Privacy Policy

TABLE OF CONTENT

1. Background

2. Definitions

3. Data Controller

4. Summary of The Processing of your Personal Data

5. Why do we Process your Personal Data?

6. Which Personal Data are Processed and according to which legal basis?

7. Social Platforms

8. Children’s Personal Data

9. For how long are your Personal Data stored?

10. Cookies

11. Your rights

12. Consent to Processing Personal Data

13. Profiling

14. To whom are we transferring your Personal Data?

15. How do we protect your Personal Data?

16. Supervision and Compliance

17. Third Party Terms & Conditions

18. Amendment of Privacy Policy

19. Contact us

1. Background

We value your privacy. That you, as our customer, trust in our commitment to protect your privacy is crucial to us.

This policy ("Privacy Policy") has been designed to inform you that Thevea Brands Group AB - Tretorn Sweden AB, Racqet International AB och Friluftsvaror Intrade AB ("Thevea", "we", "us") Process your personal data in a lawful, purposeful and safe manner. The privacy policy describes how Thevea processes your personal data and which rights you have according to the General Data Protection Regulation (EU) 2016/679 with the related compliance statutes and the additional statutes on data protection ("GDPR").

The Privacy Policy applies when (i) Thevea provides goods and services to you when you purchase and order from our domain, Tretorn.com ("Tretorn.com"), (ii) when sending out newsletters, general and customised offers and other similar marketing, (iii) in customer service cases and in our product development and (iv) in other contact with us, via Tretorn.com, via social platforms, e-mail or telephone.

In addition to this Privacy Policy, our Purchase Order Terms & Conditions apply when buying and ordering from Tretorn.com.

2. Definitions

In this Privacy Policy, the term "Personal Data" includes information that can be assigned to an identified or identifiable physical person, such as name, address, personal identification number, date of birth, credit card number, e-mail address, telephone number, order history and IP address.

In this Privacy Policy we describe how we Process your Personal Data. The term "Processing" includes how we register, store and e-mail and in other ways use your Personal Data as described in this Privacy Policy.

3. Data Controller

Tretorn.com, is operated by Thevea Brands Group AB, corporate registration number 559271-8240, with mailing address Box 2005, 250 02 Helsingborg. Thevea Brand Group is the Data Controller responsible for the Processing of your Personal Data.

4. Summary of the processing of your personal data

Below is a summary of the Processing of Personal Data we conduct. We also describe the Processing in detail in paragraphs 5, 6, 7, 8 and 9 in this Privacy Policy.

5. Why do we process your personal data?

Thevea processes your Personal Data for various purposes. In summary, the purpose of the Process is to:

Provide goods and services and execute the contract with you following your order;

Enable general customer care (quality assurance, statistics, marketing and customer analyses and business development) and customer service when you e.g. contact our customer service via e-mail or telephone;

Provide information about events, send newsletters and general and customised offers via mail and e-mail;

Provide you with information and stay in touch with you via social platforms;

Manage participation in competitions and events;

Prevent fraud and perform risk management; and

Comply with applicable law.

We only collect the Personal Data required for the purposes described in this Privacy Policy. Which Personal Data we collect about you depends on which of our goods and services you have requested, ordered or purchased or how you have been in contact with us.

Thevea collects Personal Data when you use Thevea’s services such as purchase or visit Tretorn.com or when you contact Thevea via our customer service.

In addition to the Personal Data you provide us yourself, or that we collect when providing our goods and services, we can also collect Personal Data from a third party. These third parties vary from time to time but include providers of address details from the public register to ensure we have the right address details, and credit rating agencies or banks which provide us with credit references or details for anti-money laundering checks. Furthermore, we use marketing networks, measuring tools and third parties that help Thevea or themselves to understand user behaviour and preferences. For example, an advertiser could provide Thevea with information on what happened after clicking an ad in order for Thevea to measure ad efficiency and become more relevant for you as customer.

When you are asked to provide your Personal Data, e.g. with a purchase, you can choose not to. In case you choose not to provide your Personal Data necessary to get access to a certain product or service, this could entail that you are not able to complete your purchase or order, or that we are not able to fulfil our commitments to you.

Furthermore, we collect Personal Data by using cookies (small text files stored on your device) at Tretorn.com. We do this to optimise Tretorn.com and our online services and to give you a good customer experience, as well as offer you personalised offers. Read more about our usage of cookies in paragraph
10.

6. Which Personal Data are Processed and according to which legal basis?

FOR PURCHASES, ORDERS AND CERTAIN MARKETING

The Personal Data we Process when completing a purchase or order at Tretorn.com are:

(I)FIRST AND LAST NAME;

(II)INVOICE AND DELIVERY ADDRESS;

(III)TELEPHONE NUMBER;

(IV)E-MAIL ADDRESS;

(V)PERSONAL IDENTIFICATION NUMBER;

(VI)ACCOUNT AND PAYMENT DETAILS;

(VII)PAYMENT HISTORY;

(VIII)CREDIT REFERENCES;

(IX)DELIVERY NUMBER;

(X)ORDER NUMBER;

(XI)PURCHASE HISTORY;

(XII)GENDER; AND

(XIII)IP ADDRESS AND INFORMATION REGARDING YOUR USAGE OF TRETORN.COM, SUCH AS WHICH PRODUCTS AND/OR SERVICES YOU WERE INTERESTED IN, SEARCH AND CLICK HISTORY AND YOUR ORDER HISTORY AND BUYING PATTERN.

The Processing of Personal Data is necessary for Thevea to provide sales and delivery of goods and services and thus execute the purchase agreement with you.

We Process your personal identification number to ensure safe identification of you as a person or your Personal Data. The usage of personal identification number for safe identification is also the only guarantee that valuable documents do not end up in the wrong hands and are used by the right person. We always minimise the usage of your personal identification number as much as we possibly can.

The Personal Data could also be used when you provide you with offers with benefits such as discounts, general and personalised offers, invites to events, gifts and other offers we deem to be of interest for you and that you could benefit from. We base this Process on our justified business interest of being able to offer you as our customer beneficial offers and a better customer and shopping experience. For this assessment, we have deemed the Processing not to involve any sensitive Personal Data and we have a clear commercial interest in marketing our products and services to you as our customer as efficiently as possible. You can contact us at any time to unsubscribe to any marketing as described below or follow the link in the e-mail.

WHEN YOU HAVE REQUESTED NEWSLETTERS AND OFFERS

The Personal Data we Process when you have requested newsletters and other offers are:

(I)FIRST AND LAST NAME;

(II)INVOICE AND DELIVERY ADDRESS;

(III)TELEPHONE NUMBER;

(IV)E-MAIL ADDRESS;

(V)PERSONAL IDENTIFICATION NUMBER;

(VI)GENDER;

(VII)WHICH NEWSLETTERS YOU HAVE INTERACTED WITH AND WHICH OF OUR EVENTS YOU HAVE REGISTERED TO/PARTICIPATED IN;

(VIII)IP ADDRESS; AND

(IX)INFORMATION REGARDING YOUR USAGE OF TRETORN.COM, FOR EXAMPLE WITH GOODS AND/OR SERVICES YOU HAVE EXPRESSED INTEREST IN, AND YOU ORDER AND PURCHASE HISTORY AND BUYING PATTERN.

WHEN YOU HAVE REGISTERED TO SUBSCRIBE TO OUR NEWSLETTER, WHICH INCLUDES EXCLUSIVE OFFERS, INFORMATION ABOUT PRODUCT RELEASES ETC., THE PROCESSING OF PERSONAL DATA IS PERFORMED WITH YOUR CONSENT.

FOR CUSTOMER SERVICE, PRODUCT DEVELOPMENT AND SERVICE

The Personal Data we Process when you communicate with us are:

(I)FIRST AND LAST NAME;

(II)INVOICE AND DELIVERY ADDRESS;

(III)TELEPHONE NUMBER;

(IV)E-MAIL ADDRESS;

(V)PERSONAL IDENTIFICATION NUMBER;

(VI)DETAILS ABOUT PURCHASE AND ANY COMPLAINTS;

(VII)INFORMATION AFTER CUSTOMER SURVEYS; AND

(VIII)IP ADDRESS AND INFORMATION REGARDING YOUR USAGE OF TRETORN.COM, FOR EXAMPLE WITH GOODS AND/OR SERVICES YOU HAVE EXPRESSED INTEREST IN, AND YOUR ORDER AND PURCHASE HISTORY AND BUYING PATTERN.

The Processing of Personal Data is necessary in order for Thevea to provide good service via our customer support, develop our services and products and to investigate any potential complaints, and thus accommodate our justified interest in managing customer support cases and develop our business in an efficient way.

TO COMPLY WITH LEGAL REQUIREMENTS

Some of the Personal Data Thevea processes are used to fulfill legal obligations according to legal requirements, court orders or government decisions. Such requirements could include product liability and product safety such as producing communication and information to the general public and customers about product warnings and product recalls, in case of e.g. suspicions of a defect or harmful product. It can also be required by the Bookkeeping Act (1999:1078) or Anti-Money Laundering Act (2017:630). Personal Data that are Processed in order for Thevea to fulfill their legal obligations are usually:

(I)FIRST AND LAST NAME;

(II)TELEPHONE NUMBER;

(III)PAYMENT HISTORY;

(IV)E-MAIL ADDRESS;

(V)PERSONAL IDENTIFICATION NUMBER;

(VI)CORRESPONDENCE WITH YOU; AND

(VII)DETAILS REGARDING PURCHASES, E.G. WHICH ITEM YOU BOUGHT AND ANY COMMENTS.

7. Social Platforms

Thevea uses Facebook and Instagram as channels to get in contact with customers and to market and inform about our products and services. In conjunction with this, Thevea is the data controller for publications and information containing Personal Data and comments, images and video clips posted by you on social media. Thevea asks our users to report any offensive content to us and we will remove any such content. Thevea can thus remove any content from the social platforms we deem to be offensive.

8. Childrens personal data

Thevea does not intentionally collect Personal Data from children under 16 years unless a parent/guardian has given their consent to the processing. Should we discover that a child under 16 years has provided us with Personal Data without the consent of a parent/guardian, we will immediately erase it. If you become aware that a child has provided their Personal Data to us without consent from a parent/guardian, we kindly ask you to contact us so we can take appropriate measures.

9. For how long do we store your personal data?

Your Personal Data are only stored for as long as we need to fulfill the purpose for which the Personal Data were collected, in accordance with this Privacy Policy.

Existing customers’ Personal Data are only stored for marketing purposes for 36 months after last purchase. If you do not wish us to store Personal Data for marketing purposes during this period, you are welcome to (i) contact us and object to processing or (ii) follow the link in the e-mails.

When you have given your consent to receive offers from us, we Process your Personal Data for that purpose until you unsubscribe or inform us that you withdraw your consent to receive offers. You can do this by (i) contacting us or (ii) follow the link in the e-mail.

Personal Data that has been provided in contact with customer service etc and do not lead to purchase, will be erase no later than 36 months after your case is closed.

Personal Data that are necessary to fulfill any warranty commitments and claims and complaints are stored for as long as needed for us to fulfill our warranty commitment.

To enable Thevea to fulfill our legal obligations by complying with the law, or to defend our own legal interests (in case of a legal process), we could store the Pesonal Data for a longer period. However, Personal Data are never stored longer than is necessary or statutory for each purpose.

10. COOKIES

Thevea uses cookies to deliver a tailored and convenient online experience, to enable e-mails with customised ads and offers to improve your experience with Thevea’s services. Thevea uses cookies at Tretorn.com and for Thevea’s services. In our Cookie Policy we explain further how we use cookies and which selections you can make.

11. Your rights

You have the right to receive information on the Processing of your Personal Data that we conduct. Below is an overview of the rights you can invoke by contacting us. You find our contact information at the end of this Privacy Policy.

Right to Access

You have the right to request information, free of charge, about the Processing we conduct regarding your Personal Data. You also have the right to receive a copy of the Personal Data we Processing about you. This request must be made in writing with clarification about which information you are requesting access to. We will respond to your request without any unnecessary delay. If we cannot meet your request for access to the data you would like access to, we will provide you with an explanation. The copy of your Personal Data will be sent to your registered home address, unless agreed otherwise in writing. To confirm your identity upon a request from you, we might require further information from you.

Right to Correction (Rectification)

As data controller, Thevea is responsible for the Personal Data we Process being correct. If you inform us that the Personal Data you have provided us with no longer are correct, we will rectify this as soon as possible.

Right to Erasure (Right to Be Forgotten)

You have the right to request Thevea to erase your Personal Data, without any unnecessary delay. Personal Data must be erased in the following cases:

If the Personal Data are no longer required for the purpose for which they were collected;

If you have withdrawn your consent and the Processing is only due to consent on a legal basis;

If the Processing is only for direct marketing and you object to the Processing of your Personal Data for this purpose;

If you object to the Processing of Personal Data after a balancing of interests and your interest takes precedent over ours;

If your Personal Data haven’t been Processed according to GDPR; or

If an erasure is required to fulfil a legal obligation.

There might be obligations that prevent us from immediately erasing all of your Personal data. These obligations follow applicable law concerning e.g. bookkeeping. If certain Personal Data cannot be erased due to applicable law, we will ensure that the Personal Data are only used for the purpose of fulfilling such legal obligations and not for other purposes.

Right to Restriction of Processing

You have the right to request that Thevea temporarily restricts the Processing of your Personal Data. Such restriction can be requested in the following cases:

If you believe that the Personal Data we have on you are not correct and you have a requested a rectification;

When the Processing of your Personal Data is not compliant with GDPR but you do not want to erase your Personal Data but rather restrict the Processing; and

When we do not need your Personal Data for the purposes of our Processing but you need them to establish, enforce or defend a legal claim.

When you have objected to the Processing of your Personal Data, the usage of your Personal Data is restricted for the duration of the investigation. In case of restriction of Processing of your Personal Data, Thevea will only store your Personal Data and request your consent for further Processing.

Right to Data Portability

You have the right, when we Process your Personal Data with your consent or to fulfill a business agreement with you, to request that we provide all Personal Data we have on you and that is Processed in an automated way, in a machine-readable format, e.g. in an Excel-file or CSV-file. If it is technically possible, you have the right to have your Personal Data transferred to another data controller.

Right to Object to Processing

You have the right object to our Processing of your Personal Data if the Processing is executed with the support of our justified business interest and after balancing of interest. In such a case, Thevea will ask you to specify which Processing you object to. If you object to any Processing, we will only continue the Processing if there are justified reasons for the Processing that override your interests.

12. Consent to processing of personal data

If you have given your consent, Thevea will send you newsletters and commercial material via e-mail from time to time that we believe you would have an interest in.

You decide if you want to give your consent for the intended Processing and when you want to withdraw your consent for such Processing. If you wish to withdraw your consent you should contact us as per the information below or by following the link in the e-mail.

Read more about what it means to give your consent under paragraph 6.

13. Profiling

Thevea will analyse your purchase history, your purchasing pattern and your behaviour at Tretorn.com in order to gain more knowledge about you as a customer and about our customers in general to improve our offers (so-called "Profiling"). For the same purpose, we might also review any personal wishes or preferences you have given us, e.g. information about any particular category of goods you are interested in. We do this by analysing your previous purchases and which items you have looked at or added to the shopping cart at Tretorn.com or based on what you have clicked on in our newsletters or our other communication with you. Based on this information, we provide you with personalised marketing and offers.

Thevea bases the Processing of Personal Data for Profiling in compliance with GDPR on our justified business interest of being able to send offers and information to you that we believe you would be interested in. We have based this on a balancing of interests in which we have considered that the Processing does not involve any sensitive Personal Data, that you are our customer and that we have a clear business interest in being able to market our products and services to you as our customer in an efficient way.

You can object to the Processing of Personal Data through Profiling. You do this by contacting privacy@tretornsweden.com. When we have received your message we will cease to Process your Personal Data for Profiling.

14. To whom do we transfer you personal data?

To provide some of our services and products we engage selected third parties. This means that we share portions of the Personal Data we have collected about you with them, e.g. business partners such as providers of CRM systems and case management, payment and communication services, or printing and distribution services. Thevea takes the necessary technical and organisational measures when sharing or transferring your Personal Data to ensure they are managed in a safe and secure way. These third parties will only Process your Personal Data in a way that complies with this Privacy Policy and to fulfill the purpose(es) stated in this Privacy Policy.

Thevea could be obliged, upon request, to disclose your Personal Data. Such disclosure of Personal Data could be shared with e.g. the Police or Tax Authorities.

In case of any changes to our business or ownership of Thevea, your Personal Data could also be shared with a third party. In a case where Thevea sells the entirety or parts of their business or assets, Thevea might share your Personal Data with a potential buyer or their advisor.

Thevea will not sell your Personal Data to a third party unless we have your consent to do so.

15. How do we protect you personal data?

To protect your personal privacy, discover, prevent and limit risks of hacker attacks etc., Thevea takes a number of technical and organisational information security measures. When transferring sensitive Personal Data such as credit card numbers and passwords etc. via internet, these Personal Data are protected by encryption. Thevea also takes measures to protect your Personal Data from unauthorised access, abuse, disclosure, changes and damage. Thevea ensures that access to your Personal Data is only given to personnel who need it to complete their work tasks and that they Process your Personal Data confidentially.

16. Supervision and compliance

If you are unhappy in any way with how we Process your Personal Data or if you believe that your Personal Data have been processed in breach of GDPR, you are welcome to contact us. You may also file a complaint with the supervisory authority, currently the Swedish Data Protection Authority. You find more information on www.datainspektionen.se. We ensure that all new employees are familiar with this Privacy Policy, in order to protect your Personal Data in the best possible way.

Theveareviews this Privacy Policy annually.

17. Third party terms & conditions

Our services could sometimes be subject to third party’s terms and conditions. Thevea is not responsible for such third parties' usage of your Personal Data, as they are the sole data controllers and they are responsible for the Processing of your Personal Data. Thus, it is important that you as a customer consider and review the terms and conditions of the third party, for instance in conjunction with the usage of our payment service at Tretorn.com and the service for selecting shipping method for the delivery of your order, where payment service providers and shipping companies Process your Personal Data according to their own terms and conditions. The same applies to any links at Tretorn.com linking to other websites.

18. Amendments to privacy policy

Thevea reserves the right to amend this Privacy Policy when we deem it necessary to comply with applicable law. Such amendments are mainly called for in the event of any legislative changes, due to statements from supervisory authorities or other bodies issuing statements regarding GDPR. Furthermore, this Privacy Policy will be updated as necessary due to changes in our goods and services.

We will inform you well in advice before the amendments come into effect.

19. Contact us

If you have any questions regarding this Privacy Policy or the Processing of your Personal Data, wish to make a request in accordance with the Privacy Policy or if you want to report a breach of this Privacy Policy etc., you are welcome to contact us.

Thevea Brands Group AB, org. nr 559271-8240

Box 2005, 250 02 Helsingborg

Privacy Office

E-mail: privacy@tretornsweden.com