings.
Communication: Information you provide when contacting customer service or via forms (e.g. support cases, reviews or feedback).
Technical data and online identifiers: IP address, browser information, device information and cookies (for more information see our Cookie Policy).
We do not collect sensitive personal data about you unless it is necessary. The website is also not intended to be used by children under 18 years of age without parental/guardian consent.
Why do we process your data? (Purposes and legal basis)
We process your personal data only for specific purposes and with a legal basis. The main purposes are:
To manage your order and purchase agreement: We use your contact and order details to process your order, take payment, deliver the goods and handle any returns or claims.
Legal basis: Contract – the processing is necessary to fulfil the purchase agreement with you.
To comply with legal obligations: Certain processing is carried out to meet legal obligations, e.g. accounting laws (retaining transaction data) and consumer protection laws.
Legal basis: Legal obligation.
For customer service and communication: If you contact us with questions or matters, we process the information you provide in order to assist you.
Legal basis: Legitimate interest – we have a legitimate interest in being able to support our customers and resolve issues.
For marketing (with consent): If you have actively consented to newsletters or marketing emails, we use your email address to send offers and news about our products.
Legal basis: Consent – you can withdraw your consent at any time.
To improve our website and offerings: We may process technical data and user behaviour (e.g. via cookies, see Cookie Policy) to analyse traffic and usage patterns on the website. This helps us improve the user experience and our product range.
Legal basis: Legitimate interest – to operate and improve our business. (Where we use non-essential cookies, we obtain your consent in advance, see our Cookie Policy.)
We will always clearly state if certain information is requested in order to fulfil an agreement or provide a service. If you choose not to provide mandatory information (e.g. delivery address), we may not be able to complete your purchase.
How long do we store your data?
We only store personal data for as long as necessary for the purposes above, or as long as required by law. For example:
Order and transaction history: generally stored for 7 years in accordance with accounting legislation.
Customer account data: stored for as long as you have an active account with us. If you close your account, we delete or anonymise the account data within 30 days, except for data that must be retained under law.
Marketing data: email addresses for newsletters are stored until you unsubscribe or withdraw your consent. We then delete or anonymise the data shortly thereafter.
Customer service cases: information from correspondence is stored for the duration of the case and for a period thereafter if follow-up is needed.
When personal data is no longer needed for the purposes for which it was collected, we delete or anonymise it in a secure manner.
How do we protect your personal data?
We take appropriate technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. This includes, among other things, using encryption where relevant, limiting access to personal data within our organisation (authorised personnel only), and having procedures in place for managing potential data breaches. We also require any service providers that process personal data on our behalf to maintain a high level of security and to comply with the GDPR through data processing agreements.
Sharing of data
We never sell your personal data to third parties. However, we may need to share certain data with trusted parties in order to operate our business and fulfil the agreement with you:
Suppliers and sub-processors: For example, our warehouse/logistics partner will have access to delivery information in order to ship your order. PostNord (our shipping provider) receives the necessary address details to deliver your parcel. Our payment service provider receives the information required to carry out the payment.
IT and cloud services: We may store data on servers/cloud services. These providers process data only according to our instructions.
Analytics and marketing partners: We use analytics tools and marketing services via cookies, and certain online identifying information is shared with these partners. This only occurs after you have consented to such cookies (see Cookie Policy).
Authorities: We may be required by law to disclose information to authorities (e.g. the Swedish Tax Agency (Skatteverket) or if we receive a lawful request from the police).
When data is transferred outside the EU/EEA, we ensure that adequate safeguards are in place, for example through the European Commission’s Standard Contractual Clauses or by ensuring that the recipient is certified under an approved data protection framework.
Your rights
You have several rights under data protection legislation in relation to the personal data we hold about you:
Right of access: You have the right to know which personal data we process about you, including where it comes from, the purposes, and with whom we may share it. You can request a copy of the data we hold (a subject access request).
Right to rectification: If any information about you is incorrect or incomplete, you have the right to request that we correct or complete it.
Right to erasure (“the right to be forgotten”): In certain cases you may ask us to delete your personal data, for example if the data is no longer needed for the purposes for which it was collected, or if you withdraw your consent and we have no other legal basis. We cannot delete data that must be retained by law (e.g. transaction data subject to accounting requirements).
Right to restriction of processing: You have the right to request that we restrict the processing of your data under certain circumstances – for example while a request for rectification or an objection is being investigated.
Right to object: You have the right to object to processing based on legitimate interest. If you object to direct marketing, we will always cease such processing.
Right to data portability: For data that you have provided to us yourself, and which we process based on your consent or for the performance of a contract, you can request that it be transferred to you or another controller (in a structured, commonly used and machine-readable format).
If you wish to exercise any of these rights, please contact us (see contact details below). We will respond to your request as soon as possible and no later than within one month. Please note that some rights only apply under certain conditions – if we cannot fulfil your request, we will inform you of the reason.
Cookies and tracking
On our website we use cookies and similar tracking technologies to improve the user experience, analyse traffic and for certain marketing purposes. When you first visit the website, you can choose which cookies you accept via our cookie banner (see our Cookie Policy for details). Necessary cookies are always enabled to ensure the site functions, but we only use other cookies with your consent. You can change your cookie settings at any time via the “Cookie settings” link in the footer or in your browser settings.
Contact and information
If you have questions about this Privacy Policy or our processing of personal data, or if you wish to exercise your rights, you are welcome to contact us:
Email: hej@yumea.se
Postal address: Yumea Cosmetics AB, Att: Data Protection/Privacy, Göteborgsvägen 68, 445 57 Surte, Sweden
Phone: +46 (0)10-430 02 32
If you have complaints about how we handle personal data, you have the right to lodge a complaint with the supervisory authority. In Sweden, this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).
This Privacy Policy may be updated when necessary (for example if we change how we process data or if the law changes). In the event of significant changes, we will notify you on the website or via email. Please review the policy from time to time to stay informed about how we protect your privacy.
