1. Who is responsible for your information?
Framtidsmat AB, company registration number 559230-4447, is responsible for processing personal data for ComFoo. Postal address: Byastensvägen 1G, 233 64 Bara. Contact hello@comfoo.com with questions about your personal data.
This policy describes how information is used for purchases, accounts, subscriptions, customer service and your cookie choices. Personal data is information that can be linked to you, such as your name, email address or an order associated with your account.
2. Which information is used – and why?
We use the information needed for what you choose to do. A purchase needs to be completed, and some records must be retained by law. Your consent is used for processing you can choose, such as optional cookies.
| When | Information and use | Legal basis |
|---|---|---|
| Orders and subscriptions | Name, email, phone, billing and delivery addresses, and order and subscription details to receive, deliver and administer purchases. | Contract. |
| Accounting | Order, invoice and payment records that need to form part of the accounting information. | Legal obligation. |
| My account and ComFoo Club | Account details, order history and, when the feature is used, XP, Coins and referrals to administer your membership and display your history. | Contract for the account and membership. |
| Customer service, returns and withdrawal | Name, email, customer number if you have one, order or contract reference and your message. The information is used to answer your question, identify the purchase and handle matters such as exchanges, guarantees, withdrawal or complaints. | Contract and legal obligation when the matter arises from consumer rights. |
| Questions outside a purchase | Email and any contact or question details you provide in an email or contact form, so we can answer the question. | Legitimate interest in providing customer service. You may object to the processing. |
| Optional cookies | Your choices and, if you allow it, information for the analytics or marketing used. | Consent. |
You need to provide the information required for the order so we can complete the purchase. You can still contact us or notify us that you wish to withdraw from a purchase without a customer number.
Do not send full card details, passwords, identity documents or health information in an initial message. Payment details are handled through your chosen payment service; its terms and privacy information are shown at checkout.
3. Who receives the information?
To complete a purchase, necessary information is provided to the payment provider, warehouse and logistics partner, and the carrier handling delivery. ComFoo uses Postpac for warehousing and product returns. Delivery options include Early bird, Budbee and DHL; those available for your purchase are shown at checkout.
Shop operation, email and customer service providers may need to process information to run the shop and handle your message. They receive the information needed for their task. Your contact details are used to link the question or withdrawal notification to the right purchase and to reply to you.
If you allow analytics, Google Analytics is used to understand how the shop is used. If you allow marketing, Meta, which operates Facebook and Instagram, is used to measure advertising and make it more relevant. Read more about which information may be shared in the cookies section below.
Some providers process information on our behalf as data processors. Others, such as payment providers, may be independently responsible for their processing. Access is restricted to people who need the information for their work and is protected through technical and organisational measures.
If information is transferred to a country outside the EU/EEA, a permitted transfer basis is required, such as an adequacy decision or the European Commission's standard contractual clauses with necessary additional safeguards. Contact hello@comfoo.com for information about the recipients and safeguards that apply to your data.
4. How long is information retained?
- Accounting records: are retained according to the Accounting Act's archiving requirements, through the seventh year after the end of the calendar year in which the financial year ended.
- Accounts and subscriptions: information is needed for as long as the account or contract is used. When you request closure or deletion of the account, we assess which information can be removed and which must be retained for legal requirements or outstanding matters.
- Customer service and withdrawal notifications: contact details, the content of the request and when it was received are retained for as long as needed for the matter and relevant legal claims. When the purpose ends, the information must be deleted or anonymised unless retention is required by law.
- Consent choices: the cookie
comfoo_consentis retained for 180 days. You can change the choice earlier.
A legal requirement to retain an order does not mean all account or marketing information must be retained for the same period. Information must not be kept longer than its purpose requires.
6. Your rights
You can request information and access to your personal data, correction of errors, deletion, restriction of processing and, in some cases, data portability. You may object to processing based on legitimate interest. If you object to direct marketing, that processing must stop.
These rights apply under the conditions of the General Data Protection Regulation. For example, we may need to retain accounting information despite a deletion request. If processing is based on consent, you can withdraw that consent at any time.
How to make a request
Email hello@comfoo.com and describe what you need help with. We may need to verify your identity before information is disclosed or changed. Do not send an identity document in your first email.
You receive a response without undue delay and normally within one month. If an extension is needed, we inform you and explain the reason within the first month. Requests are normally free of charge.
You can complain to the Swedish Authority for Privacy Protection (IMY) if you believe your data is being processed incorrectly. Also read IMY's information about your rights.