Privacy Policy

Who is responsible

[LEGAL NAME], organisation number [ORG NR], [ADDRESS], Sweden, is the data controller for the personal data described here. Questions may be sent to hello@lewisjohnbroo.com.

What we collect and why

Register interest (waitlist). When you register your email address, we store the address, the time it was last registered, the page it was registered from, the time you confirmed it, a token used for the confirmation and unsubscribe links and, if you unsubscribe, the time you did so. We use this to confirm your address, to write to you when a series is about to open or has opened, and to keep a record of your consent. The legal basis is your consent, which you give by confirming your address from our confirmation email. You can withdraw it at any time with the Unsubscribe link in every announcement, with the unsubscribe option of your email app where it offers one, or by writing to hello@lewisjohnbroo.com. An address that has never been confirmed is deleted 30 days after it was last registered. When you unsubscribe after confirming your address, we send you no further announcements and keep this record, marked as unsubscribed, for two years from the day you unsubscribe, so that we can show that we wrote to you only with your consent and stopped when you asked. The legal basis for keeping it is our legitimate interest in being able to show this. If your address is registered again after you have unsubscribed, the times you confirmed and unsubscribed stay as they are. We send you a confirmation email, and the confirmation and unsubscribe links in our earlier emails stop working. You are subscribed again only if you confirm your address from that email within 30 days. If you do, your new consent takes the place of the earlier record. If you do not, you remain unsubscribed. A record of which announcements were sent to your address is deleted 30 days after each announcement ends.

Orders. When you buy a piece, we process your name, email address, delivery address, telephone number, the piece and its number in the series, the amount paid and the payment reference. If you pay with Apple Pay or Google Pay at the top of the checkout, your name, email address, telephone number and delivery address come from that service, as you choose them in its payment sheet, instead of from the form. We use this to fulfil the contract, deliver the piece, send the order confirmation, handle returns and complaints, and meet our obligations under Swedish accounting law. The legal basis is the contract with you and our legal obligations. Order records are kept for seven years as required by the Swedish Accounting Act (bokföringslagen).

Withdrawals. When you withdraw from a purchase through the withdrawal function on our website, we store your name, the order number or description you enter, your email address, and the date and time we received your statement. We do not store your IP address for this purpose. We use this to send you the acknowledgement the law requires, to match your statement to your order, and to handle the return and the refund. The legal basis is our legal obligation under the Swedish Act on Distance Contracts (lag (2005:59) om distansavtal och avtal utanför affärslokaler, chapter 2, section 10 a) and the contract with you. We also use these details to limit how many acknowledgements the form sends in a day, so that it cannot be misused to send email to other people. The legal basis for this is our legitimate interest in preventing misuse of the form. A statement that matches an order is kept with the order records for seven years. A statement that cannot be matched to any order is deleted after [UNMATCHED RETENTION].

Emails about a purchase. Order confirmations, withdrawal acknowledgements and our other emails about a purchase are sent through Resend. We keep the details each email is made from, including the address it is sent to, for 30 days after it is sent or, if it cannot be sent, for 30 days after the purchase or withdrawal it concerns. After that we keep only the kind of email, the order it concerns and when it was sent, with the order records, so that we can show that we sent the confirmation the law requires. An email held back under the withdrawal form’s limits keeps its details until it is sent or, if we set the statement aside as not genuine, for as long as we keep the statement. The legal basis is the contract with you and our legal obligations, and for that record our legitimate interest in being able to show that we met them.

Payment. Payments are handled by Stripe (Stripe Payments Europe, Limited). We never see or store your card number. Stripe processes your payment details on our behalf to carry out the payment, and as an independent controller for its own purposes, such as preventing fraud and meeting its legal obligations, under its own privacy policy. If you pay with Klarna, Stripe passes Klarna Bank AB (publ) the details it needs for the payment, such as your name, contact details, address and the amount, and Klarna processes them as an independent controller under its own privacy notice, including to confirm your identity and, if you pay later or in instalments, to assess your creditworthiness. If you pay with Swish, Apple Pay, Google Pay or Link, that service also processes your data, as an independent controller under its own terms and privacy policy.

Website. Our website is served by Cloudflare, which processes technical data such as your IP address to deliver the site and to protect it from attacks and misuse, for example by limiting how many requests can be sent in a short time. Cloudflare keeps the logs of our server for three days. We use Cloudflare Web Analytics, which does not use cookies or track you across sites, to see how the site is used and how quickly its pages load. On pages with a form to register interest, to purchase or to withdraw, Cloudflare Turnstile checks that the form is used by a person rather than a program, using technical signals such as your IP address and browser. Cloudflare also uses these signals, as an independent controller, to improve its detection of bots. If an error occurs on our server or on the checkout page, a report is sent to Sentry, which stores it in the EU for 30 days. This includes a payment that does not go through, such as a declined card, and a press of Pay that brings no answer: such a report names only the step of the checkout and Stripe’s codes for what happened. Reports are sent without email addresses, cookies or what you type into forms, and Sentry is set not to store IP addresses. The legal basis for this processing is our legitimate interest in a secure and reliable website: delivering it, protecting it and its forms from misuse, understanding how it is used, and finding and fixing faults.

Holding a piece. When you press Purchase and a piece is held for you, we store with the hold a code calculated with a secret key from your IP address (for an IPv6 address, from the part of it that identifies your network), and the name and number of the network provider you connect through. We use the code so that no more than three pieces of a series can be held from one network at a time. On a shared network, such as at a workplace or on some mobile networks, this can occasionally mean waiting until another hold ends. The code is not your IP address and cannot be turned back into it without the key, but it is not anonymous, so we treat it as personal data. The code and the provider’s name and number are deleted from the hold when it ends: as soon as your payment goes through, and otherwise within about ten minutes of the hold’s twenty minutes running out, so no more than about half an hour after you pressed Purchase. Like anything we delete from our database, they can remain for up to seven days in the automatic backups that Cloudflare keeps of it, which we use only to restore the database after a fault. If the remaining pieces of a series appear to be blocked by holds that are not paid for, we receive an alert by email that lists the network providers by name and number, with how many pieces are held through each. The alert contains no code or IP address and names no visitor. As with our emails about a purchase, we keep the details it is made from for 30 days after it is sent. We use the code and the provider’s name and number only for the limit and the alert, and never for profiling or marketing. The legal basis is our legitimate interest in a fair release, in which every client has the chance to buy, and in protecting the shop from misuse.

Cookies

We use only cookies that are strictly necessary to run the site: one that remembers, for a year, the currency you choose, one that remembers, for twenty minutes, the piece held for you when you press Purchase, and those set by our payment provider during checkout. The second contains only a reference to your hold, so that pressing Purchase again, for example after going back or in a second tab, takes you to your own checkout instead of holding a second piece. We do not use advertising or tracking cookies, and therefore we do not show a cookie banner.

Who receives your data

We share data only with the service providers we need to run the site and fulfil orders: Cloudflare (hosting, security, analytics), Stripe (payments), Resend (sends our email from the EU and keeps a record of each email for 30 days), Sentry (error reports, stored in the EU) and our delivery carrier ([CARRIER]). If you pay with Klarna, Swish, Apple Pay, Google Pay or Link, that service also receives the details it needs, as set out under Payment. Some of these providers are established in the United States. Where data is transferred outside the EU/EEA, this is done under the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

We never sell personal data and never share addresses with third parties for marketing.

Your rights

You have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format and to withdraw consent at any time. Write to hello@lewisjohnbroo.com. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), www.imy.se.

Your right to object. Where we rely on our legitimate interest, you may object to the processing at any time, for reasons relating to your situation, by writing to hello@lewisjohnbroo.com.

Changes

We may update this policy. The date above shows when it was last changed.