Privacy Policy

Effective date: 31 July 2026

Voxov Design is operated by BayatiCo AB. This policy explains what personal data is collected when you visit voxovdesign.com or place an order, why it is collected, who it is shared with, and what rights you have over it. It is written to be read, not to be survived.

1. Who is responsible for your data

BayatiCo AB is the data controller.

BayatiCo AB
Org. nr 5591441992
Slätthultsvägen 8, 443 95 Stenkullen, Sweden
VAT SE559144199201
hello@voxovdesign.com

For any question about this policy or about your data, write to hello@voxovdesign.com.

2. What data is collected, why, and on what legal basis

Order information. Your name, delivery address, email address, telephone number where given, and the contents of your order. This is collected so that the order can be produced, shipped and supported. Legal basis: performance of a contract, Article 6(1)(b) of the GDPR.

Payment information. Payments are handled by Klarna. Voxov does not receive or store your full card details. Voxov receives confirmation that payment succeeded, together with a transaction reference and the information Klarna needs to associate with the order. Legal basis: performance of a contract, Article 6(1)(b).

Accounting records. Order and invoice records are retained as part of the company's books. Legal basis: compliance with a legal obligation, Article 6(1)(c), specifically the Swedish Bookkeeping Act (bokföringslagen 1999:1078).

Newsletter subscription. Your email address, the date you subscribed, and a record of your confirmation. Subscription uses double opt in: after you enter your address, a confirmation email is sent, and you are added to the list only when you click the link in it. Nothing is sent to you before that click. Legal basis: consent, Article 6(1)(a). You may withdraw consent at any time using the unsubscribe link in any email.

Customer service correspondence. The content of emails and messages you send, and the replies sent to you, so that your question can be answered and the history is available if you write again. Legal basis: legitimate interest in providing customer service, Article 6(1)(f).

Analytics. Statistics on how the site is used, collected only if you accept analytics cookies. Legal basis: consent, Article 6(1)(a).

Site security. Technical logs including IP addresses, used to keep the site available and to prevent abuse and fraudulent orders. Legal basis: legitimate interest in operating a secure service, Article 6(1)(f).

3. Who receives the data

Data is shared only with the suppliers needed to run the shop, and only to the extent each one needs.

Klarna Bank AB, Sweden, processes payments. Klarna acts as an independent controller for the payment itself and applies its own privacy policy to that processing.

Resend, email delivery, sends order confirmations, shipping notices and, where you have subscribed, the newsletter.

Supabase, hosting, database and file storage for the shop and its order records.

Lovable, the hosting platform this site runs on. In addition to hosting, Lovable collects its own platform analytics directly from the pages you visit, through a script served at /~flock.js which reports to /~api/analytics on this domain. This measures traffic and availability for the site itself and is separate from the analytics described above.

Google, website analytics, and only where you have accepted analytics cookies. If you decline, no analytics data is sent.

Advertising measurement. If you accept marketing cookies, a hashed version of your email address, and where available your telephone number and postal address, is shared with Google Ireland Limited and Meta Platforms Ireland Limited. The data is hashed before it is sent, so neither company receives the address or the number in readable form. It is used for one purpose only: to match a purchase to an advertisement you saw or clicked, so that advertising performance can be measured. It is not used to build a profile on Voxov's behalf. Legal basis: consent, Article 6(1)(a). Withdrawing consent through the cookie settings stops the sharing immediately, and nothing is shared before you accept.

PostNord, delivery. PostNord receives the name, address and contact details needed to deliver your parcel.

Data is not sold, and it is not shared for anyone else's marketing.

4. Transfers outside the EU and EEA

Some of these suppliers process data outside the EU and EEA. Where that happens, the transfer is covered by the European Commission's standard contractual clauses, or by the supplier's certification under the EU US Data Privacy Framework, together with the technical and organisational safeguards those mechanisms require. You may request details of the safeguards applied to a specific supplier by writing to hello@voxovdesign.com.

5. How long data is kept

Order and accounting records are kept for seven years after the end of the calendar year in which the financial year they belong to ended, as required by the Swedish Bookkeeping Act. This retention is a legal obligation and cannot be shortened on request.

Newsletter data is kept until you unsubscribe. A minimal record of the subscription and its withdrawal is kept afterwards so that consent can be evidenced and so you are not re added by mistake.

Customer service correspondence is kept for 24 months from the last message in the exchange.

Analytics data is kept for 14 months.

Security logs are kept for 12 months.

6. Cookies

The site uses cookies in three groups.

Necessary cookies make the site work: they hold your cart, your session, and your cookie choice itself. They cannot be switched off, and they are set without consent because the site cannot function without them.

Analytics cookies measure how the site is used. They are set only if you accept them.

Marketing cookies support advertising measurement. They are set only if you accept them.

When you first visit, a banner asks for your choice. Nothing beyond the necessary cookies is set until you make it. The site uses Google Consent Mode v2, which means that before consent, tags run in a restricted state that sets no identifying cookies, and your acceptance updates that state immediately.

You can change or withdraw your choice at any time through the cookie settings link in the footer, and you can clear cookies through your browser at any point.

7. Your rights

Under the GDPR you have the right to request access to the personal data held about you, to have inaccurate data corrected, to have data erased where there is no continuing legal basis to keep it, to have processing restricted while a dispute is resolved, to receive the data you provided in a portable machine readable format, to object to processing based on legitimate interest, and to withdraw consent at any time where processing is based on consent.

Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

To exercise any of these rights, write to hello@voxovdesign.com. A response follows within one month. Where an erasure request touches records that must be retained under the Bookkeeping Act, the reason is explained and only the retained records remain.

8. Complaints

If you believe your data has been handled incorrectly, please contact hello@voxovdesign.com first so it can be put right.

You also have the right to complain to the Swedish Authority for Privacy Protection, regardless of whether you have contacted Voxov:

Integritetsskyddsmyndigheten
Box 8114, 104 20 Stockholm
imy@imy.se
imy.se

9. Changes to this policy

If this policy changes, the revised version is published here with a new effective date. Where a change materially affects how your data is used, subscribers are notified by email.