Privacy Policy

In this data protection declaration we inform you about the processing of your personal data.
If you want to change your privacy settings (give consent or revoke consent already given), click here to change your settings.

Responsible

IONA Natur-Handelsbolag, Nappsjö 14, 91791 Dorotea, SE, info@iona-bjork.se, +43676848068848
CDN provider
Cloudflare CDN
We host parts of our website with our processor Cloudflare, Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany.
Connection data is processed for the purpose of providing and delivering the website. For the mere purpose of delivering and providing the website, the data will not be stored beyond the call. However, the connection data is stored by our processor for security purposes. The duration of processing for security purposes is variable and ends with the need for security measures. In addition, our processor anonymizes the collected data immediately after collection and makes the anonymous data available to us in the form of statistics for evaluation. We use these statistics to troubleshoot and further develop our website.
The legal basis for data processing is the legitimate interest (absolute technical necessity for the provision and delivery of the “website” service you expressly requested when you called it up) in accordance with Article 6 (1) (f) GDPR.

contact form

On our website it is possible to contact us directly using a contact form. After submitting the contact form, the personal data you entered will be processed by the person responsible for the purpose of processing your request on the basis of the consent you gave by submitting the form in accordance with Article 6 (1) (a) GDPR until revoked.
There is no legal or contractual obligation to provide the personal data. The only consequence of not providing it is that you do not submit your request and we cannot process it.

registration form

We offer you a registration option on our website. After the registration has been sent, the data given in the registration form will be processed by us for the purpose of fulfilling the contract on the basis of the contract concluded with the registration in accordance with Article 6 (1) (b) GDPR for the contract period.
There is no legal or contractual obligation to provide the personal data. The non-provision only means that no registration is possible.
A transfer of data to third parties does not take place.

security services

On this website we use security service providers such as Captcha services to avoid non-human and automated entries.

Google reCAPTCHA
If you give your consent, we will process your personal data with the Google reCaptcha service, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as the joint controller, for the purpose of avoiding non-human and automated input. We enable the service to set cookies, collect connection data and data from your web browser. In addition, we enable the service to calculate a user ID to uniquely identify the user within the advertising network operated by Google. Data is stored on your device for a period of up to two years.
The legal basis for data processing is your consent in accordance with Art. 6 Para. 1 lit. a GDPR. Failure to give consent means that the use of reCaptcha and associated forms is not possible.
You can revoke consent that has already been given by changing the data protection settings.
The Google Group transmits your personal data to the USA. The legal basis for the data transfer to the USA is your consent in accordance with Art. 49 Para. 1 lit a in conjunction with Art. 6 Para. 1 lit a GDPR in conjunction with Section 25 TTDSG. You were informed before you gave your consent that the USA does not have a level of data protection that corresponds to the standards of the EU. In particular, US secret services can access your data without you being informed and without you being able to take legal action against it. For this reason, the European Court of Justice declared the earlier adequacy decision (Privacy Shield) invalid in a judgment.

web fonts

Webshop
We offer you the opportunity to purchase products directly from our web shop. Within the framework of the web shop, the data you enter and data on the products you have selected are processed by the person responsible for the preparation of the offer, the conclusion of the contract, the fulfillment of the contract and the fulfillment of any post-contractual obligations before the conclusion of the contract on the basis of the pre-contractual relationship initiated by you and afterwards Conclusion of a contract based on the contract in accordance with Article 6 (1) (b) GDPR.
If you purchased our products via an existing customer account or a customer account was created to process the purchase, your personal data will be processed until your customer account is deleted.
For customers who have purchased our products via a guest profile, your personal data will be processed until the statutory retention requirements have expired.
There will be further processing of your data that is compatible with the purpose of fulfilling the contract for the purpose of direct marketing in forms that do not require consent, such as the addressed mailing of advertising until you object.
There is no legal or contractual obligation to provide the personal data. However, the provision is required for the conclusion of the contract. The non-provision means that no contract can be concluded.
Shopping carts from non-registered users will be deleted after a maximum of 14 days. The user accounts of registered users remain in existence until the user deletes the account. Contract data will be processed until any post-contractual obligations expire.

Payments are processed with:
Service : Klarna.
Operator : Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden
Service : PayPal
Operator : PayPal (Europe) S.à rl et Cie, SCA, 22-24 Boulevard Royal, 2449 Luxembourg

Tag Manager

Google tag manager
If you give your consent, we will process your personal data with the Google Tag Manager service, Google LLC, Amphitheater Parkway, Mountain View, CA 94043, USA, as the joint controller, for the purpose of triggering, controlling and managing other services on our website. In this specific case, the above service is to be controlled via the Google Tag Manager. The non-granting of consent therefore has exactly the effect described in the above service. You can revoke consent that has already been given by changing the data protection settings.
We enable the Google Tag Manager to collect connection data and data from your web browser. These are used by Google to further develop the service.
The legal basis for data processing is your consent in accordance with Art. 6 Para. 1 lit. a GDPR. The Google Group transmits your personal data to the USA. The legal basis for the data transfer to the USA is your consent in accordance with Art. 49 Para. 1 lit a in conjunction with Art. 6 Para. 1 lit a GDPR in conjunction with Section 25 TTDSG. You were informed before you gave your consent that the USA does not have a level of data protection that corresponds to the standards of the EU. In particular, US secret services can access your data without you being informed and without you being able to take legal action against it. For this reason, the European Court of Justice declared the earlier adequacy decision (Privacy Shield) invalid in a judgment.

Analysis Services

Google Analytics
If you give your consent, we process your personal data with the Google Analytics service, Google LLC, Amphitheater Parkway, Mountain View, CA 94043, USA, as the joint controller, for the purpose of error analysis and statistical evaluation of our website. The non-granting of consent has no direct effect on the function of the website, but without statistical data it will be more difficult for us to further develop the website. You can revoke consent that has already been given by changing the data protection settings.
We enable the service to collect connection data, data from your web browser and data about the content accessed, as well as the execution of analysis software and the storage of data on your device. The service anonymizes the collected data immediately after collection and makes the anonymous data available to us in the form of statistics for evaluation. We use these statistics to troubleshoot and further develop our website. The data on your end device is stored for a period of up to two years.
The legal basis for data processing is your consent in accordance with Art. 6 Para. 1 lit. a GDPR. The Google Group transmits your personal data to the USA. The legal basis for the data transfer to the USA is your consent in accordance with Art. 49 Para. 1 lit a in conjunction with Art. 6 Para. 1 lit a GDPR in conjunction with Section 25 TTDSG. You were informed before you gave your consent that the USA does not have a level of data protection that corresponds to the standards of the EU. In particular, US secret services can access your data without you being informed and without you being able to take legal action against it. For this reason, the European Court of Justice declared the earlier adequacy decision (Privacy Shield) invalid in a judgment.

Newsletter Services

MailChimp
After you have given your consent, your personal data will be processed for the purpose of transmitting electronic direct advertising (e.g. newsletter dispatch) until you revoke it.
For the purpose of sending the newsletter, we use the processor Mailchimp, The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE, Suite 5000 Atlanta, GA 30308, USA.
The legal basis for the processing is the consent you have given pursuant to Article 6 Paragraph 1 Letter a GDPR. There is no legal or contractual obligation to give consent. The only consequence of not giving your consent is that you will not receive a newsletter from us.
The legal basis for the data transfer to the USA is your consent in accordance with Art. 49 Para. 1 lit a in conjunction with Art. 6 Para. 1 lit a GDPR in conjunction with Section 25 TTDSG. You were informed before you gave your consent that the USA does not have a level of data protection that corresponds to the standards of the EU. In particular, US secret services can access your data without you being informed and without you being able to take legal action against it. For this reason, the European Court of Justice declared the earlier adequacy decision (Privacy Shield) invalid in a judgment.

Right to object

If the processing of your personal data is based on legitimate interest, you have the right to object to this processing.
If there are no compelling legitimate reasons for the processing on our part, the processing of your data will be discontinued on the basis of this legal basis.
You also have the right to object to the processing of your personal data for direct marketing purposes. In the event of an objection, your personal data will no longer be processed for the purpose of direct advertising.
The legality of the data processed until the objection is not affected by the objection.

right of withdrawal

You have the right to revoke consent that you have already given at any time by changing the data protection settings.
If you consent to receiving electronic advertising, you can revoke your consent by clicking on the unsubscribe link. In this case, processing will be stopped unless there is another legal basis.
The legality of the data processed until the revocation is not affected by the revocation.

data subject rights

You also have the right to information, correction, deletion and restriction of the processing of personal data.
Insofar as the legal basis for the processing of your personal data is your consent or a contract concluded with you, you also have the right to data portability.
You also have the right to lodge a complaint with the supervisory authority. More information on the supervisory authorities in the European Union can be found here.