Privacy policy
Thank you for taking the time to read our Privacy Policy and Cookie Policy.
This page explains how we process your personal data, how we use cookies, and which rights you have in connection with the processing of your personal data and our use of cookies. The policy applies to our online store Timi of Sweden on timiofsweden.com and our other country domains (together "the store").
1. Privacy Policy
Happy Accessories AB (Timi of Sweden), company registration number 556797-2590, Tolvevägen 6, 237 91 Bjärred, Sweden (hereinafter "we", "us" or "our") is the data controller for the processing of your personal data in the store as described in this policy. If you have any questions about how we process information about you, please don't hesitate to contact us at customercare@timiofsweden.com.
Or by post:
Happy Accessories AB
Attn: Privacy
Tolvevägen 6
237 91 Bjärred
Sweden
When you use the store, we collect certain information about you and your visit. Among other things, we use this information to fulfil our agreement with you and to manage your customer account. Depending on your consent, we also use information collected through cookies to improve your experience, to understand how individual parts of the store are used and to support our marketing. You can read more about this in our Cookie Policy further down this page.
We only process your personal data when we have a clear and specific purpose for doing so, and when that purpose has been fulfilled we delete the data, unless it is needed for another purpose described below.
Our processing of your personal data is governed by the EU General Data Protection Regulation (GDPR), national data protection legislation, and the guidelines and opinions of the European Data Protection Board and the national supervisory authority. We have not appointed a data protection officer, as we are not required to; all questions about your data are handled via customercare@timiofsweden.com.
1.1 What information do we collect and where does it come from?
- Information we collect when you visit the store or read our emails: general information such as country and market, device type and browser, the pages and products you view, categories you visit, searches, what you put in your basket, where you came from (for example a campaign or an ad click), and – for our newsletter – whether and when you opened it and which links you clicked. We do not store your IP address in our own visitor database.
- Information that comes from you when you create a customer account, place an order, sign up for our newsletter, ask to be told when an item is back in stock, contact customer service or leave a review: for example your name, email address, phone number, delivery and billing address, the products you buy, order amounts, discount codes, payment method (we never see your full card number), the favourites and lists you save, what you write to us, and your rating, review text and any photo you choose to upload, and your birthday (day and month) if you share it with us. This also includes the transactional emails we send you, such as order confirmations, delivery confirmations, and return and refund confirmations.
- Information that comes from third parties: payment providers tell us whether a payment went through and may tell us if a transaction looks fraudulent; carriers tell us where your parcel is; advertising partners tell us – in aggregated or pseudonymised form – how our ads performed; and if you share a photo with us on social media and give us permission to use it, we receive the photo and your username.
1.2 For what purposes and on what legal basis do we process your personal data?
We only process your personal data when we have a specific purpose and a legal basis for it. When you use the store, including when you buy our products, we process your information as follows:
1.2.1 On the basis of your consent
Newsletter and SMS: When you sign up for our newsletter (for example in a sign-up form, in your customer account or at checkout), we ask whether you want to receive direct marketing. If you give your consent, we may process your contact details (such as your name, email address and – if you sign up for SMS – your phone number), the country of the store you shop in, your favourites, your birthday (day and month) and the purchase and browsing history linked to your account, in order to send you personalised content, offers, recommendations and product campaigns – including automatic reminders, for example if you left something in your basket. With your consent, you also get personal offers from us in our marketing channels, and fewer ads for things you already own – see "Targeted ads to you as a customer" below. When we send our newsletter, we measure activity and engagement using pixel technology that records whether you opened the email, when you opened it and which links you clicked. Analysing these statistics helps us understand which parts of our newsletter interest you. If you receive a discount for signing up, it is a thank-you for the newsletter only – never for any other consent. You can withdraw your consent at any time via the unsubscribe link in every email or in your customer account.
Digital advertising: While you use the store, we may process your personal data in order to market our products to you online. Not all advertising that reaches you is based on your personal data. Some campaigns are not aimed at you as an individual but at a broader group of consumers – for example, we may tailor campaigns to a geographic area. Other types of digital advertising use personal data collected with your consent. Certain cookies and other tracking technologies can collect information about your visit – for example the products you viewed and bought – so that our advertising partners can show you ads that match your interests and help us measure how well our ads work. This only happens if you have accepted Marketing cookies (for example with "Accept all") in our cookie banner. You can find a full list of cookies in our Cookie Policy. For more information about who we share your data with, see section 1.4. Some of these advertising partners are based outside the EU/EEA, which means a transfer of your personal data to a third country; see section 1.5.
Targeted ads to you as a customer: If you have accepted Marketing cookies, we may also share hashed (encrypted, unreadable) versions of your contact details – your email address, phone number, first name, last name, postcode, city and country – with our advertising partners, so that they can show you relevant news and offers from us in their channels, for example Facebook, Instagram and YouTube. If you subscribe to our newsletter, the same consent lets us bring you our news and personal offers in our marketing channels – even if you have not accepted Marketing cookies. In both cases, we can also spare you ads for things you already own, so that what you see from us there is new to you. For this, we share only codes – never your details in plain text; exactly what is shared, with whom and on what legal basis is described under "Our marketing channels" in section 1.4.6. The advertising partner compares the codes with its own users; if there is no match, the partner deletes them. If you change your choice to "Only necessary" or unsubscribe from our newsletter, we stop sharing at the next daily update – and saying no to all customer lists at once is just as easy (see "Our marketing channels" in section 1.4.6).
Cookies and similar technologies: Our store uses cookies and similar technologies to provide necessary functionality through strictly necessary cookies and, if you consent, to measure and improve the store and to support our marketing through other cookies. If you have consented to Performance cookies, we use analytics tools – Shopify Analytics, Google Analytics and our own visitor measurement – to see how the store is used, and we use our own cookie to recognise your browser on later visits. If you choose "Only necessary", these tools are not loaded. Without your consent we only record which pages and products are viewed, baskets and purchases as aggregated counts that contain no personal data; we record them together with a pseudonymous identifier only if you have consented. You can read more about our use of cookies in our Cookie Policy.
Push notifications: If you allow it when your browser asks, we may send you push notifications in your browser with news and reminders. For this we process a technical identifier from your browser. You can turn push notifications off at any time in your browser settings.
When you communicate with us on social media: When you communicate with us on social media, for example by liking or commenting on a post we have published, tagging us, or contacting us with a customer service question on Facebook or Instagram, we may process information that you have made publicly available on your profile, as well as the content of your message to us. If we would like to feature a photo you have shared, we always ask you first, and you can ask us to remove it at any time.
Unless otherwise stated, the legal basis for the processing described above is the consent you have given us under Article 6(1)(a) GDPR. You can withdraw your consent at any time. This does not affect the lawfulness of the processing that took place before you withdrew it.
1.2.2 On the basis of our contractual obligations
To fulfil the agreement: We process personal data about your profile and your purchases to fulfil the purchase agreement with you and to manage your customer relationship with us – including taking payment, packing and shipping your order, sending order confirmations and delivery updates, and handling returns, complaints and warranty claims. This also includes customer service about your order, whether you contact us by email or via our WhatsApp chat.
To give you access to your customer account and our services: When you create a customer account, we process your account details and order history so that you can log in, see your orders and save your addresses. When you use our favourites, lists and "back in stock" services, we process your email address and the products you have saved.
To show relevant content in the store: We process information about the products you have viewed and your favourites in order to adapt the shopping experience to your needs – for example "Recently viewed", your favourites and product recommendations based on what you have looked at. This is part of the store's service and works whichever cookie choice you make.
The legal basis for the processing described above is the performance of the agreement we have entered into with you, under Article 6(1)(b) GDPR.
1.2.3 On the basis of our legitimate interests
Conversion tracking: We may measure engagement in the store. By studying how the store is used, we gain insight into how effective different parts of it are and can improve your experience. We can also evaluate how successful our advertising has been, which helps us make informed decisions about our marketing. Not all conversion tracking collects personal data – some is based on aggregated information that cannot identify you as an individual. Personal data is only collected through cookies and other tracking technologies that are activated when you have given separate consent in our cookie banner. If you have consented to Marketing cookies, such conversion data may be supplemented with additional personal data, such as a hashed email address, which the advertising partner then uses to match it with the result of the conversion. You can find a full list of cookies in our Cookie Policy, and more about who we share data with in section 1.4.
Advertising to existing customers (customer exclusion list): If you have bought from us but have neither subscribed to our newsletter nor accepted Marketing cookies, we still want to spare you ads for things you already own. We therefore share a code made from your email address with Meta – not with Google – and Meta uses it only to leave you out of our ads for new customers in our marketing channels. That way you see less of what you already know, and we don't pay for ads you don't need. The code is never used to target ads at you, and we never share your email address itself. If you subscribe to our newsletter or accept Marketing cookies, your code is instead covered by your consent (section 1.2.1); how it works and how to say no is described under "Our marketing channels" in section 1.4.6. We have documented our assessment of this processing.
Review requests: After a purchase, we email you – via our review service Loox – to ask you to rate the products you bought. Honest reviews help other customers. You can unsubscribe from review requests via the link in the email.
Reviews: When you leave a review, we publish your rating, your review text and any photo you add in our store, together with your reviewer name. Through Loox or directly by us, your review is also shared with Google so that it can be shown on Google Shopping – with your photo, if you added one, and with your name only in shortened form (for example "Anna S."). We do not share your email address or your full name with Google. Loox also shares reviews with Meta so that they can be shown in Facebook and Instagram Shops. Meta receives your full name (Meta's rules require it), your rating, the review text and any photo you added; what Meta shows publicly is decided by Meta. A review that has been shared with Meta cannot be removed there one by one – it disappears from Meta within 28 days after we switch off the connection. Reviews may be shared in this way even if they are not published in our store. If you want your review removed, email us at customercare@timiofsweden.com.
Understanding your preferences: We analyse data to understand what you and other customers like. This includes analysing purchase history, how often customers shop, which types of products they look at and how they interact with the store. By understanding the buying habits of different groups of customers, we can tailor our offers and improve our products and services. This helps us make sure we stock the right items and offer a better experience for everyone.
Personalising your experience: To improve your experience and make sure the products and content you see match your interests, we adapt the content of our store and our emails based on your interactions with us – for example by suggesting similar products or products we think you will like. See section 1.6.
Customer service: When you contact us with questions that are not about an order – by email, via our WhatsApp chat or on social media – we process your contact details and what you write to us in order to help you. We use an AI assistant (Anthropic's Claude) in our internal tools to help us summarise and answer; your personal data is not used to train the underlying AI model.
Fraud prevention: In specific cases, we may process your data where it is necessary to protect the security and integrity of our customers' financial transactions and personal data. If, for example, a payment is disputed as fraudulent, we must investigate the matter to stop potential fraud and prevent it in the future. This investigation may include processing information about other orders that are, or are likely to be, linked to it, including payment information. In such situations we may also receive additional information about an order or a transaction from our service providers, including carriers and payment providers. This processing is specific to the circumstances of a fraud claim and is not carried out as part of general data processing.
Security and backups: We process data to keep our systems secure, available and backed up.
Legal claims: Where necessary, we process some of your personal data in order to establish, exercise or defend legal claims, including to prevent, avoid or investigate fraud and misuse of our store.
The legal basis for the processing described above is our legitimate interest, which we have assessed as outweighing your interest in your personal data not being processed, under Article 6(1)(f) GDPR. You can object to the processing of your data based on our legitimate interest (section 1.7.6). If you want to do so, contact us at customercare@timiofsweden.com.
1.2.4 On the basis of our legal obligations
We process your personal data in order to fulfil our legal obligations under the Swedish Bookkeeping Act (bokföringslagen 1999:1078) and under legislation on consumer rights and product safety – for example when we handle a statutory complaint or a product recall – and to answer authorities when we are required to by law.
The legal basis for this processing is our legal obligations under Article 6(1)(c) GDPR.
1.3 How long do we keep your personal data?
We only store your personal data for as long as is necessary for the purpose of the processing. If there is an open matter – for example an unpaid order, a return or a dispute – we keep what is needed until it is resolved. Below we have listed the purposes and the retention periods that apply.
| Purpose | Retention period |
|---|---|
| Managing the customer relationship, including handling your purchases | We retain customer data for up to 3 years after your last purchase; after that it is anonymised. Information about your transactions is kept as long as the bookkeeping rules require (see "Legal obligations" below). |
| Your customer account | Until you delete your account or ask us to delete it. |
| Personalisation of the content shown in the store based on your browsing history and purchases | 12 months after the specific personal data was collected. |
| Visit data in our own visitor database | 2 years from the visit; ad click identifiers 90 days. |
| Favourites and lists | Until you remove them or delete your account. |
| "Back in stock" requests | Until we have notified you, plus 90 days; requests that are still open are deleted after at most 12 months. |
| Newsletter, SMS and your birthday, based on your consent | Until you unsubscribe or withdraw your consent. After that, we only keep your email address or phone number on a "do not send" list, so we never contact you by mistake. |
| Documentation of your consents and cookie choices | Up to 5 years after your consent has ended, so that we can show what you agreed to. |
| Customer exclusion list and customer lists at advertising partners | As long as you are in our customer register and have not objected or withdrawn your consent; at Google at most 540 days after the latest update. Partners delete codes that do not match one of their users. |
| Customer service | 2 years after the matter has been closed. |
| Reviews | As long as the review is shown in our store or in the services described in section 1.2.3, or until you ask us to remove it. At Meta, a review can only be removed by us switching off the connection, which takes up to 28 days. |
| Legal obligations | We process the information included in your invoice to fulfil our obligations under the Swedish Bookkeeping Act's rules on the storage of accounting records, i.e. until the end of the seventh year after the end of the calendar year in which the financial year ended (Chapter 7, Section 2 of the Bookkeeping Act). |
| Backups | At most 35 days. |
| Cookies | Until you withdraw your consent or – if you do not withdraw it – until the cookies expire after the period stated in our Cookie Policy below. |
| Legal claims | As long as necessary to establish, exercise or defend legal claims. |
1.4 Who do we share your personal data with?
We never sell your personal data. We share only what each recipient needs. Our processors process data only on our instructions and under a data processing agreement; independent controllers are responsible for their own processing under their own privacy policies.
1.4.1 Shipping and delivery companies
To make sure your ordered products reach you quickly, we share the relevant information with the carrier that handles the delivery and return of the items you chose at checkout – currently PostNord and DHL (service point deliveries). For a smooth delivery we must provide your name, delivery address, email address, phone number and order ID to the carrier. We create shipping labels with the shipping tools Shipmondo and PluginHive MultiCarrier. This sharing is necessary for us to fulfil our contractual obligations to you, under Article 6(1)(b) GDPR.
It is important to note that the carriers act as independent controllers. This means they have their own responsibilities and obligations for the data they receive and are separate businesses that determine the purposes and means of their processing. For you as a customer, this means that the carriers have their own privacy policies, which apply when they deliver goods from us to you. If you want to exercise your rights as a data subject, you may also need to contact them separately.
1.4.2 Technical infrastructure providers
We work with technical infrastructure providers that help keep our services running: Shopify (our online store platform, checkout, customer accounts and the automation tool Shopify Flow), Microsoft (Azure – our own database, hosted in the EU – and Microsoft 365 for email) and our business system Pyramid, which runs on our own server in Sweden. We also use store apps that each provide a function in the store: Loox (reviews), Timesact (pre-orders), iPacky (packing), Sleeknote (sign-up forms), Ønskeskyen (wishlist button), Flowbox (customer photos in the store) and Dreaminfluence (our influencer collaborations). These providers supply the technology and resources needed for our store to work efficiently and securely.
Your personal data is not shared with these providers for their own independent use. They act as our processors and follow our instructions and agreements. Some of them may be based outside the EU/EEA, which means a transfer of your personal data to a third country; see section 1.5.
1.4.3 Customer service infrastructure providers
We work with providers that make it easy for you to reach us: Microsoft 365 for email, WhatsApp (Meta) for our chat, and the AI assistant Anthropic (Claude) in our internal tools, which helps us summarise and answer your questions. These providers supply the technology needed to give you efficient, reliable and responsive customer service. Your personal data is not used to train the AI model.
1.4.4 Payment service providers
We share your personal data with payment service providers to enable secure and efficient transactions when you make a purchase, and to prevent fraud. We use Shopify Payments – with Stripe as payment processor and Klarna for Klarna's payment methods – as well as PayPal and Nets Easy. The information shared is your contact details and information about the transaction itself, such as payment method, amount, currency, date, time and, depending on the payment method, what you have ordered. This sharing is necessary for us to fulfil our agreement with you, under Article 6(1)(b) GDPR. The payment service providers act as independent controllers for their own processing, for example their checks against fraud and money laundering.
1.4.5 Providers that help us with marketing communication
We share your personal data with providers of marketing communication services so that we can stay in touch with you: Shopify Messaging (newsletter by email and SMS), Brevo PushOwl (push notifications in your browser) and Loox (review requests). These providers help us deliver emails, messages and campaigns to keep you informed about our products. The data shared with them usually includes your contact details and your communication preferences. Your data is only processed if you have consented to such communication, or when we contact you on the basis of our legitimate interest and you have not objected.
1.4.6 Providers that help us with advertising, including advertising on social media
We market our products with the help of our advertising partners Meta (Facebook, Instagram), Google (Google Ads, YouTube), Pinterest, Snapchat and TikTok, and we use Google Analytics and our own visitor measurement to understand how the store is used. There are different ways your data can be shared with our advertising partners. Cookies and similar technologies – including analytics and advertising pixels from the partners listed in this section – are used by our partners to track how you use our store. The collection of your personal data through such cookies is subject to your separate consent to those cookies. With this technology we can advertise to a relevant audience and measure the effectiveness and results of an advertising campaign and of the channel itself.
In addition, we may share encrypted (hashed) personal data with these advertising partners – as described in sections 1.2.1 (personal offers and fewer ads for things you already own, with your consent) and 1.2.3 (fewer ads on Meta for other customers who have bought from us). The advertising partner matches the encrypted data against its own database. If there is a match, our ads can reach you – or, for the exclusion list, be kept away from you – while you use the partner's services. If there is no match, the advertising partner deletes your data. Separately, product reviews are shared with Google – through our review service Loox or directly by us – and with Meta through Loox, so that they can be shown in their shopping services (section 1.2.3).
The way your data is collected determines the role of the advertising partner. Most of our advertising partners act as independent controllers; for the collection and transfer of data through Meta's pixel, we and Meta are joint controllers. Some of these partners are based outside the EU/EEA, which means a transfer of your personal data to a third country; see section 1.5.
Our marketing channels: This is where you meet us – and where your consent brings you personal offers and fewer ads for things you already own:
- Our newsletter by email – and by SMS and browser notifications if you have chosen them (sent through the providers in section 1.4.5).
- Meta (Facebook and Instagram) and Google (for example Google Search, Google Shopping and YouTube), where we show our ads. They are the only partners that receive customer lists from us.
What we share, and why: Only codes – never your details in plain text. As a newsletter subscriber, we share a code made from your email address (a so-called hash, SHA-256, that cannot be read back); if you have accepted Marketing cookies, we also share codes made from your phone number, name, postcode, city and country. Google and Meta compare the codes with their own users and delete the ones that do not match. The legal basis is your consent (Article 6(1)(a) GDPR), and we keep a record of when you gave it. For customers who have bought from us without giving that consent, only Meta receives the code, and only to leave them out of ads for new customers (our legitimate interest, Article 6(1)(f) GDPR, section 1.2.3).
Saying no is just as easy: unsubscribe via the link in any newsletter or in your customer account, or choose "Only necessary" in Cookie settings at the bottom of any page. We stop sharing at the next daily update, and Google and Meta then remove the code from our lists. To be removed from every customer list at once, email us with the subject "No ad lists" (section 1.7.6). Saying no does not affect sharing that took place before, and you can shop with us exactly as before.
1.4.7 Public authorities and advisers
In the case of ongoing complaints that you as a customer have initiated, or where we must respond to lawful requests from authorities – for example the Swedish Tax Agency, the police or a court – we may share your personal data with public authorities. We may also share data with our auditors and legal advisers. In such cases we rely on Article 6(1)(c) or Article 6(1)(f) GDPR as the legal basis for sharing the data.
Summary of recipients
| Category | Recipients | Role |
|---|---|---|
| Shipping | PostNord, DHL; shipping tools Shipmondo and PluginHive MultiCarrier | Carriers: independent controllers. Tools: processors |
| Technical infrastructure and store apps | Shopify, Microsoft (Azure, Microsoft 365), Pyramid (own server in Sweden), Loox, Timesact, iPacky, Sleeknote, Ønskeskyen, Flowbox, Dreaminfluence | Processors |
| Customer service | Microsoft 365, WhatsApp (Meta), Anthropic (Claude) | Processors |
| Payment | Shopify Payments (with Stripe and Klarna), PayPal, Nets Easy | Independent controllers |
| Marketing communication | Shopify Messaging, Brevo PushOwl, Loox | Processors |
| Advertising and analytics | Meta, Google (incl. YouTube and Google Analytics), Pinterest, Snapchat, TikTok | Independent controllers (Meta's pixel: joint controllers for collection and transfer) |
| Authorities and advisers | Swedish Tax Agency, police, courts; auditors and legal advisers | Independent controllers |
1.5 Transfers to third countries
Because some of our service providers are located outside the EU/EEA, we may transfer your data to a third country. We always make sure that such a transfer only takes place if it is permitted and carried out in accordance with applicable law and without weakening your statutory rights. We also make sure that the service provider, by contract or otherwise, guarantees that your privacy is protected at the same level as in the EU, including through the necessary organisational and technical security measures. We often rely on the European Commission's standard contractual clauses (SCC). In addition, we rely on adequacy decisions by the European Commission – for example for Canada, and for companies in the USA certified under the EU–US Data Privacy Framework – provided the conditions of the adequacy decision are met. Shopify also uses binding corporate rules within its group. We store our own data in the EU (Microsoft Azure, West Europe) and in Sweden. Email us if you would like a copy of the safeguards.
Personal data is transferred outside the EU/EEA to the following service providers:
| Partner (EU contracting entity → recipient) | Country of transfer | Safeguard |
|---|---|---|
| Shopify International Limited, 2nd Floor, 1–2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland → Shopify Inc., 151 O'Connor Street, Ottawa, Ontario K2P 2L8, Canada (and other countries where Shopify's providers are located, for example the USA and Singapore) | Canada, USA, Singapore | Adequacy decision (Canada); standard contractual clauses; binding corporate rules |
| Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland → Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA | USA | Data Privacy Framework; standard contractual clauses |
| Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland → Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA (Facebook, Instagram, WhatsApp) | USA | Data Privacy Framework; standard contractual clauses |
| Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland → Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA (Microsoft 365 support) | USA | Data Privacy Framework; standard contractual clauses |
| TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, D02 T380, Ireland (remote access from other countries) | USA, other countries | Standard contractual clauses |
| Pinterest Europe Limited, Palmerston House, Fenian Street, Dublin 2, Ireland → Pinterest, Inc., 651 Brannan Street, San Francisco, CA 94107, USA | USA | Data Privacy Framework; standard contractual clauses |
| Snap B.V., Keizersgracht 165, 1016 DP Amsterdam, Netherlands → Snap Inc., 3000 31st Street, Santa Monica, CA 90405, USA | USA | Data Privacy Framework; standard contractual clauses |
| Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA | USA | Data Privacy Framework or standard contractual clauses |
1.6 Profiling and automated decision-making
We may carry out profiling when you use our services. When we do, we evaluate your interactions with us – for example style, price level and how often you shop – in order to give you more personal and relevant recommendations and to make sure the products and content you see are close to your interests. If, for example, you have chosen to receive our newsletter, we may use profiling to make sure it is tailored to your preferences and to what we think you will find interesting. Profiling never affects prices, terms or whether you can shop with us. The legal basis is our legitimate interest (section 1.2.3); when the result is used for advertising on other websites and apps, your consent is also required (section 1.2.1). You can object to profiling at any time, and we always stop when it is for direct marketing.
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. To prevent fraud, Shopify and our payment providers use limited automatic checks – for example, an IP address or a card may be blocked for a few hours or days after repeated failed payments, and a payment provider may decline a payment or a pay-later option after its own assessment. You always have the right to ask whether a specific decision was made solely by automated means and to ask for a human review. If that happens to you and you think it is wrong, contact us at customercare@timiofsweden.com or the payment provider, and a person will look at it.
1.7 What are your rights in relation to your personal data?
Some things you can do yourself in your customer account (log in via the person icon in the store); for everything else, email customercare@timiofsweden.com. We may need to confirm that it is you, for example by asking you to reply from the email address on your account. We reply within one month.
1.7.1 Right of access
As a customer, you have the right to access a range of information, including the categories of personal data we collect about you. In your customer account you can always see your orders, addresses and profile details. For a full copy of the data we hold about you, email us.
We may reject a request that is manifestly unfounded or excessive, for example because it is unreasonably repetitive. Because you only have the right to access data that concerns you, we cannot share information that contains data about someone else. You may therefore not receive all the personal data you have requested, but in that case we will describe which information we cannot provide and why.
1.7.2 Right to rectification
If your data is out of date or incorrect, you can contact us and ask us to update it. You can also change your name and addresses yourself in your customer account. After a request, we will update, change or delete the personal data we process, except personal data that we need to continue processing on the basis of a legal obligation or our legitimate interest.
1.7.3 Right to erasure ("right to be forgotten")
You have the right to have your personal data erased if it has been processed unlawfully, must be erased because of a legal obligation, is no longer necessary for the purpose for which it was processed, if you object to the processing and there are no overriding legitimate grounds for it, or if the processing is based on your consent and you withdraw your consent.
You can delete your account yourself in your customer account by choosing "Delete account", or you can ask us to erase your data by emailing customercare@timiofsweden.com. We then delete or anonymise your data everywhere – including in our own database and on customer lists at advertising partners – except what the law requires us to keep, such as accounting records. In some cases we may not be able to comply with your request because there are grounds that entitle us to continue processing your personal data; in such cases we will tell you about these grounds in writing.
1.7.4 Right to restriction of processing
You have the right to ask us to restrict the processing of your data if any of the following applies:
- you have contested the accuracy of the personal data and are waiting for our decision on whether it is correct;
- the processing is unlawful and you oppose erasure and ask for restriction instead;
- the personal data is no longer necessary for the purpose of the processing, but you need it to establish, exercise or defend legal claims; or
- you have objected to the processing (see section 1.7.6) and are waiting for us to check whether our legitimate interest overrides your legitimate grounds.
1.7.5 Right to data portability
You have the right to data portability, which means that you have the right to receive personal data about you in a structured, commonly used and machine-readable format and to transfer it to another company without hindrance from us, if (i) the processing is based on your consent or on an agreement, (ii) the processing is carried out by automated means, and (iii) this does not adversely affect the rights and freedoms of others.
Where technically possible, you also have the right to have the personal data transferred directly from us to another controller.
1.7.6 Right to object
You have the right to object to any processing that we base on our legitimate interest (section 1.2.3), including profiling. We must then demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or show that the personal data is needed to establish, exercise or defend legal claims.
If your personal data is processed for direct marketing purposes – including the customer exclusion list – you have the right to object, and we will then always stop the processing. To be removed from the customer exclusion list and all customer lists, just email customercare@timiofsweden.com with the subject "No ad lists". We remove you at the next daily update, and you stay off the lists.
Withdrawing your consent
You can withdraw a consent at any time:
- Cookies, advertising and targeted customer lists: open Cookie settings at the bottom of any page and choose "Only necessary", or switch off the categories you no longer want. Whatever that choice covered leaves our customer lists at Google and Meta at the next daily update.
- Newsletter and SMS: the unsubscribe link in every email (or the instructions in every SMS), or in your customer account; at the next daily update, your code then also leaves our customer lists at Google and Meta – for offers and for fewer ads alike – unless you have accepted Marketing cookies. If you have bought from us, Meta may keep sparing you ads for things you already own (section 1.2.3) until you email us with the subject "No ad lists"; that takes you off every customer list at once.
- Push notifications: your browser settings.
1.8 Organisational and technical security measures
The GDPR requires your personal data to be processed securely and confidentially. Our own database is hosted in Microsoft Azure in the EU, with no open access from the internet, and is encrypted both at rest and in transit. Each system has only the access it needs, and services that are open to the internet cannot read customer data. Passwords and keys are kept in a separate vault, and backups are encrypted. Only staff who need data for their work can access it. Our security is reviewed regularly and always takes your rights into account.
1.9 Updates to this policy
Rapid developments in the digital and technical field may change how we process personal data. We therefore reserve the right to update and change this policy. You can always find the current policy in our store, and the date at the top shows the latest version. If we make significant changes, we will let you know with a visible notice in the store.
1.10 Questions and complaints
We are happy to help if you have any questions about how we process your personal data – and if you are not happy with how we handle your data, please tell us first, because we really want to put it right. If you feel that we have failed in our responsibilities when processing your personal data, have not responded to your request or have processed your data in breach of data protection law, you have the right to lodge a complaint with a supervisory authority. Our lead authority is the Swedish Authority for Privacy Protection (IMY), Box 8114, 104 20 Stockholm, Sweden, www.imy.se. You can also contact the authority in the country where you live or work, for example Datatilsynet in Norway (www.datatilsynet.no) or Denmark (www.datatilsynet.dk), the data protection authority of your German federal state, or the Information Commissioner's Office in the UK (ico.org.uk). We have not appointed a separate representative in the UK; Happy Accessories AB is your point of contact for UK customers too. A list of all EU/EEA authorities is available at edpb.europa.eu.
Our store is not aimed at children. You must be at least 16 years old to sign up for our newsletter or to consent to advertising. If you think a child has given us their details, contact us and we will delete them.
1.11 Contact us
You can contact us at customercare@timiofsweden.com or by post: Happy Accessories AB (Timi of Sweden), company registration number 556797-2590, Attn: Privacy, Tolvevägen 6, 237 91 Bjärred, Sweden.
2. Cookie Policy
Like most websites, we use cookies for several purposes. This Cookie Policy describes which cookies we use, for what purposes, and how you can withdraw your consent. If you have any questions about our use of cookies, you are welcome to contact us at customercare@timiofsweden.com.
2.1 What is a cookie?
A cookie is a small text file that is stored on your computer or device via your browser when you visit the store. Cookies make it possible to collect certain information, including which pages and functions you visit and use. Similar technologies – pixels, tags, local storage and scripts – work in much the same way, and we call them all "cookies" here.
Some cookies are technically necessary for functions you use in the store (for example so that we can keep the contents of your basket), while others are used for other purposes (for example to compile statistics). In the next section you can read more about which cookies may be used.
The first time you visit our store, you will be shown a cookie banner where you can give your consent to our use of cookies: Accept All, Only necessary, or Manage preferences, where you can choose category by category. As shown below, you can always change your consent. Cookies that are technically necessary cannot be switched off and are therefore stored without consent.
There are basically two main types of cookies – "session" and "persistent":
- Session cookies are linked to your current visit and are deleted automatically when you close your browser.
- Persistent cookies are stored and renewed each time you visit the store, but are removed after a certain time. They make it possible to recognise you when you return. Where persistent cookies are used, their duration is shown in the table below.
A distinction is also made between "first-party cookies" and "third-party cookies". First-party cookies are set by us (or by Shopify on our behalf), while third-party cookies are set by a third party that has elements embedded in the store. The table below shows which cookies are set by whom.
2.2 Which cookies do we use?
Our cookie banner groups cookies into four categories. Below you will find the exact text from the banner for each category, followed by the services that use it.
Necessary – always on
"Needed for the shop to work: your cart and checkout, login, fraud prevention, remembering your cookie choice, and your language and currency. These cannot be switched off."
Services: Shopify (store, checkout, customer account, Shop Pay) and our own favourites, lists and "Recently viewed" service, which is part of the store's service (section 1.2.2) and works whichever choice you make. You can set your browser to block these cookies, but then parts of the store won't work.
Performance
"Lets us count visits and see which pages are most popular and how visitors move around the site, so we can keep improving it. The information is aggregated and anonymous."
Services: Shopify Analytics, Google Analytics and our own visitor measurement (_tv, t.timiofsweden.com). With this choice we also use our own cookie to recognise your browser on later visits (section 1.2.1).
Marketing
"We and our marketing partners collect information about your website usage to offer you personalised content, offers and advertising, tailored to your interests based on what you've viewed and purchased in our digital channels. Our goal is to show you jewellery that is as relevant to you as possible."
Services: Meta (Facebook, Instagram), Google (Google Ads, YouTube), Pinterest, Snapchat and TikTok – their analytics and advertising pixels, as described in section 1.4.6. With this choice, you also say yes to personal offers – and fewer ads for things you already own – in our marketing channels at Google and Meta, based on hashed contact details; as a newsletter subscriber, you give the same consent for your hashed email address even without this choice – see section 1.2.1 and "Our marketing channels" in section 1.4.6.
Functional
"Enables enhanced functionality and personalisation, such as recently viewed items and recommendations. Without these cookies some of these services may not work properly."
Services: store apps that remember choices you make and provide extra functions – Sleeknote (sign-up forms), Ønskeskyen (wishlist button), Flowbox (customer photos), Loox (reviews) and Brevo PushOwl (push notifications).
Below you will find detailed information about each cookie, including who sets it, its purpose and its duration. Durations are the maximum; many cookies are removed sooner. Shopify's cookies follow Shopify's current list (shopify.com/legal/cookies, read 6 October 2026). Third-party cookies are set by each provider and can change – the provider's own cookie policy applies.
| Category | Cookie | Set by | Purpose | Duration |
|---|---|---|---|---|
| Necessary | _shopify_essential | Shopify | Essential store information such as session and checkout | 1 year |
| Necessary | _tracking_consent | Shopify | Remembers your cookie choice | 1 year |
| Necessary | cart | Shopify | Your basket | 2 weeks |
| Necessary | cart_currency | Shopify | Starts a new basket in the same currency after checkout | 2 weeks |
| Necessary | localization | Shopify | Shows the store for the right country | 1 year |
| Necessary | discount_code | Shopify | Keeps a discount code for the next checkout | Session |
| Necessary | shopify_pay | Shopify | Logs you in to Shop Pay on return visits | 1 year |
| Necessary | login_with_shop_finalize, __Host-Http-shop_binding | Shopify | Logging in with Shop | 5 minutes / 3 hours |
| Necessary | _shopify_test | Shopify | Checks that the browser accepts cookies | 1 minute |
| Necessary | storefront_digest | Shopify | Password-protected store preview | 1 year |
| Necessary | Local storage for favourites and "Recently viewed" | Timi of Sweden | Remembers your favourites and the products you viewed | Until you clear it |
| Performance | _shopify_analytics, _shopify_y, shop_analytics | Shopify | Store statistics | 1 year |
| Performance | _shopify_s | Shopify | Identifies a browsing session | 30 minutes |
| Performance | _tv | Timi of Sweden (t.timiofsweden.com) | Recognises your browser on later visits for our own statistics | 2 years |
| Performance | _ga, _ga_<ID> | Google Analytics | Visit statistics | 2 years |
| Marketing | _shopify_marketing | Shopify | Marketing data for the store and checkout | 1 year |
| Marketing | _fbp, _fbc | Meta | Ads and measurement on Facebook and Instagram | 3 months |
| Marketing | _gcl_au, _gcl_aw | Google Ads | Ads and conversion measurement | 3 months |
| Marketing | _ttp | TikTok | Ads and measurement on TikTok | 13 months |
| Marketing | _pin_unauth, _pinterest_ct_ua | Ads and measurement on Pinterest | 1 year | |
| Marketing | _scid | Snapchat | Ads and measurement on Snapchat | 13 months |
| Functional | Cookies and local storage from store apps (Sleeknote, Ønskeskyen, Flowbox, Loox, Brevo PushOwl) | The app provider | Remembers your choices in the app | Set by each app provider |
2.3 Withdrawing your consent
You can withdraw or change your consent to cookies at any time by clicking the Cookie settings link at the bottom of any page in the store, where you can again choose "Accept all", "Only necessary" or the individual categories. Your new choice applies straight away. Cookies that are technically necessary for the store to work ("Necessary") cannot be switched off.
You can also block or delete cookies in your browser's settings: Google Chrome, Mozilla Firefox, Microsoft Edge, Apple Safari.
If you choose to withdraw your consent or to delete or block cookies, please be aware that – depending on the type of cookie – this may affect your experience in the store; if you block necessary cookies, your basket, login and favourites may stop working. Browsers' "Do Not Track" signal has no common standard, so we don't respond to it – instead we respect the choice you make in our cookie banner.
2.4 Processing of your personal data
When you accept our use of cookies, in some cases – as stated in the consent – we will process your personal data, for example information about how you use the store and a pseudonymous identifier for your browser. You can read more about our processing of personal data and your rights in our Privacy Policy above.
2.5 Changes to this Cookie Policy
We may change this Cookie Policy at any time. If we make changes that require your consent again, you will be shown the cookie banner the next time you visit our store.
Questions? Email us at customercare@timiofsweden.com – we're happy to help.