Privacy Policy

Data controller

Rafaelli Atelier (sole proprietorship), Swedish company registration number 840522-1063, Stockholm, is the controller responsible for the processing of your personal data.

If you have any questions about how we handle your data, please contact us at [email protected].

What data we collect

When you send our contact form, we collect:

• your name
• your email address and/or phone number
• which service you are interested in
• your message and anything you choose to tell us in it
• the language you used on the website and when the message was sent

If you contact us by email or on Instagram, we process the details you send there. If you become a customer, we also keep the details needed for your order, such as measurements, preferences and invoicing details.

Why we process your data

• To respond to your enquiry and give you a quote. Legal basis: steps prior to entering into a contract (Article 6(1)(b) GDPR) and our legitimate interest in replying to people who contact us (Article 6(1)(f)).
• To carry out an order and keep in touch with you during the work. Legal basis: performance of a contract (Article 6(1)(b)).
• For bookkeeping. Legal basis: legal obligation under the Swedish Accounting Act (Article 6(1)(c)).
• For website statistics. Legal basis: your consent (Article 6(1)(a)); see the section on cookies below.
• For anonymous visitor statistics via Cloudflare. Legal basis: our legitimate interest in knowing how many people visit the website (Article 6(1)(f)).

We do not use your data for marketing, we do not sell it, and we make no automated decisions about you.

Cookies and website statistics

We use Google Analytics to understand how the website is used, for example which pages are visited. Google Analytics sets cookies and collects information about your browser, your device and your approximate location. The statistics are used only to improve the website.

Statistics cookies are only set if you accept them. You can change your choice at any time using the “Cookie settings” link at the bottom of the page. Your choice is saved in your browser.

In addition, we use Cloudflare Web Analytics to count visits and see which pages are visited. Cloudflare Web Analytics uses no cookies, stores nothing in your browser and does not track you across websites. We only see the statistics in aggregated form, and they cannot be linked to you.

The fonts on this website are loaded from Google Fonts, which means your IP address is sent to Google when the page loads.

Who receives your data

We only share your data with the providers we use to run the website and the business:

• Cloudflare – hosts the website, stores messages from the contact form and provides anonymous visitor statistics
• FormSubmit – forwards the contact form to our email
• Google – email (Gmail), website statistics (Google Analytics) and fonts (Google Fonts)
• Meta – if you contact us on Instagram, Meta’s own privacy policy also applies

We may also have to disclose data when required by law, for example to the Swedish Tax Agency.

Some of these providers may process data outside the EU/EEA, including in the United States. Such transfers rely on the European Commission’s adequacy decision (EU–US Data Privacy Framework) or the European Commission’s standard contractual clauses.

How long we keep your data

• Enquiries that do not lead to an order are deleted no later than 12 months after our last contact.
• Order details are kept while we work on your order and for up to three years afterwards so we can handle any complaints.
• Accounting records are kept for seven years as required by the Swedish Accounting Act.
• Google Analytics statistics are kept for no more than 14 months.

Your rights

You have the right to:

• find out what data we hold about you and receive a copy of it
• have inaccurate data corrected
• have your data deleted
• request that processing be restricted
• object to processing based on our legitimate interest
• receive data you have provided to us in a machine-readable format
• withdraw your consent at any time

Contact us at [email protected] and we will respond within one month. We may need to keep some data despite a deletion request, for example accounting records.

Complaints

If you are unhappy with how we process your personal data, you can lodge a complaint with the Swedish Authority for Privacy Protection (IMY), www.imy.se. Please feel free to contact us first and we will try to resolve it.

Changes

We may update this policy from time to time. The latest version is always available on this page.