Privacy Policy

In this privacy policy, we inform you about the processing of your personal data.
If you wish to change your privacy settings (grant or withdraw consents), click here to change your settings.

 

Controller

IONA Natur-Kommanditbolag, Nappsjö 14, 91791 Dorotea, SE, info@iona-bjork.se, +43676848068848

Connection data is processed for the purpose of providing and delivering the website. For the sole purpose of delivering and providing the website, the data is not stored beyond the access. However, the connection data is stored by our data processor for security purposes. The duration of processing for security purposes varies and ends when the security measures are no longer necessary. In addition, our data processor anonymizes the collected data immediately after collection and provides us with the anonymous data in the form of statistics for evaluation. We use these statistics to troubleshoot and further develop our website.
The legal basis for data processing is the legitimate interest (absolute technical necessity to provide and deliver the service "website" expressly requested by you through your access) pursuant to Art. 6(1)(f) GDPR.

Contact Form

On our website, you have the option to contact us directly via a contact form. After submitting the contact form, the controller processes the personal data you entered for the purpose of processing your request on the basis of the consent you granted by submitting the form pursuant to Art. 6(1)(a) GDPR until revoked.
There is no legal or contractual obligation to provide the personal data. Failure to provide it merely means that you cannot submit your request and we cannot process it.

Registration Form

We offer you the option to register on our website. After submitting the registration, we process the data listed in the registration form for the purpose of contract fulfillment on the basis of the contract concluded with the registration pursuant to Art. 6(1)(b) GDPR for the duration of the contract.
There is no legal or contractual obligation to provide the personal data. Failure to provide it merely means that registration is not possible.
No data is transmitted to third parties.

Security Services

On this website, we use the services of security providers such as CAPTCHA services to prevent non-human and automated inputs.

Google reCAPTCHA
In the event that you grant your consent, we process your personal data with the Google reCAPTCHA service, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as joint controllers for the purpose of preventing non-human and automated inputs. In doing so, we allow the service to set cookies, collect connection data and data from your web browser. In addition, we allow the service to calculate a User ID to uniquely identify the user within the Google-operated advertising network. Data is stored on your device for up to two years.
The legal basis for data processing is your consent pursuant to Art. 6(1)(a) GDPR. Failure to grant consent means that the use of reCAPTCHA and associated forms is not possible.
You can withdraw a previously granted consent by changing the privacy settings.
The Google Group transmits your personal data to the USA. The legal basis for data transmission to the USA is your consent pursuant to Art. 49(1)(a) in conjunction with Art. 6(1)(a) GDPR in connection with §25 TTDSG. You were informed prior to granting your consent that the USA does not have a level of data protection corresponding to EU standards. In particular, US intelligence agencies can access your data without you being informed and without you being able to take legal action against it. For this reason, the European Court of Justice declared the previous adequacy decision (Privacy Shield) invalid in a ruling.

Web Fonts

Webshop
We offer you the option to purchase products directly through our webshop. Within the scope of the webshop, the controller processes the data you enter as well as data about the products you select for the purpose of making offers, concluding contracts, fulfilling contracts, and fulfilling any post-contractual obligations before contract conclusion based on the pre-contractual relationship initiated by you and after contract conclusion based on the contract pursuant to Art. 6(1)(b) GDPR.
If the purchase of our products was made through an existing customer account or a customer account was created to process the purchase, your personal data will be processed until your customer account is deleted.
For customers who purchased our products through a guest profile, your personal data will be processed until the expiration of the statutory retention obligations.
Further processing of your data for direct marketing purposes, in non-consent-requiring forms such as addressed postal advertising, is carried out in a manner compatible with contract fulfillment until you object.
There is no legal or contractual obligation to provide the personal data. However, provision is required to conclude the contract. Failure to provide it means that no contract can be concluded.
Carts from unregistered users are deleted after a maximum of 14 days. Registered users' accounts remain until the account is deleted by the user. Contract data is processed until the expiration of any possible post-contractual obligations.

Payments are processed with:
Service: Klarna.
Operator: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden
Service: PayPal
Operator: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg

Tag Manager

Google Tag Manager
In the event that you grant your consent, we process your personal data with the Google Tag Manager service, Google LLC, Amphitheatre Parkway, Mountain View, CA 94043, USA, as joint controllers for the purpose of triggering, controlling, and managing other services on our website. In this specific case, the above-mentioned service is to be controlled via Google Tag Manager. Failure to grant consent therefore has exactly the same effect as described for the above-mentioned service. You can withdraw a previously granted consent by changing the privacy settings.
We allow Google Tag Manager to collect connection data and data from your web browser. This is used by Google to further develop the service.
The legal basis for data processing is your consent pursuant to Art. 6(1)(a) GDPR. The Google Group transmits your personal data to the USA. The legal basis for data transmission to the USA is your consent pursuant to Art. 49(1)(a) in conjunction with Art. 6(1)(a) GDPR in connection with §25 TTDSG. You were informed prior to granting your consent that the USA does not have a level of data protection corresponding to EU standards. In particular, US intelligence agencies can access your data without you being informed and without you being able to take legal action against it. For this reason, the European Court of Justice declared the previous adequacy decision (Privacy Shield) invalid in a ruling.

Analytics Services

Google Analytics
In the event that you grant your consent, we process your personal data with the Google Analytics service, Google LLC, Amphitheatre Parkway, Mountain View, CA 94043, USA, as joint controllers for the purpose of error analysis and statistical evaluation of our website. Failure to grant consent has no immediate effect on the website's functionality, but without statistical data, the further development of the website is made more difficult. You can withdraw a previously granted consent by changing the privacy settings.
We allow the service to collect connection data, data from your web browser, and data about the accessed content, as well as to execute analytics software and store data on your end device. The service anonymizes the collected data immediately after collection and provides us with the anonymous data in the form of statistics for evaluation. We use these statistics to troubleshoot and further develop our website. The data on your end device is stored for up to two years.
The legal basis for data processing is your consent pursuant to Art. 6(1)(a) GDPR. The Google Group transmits your personal data to the USA. The legal basis for data transmission to the USA is your consent pursuant to Art. 49(1)(a) in conjunction with Art. 6(1)(a) GDPR in connection with §25 TTDSG. You were informed prior to granting your consent that the USA does not have a level of data protection corresponding to EU standards. In particular, US intelligence agencies can access your data without you being informed and without you being able to take legal action against it. For this reason, the European Court of Justice declared the previous adequacy decision (Privacy Shield) invalid in a ruling.

Newsletter Services

MailChimp
After granting your consent, your personal data is processed for the purpose of transmitting electronic direct advertising (e.g., newsletter distribution) until revoked.
For the purpose of newsletter distribution, we use the data processor Mailchimp, The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE, Suite 5000 Atlanta, GA 30308, USA.
The legal basis for processing is the consent you granted pursuant to Art. 6(1)(a) GDPR. There is no legal or contractual obligation to grant consent. Failure to grant consent merely means that you will not receive any newsletters from us.
The legal basis for data transmission to the USA is your consent pursuant to Art. 49(1)(a) in conjunction with Art. 6(1)(a) GDPR in connection with §25 TTDSG. You were informed prior to granting your consent that the USA does not have a level of data protection corresponding to EU standards. In particular, US intelligence agencies can access your data without you being informed and without you being able to take legal action against it. For this reason, the European Court of Justice declared the previous adequacy decision (Privacy Shield) invalid in a ruling.

Right to Object

If the processing of your personal data is based on legitimate interest, you have the right to object to this processing.
If there are no compelling legitimate grounds for the processing on our part, the processing of your data on the basis of this legal ground will be discontinued.
In addition, you have the right to object to the processing of your personal data for direct marketing purposes. In the event of an objection, your personal data will no longer be processed for direct marketing purposes.
The lawfulness of the data processed up to the point of objection is not affected by the objection.

Right of Withdrawal

You have the right to withdraw a previously granted consent at any time by changing the privacy settings.
In the event of consent to receive electronic advertising, your consent can be withdrawn by clicking on the unsubscribe link. In this case, processing will be discontinued unless another legal basis exists.
The lawfulness of the data processed up to the point of withdrawal is not affected by the withdrawal.

Data Subject Rights

You also have the right to access, rectification, erasure, and restriction of processing of the personal data.
To the extent that the legal basis for the processing of your personal data is your consent or a contract concluded with you, you also have the right to data portability.
Furthermore, you have the right to lodge a complaint with the supervisory authority. Further information about the supervisory authorities in the European Union can be found here.