Hemtex Privacy Policy

1. Introduction and scope

Version 12.11.2026. This privacy policy explains how Hemtex AB processes personal data when you visit hemtex.com, shop with us, create a user account, contact customer service or join Club Hemtex.

It is a single policy for all visitors, customers and members. Processing that only concerns members of Club Hemtex is described separately in section 5. If you are not a member, section 5 does not apply to you.

The policy applies to processing in the EU markets served by hemtex.com. The web shop currently delivers to Denmark. Purchases are governed by our General Terms and Conditions (the "GTC"), and this policy is the privacy notice referred to in GTC sections 4.1 and 11.1. Where this policy refers to ordering, payment, delivery, withdrawal, returns and complaints, the commercial terms are those in the GTC. Our use of cookies is described in section 6 and in our Cookie Policy.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the national data protection, e-privacy and marketing rules of your country. For Denmark these include the Danish Data Protection Act (databeskyttelsesloven), the Danish Marketing Practices Act (markedsføringsloven) and the Danish Cookie Order (cookiebekendtgørelsen).

2. Data controller and contact

Hemtex AB ("Hemtex", "we", "us"), corporate ID no. 556132-7056, VAT ID SE556132705601, is the data controller for the processing described in this policy. Hemtex AB owns and operates hemtex.com and Club Hemtex, and is the seller under the GTC.

For questions about this policy, or to exercise your rights under section 10, contact us:

• Privacy enquiries: dataprotection@hemtex.com
• Customer service: customersupport@hemtex.com
• Postal address: Hemtex AB, Box 495, 501 13 Borås, Sweden
• Visiting and returns address: Prognosgatan 22, 504 64 Borås, Sweden

For product reviews shared across the websites of Hemtex and its group companies, Hemtex AB and the group company publishing the review are joint controllers, see section 4.5. You can contact us about any such review.

3. Personal data we collect

We collect only the data we need for the purposes in sections 4 and 5. We do not collect special categories of personal data. We do not ask for or store your CPR number in connection with purchases, deliveries or returns (GTC 11.2).

3.1 Data you give us

• Order data: name, delivery and billing address, email address, mobile number, the products ordered, and the delivery and payment method chosen. For made-to-measure products, also the measurements you enter. You do not need a user account or a membership to shop.
• Business customer data: company name, address and CVR/VAT number, if you ask for an invoice with company details (GTC 16.1).
• User account data: name, address, postal code, city, country, email address, mobile number and password. Date of birth and gender are optional. You may also add extra contact details for product recall notices.
• Customer service data: your enquiries, complaints with any photos and descriptions, withdrawal and return notices, and our correspondence with you.
• Reviews and user-generated content: your product rating, review text, name as shown with the review, and images or posts you allow us to use.

3.2 Data we collect when you use hemtex.com

• Device and connection: device manufacturer, operating system, browser version, IP address, network ID, cookies and unique identifiers.
• Usage: pages visited, time of visit, functions used and products viewed or bought.
• Location: approximate geographic location when you use our services.

Data collected through cookies other than strictly necessary ones is only collected with your consent, see section 6.

3.3 Data from others

• Our payment partner Kustom confirms whether a payment was reserved, charged or refunded. Hemtex never receives or stores your card details (GTC 11.3).
• Our carrier DHL sends us delivery status and tracking events.
• Advertisers may tell us what happened after you clicked an ad. As far as possible this is done with anonymised data.

4. Why we process your data and on what legal basis

Most processing is necessary to perform the purchase contract you enter into with us under the GTC. Other processing rests on your consent, our legitimate interests or a legal obligation, as set out below.

Purpose	Data used	Legal basis (GDPR)	GTC reference
Receive, confirm and fulfil your order (4.1)	Order data	Art. 6(1)(b), contract	1, 3
Payment and refunds (4.2)	Order data, payment status	Art. 6(1)(b), contract	5, 15
Delivery, pick-up notices and tracking (4.3)	Name, address, email, mobile number	Art. 6(1)(b), contract	6 to 8
Withdrawal, returns, complaints and disputes (4.4)	Order and customer service data	Art. 6(1)(b), contract; Art. 6(1)(c), legal obligation; Art. 6(1)(f) for legal claims	10, 12 to 15, 17
Review invitations (4.5)	Name, email, order lines	Art. 6(1)(f), legitimate interest; Denmark: Art. 6(1)(a), consent	4.1
Publishing reviews and user-generated content (4.5)	Review data, name, content	Art. 6(1)(a), consent	4
User account (4.6)	User account data, order history	Art. 6(1)(b), contract
Statistics and site improvement (4.7)	Usage data, order data in aggregated form	Art. 6(1)(f), legitimate interest; Art. 6(1)(a), consent for analytics cookies
Security and prevention of fraud and misuse (4.8)	Device, usage, account and order data	Art. 6(1)(f), legitimate interest	1.3
Bookkeeping, tax and requests from authorities (4.9)	Order, payment and refund records	Art. 6(1)(c), legal obligation
Product recalls and safety warnings (4.10)	Purchase records, contact details	Art. 6(1)(c), legal obligation
Club Hemtex (section 5)	See section 5	See section 5

4.1 Orders

When you place an order we use your name, address, email address, mobile number and order details to accept the order, send the order confirmation with the GTC by email, and deliver the products. Without this data we cannot process your order. If you ask us to restrict processing of this data, we may be unable to complete your order (GTC 11.4).

Business customers who ask for an invoice with company details give us their company name, address and CVR/VAT number for that purpose (GTC 16.1).

4.2 Payment

You can pay by card (Visa or Mastercard), Apple Pay, Google Pay or Klarna invoice. All web shop payments are processed by our payment partner Kustom, which is certified under the Payment Card Industry Data Security Standard (PCI DSS). Hemtex does not receive or store your card details.

We share the personal data needed to complete and manage your purchase with Kustom: contact details, order details and amount. Kustom processes this data as an independent controller under its own privacy policy. The amount is reserved when you order and charged when the goods are dispatched; for made-to-measure products it is charged when you order (GTC 5.4).

If you choose Klarna invoice, Klarna is your creditor and processes your data under its own terms and privacy notice. Klarna may decline a payment request. Its credit decisions are automated, are made by Klarna and not by Hemtex, and cannot be changed by our customer service (GTC 5.3). Contact Klarna to exercise your rights concerning such a decision.

Refunds are made to the original payment method through Kustom, and we confirm the refund by email (GTC 15).

4.3 Delivery

Orders are dispatched from our central warehouse in Sweden and delivered by DHL to a parcel locker, a service point or your address in Denmark (GTC 6). DHL receives your name, delivery address, email address and mobile number so that it can deliver the parcel, send the pick-up notification and return uncollected parcels to us (GTC 8). DHL is an independent controller for its transport services.

For made-to-measure products, your measurements and order details are sent to the manufacturer as soon as you place the order (GTC 13.1)

4.4 Withdrawal, returns, complaints and disputes

If you withdraw from a purchase, we process your order data and your statement to register the withdrawal and refund you. This applies whether you use the "Fortryd aftale" function in the web shop footer, the standard withdrawal form or email (GTC 12.4). When you use the function, we record your statement and send an acknowledgement of receipt by email.

Returns are booked at hemtex.com/return, which generates a QR code for the return parcel (GTC 12.6). We process your name, contact details and order number for this, and the condition of the returned product where diminished value is assessed (GTC 14) [confirm the provider of the returns portal].

If you complain about a defective product, we process your order number or receipt, your description and any photos you send, and reply within 14 days (GTC 10). We keep the documentation needed to show that statutory consumer rights were met. If a dispute is brought before the Swedish National Board for Consumer Disputes (ARN), a court or another body named in GTC 17, we share the data needed for the case.

4.5 Product reviews and user-generated content

After a purchase we may invite you by email to review the product (GTC 4.1). We send this invitation on the basis of our legitimate interest in learning from customers' experience, GDPR Art. 6(1)(f), and within the rules on messages to existing customers in Article 13(2) of the ePrivacy Directive 2002/58/EC as implemented in your country. Each invitation has a link to opt out of further invitations. Exception for Denmark: we send the invitation only if you have consented to receive marketing from us.

Giving a review is voluntary. If you submit one, we publish your rating, your text and the name you choose to show next to the product on the basis of your consent. You decide how your name appears, for example your first name only or your initials. You can also give feedback that is not published. We link each review to an order number to verify that it comes from a customer who bought the product (GTC 4.2). We publish positive and negative reviews and remove only unlawful or offensive content.

Reviews are managed through our supplier TestFreaks. They may be translated and published on the websites of Hemtex and its group companies in other countries on the same consent. The companies concerned are joint controllers for this sharing.

We show your social media images or posts on our website and in our marketing only if you have specifically consented to us sharing that content. This is managed through our supplier Cevoid. We do not link this content to your customer account or to other personal data we hold about you. You can withdraw your consent to a review at any time, and ask us to remove it, by contacting dataprotection@hemtex.com. To withdraw your consent for social media content and have it removed, contact the same address and give us the social media profile name the content was posted from.

4.6 User account

You can create a user account on hemtex.com without joining Club Hemtex. The account gives you digital overview for purchases and returns, and fills in your delivery address automatically at checkout when you are logged in. We process your account data to operate the account under the Terms of Use for User Accounts on hemtex.com and Club Hemtex. Your account is personal, and you are responsible for keeping your password safe.

4.7 Statistics and site improvement

We compile statistics on traffic, usage patterns and sales to improve hemtex.com, our range and our services. Where practical we use aggregated or anonymous data. Website analytics that rely on cookies, such as Google Analytics, run only if you have accepted analytics cookies.

4.8 Security and prevention of misuse

We process data to keep hemtex.com secure and to prevent fraud and misuse, such as attempts to log into other people's accounts, payment fraud, spam and harassment. Where there is a reasonable suspicion of fraud or theft in connection with an order, we may cancel the order and report the matter to the police, including the data needed for the report (GTC 1.3).

4.9 Legal obligations

We use and keep purchase records, transaction information and contact details where needed to meet accounting and record-keeping requirements, and we give information to competent authorities where the law requires it. We process only the data needed for the obligation concerned.

4.10 Product recalls and safety warnings

Where we are legally required to notify customers of a product recall or safety warning under the EU General Product Safety Regulation (EU) 2023/988, we use purchase records and existing contact details to identify and contact the customers affected. Account holders can add extra contact details for this purpose.

5. Club Hemtex membership

This section applies only to members of Club Hemtex and applies in addition to the rest of this policy.

5.1 What Club Hemtex is

Club Hemtex is our free benefits and loyalty programme. It offers member benefits, campaigns, inspiration and product tips. Anyone aged 16 or older can join. Membership is voluntary and personal. You can shop, and hold a user account, without joining.

When you join, a personal user account is created on hemtex.com (section 4.6). By registering or using a member benefit you accept the Terms of Use for User Accounts on hemtex.com and Club Hemtex. We process personal data to register you, administer your membership and give you member benefits. This processing is necessary to perform our agreement with you, GDPR Art. 6(1)(b).

Receiving marketing is optional and is not a condition of membership.

5.2 Data we process about members

• Account and contact data: name, address, postal code, city, country, email address and mobile number. Date of birth and gender are optional.
• Purchase history: what you buy on hemtex.com when you are logged in as a member.
• Marketing preferences and consent records: which channels you have chosen, and when you gave or withdrew each consent.
• Email opening information: whether you open the marketing emails we send you, see 5.4.

We use this data as follows:

• Your name and email address or phone number to answer membership enquiries.
• Your user account to identify you when you are logged in, so that you can use member benefits at checkout.
• The combination of address, name and mobile number to prevent duplicate accounts, fraud and misuse of member offers, based on our legitimate interest, GDPR Art. 6(1)(f).

5.3 Email and SMS marketing, based on your consent

When you register, you choose whether to receive marketing by email, by SMS, by both or by neither. If you consent, we send newsletters, campaigns, inspiration and member offers through the channels you selected. The legal basis is your consent, GDPR Art. 6(1)(a), which also meets the consent rule for electronic marketing in your country, for Denmark section 10 of the Marketing Practices Act.

We may use your registered country to group members by country or region, so that general marketing is relevant to the recipients. If we introduce profiling in the future, we will inform you first and ask for a separate consent.

5.4 Email opening information and member activity

When we send you marketing emails, we measure whether they are opened. We use this information, together with your purchase activity, to identify active and inactive members and to avoid unnecessary messages. The legal basis is our legitimate interest in an up-to-date membership register and in not sending emails that are not read, GDPR Art. 6(1)(f). It is not a basis for sending marketing, which always requires your consent.

We send marketing emails only if you have consented to email marketing (5.3). If you withdraw that consent, we stop sending them and stop measuring email opens.

5.5 Shopping cart reminders

If you have consented to receive marketing by email (5.3), we may send you an email reminder when you have added items to your shopping cart without completing your purchase. We send these reminders only to members who have consented to email marketing. We use your email address and the items in your cart for this. The legal basis is our legitimate interest in helping customers complete purchases they have started, GDPR Art. 6(1)(f). If you withdraw your consent to email marketing, you will no longer receive shopping cart reminders either.

5.6 Keeping member details accurate

We may correct or update the contact and membership details you have given us, such as address and postal code. To do this, we may update your postal address from public address registers and remove members who have died, through our supplier Dun & Bradstreet. This is based on our legitimate interest in accurate member data and in not sending messages or post to wrong addresses or to people who have died, GDPR Art. 6(1)(f).

5.7 Member recipients

We use Voyado as our marketing automation system and Avensia as our CRM partner. Both are data processors under data processing agreements and act only on our instructions. Their privacy policies are available here: Voyado and Avensia.

5.8 Managing or ending your membership

You can withdraw each consent independently at any time on My Page or by contacting dataprotection@hemtex.com. Withdrawing a marketing consent does not affect your membership or your other consents, and it does not affect the lawfulness of processing carried out before the withdrawal. You can also leave Club Hemtex and keep a plain user account. Retention after you leave is described in section 9.

6. Cookies and similar technologies

Cookies are small text files stored in your browser when you visit hemtex.com. Strictly necessary cookies make the site, the basket and the checkout work and keep the site secure. They are set without consent, and any personal data in them is processed on our legitimate interest in a functioning and secure site.

All other cookies, such as analytics and marketing cookies, are set only if you consent in our cookie banner. You can change or withdraw your consent at any time through the cookie settings. Which cookies we use, their purposes, providers and lifetimes are listed in our Cookie Policy.

7. Who we share your data with

We do not sell your personal data. We share it only where a contract, a legal obligation or your consent allows it. Suppliers that process data on our behalf are bound by data processing agreements and may only act on our instructions.

Recipient	Why	Data shared	Role
Kustom (payment partner)	Process card, Apple Pay and Google Pay payments, reservations and refunds (GTC 5, 15)	Contact details, order details, amount	Independent controller
Klarna	Klarna invoice, including Klarna's automated credit decision (GTC 5.3)	Contact details, order details, amount	Independent controller and your creditor
DHL	Deliver, notify and track your parcel, return uncollected parcels (GTC 6, 8)	Name, address, email, mobile number	Independent controller
Manufacturer of made-to-measure products	Produce your order (GTC 13.1)	Measurements, order details	[confirm role]
Inretrn	Generate the return at hemtex.com/return (GTC 12.6)	Name, contact details, order number	Processor
Group companies of Hemtex	Shared IT, customer service and finance functions; shared product reviews	Data needed for the function concerned	Processor; joint controller for reviews
IT, hosting and e-commerce platform suppliers	Operate hemtex.com and our order and ERP systems	Data stored in the systems concerned	Processor
TestFreaks	Collect, verify and publish product reviews	Name, email, order lines, review	Processor
Cevoid	Show customer content from social media with consent	Content and profile name	Processor
Google (Analytics)	Website statistics, only with cookie consent	Online identifiers, usage data	Processor
Voyado, Avensia	Account and member system, marketing automation, CRM	Account, purchase and consent data	Processor
Dun & Bradstreet (data washing)	Update member addresses and remove deceased members (5.6)	Name, address	Processor
ARN, courts, police, other authorities, advisers	Disputes, fraud reports, legal obligations (GTC 1.3, 17)	Data required in the individual case	Independent controller

Kustom, Klarna and DHL describe their own processing in their privacy notices. Kustom's general terms are available at kustom.co.

8. Transfers outside the EU/EEA

As a rule we process your personal data within the EU/EEA. Some suppliers and advertising partners are established outside the EU/EEA or have sub-suppliers there, mainly in the USA.

Where data is transferred to a third country, we make sure the transfer has a valid basis under GDPR Chapter V: an adequacy decision by the European Commission (including the EU-US Data Privacy Framework for certified US companies) or the Commission's standard contractual clauses with supplementary measures where needed. Contact us for a copy of the safeguards used.

9. How long we keep your data

We keep personal data only as long as needed for the purpose it was collected for, or as long as the law requires.

Data	Retention
Guest order contact data in customer and marketing systems	Deleted once the order is delivered and all messages needed to fulfil the purchase have been sent
Purchase, payment and refund records in our ERP system	The retention period required by the accounting legislation that applies in the relevant jurisdiction
Withdrawal, return and complaint cases, customer service correspondence	2 years after the case is closed, or longer while a dispute or legal claim is open
User account without membership	While active. An account is active if you have purchased while logged in during the last 12 months
Club Hemtex membership data	While active. A membership is active if, during the last 30 months, you have purchased while logged in or opened an email from us as a member
Email opening information	Only as long as needed to assess activity within the 30-month period
Records of your consents and withdrawals, and marketing preferences	As long as needed to document consent and respect your choices
Email address after leaving Club Hemtex	1 month, to prevent misuse of the club
Product reviews and user-generated content	Until you withdraw consent or ask for removal, or the product is no longer listed
Cookie data	As stated in the Cookie Policy

Opening a marketing email from us counts towards activity.

Before we delete an inactive account or membership, we email you and ask whether you want to keep it. If we do not hear from you, the account is deleted.

When you leave Club Hemtex or close your account, your data is deleted from the systems of our processor Voyado, except the limited consent records above. Purchase records remain in our ERP system for the statutory period. We also delete data on request, unless we have a legal obligation or another lawful basis to keep it, for example an open complaint.

10. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you and receive a copy.
• Rectification of inaccurate or incomplete data.
• Erasure of data we no longer need or have no basis to keep.
• Restriction of processing in certain cases.
• Data portability: receive data you have given us in a machine-readable format, where processing rests on consent or contract.
• Object to processing based on legitimate interest. You can always object to direct marketing, including profiling for marketing.
• Withdraw consent at any time. Withdrawal does not affect processing carried out before it.

You can view and correct your data, and manage your consents, on My Page. For other requests, contact us using the details in section 2. We reply without undue delay and within one month at the latest. We may ask you to confirm your identity first.

11. Security, complaints and changes

11.1 Security

We protect personal data against unauthorised access and use. Data sent between you and hemtex.com is encrypted with HTTPS. Access to personal data is limited to employees and suppliers who need it for their work, and is governed by internal access controls.

11.2 Complaints

If you believe we process your data unlawfully, please contact us first so we can resolve it. You also have the right to lodge a complaint with the data protection authority in the country where you live or work, or with our lead authority in Sweden.

Country	Authority	Contact
Denmark	Datatilsynet	Carl Jacobsens Vej 35, 2500 Valby, dt@datatilsynet.dk, datatilsynet.dk
Sweden (lead authority for Hemtex AB)	Integritetsskyddsmyndigheten (IMY)	Box 8114, 104 20 Stockholm, imy@imy.se, imy.se

If you live in another EU country, you can find your authority in the European Data Protection Board's list of data protection authorities. Further hemtex.com markets are added to this table as they open.

11.3 Changes to this policy

We may update this policy when our services or the law change. The current version and its date are always available on hemtex.com. We tell you in advance of material changes, and ask for new consent where the law requires it. Earlier versions are available here [this is version 1].