Privacy policy

Who is responsible

Ekovital Norden AB, company registration number 559588-0187, is the controller for the processing described here. Contact: support@vitadepot.eu. Full details are at the bottom of this page.

What we process, and why

To deliver your order — name, email, phone, delivery address and what you bought. Legal basis: performance of the contract, Article 6(1)(b) GDPR. Without these we cannot ship anything.

To keep accounts — the order as an accounting record. Legal basis: legal obligation, Article 6(1)(c). This is why order data survives a deletion request.

To answer you — your address and whatever you write, for as long as the case is open. Legal basis: legitimate interest, Article 6(1)(f).

We do not profile you, we do not sell data, and we run no advertising or analytics trackers on this site.

Cookies

Cookies on this site come in two kinds. The 10 listed below are strictly necessary for the shop to work and need no consent — the ePrivacy exception applies. Beyond those, we measure our advertising with , but only if you agree in the bar at the bottom of the page.

If you agree, sets cookies, among them , that show whether a purchase came from an ad. If you decline, nothing is loaded from at all. You can change your choice at any time through Cookie choice in the footer.

vitadepot_cart

30 days · not readable by page scripts · carries supplierSku, quantity

vitadepot_checkout

2 days · not readable by page scripts · carries email, phone, firstName, lastName, shippingLine1, shippingLine2, shippingPostalCode, shippingCity, shippingCountry, customerNote

vitadepot_kassa

1 days · not readable by page scripts · carries orderNumber

vitadepot_ombud

1 days · not readable by page scripts · carries parcelShopId, parcelShopName, parcelShopAddress, parcelShopPostalCode, parcelShopCity

vitadepot_locale

365 days · carries language

vitadepot_rabattkod

0.25 days · not readable by page scripts · carries discountCode, email

vitadepot_market_hint

365 days · carries dismissed

vitadepot_consent

180 days · carries granted eller denied

vitadepot_admin

Session cookie · not readable by page scripts · carries adminSession

vitadepot_admin_sprak

365 days · carries sv eller en

Who else sees the data

These are our processors. Each receives only what it needs to do its job.

Railway Corp.

EU (Amsterdam) · receives server logs, IP address, order data while it is being processed

Railway Postgres

EU (Amsterdam) · receives order data, contact details, delivery address

Resend, Inc.

USA (SCC + DPF) · receives email address, name, order number, order contents

Kustom (Kustom Kredit AB)

EU (Sweden) · receives amount, order number, name, email address, billing address

Our logistics partner

order handling, picking, packing and dispatch from the partner's warehouse at Mailstep a.s., Praha 9, Czechia · EU (Czechia) · receives name, delivery address, phone number, order contents

Transfers outside the EU are covered by the standard contractual clauses, and where noted by the EU–US Data Privacy Framework.

Payment

Card and account details never reach us. They go straight to Kustom, our payment service provider, which is the controller for that part. We see the amount, the order and whether the payment was approved.

How long we keep it

Order records: 7 years, because accounting law requires it. Support correspondence that is not an accounting record: 24 months. The checkout cookie's contents disappear on their own after 2 days.

Your rights

You have the right of access (Article 15), rectification (16), erasure (17), restriction (18), data portability (20) and to object (21). Email support@vitadepot.eu and we answer within one month.

Erasure does not extend to what accounting law requires us to keep. We will say which data that is rather than refuse the whole request.

You may also complain to a supervisory authority — in Sweden that is Integritets­- skyddsmyndigheten (IMY), and you may equally turn to the authority in your own country of residence or place of work (Article 77).

Automated decision-making

We make no automated decisions producing legal effects concerning you. If you choose a payment method involving credit, the provider may make such an assessment — that processing is theirs, and their terms and privacy notice are shown before you confirm.