Privacy policy

This policy explains how Pouchify handles personal data when you visit our store, place an order or contact customer service.

1. Who is responsible?

Pouchify is operated by Vending & Machines Sweden AB, Swedish company registration number 559519-2971. We are the controller for processing that we determine. Address: Bergsgatan 106, 802 66 Gävle, Sweden. Contact august.ekenberg@gmail.com or +46 8 29 90 00 with privacy questions or to exercise your rights.

2. Personal data we handle

We handle information you provide when ordering, creating an account or contacting us, such as your name, email, telephone number, billing and delivery addresses, purchases, order history, payment status and customer service messages. Payment, delivery and verification providers also supply necessary information and confirmations.

Technical information may include your IP address, browser, device, language, country, page visits and session or cookie identifiers. Information from optional measurement and advertising technologies depends on the features used and your choices. See our cookie policy for more information.

When identification or age verification forms part of your purchase, the identity information and verification results needed for the check are processed. The relevant flow may use BankID. Please do not send customer service more identity information than we expressly need to help you.

3. Purposes and legal grounds

Purchases, payments, delivery and returns: We use contact details, addresses, order information and payment status to enter into and perform the purchase contract, deliver your order, answer purchase-related questions and issue refunds. The legal ground is contract, including steps you request before a purchase.

Accounting and legal duties: Necessary information is processed to meet Swedish accounting requirements and other applicable legal duties. The legal ground is legal obligation. Where age verification is required by law, necessary information is used to meet that duty.

Security and customer service: Technical information, case records and necessary identity details may be processed to prevent fraud and misuse, protect the website, investigate faults and establish, exercise or defend legal claims. The legal ground is our legitimate interest in safe operations, reliable support and protecting our rights and our customers’ rights. Checks for the store’s own age restrictions rely on the legitimate interest in maintaining those restrictions where they are not a legal requirement.

Optional communications and advertising: Where we ask for consent, it covers the communication or processing described when you make your choice. Consent can be withdrawn. Optional cookies and similar analytics or advertising technologies are covered by the choices described in our cookie policy. A purchase does not by itself constitute consent to all marketing.

4. Who receives information?

We share necessary information with providers for the purposes described here. These may include WordPress.com, Jetpack and WooCommerce services from Automattic for hosting and store functions, WooPayments and the provider or payment method used for payment, PostNord or another chosen carrier for delivery, and providers needed for BankID and age verification.

The store is connected to Google for product information and related features. Where advertising measurement is used, Google may receive visit and purchase information and, where that feature is used, hashed contact details for matching. Hashed information remains personal data. Optional advertising providers and technologies are described in the cookie information and choices presented to you.

Providers may act as our processors or as independent controllers for particular activities, such as payments, fraud checks or transport. Their own privacy notices apply to processing they control. We may also disclose information where required by law or necessary to establish, exercise or defend legal claims. We do not sell customer registers.

5. Processing outside the EU and EEA

Some providers operate or use service providers outside the EU and EEA, which can involve processing in those countries, including the United States. Transfers require a lawful GDPR mechanism, such as an applicable adequacy decision or European Commission standard contractual clauses and additional safeguards where needed. Contact us for information about recipients, transfers and applicable safeguards, or to request a copy of relevant safeguards.

6. Retention

We retain information to complete orders and deal with payments, returns, complaints and open cases. Afterwards, we retain only information needed for remaining duties or legitimate legal claims. Accounting records are retained for the period required by Swedish accounting law. Customer service records are assessed according to the nature and closure of the case and whether the information remains necessary for a complaint or dispute.

Technical and security information is kept while needed for operation, troubleshooting and investigating misuse. Information processed on consent is used for the stated purpose until consent is withdrawn or the information is no longer needed. A limited record of an opt-out may be retained to respect your choice. Information is deleted or anonymised when there is no longer a basis to retain it. Cookie lifetimes are explained separately in the cookie policy.

7. Your rights

You can request information about and access to your personal data, correction of inaccurate data and, where the conditions are met, erasure, restriction and portability. You can object to processing based on legitimate interests and always object to direct marketing. Consent can be withdrawn without affecting the lawfulness of processing before withdrawal.

Contact the email address above. We may need to verify your identity proportionately to protect your data. We normally respond within one month. If a complex request needs more time, we will inform you within that period. Some rights have exceptions, for example where records must be retained by law.

You may complain to the Swedish Authority for Privacy Protection, IMY, or another competent supervisory authority in the EU or EEA.

8. Information needed to place an order

Information required for payment, delivery or a mandatory check must be supplied for us to complete the purchase. Without it, we may be unable to process the order or deliver the goods. Optional analytics and advertising should not be confused with information needed to fulfil a purchase. Payment providers can carry out their own assessments under their terms and privacy information; contact the relevant provider to request an explanation or challenge such an assessment.

9. Minors, security and updates

The store is intended for people aged 18 or over. Contact us if you believe a child has provided personal data so that we can investigate how it should be handled. We use reasonable technical and organisational safeguards, but no internet transmission or storage can be guaranteed entirely risk-free.

We may update this information when our operations, services or applicable rules change. The current version appears on this page. Material changes will be communicated in a way appropriate to the change.

The withdrawal form

We process your name, information identifying the purchase and receipt email to receive and handle withdrawal notices. A draft review is kept temporarily for up to 30 minutes. The receipt download session lasts up to two days. The registered case is kept while needed for withdrawal, refunds, complaints and applicable legal obligations or claims. Temporary hashed abuse counters last no more than one hour.

Read our terms of purchase, shipping information, returns policy and privacy policy. Contact and company information.