1       Introduction

Welcome to Mush Brush AB’s Privacy Policy. We are committed to respecting your privacy and protecting your personal data. This notice explains how we collect, use, and safeguard your personal data when you visit our website, use our services, or engage with us in other ways. It also informs you about your privacy rights and how the law protects you.

1.1      Purpose of This Privacy Notice

This Privacy Notice provides information on how Mush Brush AB collects and processes your personal data through your use of our website, our stores, or participation in events. This includes data you provide when you sign up for our newsletter, purchase products or services, or enter competitions. Our website is not intended for children, and we do not knowingly collect data from individuals under the age of 18.

1.2      Controller

Mush Brush AB org.nr 559378-7939 is the data controller responsible for your personal data. For any questions or requests regarding this Privacy Notice, please contact us using the details below.

Mush Brush AB
Engelbrektsgatan 43 B
114 32 Stockholm, Sweden
Email: info@mushbrush.se

1.3      Definitions

“Personal data” means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

“Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.

“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

“Recipient” means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not.

“Third party” means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

“Consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

2       Your Rights Regarding Your Personal Data

Under data protection legislation (Regulation (EU) 2016/679 (GDPR)), you have the right to control your own personal data and to receive information directly from us about how we handle your data. Below, you can read about your rights.

Do you want to know more or contact us to exercise any of your rights? You can easily do so by sending an email to info@mushbrush.se. If you want to obtain information about which personal data Mush Brush AB processes about you, a so-called record extract, or to have data deleted, fill out the form available on our website. For other types of inquiries, see contact information.

2.1      Right to Have Your Information Deleted ("Right to Be Forgotten")

In certain cases, you have the right to have your personal data deleted. This applies, for instance, to data that (i) is no longer necessary for the purpose for which it was collected, or (ii) if you withdraw your consent for a specific processing activity. In some instances, Mush Brush AB may not be able to delete your data. This could be because the data is still necessary for the purpose it was collected, because Mush Brush AB's interest in continuing to process it outweighs your interest in having it deleted, or because we are legally required to retain it.

You can read more about the legal obligations that apply to Mush Brush AB in terms of data retention, in sections 4 and 9. These laws prevent us from immediately deleting certain information. You also have the right to object to our use of your personal data for specific purposes such as direct marketing, which you can read more about here in the list.

More information about the right to be forgotten can be found on the Swedish Authority for Privacy Protection’s website.

2.2      Right to Be Informed

You have the right to be informed about how we process your personal data. We do this through this data protection information and by responding to your inquiries.

More information about the right to information can be found on the Swedish Authority for Privacy Protection’s website.

2.3      Right to Access Your Personal Data ("Right of Access")

You have the right to know whether Mush Brush AB processes your personal data and to receive a copy of this data, so-called right of access. Through the record extract, you will know what information we have about you and how we process your personal data.

More information about the right of access can be found on the Swedish Authority for Privacy Protection’s website.

2.4      Right to Access and Transfer Your Personal Data to Another Recipient ("Data Portability")

This right allows you to request a copy of the data Mush Brush AB has about you and that we process in order to fulfill an agreement with you or based on your consent, in a machine-readable format. This is to enable you to transfer your personal data to another controller.

More information about the right to data portability can be found on the Swedish Authority for Privacy Protection’s website.

2.5      Right to Rectification

You have the right to request that we correct incorrect or incomplete information about you and that we complete your information.

More information about the right to rectification can be found on the Swedish Authority for Privacy Protection’s website.

2.6      Right to Restriction of Processing

If you believe that the data we have about you is incorrect, that our processing violates the law, or that we no longer need the data for a specific purpose, you have the right to request that we restrict our processing of that data. You can also request that we do not process your data while we verify this, or while we verify whether you have the right to object to certain processing, as described below.

More information about the right to restriction can be found on the Swedish Authority for Privacy Protection’s website.

2.7      Right to Object to Our Processing of Your Personal Data

You may object to our processing that is based on legitimate interest (Article 6(1)(f) GDPR) by referring to your personal circumstances. You can also always object to our use of your personal data for direct marketing. When you inform us that you no longer wish to receive direct marketing from us, we will disable marketing and therefore stop sending you such information.

More information about the right to object can be found on the Swedish Authority for Privacy Protection’s website.

2.8      Right to Withdraw Your Consent

As described in section 5 below, in cases where we process your personal data based on your consent or explicit consent, you have the right to withdraw your consent at any time. When you withdraw your consent, we will stop the processing.

2.9      Right to Lodge a Complaint

If you have complaints about Mush Brush AB's processing of personal data, you can contact the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten), which is the Swedish supervisory authority for Mush Brush AB's data processing. You can reach the Authority through this link.

3       The Data We Collect About You

We collect various types of personal data about you, including:

·       Identity Data: First name, last name, title, date of birth, gender.

·       Contact Data: Billing address, delivery address, email address, telephone number.

·       Financial Data: Bank account details, card number details, payment details.

·       Transaction Data: Details about payments to and from you and other details of products and services you have purchased.

·       Technical Data: IP address, browser type and version, time zone setting, browser plug-ins, operating system, and platform.

·       Profile Data: Username, password, purchase history, interests, preferences, feedback.

·       Usage Data: Information about how you use our website, products, and services.

·       Marketing and Communications Data: Preferences in receiving marketing from us and our third parties, communication preferences.

We also collect Aggregated Data for statistical purposes, which does not directly or indirectly reveal your identity.

We do not collect Special Categories of Personal Data (e.g., race, religion, health data) or information about criminal convictions.

4       Which Personal Data is Used for What Purpose and on What Legal Basis?

5       How to withdraw your consent?

In cases where Mush Brush AB uses your personal data based on your consent, you can withdraw this consent at any time. You can do this either by sending an email to info@mushbrush.se or through the contact details provided in section 1 and 12. We will then delete the data. If you withdraw your consent or remove the uploaded information, it may mean that the service can no longer be used in cases where Mush Brush AB’s processing of personal data is based on your consent.

As described in section 2, you have the right to object to certain uses of your personal data (for example, you can opt-out of marketing). You also have the right to have certain data deleted, which is also described in section 2.

6       Mush Brush AB’s profiling

6.1      Mush Brush AB’s profiling of you as a customer.

Mush Brush AB performs profiling of you as a customer. "Profiling" means automated processing of personal data to assess certain personal characteristics about you, such as analyzing or predicting your personal preferences, like buying interests.

The purpose of Mush Brush AB’s profiling and the types of personal data used for each respective profiling are described in detail in section 4 above.

Profiling for these purposes does not significantly affect you as a customer.

We use profiling to:

·       Deliver customized marketing to you through both our own and external platforms and services.

If you have any questions about how the profiling process works, you can contact us. Contact details can be found in sections 1 and 12. You can object to our profiling for marketing purposes at any time by contacting us (and we will then stop profiling for marketing). You can also opt out of our profiling for our services by terminating the service.

7       Who do we share your personal data with?

When we share your personal data, we ensure that the recipient processes it in accordance with this information, for example by entering into so-called data processor agreements with the recipients. These agreements include all reasonable contractual, legal, technical, and organizational measures to ensure that your data is processed with an adequate level of protection and in accordance with applicable law.

7.1      Categories of recipients that Mush Brush AB will always share your personal data with.

7.1.1      Suppliers and subcontractors.

Description of recipients: Suppliers and subcontractors are companies that are only authorized to process the personal data they receive from Mush Brush AB on Mush Brush AB’s behalf, so-called data processors. Examples of such suppliers and subcontractors include software and data storage providers, payment processing providers and business consultants.

Purpose and legal basis: Mush Brush AB needs access to services and functionality from other companies that Mush Brush AB cannot provide on its own. Mush Brush AB has a legitimate interest in accessing these services and functionalities (Article 6(1)(f) GDPR). We ensure that the processing involved is necessary to fulfill this interest, and that our interest outweighs your right not to have your data processed for this purpose. You have the right to object to this processing, based on circumstances specific to your case. More information about your rights can be found in section 2.

7.1.2      Authorities.

Description of recipients: Mush Brush AB may provide necessary information to authorities such as the Police (Polismyndigheten), the Tax Agency (Skatteverket), or other authorities and courts.

Purpose and legal basis: Sharing personal data with authorities is done when we are legally required to do so, or in some cases if you have instructed us to do so. Depending on the authority and the purpose, the legal grounds for this sharing may be compliance with the law (Article 6(1)(c) GDPR), fulfilling the contract with you (Article 6(1)(b) GDPR), or Mush Brush AB having a legitimate interest in protecting itself from crime (Article 6(1)(f) GDPR).

7.1.3      Disposal of business or assets.

Description of recipients: In the event that Mush Brush AB sells its business or assets, Mush Brush AB may share your personal data with a potential buyer of such businesses or assets. If Mush Brush AB or a significant portion of Mush Brush AB’s assets is acquired by a third party, personal data about Mush Brush AB’s customers may also be shared.

Purpose and legal basis: Mush Brush AB has a legitimate interest in carrying out these transactions (Article 6(1)(f) GDPR). We ensure that the processing involved is necessary to fulfill this interest, and that our interest outweighs your right not to have your data processed for this purpose. You have the right to object to this processing, based on circumstances specific to your case. More information about your rights can be found in section 2.

7.2      Payment Service Providers, Checkout Providers, Card Networks, and Financial Institutions.

Description of recipients: Payment service providers, checkout providers, card networks, and financial institutions who provide services to you, and Mush Brush AB to facilitate, process, and administer electronic payments via various payment methods such as credit cards and bank-based payment methods (e.g., direct debit and bank transfers).

Purpose and legal basis: Mush Brush AB share your information with the payment service provider they use to process your payment. Some payment service providers also receive your information from Mush Brush AB, or independently collect and use your information, in accordance with their own data protection information or to prevent fraud. Sharing with payment service providers, checkout providers, card networks, and financial institutions is done to enable a payment method or to process a transaction initiated by you and is done to fulfill the contract with you (Article 6(1)(b) GDPR).

7.3      Logistics and Transport Companies.

Description of recipients: Logistics and transport companies.

Purpose and legal basis: Mush Brush AB will share your data with logistics and transport companies that deliver the goods you have ordered, if you have signed up for package tracking. Examples of data we share include contact and identification details, as well as tracking numbers.

Logistics and transport companies process your data in accordance with their own privacy policies. The sharing occurs to fulfill the agreement between you and Mush Brush AB (Article 6(1)(b) GDPR).

7.4      Advertising Services and Digital Advertising Platforms.

Description of recipients: Third-party advertising services and digital advertising platforms.

Purpose and legal basis: Mush Brush AB will share your personal data with third-party advertising services to deliver more relevant Mush Brush AB ads to you on non-Mush Brush AB websites and third-party digital advertising platforms. This is based on your interactions with Mush Brush AB's products. Mush Brush AB will also share this data to measure advertising performance. Some third-party advertising services and platforms may use your personal data for their own purposes and in accordance with their privacy policies. You can also find out more about this sharing and how to exercise your rights against these companies by contacting us.

This processing is based on your consent (according to Article 6.1(a) GDPR). You can withdraw your consent at any time at Mush Brush AB’s website. You may also object to this processing with the same effect as withdrawing your consent. See section 2 for more information on your rights. This processing may involve profiling intended to personalize marketing based on what we believe you might be interested in. You can read more about profiling in section 6.

7.5      Social Media.

Description of Recipients: Social media companies such as Facebook, Instagram, or TikTok.

Purpose and Legal Basis: If you contact us via social media platforms like Facebook, Instagram, or TikTok, your personal data will be collected and processed by these companies as well, in accordance with their privacy policies. The sharing occurs to fulfill the agreement with you (Article 6(1)(b) GDPR).

8       When can we transfer your personal data outside the EU/EEA, and how do we protect it?

We always strive to process your personal data within the EU/EEA. However, in certain situations, such as when we share your information with a supplier or subcontractor operating outside the EU/EEA, your personal data may be transferred outside the EU/EEA. Mush Brush AB always ensures that the same high level of protection applies to your personal data according to GDPR, even when the data is transferred outside the EU/EEA. Your rights regarding the data (which you can read more about in section 2) are not affected by the transfer outside the EU/EEA. You can find more information about the recipients we share information within section 7.

If you want more information about our protective measures, you can always contact us. Contact details can be found in section 1 and 12. You can also find more information about which countries are considered to have an “adequate level of protection” on the Swedish Data Protection Authority’s website here.

8.1      Special Protective Measures Used by Mush Brush AB When Transferring Data Outside the EU/EEA

Countries outside the EU/EEA may have laws that allow public authorities to request personal data stored in the country for the purpose of combating crime or defending national security. Whether it is Mush Brush AB or one of our suppliers handling your personal data, we will ensure a high level of protection when transferring such data and that appropriate protective measures have been taken according to applicable data protection laws (GDPR). Such protective measures include:

·       Whether the European Commission has decided that the country outside the EU/EEA to which your personal data is transferred achieves an “adequate” level of protection, which corresponds to the level of protection that GDPR provides. This means that the data will continue to be protected from unauthorized access and that you can exercise your rights with respect to the data.

·       The transfer is subject to the EU-US Privacy Shield framework. This is an opt-in certification system for American companies, administered by the U.S. Department of Commerce. This privacy framework includes a number of enforceable principles and requirements that must be certified by the U.S. company and ensures that your data is still sufficiently protected.

9       How long do we store your personal data?

The length of time Mush Brush AB stores your data depends on the purpose for which the data is used:

·       Personal data used for the contractual relationship between you and Mush Brush AB is typically stored as long as the agreement is in effect, and thereafter for a maximum of 10 years due to statutes of limitations.

·       Personal data that Mush Brush AB is required to store according to applicable law, such as accounting regulations, is typically stored for 7 years.

The legal requirements described above mean that Mush Brush AB is not allowed to delete your personal data, even if you request to have it deleted as described in section 2. If we are not required by law to retain the data, we must instead make a judgment on whether we need the data to protect ourselves from legal claims.

Please note that even though we must retain your data for legal obligations, this does not mean that your data can simultaneously be used by us for purposes other than fulfilling the legal obligations. Mush Brush AB assesses each individual purpose to determine how long we are allowed to use your data, as you can read more about in section 4.

10   How we use cookies and other tracking technologies

To provide a tailored and smooth experience, Mush Brush AB uses cookies and similar tracking technologies on our various interfaces such as our website.

11   Updates to this Privacy Notice

We are constantly working to improve our services so that you get an even smoother user experience. This may involve changes to existing and future services. If such an improvement requires a notice or consent according to applicable law, you will be notified or given the opportunity to provide your consent. It is also important that you read this privacy notice each time you use one of our services, as the processing of your personal data may differ from your previous use of the respective service.

12   Contact Information for Mush Brush AB

Mush Brush AB is registered with the Swedish Companies Registration Office under company number 559378-7939 and is headquartered at Engelbrektsgatan 43 b, 114 32 Stockholm.

Mush Brush AB
Engelbreksgatan 43B
114 32 Stockholm, Sweden
Email: info@mushbrush.se

We aim to respond to all legitimate requests within 24 hours. Complex requests may take longer, and we will keep you updated.

Mush Brush AB complies with Swedish data protection laws. For more information about Mush Brush AB, feel free to visit Alla Bolag.