We only collect the personal data we need to deliver your order, help you and run our store lawfully. Nothing more, and we don't keep it longer than described below.

Under the GDPR we need a legal basis for every use of your data: to fulfill the contract (your order), our legitimate interest (such as fraud prevention), a legal obligation (such as tax rules), or your consent (for marketing).

You can unsubscribe from marketing emails at any time with the link in every email, or contact us to withdraw your consent. This doesn't affect anything we lawfully did before.

We only share data with the service providers we need to run our store and deliver your order. We never sell your personal data, to anyone, for any reason.

Shopify processes data for us as a data processor under Article 28 GDPR, following our documented instructions and under a data processing agreement. You can read Shopify's own privacy policy at shopify.com/legal/privacy.

Vilkoo is based in Sweden and sells to customers in the United States, so your data necessarily travels between the EU and the US.

Order data is processed on Shopify's infrastructure, which stores data mainly in the United States and Canada. When personal data leaves the EEA, we use a transfer mechanism allowed under Chapter V GDPR: usually the EU–US Data Privacy Framework adequacy decision for certified US recipients, or the European Commission's Standard Contractual Clauses where no adequacy decision applies.

We use cookies for essential site functions, for analytics and, only with your consent, for advertising. You control this through our consent banner and your browser settings.

Analytics and marketing cookies are only placed after you accept them in our consent banner, and you can change your choice at any time. We respect Global Privacy Control and Do Not Track browser signals where technically possible. California residents can opt out of sharing for cross-context advertising by emailing info@vilkoo.com with the subject "CCPA – Opt Out of Sharing".

Because Peter Hulspas, Sole Proprietorship is based in Sweden, the GDPR applies to how we handle data. These rights are available to all our customers, wherever they live.

If you believe we have handled your data unlawfully, you can file a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, 104 20 Stockholm, Sweden, at imy.se. US residents can also contact the FTC at ftc.gov or their state attorney general.

California residents have extra rights under the CCPA/CPRA, next to the GDPR rights above. You can rely on whichever gives you the strongest protection.

We do not sell your personal information as defined in the CCPA. To use your rights, email info@vilkoo.com with the subject "CCPA Request". We confirm receipt within 10 business days and respond in full within 45 days (extendable by another 45 days with notice). You may appoint an authorized agent to make a request for you, with your written and signed permission.

No system is 100% secure. If a personal data breach happens, we notify the Swedish Authority for Privacy Protection (IMY) within 72 hours where Article 33 GDPR requires it, and inform affected customers directly when the breach poses a high risk, in line with applicable US state breach notification laws.

We review this Privacy Policy regularly. For important changes that affect your privacy rights, we post a notice on vilkoo.com before they take effect, and email you where required.