Privacy Policy

How Solros Ateljé collects, uses, and protects your personal data under the EU General Data Protection Regulation (GDPR) and Swedish data protection law.

Last updated: 25 July 2026 | Data controller: Solros Ateljé AB, org.nr 559284-7316

1. Data Controller

Solros Ateljé AB ("Solros Ateljé", "we", "us") is the data controller responsible for processing your personal data.

Company: Solros Ateljé AB
Organisation number: 559284-7316
Address: 42 Södra Förstadsgatan, 211 43 Malmö, Sweden
Email: [email protected]
Phone: +46 40 12 48 70

2. Legal Basis and Applicable Law

We process personal data in accordance with:

Regulation (EU) 2016/679 — the General Data Protection Regulation (GDPR)
The Swedish Data Protection Act (SFS 2018:218 — Dataskyddslagen), which supplements the GDPR in Sweden
Guidance and decisions issued by the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten — IMY)

Our processing activities comply with IMY requirements for transparency, lawful basis documentation, and data subject rights. For general guidance on your rights, visit www.imy.se.

3. Personal Data We Collect

We may collect and process the following categories of personal data:

Contact details: name, email address, phone number, delivery address
Order information: product selections, subscription preferences, delivery schedules, payment references (we do not store full card numbers)
Communication: messages sent via our contact form, email, or phone
Website usage: IP address, browser type, pages visited, and cookie data (with your consent — see our Cookie Policy)
Event details: venue information, event dates, and floral preferences when you book a consultation for weddings or corporate events
Newsletter subscription: email address and subscription date when you opt in to our mailing list

4. Purposes and Legal Bases for Processing

We process your data only where a lawful basis exists under Article 6 GDPR:

Contract performance (Art. 6(1)(b)): processing orders, managing flower subscriptions, arranging delivery across Malmö and Skåne, and fulfilling event floral contracts
Legitimate interests (Art. 6(1)(f)): responding to enquiries, improving our services, ensuring website security, and maintaining business records
Consent (Art. 6(1)(a)): analytics cookies, newsletter communications, and any optional marketing where applicable
Legal obligation (Art. 6(1)(c)): retaining invoices and accounting records as required by the Swedish Bookkeeping Act (Bokföringslagen, SFS 1999:1078) and the Swedish Accounting Act (Bokföringslagen)

5. Data Retention

We retain personal data only as long as necessary for the purposes described:

Order and customer data: 7 years after the end of the financial year (per Bokföringslagen)
Subscription records: duration of subscription plus 7 years for accounting purposes
Contact form enquiries: 12 months unless an order follows
Event consultation records: 3 years after the event date, or 7 years if a contract was fulfilled
Newsletter subscription: until you unsubscribe or withdraw consent
Analytics data: 26 months (if consent given)
Cookie consent records: 12 months

6. Data Processors and Recipients

We may share your data with trusted third-party processors who assist our operations:

Payment service providers (for transaction processing)
Delivery and courier services (for flower delivery in Malmö and Skåne)
Email and hosting providers (for website and communication infrastructure)
Analytics providers (only with your consent)
Accounting and bookkeeping services

All processors are bound by data processing agreements (DPA) compliant with Article 28 GDPR. We do not sell your personal data to third parties.

Where data is transferred outside the EU/EEA, we ensure appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission, or adequacy decisions as recognised by IMY.

7. Your Rights Under GDPR

As a data subject in Sweden, you have the following rights under Articles 15–22 GDPR:

Right of access: request a copy of the personal data we hold about you
Right to rectification: request correction of inaccurate or incomplete data
Right to erasure: request deletion of your data where no legal retention obligation exists ("right to be forgotten")
Right to restriction: request limited processing in certain circumstances
Right to data portability: receive your data in a structured, commonly used, machine-readable format
Right to object: object to processing based on legitimate interests or for direct marketing purposes
Right to withdraw consent: withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal

To exercise any of these rights, contact us at [email protected]. We will respond within one month as required by GDPR, which may be extended by a further two months for complex requests. We will inform you of any such extension and the reasons for it.

8. Right to Lodge a Complaint with IMY

If you believe we have not handled your personal data correctly, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten — IMY):

Integritetsskyddsmyndigheten (IMY)
Box 8114
104 20 Stockholm, Sweden
Phone: +46 8 657 61 00
Website: www.imy.se
Email: [email protected]

You may also contact your local municipality or consumer guidance service. We encourage you to contact us first so we can address your concern directly.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encrypted connections (HTTPS/TLS), access controls, staff training, and regular review of our processing activities.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify IMY within 72 hours where required under Article 33 GDPR, and affected individuals without undue delay where required under Article 34.

10. Automated Decision-Making and Profiling

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you within the meaning of Article 22 GDPR.

11. Children's Data

Our services are not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at [email protected] and we will delete it promptly.

12. Personal Data in Flower Orders and Deliveries

When you order flowers for delivery to a third party, we process the recipient's name and address solely for the purpose of completing the delivery. We do not use recipient data for marketing unless the recipient separately opts in. Delivery notes may include your name if you choose to include a gift message.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Material changes will be posted on this page with an updated date. Where changes significantly affect your rights, we will notify you by email if we have your contact details and the change requires it under IMY guidance.

14. Contact

For privacy-related enquiries, contact our data controller at:

Email: [email protected]
Post: Solros Ateljé AB, 42 Södra Förstadsgatan, 211 43 Malmö, Sweden
Phone: +46 40 12 48 70