Privacy policy

This policy explains how JTI Ventures AB processes personal data when you visit Minibirk.com, shop, use an account or contact us. It applies to customers and others who use our services.

Data controller and contact details

JTI Ventures AB, company registration number 559041-2358, is the controller responsible for the processing described here, unless otherwise stated. You can contact us about your data and rights at info@minibirk.com or on +46 10 641 20 22. Our address is Andesitgatan 6, 254 68 Helsingborg, Sweden.

Data we collect and where it comes from

The data we process depends on how you use the store. Personal data is information that can be linked to you. It may come directly from you, from your use of the services or from our providers.

Contact and orders: name, address, email, phone number, billing and delivery addresses, order details and payment confirmation.
Account: username, password, security questions and other information used to manage and protect the account.
Customer service: information you provide when asking questions or requesting help.
Usage: device, browser, network connection, IP address, approximate location derived from your IP address or other technical information, and how you use the website and account.

Shopify and other service providers may collect data on our behalf. Payment providers receive information such as card or bank details and billing addresses to process payments. When you visit the website, interact with adverts, or open and click links in emails, we and our partners may also collect usage data through cookies, pixels, web beacons, software libraries and similar technology.

You choose what information to provide directly to us. Information needed for a particular feature or to complete a purchase cannot be omitted if you want to use that feature or complete your order.

Why we process your data

Completing purchases and providing services: to take payment, manage orders and accounts, arrange delivery, returns and exchanges, and send information about purchases and other transactions. The legal basis is performance of our contract with you.
Customer service and improvements: to answer questions, follow up on enquiries and improve the services. The basis is our legitimate interest in effective customer service and maintaining customer relationships, or the contract when the enquiry concerns fulfilling your purchase.
Security: to detect, investigate and prevent fraud, illegal or harmful activity, and protect the services and our rights and those of others. The basis is our legitimate interest in secure operations and preventing misuse.
Marketing: for advertising by email, text message or post, and to personalise adverts and services here and on other websites. The basis is our legitimate interest in marketing our products, following a balancing of interests. Where consent is required, that consent is the basis instead. You always have the right to object to direct marketing.
Legal obligations and claims: to meet legal requirements and handle disputes or contractual claims. The basis is a legal obligation or our legitimate interest in establishing, exercising or defending legal claims.

If you choose other Shopify services, your account may be matched with those services. Shopify then processes data under its privacy policy and consumer information.

Cookies and similar technology

We use cookies to operate the store, remember activity and preferences, analyse use, and personalise services and marketing. Service providers and other partners may use this technology for these purposes. See also Shopify's cookie information.

Necessary cookies may be used to make a service you request work. Other cookies require active consent for the relevant purpose. Visiting or continuing to use the website does not in itself constitute consent. You have the right to decline and to withdraw consent at any time.

You can also delete or block cookies in your browser. Blocking necessary cookies may prevent some features from working. Blocking cookies does not automatically stop all other personal data processing or sharing with third parties. Contact us if you have questions about processing or your choices.

Who may receive your data

We may share contact, order, account, customer service and usage data, as well as location data, with the following recipients for the purposes described above:

Providers of website platforms, IT, cloud storage, payment, analytics, customer service, distribution and delivery.
Business and marketing partners, who process data under their own privacy notices.
Related companies and affiliate partners for our legitimate business purposes.
Other recipients when you ask us to or give consent, for example through social widgets or account integrations.
Relevant parties in events such as a merger or bankruptcy, or where disclosure is needed for legal requirements, government orders, contractual claims or protection of our rights and those of others.

We do not use or disclose sensitive personal data without your consent, and we do not use it to draw inferences about you.

With your consent, we share personal data for advertising and marketing. During the preceding twelve months, we have “sold” and “shared” personal data, as defined by applicable law, for these purposes. The data includes identifiers such as name, email and phone number, commercial information about products or services purchased, and usage data. The recipients are business and marketing partners.

Retention and security

How long data is kept depends on what it is needed for: managing your account, completing purchases and providing service, meeting legal requirements, or handling disputes and contractual claims. We assess retention periods based on these needs. A request for deletion therefore does not always mean all data can be removed immediately.

No security measure or transmission method provides complete protection. Do not send sensitive or confidential information through insecure channels. Protect your login details and contact us if you suspect someone has gained unauthorised access to your account.

Processing outside the EU/EEA

Data may be transferred to and processed by staff, providers and partners in other countries. For transfers outside the EU/EEA, we use applicable safeguards, such as the European Commission's standard contractual clauses, unless the country is covered by an adequacy decision. For data subject to UK rules, the corresponding applicable transfer mechanisms are used.

Your rights

You can contact us to exercise your rights. Depending on the processing and applicable law, you have the right to:

Receive information about processing and access your personal data.
Have inaccurate or incomplete data corrected.
Request deletion or restriction of processing.
Object to processing based on legitimate interests, and always to direct marketing.
Receive data you have provided in a usable format and, when the conditions are met, have it transferred to another organisation.
Withdraw consent. This does not affect the lawfulness of processing before withdrawal.
Opt out of “sale”, “sharing” or targeted advertising where these rights apply under the law.

If you use the Global Privacy Control signal, GPC, we automatically interpret it as a request to opt out of “sale” or “sharing” for the device and browser you are using, where this applies based on your location.

You can unsubscribe from marketing emails through the link in the messages. We may still send information about your account, order or other transactions.

These rights have certain legal limitations. We may need to verify your identity using contact or account details. You may appoint a representative; we may then need evidence of their authority. Exercising your rights does not affect your standing as a customer.

We handle requests as soon as possible and normally within one month at the latest. If the law permits an extension, we will inform you within the first month and explain why. If we reject a request, you can reply to the decision and request a review.

Complaints, children and external websites

Contact us if you have concerns about the processing. You can also complain to the Swedish Authority for Privacy Protection, IMY, or the competent supervisory authority where you live. You do not need to have your complaint reviewed by us first.

The store's services are intended for adults. We do not knowingly collect children's personal data. If a child for whom you are the guardian has provided data, you can contact us to request deletion. We are not aware of having “sold” or “shared” personal data about anyone under 16, as defined by applicable law.

Links to other websites do not mean we are responsible for or endorse their content, privacy or security. Read their own terms. Information you post in public or partly public forums, such as social media, can be read and used by others.

Changes to this policy

We may update this policy when our practices or legal requirements change. The updated version will be published here, and we will provide further information when required by law. Contact us if you would like to know more about a change.