Privacy Policy

The personal data we collect about you and process may come from XOPC Ltd.'s websites (both our own and other websites as well as social networks belonging to third parties), our apps, electronic mail, SMS and other electronic messages, membership of our customer club, calls to customer service, stores, printed and digital registration forms for e.g. competitions, campaigns, events etc. Also from publicly available information from social networks and other public sources. What information we collect about you depends on which of our services you use. The personal data controller is XOPC Ltd., organization number +380999500300. However, all companies within the XOPC Ltd. group within the EU/EEA may process your personal data.

XOPC Ltd. has appointed a data protection representative  with the task of, among other things, monitoring and safeguarding your rights.

With reference to law below, we mean the Data Protection Regulation, GDPR, and other applicable data protection legislation.

We collect this information

Generally

We collect personal contact information such as social security number, name, postal address, e-mail address, information on social networks and/or telephone number. It may also be other information needed to give you access to your specific account profile, such as login name/email address, screen name, irreversible passwords or security questions and answers, and demographic information such as date of birth, age or age range, gender, geographic location (for example postal code) and products in which you have shown interest.

If you are a member, XOPC Ltd. processes your social security number in order to ensure your identity, send digital receipts, verify your BankID and update your address details. 

Technical data

Information about the technical equipment you use to connect to any of our websites or apps, such as the IP address of your computer or device, type of operating system, and browser type and version. If you connect to a XOPC Ltd. website or app using a smartphone or other mobile device, we may also collect information about your phone's unique ID, advertising ID, geographic location, and similar data.

Information about the use of websites

When you visit or interact with our websites, including our chat feature, shop live, live meeting or newsletter, we use automatic data collection technology to collect certain information about your activities. This includes information about which links you click, which pages or content you view and for how long, as well as other similar information and statistics about your visits, such as response times to content, file download errors and length of visits to certain pages. This information is collected automatically with the help of cookies (browser cookies, flash cookies) and web beacons, as well as with the help of third-party tracking services. Read more under Customize your personal data and Cookies/similar technologies.

Consumer feedback

Information that you voluntarily provide us about your experiences with our products and services.

Consumer Generated Content

Content that you create and then share with us by uploading it to any of our websites or apps, including social networking apps like Facebook. It can be photographs, videos, personal stories or other things. We may collect and publish consumer-generated content in connection with a wide range of activities, including contests and other promotions, chats, online community and consumer activities, and participation in third-party social networks.

Information in social networks

Information that you share publicly on a social network or information included in your profile on a third-party social network (such as Facebook) that you allow the network to share with us. This includes basic account information (name, email address, gender, birthday, hometown, profile picture, username, friend list, and the like) and additional information or activities that you allow the social network to share. We receive information about your profile or parts of the profile on a social network every time you download or communicate with a XOPC Ltd. web application on a social network such as Facebook, every time you use a social networking feature integrated into a XOPC Ltd. website (such as Facebook Connect) or whenever you communicate with us through a social network. To read more about how your data in third-party social networks is collected by XOPC Ltd., or if you do not agree to the sharing of data from social networks, please visit the website of the respective social network.

Payment details and financial information

This applies to all information that we need to complete an order or that you use to make a purchase, such as payment or credit card details (cardholder name, card number, expiry date) or other forms of payment. We ourselves do not have access to bank details such as credit card details, but they are handled by affiliated bank providers. Regardless of the method, we handle payment information and financial data in a way that complies with applicable laws and standards such as PCI DSS.

Call to customer service

Conversations with our customer service may be recorded for local operational needs (for example, for quality or training purposes) and in some cases to archive evidence that information has been obtained about our personal data processing. Credit card details are not recorded. If required by applicable law, you will be informed of the recording at the beginning of the conversation and given the opportunity to refuse it.

Other sources

In order to keep our information about you up to date, we may, ourselves or through our service providers, collect information about you from other sources, for example publicly available personal registers. In order to secure payment, etc., we can also use information that we collect, e.g. with credit assessment registers such as UC, and from our partners.

Camera surveillance

We also collect images of you when you visit one of our physical stores through camera surveillance. We use camera surveillance to prevent crime and create security for our customers, our employees and for us as a company.

Collection, purpose and legal basis

In order for our processing of your personal data to be legal, it is assumed that there is a legal basis for this, i.e. that it is necessary to fulfill an agreement with you or a legal obligation, or that the processing is done after a balance of interests or after you have given your consent to a specific treatment. Below are examples of the purposes for which we process your personal data and the legal basis on which this is done, unless otherwise expressly stated in connection with the collection of your personal data.

Legitimate interest

Where applicable, XOPC Ltd.'s legitimate interest in the below-mentioned personal data processing based on a balancing of interests is to be able to offer you a better purchasing and customer experience and to provide you with personally adapted offers and other relevant information as well as satisfactory service and communication. As part of our endeavor to constantly try to make improvements for you as a customer, we analyze how you use the services. Another legitimate interest is to prevent crime and create security for our customers, our employees and for us as a company.

Log files

We collect data in the form of log files that record activity on the websites and collect statistics about your surfing habits. The data is created automatically and helps us to search for errors, improve performance or maintain the security of the websites. If you are a member of XOPC Ltd., the data is also used to analyze your behavior to be used as a basis for providing you with targeted and relevant marketing offers, benefits and discounts, product information, invitations to events, etc., so-called profiling.

Legal basis: Legitimate interest (non-member) or fulfillment of membership agreement (member)

Web signals

Web beacons are small strings of code that create a graphic image on a web page or in an e-mail message and whose purpose is to transmit data back to us. Information collected through web beacons may include technical data such as IP address and information about how you respond to an email campaign (such as the time the email was opened and which links you clicked on in the message). We may use web beacons on our websites or insert them into emails you receive from us. We use information from web beacons for a variety of purposes, including website traffic reports, counting unique visitors, advertising, email review and reporting, and website customization. If you are a member of XOPC Ltd., the data is also used to analyze your behavior to be used as a basis for providing you with targeted and relevant marketing offers, benefits and discounts, product information, invitations to events, etc., so-called profiling.

Legal basis: Legitimate interest (non-member) or fulfillment of membership agreement (member)

Customer service

When responding to inquiries and other matters, we usually collect the contact details and information (such as order status, technical issues, questions or complaints about products, general questions) that we need to resolve the matter.

Legal basis: Fulfillment of contract (customer issues) and legitimate interest (other)

Competitions, marketing and other promotions

We use your personal data to provide you with information about goods or services (such as marketing materials, promotions or offers). It can be through e-mail, advertisements, SMS, telephone calls and postal mailings to the extent permitted by current legislation. This use of your personal data for marketing purposes and offers may, if you are a member, also be subject to so-called profiling (see further below under the headings "Individual adaptation" and "Interest-based advertising"). Some of our campaigns may be conducted on third party websites and/or in social networks. For more information about our contests and other promotions, please see the official rules or details attached to each contest/promotion.

Legal basis: Legitimate interest (non-member) and fulfillment of membership agreement (member)

Social networks

In order to send you advertisements and communicate with you in social networks, we use your personal data when you interact with functions of third-party social networks, such as "like" functions. You can find out more about those features and what profile information we may collect about you, plus how to avoid disclosing that information by reading the social network's privacy policy.

Legal basis: Legitimate interest (non-member) and fulfillment of membership agreement (member)

Individual adaptation 

We use your personal data to analyze your preferences and habits, to anticipate your needs, to improve and tailor your experience on our websites and in our apps, to ensure that content from our websites/apps is optimized for you and your computer or device and for you to be able to use interactive functions if you wish. For example, we remember your username, email address or screen name so that you can quickly log in the next time you visit our website or so that you can easily find the items you previously added to your shopping cart. If you are a member of XOPC Ltd., the data is also used to analyze your behavior to be used as a basis for providing you with targeted and relevant marketing offers, benefits and discounts, product information, invitations to events, etc., so-called profiling.

Legal basis: Legitimate interest (non-member) and fulfillment of membership agreement (member)

Interest-based advertising

We may partner with advertising service providers and other service providers for our marketing. In the event that you are a member of XOPC Ltd., part of the marketing is adapted, including things we think you may be interested in, so-called profiling, including based on segmentation.

Legal basis: Fulfillment of membership agreement (member)

Order fulfillment

We use your personal data to process and deliver your orders, inform you about the status of your order, check addresses, verify your identity and other fraud prevention activities. This means that we use certain personal contact details and payment information.

Legal basis: Fulfillment of contract

Member of XOPC Ltd.

If you are a member of XOPC Ltd., we use your personal data to create and manage member accounts, e.g. to grant authorization to log in, ensure the member's identity, provide the opportunity to follow order history and receive digital receipts, save settings, register and calculate bonus points, administer bonus checks, send out bonus checks, analyze your behavior to use as a basis to provide you with targeted and relevant marketing offers, benefits and discounts, product information, invitations to events, etc., so-called profiling, and provide the member with personalized content.

Legal basis: Fulfillment of membership agreement

Other general purposes 

We use your information for other general business purposes, such as internal marketing studies and demographic surveys and to measure the effectiveness of advertising campaigns, in order to evaluate, develop and improve our services and products and systems. We also use your personal data to ensure our own security, prevent abuse of our services, prevent and investigate crime and fulfill our obligations under the law.

Legal basis: Legitimate interest and fulfillment of a legal obligation

Camera surveillance

We use camera surveillance in our stores to prevent crime and create security for our customers, our employees and for us as a company. See our full CCTV policy . 

Legal basis: Legitimate interest

Information to third parties

We are very keen to protect your personal data. Except in cases where you have given your consent, we neither license nor sell your personal data to third parties. However, we may transfer to, or share your personal data with, companies within the XOPC Ltd. group within the EU/EEA, and with selected third parties as follows.

Service providers

Here we mean external companies that we hire to help us run our business (such as order fulfillment, payment processing, anti-fraud and identity control, debt collection, operation of websites, support services, campaigns, web development, customer service, etc.). Service providers and their staff are in most cases only permitted to use your personal data on our behalf and for the specific tasks they have to perform according to our instructions and act as personal data processors for us. They are required to keep your personal data confidential and secure. In other cases, they process the personal data independently or as a joint personal data controller with XOPC Ltd..

Due to legal reasons

If XOPC Ltd. or its assets are acquired by or merged with another company, including through bankruptcy, we may share your personal information with any of our successors. We may also disclose your personal information to third parties when required by applicable law, in connection with legal proceedings (such as in response to a request from competent law enforcement, to protect our rights, privacy, safety, property or the public, or to enforce contractual terms or conditions of our website).

This is how your personal data is protected

Storage time

In accordance with current legislation, we use your personal data only for as long as is necessary to fulfill the purposes for which your personal data was collected or to comply with applicable legal requirements.

Persons who have access to your personal data

Your personal data is only processed by authorized personnel at XOPC Ltd. in the performance of their duties and depending on the purposes for which your personal data has been collected (customer service personnel have, among other things, access to your data in the customer register).

Actions in operational environments

We store your personal data in operating environments that use appropriate security measures to prevent unauthorized access. We follow reasonable standards for the protection of personal data. Transmission of information via the Internet is unfortunately not completely secure. Although we go to great lengths to protect your personal data, we cannot guarantee data security when transmitted through our websites. Should we discover a breach of privacy, XOPC Ltd. will notify the Swedish Data Protection Authority and the affected customers where required by law.

Actions by you

It is important that you yourself also participate in keeping your personal data safe and secure. For example, consider choosing a password that is difficult for others to guess. Never reveal the password to anyone. You are responsible for keeping your password confidential and for all use of your account. If you use a shared or public computer, you must ensure that your user data is not saved on the computer. Be sure to log out of the account every time you leave the computer. Also, use the privacy settings or controls we provide on our website or in our app.

Transfer of your personal data 

Storage and processing of your personal data as above may require that your personal data is ultimately transferred to and/or stored at a destination outside your home country, usually Norway, Switzerland or Luxembourg. Transfer of data to countries outside the EU/EEA requires that the country in question has an agreement with the EU/EEA, that the country is considered to have sufficient data protection legislation, or that we have reached an agreement with the relevant third party that they must apply approved by the EU Commission clauses regarding the protection of personal integrity. You will find a list of approved third countries and standard clauses on the website of the European Commission and on the website of the Swedish Privacy Agency regarding the transfer of data to third countries.

Customize your personal data

Cookies/similar technologies

You can set your browser to block all or some cookies or to notify you when a website uses cookies. Read more about our  cookies .

Advertising, marketing and promotions

You can opt out of marketing communications from any medium including third party social networks at any time by calling customer service. Please note that even if you opt out of marketing communications, you may still receive administrative communications from us, such as order confirmations or other transactional information, notifications about account activities (account confirmations, password changes, etc.) and other important communications. For members, however, the marketing communication is covered by the commitments that XOPC Ltd. has towards its members as long as the membership lasts.

Your rights

Right of access 

In accordance with the law, you have the right to request information from us about what personal data XOPC Ltd. processes about you after you have clearly indicated what information you wish to receive (for example, which categories of specific personal data we process about you and for what purposes). You can exercise these rights by contacting us. We will then want to ensure your identity. We will respond to your requests without undue delay and within one month. In the event that we cannot fulfill your wishes, we will notify you of this and indicate why. 

Change and deletion of personal data and data portability

In the manner and limited to what is prescribed by law, you can request the removal, correction or change of your personal data, refuse to process your personal data, limit the use and disclosure of personal data, have the personal data you provided to us transferred (ported) and revoke any consent to the processing of your personal data. Please note that in some cases we cannot delete your personal data without simultaneously deleting your user account. We may be required to retain some of your personal data after you request deletion to comply with our legal or contractual obligations. It may also be permitted by applicable law for us to retain certain personal data to meet our business needs. Some of our websites have a special function for you to be able to review and edit the personal data you have provided us yourself. Please note that our registered customers must be able to verify their identity (for example, login name/email address, password) before they can access their account information and make changes. This helps us prevent unauthorized access to your account. Please note that all information provided to us is processed in accordance with current legislation and to the extent permitted by law.

Right to objections

You have the right to object to our processing of your personal data, which we do on the basis of legitimate interest after a balance of interests. We must then, after you have specified which treatment you object to, show that there are interests that weigh more heavily. You also have the right to object at any time to the processing of your personal data for direct marketing, including profiling. For members, however, profiling is covered by the commitments that XOPC Ltd. has towards its members as long as the membership lasts.

Amendments and Complaints

Changes/adjustments to the policy 

XOPC Ltd. has the right to make changes to the privacy policy. If any significant changes are made to the privacy policy, we will inform you of this in good time before the changes take place.

Complaint

If you believe that we are processing your personal data in violation of current regulations, we ask you to report this to us as soon as possible. You have the opportunity to contact the Swedish Privacy Protection Authority if you have a complaint about our processing of personal data.

Damages

If you believe that you have suffered damage due to our processing of your personal data in violation of the law, you may be entitled to compensation. You can then claim damages from us or file a lawsuit in court.

Contact us and/or our data protection officer

If you have questions or comments regarding this policy or our processing of personal data, you are welcome to contact our customer service