Privacy Policy
Effective from: 7 September 2025
Website: www.skin-nurse.se

1) Who is responsible for your personal data?
Data controller: Camelia Teodora Stefan (registration number 8010308560)
Privacy enquiries: info@skin-nurse.se

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and Swedish law.

2) What data do we collect?
When you shop, contact us or use the website, we may process:

• Identity and contact details: name, address, email and telephone number.
• Orders and delivery: orders, delivery options, returns and enquiry history.
• Payment: transaction ID, payment status and payment method. We do not store complete card details; see section 4.
• Technical and usage data: IP address, device/browser information and essential cookies for the cart and checkout.

3) Purposes and legal bases
We process data to:

• Manage purchases and delivery (payments, picking, shipping, returns and support): performance of a contract.
• Meet legal requirements (accounting and consumer rights): legal obligation.
• Prevent misuse and attempted fraud, and improve security and the customer experience: legitimate interest.

4) Payments through Stripe
We use Stripe for card and digital payments. Card details are sent directly to Stripe and are not stored by us. Stripe processes payment data and performs fraud checks, and may act as an independent data controller for that processing.

Read more in Stripe’s privacy policy. For questions about an assessment or enquiry handled by Stripe, you can contact us or Stripe.

5) Cookies
We use essential cookies to make the cart and checkout work (WooCommerce), as well as Stripe cookies to enable secure payments and fraud protection.

6) Recipients and sharing
We share data only when necessary for the stated purposes:

• IT, hosting and operations: hosting, security and support providers.
• E-commerce platform: WooCommerce (stored in our environment).
• Payments: Stripe.
• Logistics: shipping and distribution partners.
• Authorities: when required by law.

7) Transfers outside the EU/EEA
Some providers, such as Stripe, may process data outside the EU/EEA. For these transfers, we use the EU Standard Contractual Clauses (SCCs) and, where necessary, supplementary safeguards to ensure an adequate level of protection.

8) Retention period
We retain data only for as long as necessary. Order and payment data are kept for at least seven years under the Swedish Accounting Act.

9) Your rights
You have the right to:

• Access your data (a copy of your personal data).
• Correct inaccurate data.
• Have data erased (the right to be forgotten) where permitted by law.
• Restrict or object to certain processing, particularly processing based on legitimate interests or for direct marketing.
• Receive and transfer data you have provided, where processing is automated and based on consent or a contract.
• Withdraw consent at any time, with effect for future processing.

Contact info@skin-nurse.se to exercise your rights. If necessary, we may request additional information to verify your identity.

10) Complaints to the supervisory authority
If you believe we are processing data unlawfully, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY).

11) Security
We use TLS encryption, access controls based on the principle of least privilege, logging, regular updates, backups and incident management procedures. Card data is handled only by Stripe.

12) Children
Our shop is intended for people aged 18 and over. We do not knowingly collect data about children. Contact us if you believe a child has provided data to us.

13) Automated decisions
We do not make decisions with legal or similarly significant effects solely through automated processing. Stripe uses automated fraud checks for payments; contact us if you wish to object or obtain more information.

14) Changes to this policy
We may update this policy. The latest version is always available at www.skin-nurse.se. We will notify you of significant changes at checkout, by email or on the website.