/)
/)
Privacy policy
Effective date: January 4, 2024
Summary
We at Röhnisch Sportswear AB (“Röhnisch”) are responsible for processing your personal data in our capacity as data controller, as described in this Privacy Policy. We care about how your personal information is used and shared. In addition, we appreciate your trust in us to do so responsibly. This Privacy Policy describes how we process your personal data if you purchase with us, visit our website, contact us, subscribe to our newsletters, or participate in any of our competitions.
How do we process your personal data?
If you purchase with us, we process your personal data to administer your purchase and any returns or claims, fulfill legal obligations such as storing information for accounting purposes, and send a request to review your purchase.
When you visit our website and consent to the cookie policy, we process your personal data to analyze how our website is used and to show you relevant information on other sites. We do this using Google's and Voyado’s analytics services and Google’s, Meta’s, Bing’s, and TikTok’s marketing services.
If you contact us, we will process your personal data, e.g., to answer your questions.
If you subscribe to our newsletter, we process your personal data so you can receive our newsletters.
If you participate in a competition that we organize or share your social media posts, we process your personal data to conduct the competition or share your posts.
See Appendix 1 to learn more about our current personal data processing.
Your rights
In summary, you have the following rights:
The right to complain to the Swedish Authority for Privacy Protection
The right to withdraw your consent
Right to access
Right to object
Right to erasure
Right to data portability
Right to rectification
Right to restrict personal data processing
Please contact us if you have any questions about your rights or wish to exercise any of them.
Below, you can read more about:
Who is responsible for the processing of personal data?
What rights do you have when we process your personal data?
Who has access to your personal data and why?
Do we share your personal data outside the EU/EEA?
Balance of interests
Appendix 1: Detailed information on how we currently process and store your personal data
Who is responsible for the processing of personal data?
Röhnisch Sportswear AB, company registration number 556130-5649, is responsible as data controller for processing your personal data as described in this Privacy Policy.
Torbjörn Ungvall (CTO Röhnisch) is responsible for data protection and handling questions regarding personal data covered by this Privacy Policy.
If you have any questions regarding our processing of your personal data or would like to exercise any of your rights, please contact us at our email address, privacy@rohnisch.com, or call us at +46 19 32 16 00. Our postal address is Röhnisch Sportswear AB, Box 6116, 700 06 Örebro, Sweden.
What rights do you have when we process your personal data?
In accordance with the data protection legislation, you have certain rights concerning our processing of your personal data. If you have any questions about your rights or wish to exercise them, please get in touch with us. More detailed information about your rights can be found below.
Right to complain to the Swedish Authority for Privacy Protection (Article 77 GDPR)
You have the right to lodge a complaint with the competent supervisory authority if you believe processing your personal data breaches the GDPR. The Swedish Authority for Privacy Protection is the competent supervisory authority in Sweden.
In detail: Your right to complain will apply if it does not affect any other administrative review procedure or legal remedy. Such a complaint should preferably be lodged with the authority of the Member State where you are domiciled, where you work, or where a breach of applicable data protection laws and regulations is alleged to have occurred.
The supervisory authority has an obligation to inform you of the progress and outcome of the complaint, including informing you of the possibility of having your complaint heard in court.
Right to withdraw consent (Article 7.3 GDPR)
You have the right to withdraw your consent at any time. Your withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.
Right of access (Article 15 GDPR)
You have the right to receive confirmation of whether we process your personal data. You can send us a request by contacting us. If we process your personal data, you also have the right to receive a copy of the personal data we process and information about the processing.
In detail: The information we, in such cases, provide you with is:
the purposes of the processing;
the categories of personal data to which the processing relates;
the recipients or categories of recipients to whom the personal data have been or are to be disclosed, in particular recipients in third countries or international organizations;
where possible, the foreseeable period during which the personal data will be stored or, if this is not possible, the criteria used to determine that period;
the existence of the right to request the rectification or erasure of the personal data from us, or restrictions on the processing of personal data relating to you or to object to such processing;
the right to lodge a complaint with a supervisory authority;
if we do not collect your information, any available information about where that information comes from;
the existence of automated decision-making, including profiling per Articles 22.1 and 22.4 GDPR, where you also have the right to receive meaningful information about the logic behind, and the significance and anticipated consequences of, such processing; and
if the personal data is transferred to a third country or an international organization, you also have the right to information about the appropriate safeguards taken per Article 46 GDPR during the transfer.
You have the right to receive a copy of the personal data we process. We may charge a reasonable fee for any additional copies you request based on our administrative costs. If you have requested the information via an electronic form, you will receive the information in a generally used electronic format unless you request otherwise.
Your right to request copies as described above shall not prejudice the rights and freedoms of others.
Right to object (Article 21 GDPR)
You have the right to object to processing personal data regarding the personal data we process.
In detail: Your right to object applies as follows:
You have the right to object at any time to grounds relating to your specific situation regarding processing your personal data per Article 6.1 e or 6.1 f GDPR, which includes profiling based on these provisions. If you object, we may no longer process your personal data unless we can show forcing, legitimate grounds for the processing that outweigh your interests, rights, and freedoms or if it is for the establishment, exercise, or defense of legal claims.
If your personal data is processed for direct marketing. In that case, you have the right to object to processing your personal data for such marketing, including profiling, if such profiling is related to direct marketing. If you object to processing for direct marketing purposes, you have an unconditional right to have the processing of your personal data for such purposes ceased.
Concerning the use of the services of the information society, you have the right to object using automated means by using technical specifications.
Right to erasure (“right to be forgotten”) (Article 17 GDPR)
You have the right to have your personal data deleted by us without undue delay.
In detail: We have an obligation to delete personal data without undue delay if any of the following applies:
the personal data is no longer necessary for the purposes for which it was collected or processed;
you withdraw your consent on which the processing is based per Article 6.1 a GDPR, or Article 9.2 a GDPR, and there is no other legal basis for the processing;
you object to the processing per Article 21.1 GDPR, and there are no overriding legitimate reasons for the processing, or you object to the processing per Article 21.2 GDPR;
the personal data has been processed unlawfully;
the personal data must be deleted to comply with a legal obligation under Union or Member State national law to which we are subject; or
the personal data has been collected in connection with offering information society services in the cases referred to per Article 8.1 GDPR.
If we have disclosed the personal data and are required to delete the personal data according to the above, taking into account the available technology and the cost of implementation, we shall take reasonable steps, including technical measures, to notify other controllers processing the personal data that you have requested that they delete any links to, or copies or reproductions of, that personal data.
We will notify each recipient to whom the personal data has been disclosed of any erasure as described above unless this proves impossible or entails a disproportionate effort.
Please note that our obligation to erase as set out above does not apply to the extent that processing is necessary for the following reasons:
to exercise the right of freedom of expression and information;
to comply with a legal obligation requiring processing under Union or Member State national law to which we are subject or for the performance of a task in the public interest or which is part of the exercise of official authority by us;
for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes per Article 89.1 GDPR, to the extent that your right to erasure is likely to preclude or significantly impede the achievement of the purpose of that processing; or
to establish, assert, or defend legal claims.
Right to data portability (Article 20 GDPR)
You have the right to receive your personal data from us in a structured, commonly used, and machine-readable format. You also have the right to transfer your personal data to another controller where technically feasible (“data portability”).
In detail: The right to data portability applies to personal data that you have provided to us in a structured, commonly used, and machine-readable format if:
the processing is based on the lawful basis of consent per Article 6.1 a, or Article 9.2 a GDPR, or performance of contracts per Article 6.1 b GDPR; and
the processing is automated.
Your right to data portability does not affect your right per Article 17 GDPR (right to erasure). Your right to data portability does not apply to processing necessary for the performance of a task in the public interest or that is part of the exercise of authority by us.
Your right to data portability must not adversely affect the rights and freedoms of others.
Right to rectification (Article 16 GDPR)
You have the right to have inaccurate personal data concerning you rectified without undue delay. Considering the purpose of our processing of your personal data, you also have the right to supplement incomplete personal data, including by providing a supplementary statement.
In detail: We will notify each recipient to whom the personal data has been disclosed of any rectification that has taken place unless this proves impossible or entails a disproportionate effort.
Right to restriction of processing (Article 18 GDPR)
You have the right to request that the processing of your personal data be restricted.
In detail: Your right applies if:
you dispute the accuracy of the data (but only for a period of time that allows us to verify it);
the processing is unlawful, and you object to the erasure of the personal data and instead request a restriction on the use of the data;
you need the personal data to establish, assert, or defend legal claims even though we no longer need the personal data for our purpose of processing; or
you have objected to processing per Article 21.1 GDPR pending verification of whether the controller's legitimate grounds outweigh the legitimate grounds of the data subject.
Where the processing as described above has been restricted, such personal data may, except for storage, only be processed with your consent or for the establishment, exercise, or defense of legal claims or the protection of the rights of any other natural or legal person or for reasons relating to an important public interest of the Union or of a Member State. We will notify you before the restriction of processing ends.
We will notify each recipient to whom the personal data has been disclosed of any restriction that has occurred as described above unless this proves impossible or entails a disproportionate effort.
Who has access to your personal data and why?
Your personal data is primarily processed by us at Röhnisch. However, like all companies, we use IT providers to ensure we have functioning IT systems and run our business efficiently. These IT providers process personal data on our behalf as data processors. In some cases, we transfer your personal data to recipients who are independent data controllers for processing your personal data, e.g., to the carrier of your choice when you shop with us.
You can read about the recipients who process your personal data in Appendix 1.
Do we share your personal data outside the EU/EEA?
Your personal data might be transferred outside the EU/EEA when we use IT providers based outside the EU/EEA. The personal data transferred is listed in Appendix 1. In summary, your personal data might be transferred outside the EU/EEA in the following cases:
Your personal data will be transferred to the United States, Japan, and Australia when we use Zendesk.
Your personal data is stored within the EU/EEA but might be transferred to the United States when we use Centra, Voyado Enagae, Voyado Elevate, Ingrid, and TestFreaks.
When we transfer your personal data outside of the EU/EEA, this is done on the basis of the European Commission’s Standard Contractual Clauses (Article 46.1.c GDPR), Module 2. The European Commission’s Standard Contractual Clauses can be found here.
Balance of interests
As we have stated above, we process some of your personal data on the basis of a balance of interests as a legal basis for the processing. The balance of interests means that we have assessed that our legitimate interest in carrying out the processing outweighs your interest and your fundamental right not to have your personal data processed.
Updates
This Policy is subject to changes and updates and shall reflect our current practices regarding processing personal data. We periodically update the Privacy Policy and reserve the right to change the provisions of this Policy at any time. When we update this Privacy Policy, we will modify the "Effective Date" at the top to indicate when such changes have occurred.
We encourage you to review the site periodically, and we will alert you that changes have been made by updating the Effective Date of the Policy.
Appendix 1: Detailed description of how we process and store your personal data
Here, you can read in more detail about why we process your personal data, what categories of personal data we process, and the legal basis for processing your personal data. You can also read about how long we store your personal data.
If you make a purchase with us
We process your personal data when you purchase with us. We receive your personal data from you in connection with the purchase.
Purpose: To administer your Purchase.
Processing performed: Receive and register your order, communicate with you after purchase, e.g., send order confirmation, and deliver your order.
Personal data processed: Name, contact details (address, email, and phone number), order information, and payment information.
Legal basis: The processing is necessary to fulfill the agreement regarding your purchase. If the personal data is not provided, you cannot make a purchase with us. (Performance of Agreement, Article 6.1.b GDPR)
Storage time: Your purchase information is stored and processed for six months. If you have purchased a product with a guarantee, we store information about your purchase for two years. Personal data is stored longer for the purposes below, e.g., for accounting reasons.
Recipients of personal data: All order data will be processed by Centra. Our payment service providers, Klarna, Adyen, and Paypal, collect your personal data concerning the purchase. The payment service providers are independent data controllers for processing your personal data. Read more about Klarna’s privacy policy here. Read more about Adyen’s privacy policy here. Read more about PayPal’s privacy policy here. We will also share your name, address, and contact details with the carrier of your choice at checkout to deliver your products. The carrier we use is the independent data controller for processing personal data. Our carriers are Postnord, DHL, UPS, Bring, DB Schenker, Airmee, Budbee, and nShift. We also share your personal data with our IT providers as data processors.
Transfer outside of the EU/EEA: This personal data might be transferred to the United States by sharing your personal data with our IT providers. When we transfer your personal data outside of the EU/EEA, this is done on the basis of the European Commission’s Standard Contractual Clauses (Article 46.1.c GDPR), Module 2. The European Commission’s Standard Contractual Clauses can be found here.
Purpose: To administer the right of withdrawal, complaints, or other claims.
Processing performed: Should you choose to exercise your right of withdrawal, complain about an item, or make a claim against us, we will process your personal data for that purpose.
Personal data processed: Name, contact details (address, email, and phone number), and information from our communication concerning your claim (e.g., information about the order in question).
Legal basis: The processing is necessary to fulfill the agreement regarding your purchase. If the personal data is not provided, you cannot make a purchase with us. (Performance of Agreement, Article 6.1.b GDPR)
Storage time: Your personal data will be erased twelve months from the case's termination date.
Recipients of personal data: Your personal data is shared with our IT providers as data processors.
Transfer outside of the EU/EEA: Through our sharing of your personal data with our IT providers, this personal data will be transferred to the United States, Japan, and Australia. When we transfer your personal data outside of the EU/EEA, this is done on the basis of the European Commission’s Standard Contractual Clauses (Article 46.1.c GDPR), Module 2. The European Commission’s Standard Contractual Clauses can be found here.
Purpose: To comply with the rules of the Accounting Act.
Processing performed: To comply with accounting laws by recording, accounting, and filing your payments and other transactions between us and you.
Personal data processed: Payment history, transactions, and other materials that constitute accounting material.
Legal basis: The processing is necessary to comply with mandatory law, i.e., the Accounting Act. (Legal obligation, Article 6.1.c GDPR, and Balance of Interests, Article 6.1.f GDPR)
Storage time: Personal data is stored for seven to eight years to comply with the Accounting Act (the end of the seventh accounting year).
Recipients of personal data: We share your personal data with our IT providers as data processors.
Transfer outside of the EU/EEA: This personal data might be transferred to the United States by sharing your personal data with our IT providers. When we transfer your personal data outside of the EU/EEA, this is done on the basis of the European Commission’s Standard Contractual Clauses (Article 46.1.c GDPR), Module 2. The European Commission’s Standard Contractual Clauses can be found here.
Purpose: To submit a request if you would like to review your purchase.
Processing performed: To submit requests to review our products and your shopping experience and manage the responses you provide. To do so, we use the service TestFreaks. We share information about you as a customer with TestFreaks to administer your review and publish it on our website. You can choose whether you wish to enter your name.
Personal data processed: Name, email, and the information you provide in the review.
Legal basis: The processing is justified by our legitimate interest in being able to contact you with a request to review our products and our offering. (Balance of interests, Article 6.1.f GDPR)
Storage time: The personal data is stored for two years after the purchase. However, if you object to our processing, we will stop processing your personal data earlier.
Recipients of personal data: We share your personal data with TestFreaks. TestFreaks will process personal data as our data processor.
Transfer outside of the EU/EEA: This personal data might be transferred to the United States by sharing your personal data with our IT providers. When we transfer your personal data outside of the EU/EEA, this is done on the basis of the European Commission’s Standard Contractual Clauses (Article 46.1.c GDPR), Module 2. The European Commission’s Standard Contractual Clauses can be found here.
When you visit our website
We analyze how our website is used and show you relevant offers on other pages you visit based on such analysis. We explain this in detail below. To protect your privacy, we and our partners have taken steps to avoid identifying those who use our website, e.g., only an encrypted version of your IP address is used so that we cannot track who you are.
Personal data processed is collected from your device (e.g., mobile, computer, or tablet) when you visit our website. Our providers, Google, Hotjar, Voyado Elevate, Voyado Engage, Meta, Bing, and TikTok, also use the information they have acquired previously to conduct analytics and to show you interesting offers from us.
As described below, we use cookies to collect personal data for analysis and marketing. In our information text about cookies, we explain in more detail how this is done.
Purpose: To analyze how our website is used.
Processing performed: To analyze how you use our website to improve our products and our website. We use Google Analytics and other Google Analytics services, Hotjar, Voyado Elevate, and Voyado Engage analytics tools to do this. The analytics service means a unique ID is placed on your device to distinguish visitors and see website usage patterns. However, we cannot see who you are. The personal data we collect is processed to optimize function and page speed and change the website to suit you as a visitor.
Personal data processed: What area you are in, information about how you use the website, such as what you click on, device information, how many times you have visited the website, and information Google has about you before, e.g., from which website you found us. To Voyado Elevate, we send contact information about you, such as your name, phone number, and shopping history.
Legal basis: We obtain your consent on our website to analyze how you use our website to provide you with a better experience. (Consent, Article 6.1.a GDPR)
Storage time: The personal data will be used by us for twelve months after your visit. Our analytics services will continue to process your personal data as an independent data controller. See their privacy policies for information about how long Google and Voyado store your personal data.
Recipients of personal data: Your personal data is shared with Google and Voyado. They are independent data controllers for certain personal data processing and inform you separately about how they process your personal data.
Transfer outside of the EU/EEA: This personal data might be transferred to the United States by sharing your personal data with our IT providers. When we transfer your personal data outside of the EU/EEA, this is done on the basis of the European Commission’s Standard Contractual Clauses (Article 46.1.c GDPR), Module 2. The European Commission’s Standard Contractual Clauses can be found here.
Purpose: To show interesting offers from us on other pages you visit.
Processing performed: To promote our products by showing you offers and new products that interest you on Google, Facebook, Instagram, Bing, and TikTok. We may customize the marketing to suit you based on the information Google, Meta, Bing, and TikTok have acquired about you and your previous browsing history with us (so-called profiling*).
Personal data processed: Encrypted IP address that we at Röhnisch cannot connect to you, geographic location, and what pages you visited after clicking on our ad. Next, you’ll see search results and advertising banners based on analysis of how and when you use our website, e.g., if you add something to your shopping cart, make a purchase, or search for something, Information that marketing services have about you previously, e.g., from which website you found us.
Legal basis: We obtain your consent to provide personalized marketing that is relevant to you based on the information we have about you, e.g., based on what you have shown interest in on our website. Here, you can make choices about the marketing you see from Google. Here, you can find more information about your choices on Instagram and here on Facebook; under the heading Ad settings, you can choose which marketing you want to see on Facebook. (Consent, Article 6.1.a GDPR)
Storage time: You will see our marketing for six months after you visit our website. Our marketing services will continue to process your personal data as an independent data controller. You can read about how long Google, Meta, Bing, and TikTok store your personal data in their privacy policies.
Recipients of personal data: We share your personal data with Google, Meta, Bing, and TikTok. These companies are independent data controllers for the processing they carry out and inform you separately about how they process your personal data.
Transfer outside of the EU/EEA: Through our sharing of your personal data with Google and Meta, this personal data will be transferred to the United States. When we transfer your personal data outside of the EU/EEA, this is done on the basis of the European Commission’s Standard Contractual Clauses (Article 46.1.c GDPR), Module 2. The European Commission’s Standard Contractual Clauses can be found here.
*Profiling: Your activity on our website is used in so-called profiling, which Google, Meta, Bing, and TikTok do to show you the offers that they and we think are best suited for you and to provide personalized marketing. Profiling is done because we would otherwise be unable to show you relevant offers and marketing. Without this profiling, you would instead have seen offers that are not relevant to you. You have the right to object to profiling.
If you contact us
When you contact us, e.g., via social media, we will process your personal data as described below. We receive your personal data from you through our contact. If you use social media, your social media (e.g., Facebook) will also process your personal data. Therefore, we recommend reading our information below and your information on these social media sites.
Purpose: To communicate with you if you contact us.
Processing performed: Communicate with you if you contact us, for example, through our customer service, chat, or social media.
Personal data processed: Name and the contact details you use, e.g., email address, telephone number, and/or address. Other information you provide in connection with our contact. If you contact us through social media (e.g., our Instagram), we also process information from your profile (username and the image you have selected for your account).
Legal basis: The processing is justified by our legitimate interest in being able to communicate with you on our social media and via our customer service. (Balance of interests, Article 6.1.f GDPR)
Storage time: We delete communications in our customer service cases within 12 months of our contact regarding the case ending. On social media, we delete your comments and our communication on request. Materials that may be perceived as offensive are continuously removed. This applies, for example, to unpleasant comments, foul language, or ad hominem attacks.
Recipients of personal data: In a customer service matter, your personal data is shared by our IT provider, Zendesk, as controller. Read more about Zendesk’s privacy policy here. The social media platform also receives your personal data if you contact us via social media.
Transfer outside of the EU/EEA: This personal data might be transferred to the United States by sharing your personal data with our IT providers. When we transfer your personal data outside of the EU/EEA, this is done on the basis of the European Commission’s Standard Contractual Clauses (Article 46.1.c GDPR), Module 2. The European Commission’s Standard Contractual Clauses can be found here.
If you subscribe to our newsletter
Below, we describe how we process your personal data if you have chosen to subscribe to our newsletters. We receive your personal data when you purchase or choose to fill in your email address when subscribing to our newsletters.
Purpose: To send newsletters.
Processing performed: To send newsletters by email and develop and improve our newsletters by analyzing how you open them and what you click on in the newsletters.
Personal data processed: Email address, information on how you open our newsletter and what you click on, and IP address.
Legal basis: We obtain your consent to send you newsletters. You can object to marketing and withdraw your consent at any time. (Balance of interests, Article 6.1.f GDPR)
Storage time: We delete communications in our customer service cases within 12 months of our contact regarding the case ending. On social media, we delete your comments and our communication on request. Materials that may be perceived as offensive are continuously removed. This applies, for example, to unpleasant comments, foul language, or ad hominem attacks.
Recipients of personal data: Your personal data is shared with Voyado Engage as controller to enable us to administrate all subscribers and to send newsletters.
Transfer outside of the EU/EEA: Through our sharing of your personal data with our IT providers, this personal data will be transferred to the United States, Japan, and Australia. When we transfer your personal data outside of the EU/EEA, this is done on the basis of the European Commission’s Standard Contractual Clauses (Article 46.1.c GDPR), Module 2. The European Commission’s Standard Contractual Clauses can be found here.
If you participate in one of our competitions or if we share your social media posts
If you enter a competition with us, we will process your personal data. We receive your personal data from you through your competition participation and from your social media.
Purpose: To complete the competition.
Processing performed: To administer your participation in the competition.
Personal data processed: Name, such as Instagram username. You provided us with your entry and other information, such as your email address, when you entered the competition.
Legal basis: We have a legitimate interest in being able to administer your registration and participation. (Balance of interests, Article 6.1.f GDPR)
Storage time: We store the personal data until the competition is completed.
Recipients of personal data: If the competition is conducted on one of our social channels, the relevant social media will access your personal data.
Transfer outside of the EU/EEA: This personal data might be transferred to the United States by sharing your personal data with our IT providers. When we transfer your personal data outside of the EU/EEA, this is done on the basis of the European Commission’s Standard Contractual Clauses (Article 46.1.c GDPR), Module 2. The European Commission’s Standard Contractual Clauses can be found here.
If you tag us on social media.
Purpose: To share social media posts.
Processing performed: Share your posts on social media. If you share content on social media and tag us, we may send you a request to use your content in our marketing. We will share your post about our products on our channels if you agree.
Personal data processed: Information from your profile (username and the image you have selected on your account) and other information contained in the post you have created.
Legal basis: Your consent, which you provide in response to our request to share your post. (Consent, Article 6.1.a GDPR)
Storage time: The posts we share on social media will be stored there until you ask us to remove the post.
Recipients of personal data: We share your personal data with the social media used to process your personal data as a data processor.
Transfer outside of the EU/EEA:This personal data will be transferred to the United States through our sharing of your personal data with Meta. When we transfer your personal data outside of the EU/EEA, this is done on the basis of the European Commission’s Standard Contractual Clauses (Article 46.1.c GDPR), Module 2. The European Commission’s Standard Contractual Clauses can be found here.