Privacy Policy

This Privacy Policy explains how iCRO-SEO Digital Agency AB (org.nr 559086-8757), operating the Qshop website ("we", "us", "our"), collects, uses, stores and protects your personal data when you visit or shop on Qshop. We comply with the EU General Data Protection Regulation (GDPR) and applicable Swedish data protection law.

1. Data controller

iCRO-SEO Digital Agency AB, org.nr 559086-8757, Sweden, is the data controller. You can contact us at info@croseo.se.

2. What data we collect

• Order data: name, email, shipping address, billing address, phone number, order contents.
• Account data (if you create an account): email, password (hashed), preferences.
• Payment data: handled by our PCI-DSS-compliant payment provider — we never store your full card number.
• Technical data: IP address, device type, browser, pages visited, referring URL.
• Marketing data: email, consent status, campaign interactions (if you opt in).

3. Why we use your data (legal basis)

• To fulfil your order (contract, GDPR Art. 6.1.b).
• To comply with legal obligations such as bookkeeping (GDPR Art. 6.1.c).
• To improve our service and prevent fraud (legitimate interest, GDPR Art. 6.1.f).
• To send marketing emails (consent, GDPR Art. 6.1.a) — you can unsubscribe at any time.

4. How long we keep your data

Order and invoicing data is kept for 7 years to comply with Swedish accounting law (Bokföringslagen). Marketing consent data is kept until you withdraw consent. Technical logs are kept for up to 12 months.

5. Sharing your data

We share data only with processors that help us deliver Qshop: payment providers, shipping carriers, email and analytics providers, and our hosting provider. All processors operate under data processing agreements. Some providers may be located outside the EU/EEA — in such cases we use EU Standard Contractual Clauses.

6. Your rights under GDPR

• Right of access to your personal data.
• Right to rectification and erasure ("right to be forgotten").
• Right to restrict or object to processing.
• Right to data portability.
• Right to withdraw consent at any time.
• Right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).

To exercise any right, email info@croseo.se.

7. Cookies

We use cookies as described in our Cookie Policy. You can change your consent at any time by clearing the cookie consent in your browser.

8. Changes

We may update this policy. The latest version is always available on this page with the "last updated" date.