1) Introduction & Controller

Controller: JO&LYD, Stockholm, Sweden. Email: info@jolyd.com.

Registered operational address: Tujavägen 29, 14145 Huddinge, Sweden. Phone: +46 704 971 496.

2) Personal Data We Collect

• Account information: first/last name, email, phone, billing & shipping address (provided by you).
• Order information: products purchased, order notes, delivery details; payment tokens processed securely by our payment providers (we do not store full card data).
• Social login data: if you register/login via Facebook or LinkedIn, we receive basic profile data (name, email, provider ID) per your consent with those providers.
• reCAPTCHA: our forms may use Google reCAPTCHA to prevent abuse; this involves technical data (IP/device) as per Google’s terms.
• Newsletter opt-in: your email and marketing preferences, only when you explicitly consent.
• VIP Portal data (partners/stylists): name, contact details, portfolio links, payout/loan logistics where applicable.
• Usage data: device/browser, IP address, site interactions, cookies (for performance, analytics, preferences).

3) How We Use Your Data

• Order fulfilment: to process purchases, arrange insured shipping, handle returns and after-sales care.
• Communication: to send service emails (order updates, account notices).
• Marketing (opt-in only): to share news, launches and limited allocations—only if you have consented; you may unsubscribe anytime.
• Security & fraud prevention: including reCAPTCHA, rate-limiting and access controls.
• Site performance & analytics: to improve experience and product curation.
• Legal compliance: tax, accounting and consumer protection obligations.

4) Legal Bases (GDPR)

• Contract: processing necessary to perform our contract with you (e.g., fulfilling your order).
• Consent: for marketing communications, certain cookies, and social logins where applicable.
• Legitimate interests: website security, fraud prevention, analytics, service improvement.
• Legal obligation: retention of invoices and records required by law (tax/accounting).

5) Sharing of Data

We share data only with trusted providers strictly for the purposes listed below, under confidentiality and data-processing agreements:

• Payment processors: Stripe, Clarna, PayPal.
• Hosting & email providers: secure cloud and transactional email services.
• Social login providers: Facebook, LinkedIn (if you choose to use them).
• Newsletter & CRM: Mailchimp and/or Klaviyo (opt-in contacts only).
• Shipping carriers: DHL, UPS, Post (national postal services).
• Analytics & advertising: Google Analytics and Meta Pixel (where enabled and consented).

We do not sell your personal data.

6) International Transfers

Some providers (e.g., Mailchimp, LinkedIn, Meta) may process data in the United States or other non-EU countries. In such cases, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs) and provider-implemented technical measures.

7) Retention

• Accounts: retained until you request deletion or your account becomes inactive and is anonymised per our schedules.
• Orders & invoicing: retained for 7–10 years to meet accounting/legal requirements.
• Newsletters: retained until you unsubscribe (opt-out) or we remove inactive contacts.
• VIP Portal records: retained as needed for partnership accounting and compliance.

8) Your Rights

Subject to GDPR and local law, you may request:

• Access to the personal data we hold about you;
• Rectification of inaccurate or incomplete data;
• Erasure (“right to be forgotten”);
• Restriction or Objection to certain processing (including marketing/profiling);
• Data portability in a structured, commonly used and machine-readable format;
• Withdrawal of consent at any time (where processing is based on consent).

To exercise your rights, email info@jolyd.com with the subject “Privacy Request”. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, formerly Datainspektionen).

9) Cookies & Tracking

We use cookies to remember preferences (language, currency, wishlist), enable secure checkout, and improve site performance. Where required, analytics/advertising cookies (e.g., Google Analytics, Meta Pixel) are used only with your consent. You can adjust your preferences anytime via our Cookie Settings.

10) Security

• HTTPS/SSL across our site; encryption in transit and at rest where applicable.
• Role-based, least-privilege access to systems and data.
• Regular updates, monitoring and fraud-prevention controls (including reCAPTCHA).

Data breach notification: In the unlikely event of a breach affecting your personal data, we will notify affected users without undue delay and, where required, within 72 hours of becoming aware, as well as the relevant supervisory authority.

11) Contact

We may update this Policy from time to time. Material changes will be announced here and, where appropriate, via email.