Privacy policy

Data controller

Café Crema Stockholm AB (company reg. no. 559254-9025), Lindhagensgatan 149, 112 15 Stockholm, is the data controller for the processing of your personal data. If you have questions about how we handle your data, or want to exercise your rights, email us at info@cafecrema.se.

When you order a cake

We process your name, email address and phone number, what you've ordered, which café and day you're collecting it, and any requests you write to us. We use this data to bake and hand over your cake, send the order confirmation and contact you if something happens with the order. The legal basis is our contract with you. We keep receipts and other records to comply with the Swedish Bookkeeping Act.

If you tell us about an allergy, that is information about your health. We only use it to make your cake, based on the explicit consent you give when you write it. Please don't write more than we need to know.

Payment is handled by Stripe. We never receive your full card number. If you choose Klarna, Klarna processes your data according to its own data protection notice.

When you're a business customer

We process data about the company's contact person and the person placing the order: name, email address and phone number, and the addresses and details needed for delivery and invoicing. We use them to assess the application, receive, deliver and invoice orders and send order confirmations. The legal basis is the contract with the company and our legitimate interest in being able to stay in contact with the company's contact persons. We keep invoicing records to comply with the Swedish Bookkeeping Act.

When you contact us

If you write to us through the contact form or by email, we process your name, email address and what you write, so that we can reply. The legal basis is our legitimate interest in answering questions from guests and others.

The newsletter

If you subscribe to our newsletter, we process your email address to send it to you, based on your consent. You can unsubscribe at any time by emailing us.

When you visit the website

The servers running the website log technical data such as IP address and browser, so that the website works and stays secure. The legal basis is our legitimate interest in a working and secure website. We describe which cookies we use under cookies.

When you apply for a job or work experience

If you send an application to jobb@cafecrema.se, we process what you send us, for example your name, contact details, CV and cover letter, to assess the application and contact you. The legal basis is our legitimate interest in being able to recruit. Please don't send more data than we need, for example about your health.

Who we share data with

We never sell your data. We use suppliers who process data on our behalf and only according to our instructions (data processors):

• Vercel, which runs the website
• Neon, where the database is stored within the EU
• Stripe, which handles payments
• Formspree, which receives the contact form and newsletter sign-ups
• our email provider, which sends order confirmations and order receipts

Stripe and Klarna are in some respects data controllers themselves, for example to prevent fraud and comply with payment services rules. We also disclose data to authorities when the law requires it.

Transfers outside the EU/EEA

Vercel, Stripe and Formspree are American companies, so data may be processed in the USA. The transfer is protected because the companies are certified under the EU–US Data Privacy Framework or through the European Commission's standard contractual clauses.

How long we keep the data

• Cake orders: for as long as needed to complete the purchase and handle any complaint. Accounting records are kept for seven years after the end of the financial year, in accordance with the Swedish Bookkeeping Act.
• Business customers: for as long as the customer relationship lasts and up to 12 months after that. Invoicing records are kept for seven years after the end of the financial year.
• Contact with us: until the matter is closed, at most 12 months.
• The newsletter: until you unsubscribe.
• Job and work experience applications: for as long as the recruitment is ongoing, at most 12 months.
• Technical logs: a short time, for troubleshooting and security.

Your rights

You have the right to:

• find out what data we have about you and get a copy of it
• have incorrect data corrected
• have your data erased, unless we're required by law to keep it
• request that processing is restricted
• object to processing based on our legitimate interest
• receive data you've given us in a machine-readable format
• withdraw consent at any time

Email us at info@cafecrema.se and we'll reply within a month.

Complaints

If you think we're handling your data incorrectly, you can contact us or lodge a complaint with the Swedish Authority for Privacy Protection (IMY).

Changes

We update the policy when our handling of personal data changes. The date at the top shows when it was last changed.