Privacy policy
In this privacy policy, we inform you about the processing of your personal data. If you would like to change your privacy settings (grant consent or revoke consent already granted), click here to change your settings.
Responsible
IONA Natur-Handelsbolag, Nappsjö 14, 91791 Dorotea, SE, info@iona-bjork.se, +43676848068848
CDN provider
Cloudflare CDN
We host parts of our website with our contract processor Cloudflare, Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany.
For the purpose of providing and delivering the website, connection data is processed. For the mere purpose of delivery and provision of the website, the data is not stored beyond the call. However, connection data is stored by our order processor for security purposes. The duration of processing for security purposes is variable and ends with the necessity of the security measures. In addition, our order processor anonymizes the collected data immediately after collection and provides us with the anonymous data in the form of statistics for evaluation. We use these statistics for troubleshooting and further development of our website.
The legal basis for the data processing is the legitimate interest (unconditional technical necessity for the provision and delivery of the service "website" expressly requested by you by your call) in accordance with Art. 6 para. 1 lit. f DSGVO.
Contact form
On our website, you have the option of contacting us directly via a contact form. After sending the contact form, the personal data entered by you will be processed by the responsible party for the purpose of processing your request on the basis of the consent granted by you by sending the form pursuant to Art. 6 para. 1 lit. a DSGVO until revoked.
There is no legal or contractual obligation to provide the personal data. The only consequence of not providing it is that you do not submit your request and we cannot process it.
Registration form
We offer you a registration option on our website. After sending the registration, we process the data listed in the registration form for the purpose of fulfilling the contract on the basis of the contract concluded with the registration pursuant to Art. 6 para. 1 lit. b DSGVO for the term of the contract.
There is no legal or contractual obligation to provide the personal data. Failure to provide it merely means that registration is not possible.
Data will not be transferred to third parties.
Security services
On this website, to avoid non-human and automated input, we use the services of security service providers such as Captcha services.
Google reCAPTCHA
In the case of granting your consent, we process your personal data with the service Google reCaptcha, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland as joint controller for the purpose of avoiding non-human and automated input. In doing so, we enable the service to set cookies, collect connection data and data from your web browser. In addition, we enable the service to calculate a user ID to uniquely identify the user within the advertising network operated by Google. Data is stored on your device for a period of up to two years.
The legal basis for the data processing is your consent pursuant to Art. 6 para 1 lit. a DSGVO. Failure to provide consent means that the use of reCaptcha and associated forms is not possible.
You can revoke consent you have already given by changing the privacy settings.
The Google Group transfers your personal data to the USA. The legal basis for the data transfer to the USA is your consent pursuant to Art. 49 para. 1 lit a in conjunction with Art. 6 para. 1 lit a DSGVO in conjunction with §25 TTDSG. Before giving your consent, you were already informed that the USA does not have a level of data protection that corresponds to the standards of the EU. In particular, US intelligence services can access your data without you being informed and without you being able to take legal action against it. For this reason, the European Court of Justice has ruled that the previous adequacy decision (Privacy Shield) is invalid.
Web Fonts
Webshop
We offer you the possibility to purchase products directly via our webshop. Within the framework of the webshop, the data entered by you as well as data on products selected by you will be processed by the responsible party for the purpose of making the offer, concluding the contract, fulfilling the contract as well as fulfilling any post-contractual obligations prior to the conclusion of the contract on the basis of the pre-contractual relationship initiated by you and after the conclusion of the contract on the basis of the contract pursuant to Art. 6 (1) lit. b DSGVO.
If the purchase of our products was made via an existing customer account or a customer account was created to process the purchase, your personal data will be processed until the deletion of your customer account.
In the case of customers who have purchased our products via a guest profile, your personal data will be processed until the expiry of the statutory retention obligations.
Further processing of your data for the purpose of direct marketing in forms not subject to consent, such as the addressed postal dispatch of advertising, which is compatible with the purpose of fulfilling the contract, will take place until you object.
There is no legal or contractual obligation to provide the personal data. However, the provision is necessary for the conclusion of the contract. Failure to provide the data means that no contract can be concluded.
Shopping carts of non-registered users will be deleted after a maximum of 14 days. The user accounts of registered users remain until the account is deleted by the user. Contractual data will be processed until the statute of limitations of possible post-contractual obligations.
Payments are processed with:
Service: Klarna.
Operator: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden
Service: PayPal
Operator: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxenburg
Tag Manager
Google Tagmanager
In case of granting your consent, we process your personal data with the service Google Tag Manager, Google LLC, Amphitheatre Parkway, Mountain View, CA 94043, USA, as joint controller, for the purpose of triggering, controlling and managing further services of our website. In the specific case, the service listed above is to be controlled via Google Tag Manager. Failure to give consent therefore has exactly the same effect as described for the service listed above. You can revoke consent you have already given by changing the privacy settings.
We allow the Google Tag Manager to collect connection data and data from your web browser. These are used by Google to further develop the service.
The legal basis for the data processing is your consent pursuant to Art. 6 para 1 lit. a DSGVO. The Google Group transfers your personal data to the USA. The legal basis for the data transfer to the USA is your consent pursuant to Art. 49 para 1 lit a in conjunction with Art. 6 para 1 lit a DSGVO in conjunction with §25 TTDSG. Before giving your consent, you were already informed that the USA does not have a level of data protection that corresponds to the standards of the EU. In particular, US intelligence services can access your data without you being informed and without you being able to take legal action against it. For this reason, the European Court of Justice has ruled that the previous adequacy decision (Privacy Shield) is invalid.
Analytics services
Google Analytics
In case of granting your consent, we process your personal data with the service Google Analytics, Google LLC, Amphitheatre Parkway, Mountain View, CA 94043, USA, as joint controller, for the purpose of error analysis and statistical evaluation of our website. Not granting consent has no immediate effect on the function of the website, but without statistical data it will be more difficult for us to further develop the website. You can revoke consent you have already given by changing the privacy settings.
We enable the service to collect connection data, data of your web browser and data about the accessed content as well as the execution of analysis software and the storage of data on your end device. The service anonymizes the collected data immediately after collection and provides us with the anonymous data in the form of statistics for evaluation. We use these statistics for troubleshooting and for the further development of our website. The data on your terminal device is stored for a period of up to two years.
The legal basis for the data processing is your consent in accordance with Art. 6 para. 1 lit. a DSGVO. The Google Group transfers your personal data to the USA. The legal basis for the data transfer to the USA is your consent pursuant to Art. 49 para 1 lit a in conjunction with Art. 6 para 1 lit a DSGVO in conjunction with §25 TTDSG. Before giving your consent, you were already informed that the USA does not have a level of data protection that corresponds to the standards of the EU. In particular, US intelligence services can access your data without you being informed and without you being able to take legal action against it. For this reason, the European Court of Justice has ruled that the previous adequacy decision (Privacy Shield) is invalid.
Newsletter Services
MailChimp
After granting your consent, your personal data will be processed for the purpose of transmitting electronic direct advertising (e.g. newsletter dispatch) until revoked.
For the purpose of sending newsletters, we use the order processor Mailchimp, The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE, Suite 5000 Atlanta, GA 30308, USA.
The legal basis for the processing is the consent given by you pursuant to Art. 6 (1) a DSGVO. There is no legal or contractual obligation to grant consent. The only consequence of not granting consent is that you will not receive a newsletter from us.
The legal basis for the data transfer to the USA is your consent pursuant to Art. 49 para 1 lit a in conjunction with Art. 6 para 1 lit a DSGVO in conjunction with §25 TTDSG. Before giving your consent, you were already informed that the USA does not have a level of data protection that corresponds to the standards of the EU. In particular, US intelligence services can access your data without you being informed and without you being able to take legal action against it. For this reason, the European Court of Justice has declared the previous adequacy decision (Privacy Shield) invalid in a ruling.
Right of objection
If the processing of your personal data is based on legitimate interest, you have the right to object to this processing.
Unless there are compelling legitimate grounds for processing on our part, the processing of your data will cease on the basis of this legal ground.
In addition, you have the right to object to the processing of your personal data for the purpose of direct marketing. In the event of an objection, your personal data will no longer be processed for the purpose of direct marketing.
The lawfulness of the data processed until the objection is not affected by the objection.
Right of withdrawal
You have the right to revoke any consent you have already given at any time by changing your privacy settings.
In the case of consent to receive electronic advertising, you can revoke your consent by clicking on the unsubscribe link. In this case, processing will cease unless there is another legal basis.
The legality of the data processed until the revocation is not affected by the revocation.
Data subject rights
You also have the right to information, correction, deletion and restriction of the processing of personal data.
If the legal basis for the processing of your personal data is your consent or a contract concluded with you, you also have the right to data portability.
Furthermore, you have the right to lodge a complaint with the supervisory authority. You can find more information about the supervisory authorities in the European Union here.