Privacy Notice

Welcome to the website of Fjällräven!

In this privacy notice, we would like to inform you about how we process your personal data and your rights according to the European General Data Protection Regulation (GDPR). Unless otherwise stated below, the controller responsible for data processing is Fenix Outdoor E-Com AB (hereinafter referred to as " Fenix Outdoor", "we" or "us"), unless otherwise stated below.

Our privacy notice consists of two parts. Part A provides you with general information on data protection at Fenix Outdoor and explains, among other things, what rights you have and where you can assert them. Part B is dedicated to the different groups of data subjects and explains in detail what data we collect and process about you. We address you in your role as:

1.    Visitors of our website;
2.    Customers of our online store;
3.    Newsletter subscribers;
4.    Competition participants;
5.    Event participants; 
6.    Social media visitors;
7.    Contact persons at service providers, suppliers and business partners;
8.    Applicants.

A.    General information

1.    How can you contact us?
If you have any questions or suggestions regarding this privacy notice or would like to assert your rights, please send your request to:

Fenix Outdoor E-Com AB
Brogatan 141
894 35 Själevad
Sweden

The easiest way to reach us is to send an e-mail to our customer service at ecom@fenixoutdoor.se.

2.    How can you get in touch with our data privacy officer?
Our data protection officer can be contacted at privacy.ecom@fenixoutdoor.se.

3.    On which basis do we process your personal data?
The term "personal data" as used in data protection law refers to all information relating to an identified or identifiable person. We process personal data in compliance with the relevant data protection regulations, in particular GDPR. Data processing by us only takes place on a legal basis. We process personal data only with your consent (Art. 6 (1) (a) GDPR), for the performance of a contract to which you are a party or at your request for the implementation of pre-contractual measures (Art. 6 (1) (b) GDPR), for compliance with a legal obligation (Art. 6 (1) (c) GDPR) or if the processing is necessary to safeguard our legitimate interests or the legitimate interests of a third party, unless your interests or fundamental rights and freedoms, which require the protection of personal data, prevail (Art. 6 (1) (f) GDPR).

4.    What are your rights?
You decide on your data! As a data subject, you have several rights that you can assert against us. You have the following rights under the applicable data protection laws: 

• In accordance with Art. 15 GDPR, you have the right to request information as to whether or not we process personal data relating to you and, if so, to what extent.
• In accordance with Art. 16 GDPR, you have the right to demand that we rectify your data. • In accordance with Art. 17 GDPR, you have the right to demand that we erase your personal data.
• In accordance with Art. 18 GDPR, you have the right to request that the processing of your personal data be restricted.
• In accordance with Art. 20 GDPR, you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, and to transmit this data to another controller.
• If you have given us your consent to data processing, you can withdraw this consent at any time in accordance with Art. 7 (3) GDPR. Such a withdrawal will not affect the lawfulness of processing based on consent that took place prior to the withdrawal.
• If you believe that the processing of your personal data violates the provisions of GDPR, you have the right to lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR.

In accordance with Art. 21 (1) GDPR, you have the right to object to processing based on the legal basis of Art. 6 (1) (e) or (f) GDPR on grounds relating to your particular situation. If we process personal data about you for the purpose of direct marketing, you can object to this processing in accordance with Art. 21 (2) and (3) GDPR.

If you exercise your rights in accordance with Art. 15 to 22 GDPR, we process the personal data that you have provided, for the purpose of fulfilling these rights and to be able to provide evidence of this. Data stored for the purpose of providing information and the preparation thereof will only be processed for this purpose and for the purposes of data protection control. Otherwise, processing will be restricted in accordance with Art. 18 GDPR.

This processing is based on the legal basis of Art. 6 (1) (c) GDPR in conjunction with Art. 15 to 22 GDPR.

5.    Where do we process your data?
We generally process your data on European servers with the highest security standards. In providing our services, we are supported by external service providers to whom we send your data. Some data processing may involve the transfer of certain personal data to third countries, i.e. countries in which GDPR is not applicable law. Such a transfer is permitted if the European Commission has determined that an adequate level of data protection is required in such a third country. This applies to all transfers to countries in this list: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en.

If there is no such adequacy decision by the European Commission, personal data will only be transferred to a third country if there are suitable guarantees in accordance with Art. 46 GDPR or if one of the requirements of Art. 49 GDPR is met.

Unless there is an adequacy decision and unless otherwise stated below, we use the EU standard data protection clauses as appropriate safeguards for the transfer of personal data to third countries. You have the option of obtaining or viewing a copy of these EU standard data protection clauses. Please contact the address given above.

If you consent to the transfer of personal data to third countries, the transfer takes place on the legal basis of Art. 49 (1) (a) GDPR.

6.    To whom and why do we disclose your personal data?
In order to provide our services and operate economically as a company, we use various external companies to which we transfer personal data in some cases. Insofar as other specific recipients receive personal data for some groups of data subjects, we will inform you about this in Part B.

• Hosting provider: We use certified service providers to host our data who have the highest security standards.
• IT service providers and SaaS providers: We use the services of various service providers who support us as processors and simplify and optimize our processes.
• Advertising and marketing providers: With the help of various advertising and marketing providers, we aim to increase our brand awareness, promote demand for our products and increase our customer loyalty. For this purpose, campaigns are planned, played out and their success measured and analyzed. The providers are usually also processors.
• Payment providers: In order to process payments in our online store we share your data with payment providers and banks that process your data as controllers and/or processors.
• Shipping service providers: We may transfer your personal data to fulfillment service providers as well as postal and delivery services in order to offer and deliver our goods to you in various markets.
• Affiliated companies: We are a group of companies, which means that data transfer between companies is not excluded.

Administration and authorities: Further transfers may take place in order to comply with legal regulations or to respond to court orders or other similar official requests. This also includes transfers to the tax authorities and tax consultancy/auditing firms.

7.    For how long do we store your data?
Unless otherwise stated in this privacy notice, we only store the data for as long as is necessary to achieve the purpose of processing or to fulfill our contractual or legal obligations. Such statutory retention obligations may arise in particular from accounting or tax law regulations. From the end of the calendar year in which the data was collected, we will store such personal data contained in our accounting data for ten years and store personal data contained in commercial letters and contracts for six years. In addition, we will retain data in connection with consents requiring proof and with complaints and claims for the duration of the statutory limitation periods. We will delete data stored for advertising purposes if you object to processing for this purpose.

8.    How do we use cookies and other tracking-technologies?
We use cookies and similar technologies on our websites. We have compiled more information about how we use these technologies in our cookie banner. The banner can be accessed via the footer of our websites. There you will also find a list of companies that place cookies on our websites and process data on the basis of your consent in accordance with Art. 6 (1) (a) GDPR, a list of cookies that we place and an explanation of how you can refuse certain types of cookies.

B.    How and why we process your data

1.    Visitors of our website
a) We process pseudonymous information about the device and browser you are using, server log files, your network connection and your IP address for the following purposes:

• Ensuring the security, operability and stability of our websites, including defense against attacks;
• Integration of third-party content, including content from social media users via Flowbox AB.

Legal basis: Legitimate interest in accordance with Art. 6 (1) (f) GDPR in the flawless functionality and stability of the website.

b) We process information about how you behave on the website. This includes the IP address and user IDs, some of which are assigned by third-party providers, and is used for the following purposes:

• Reach measurement and analysis of visitor behaviour to optimize our websites, increase customer satisfaction and error analysis;
• (Conversion) tracking to measure reach and determine commission for our affiliate partners and influencers;
• Remarketing to attract new customers through personalized display of our advertising;
• Display of external content provided to us by third-party providers;
• Display of external content provided to us by influencers or other social media users via Flowbox AB.

Legal basis: Consent in accordance with Art. 6 (1) (a) GDPR, which we obtain via the consent banner on our website and which you can withdraw or adjust at any time via the footer of the website.

c) We process your data that you provide to us via our contact forms or via our chat. This is done for the following purposes: 

• To answer your request.

Legal basis: Depending on the type of request, initiation of a contract pursuant to Art. 6 (1) (b) GDPR or legitimate interest in accordance to Art. 6 (1) (f) GDPR to promote customer loyalty.

2.    Customers of our online store
a) We process the data that you provide about yourself when placing an order in our online store and that we collect in connection with the order, such as your name, address, e-mail address, payment information and information about purchased goods, including purchase history. Processing is carried out for the following purposes:

• Fulfillment of our contract: This includes processing your order, shipping the goods, handling payment and returns management;
• Customer account: If created by you in the past, you can view your personal data and purchase history through your password-protected customer account;
• (Internal) customer administration;
• Customer service: This includes answering questions about your order or our products, processing complaints and (if appropriate) forwarding the data to the manufacturer.
  
  Legal basis: Fulfillment of contract in accordance with Art. 6 (1) (b) GDPR.
  
  Without the provision of the data, it is not possible to fulfill the contract.
• Non-commercial communication on technical, contractual and security-related topics (e.g. order and shipping confirmations, forgotten password messages, customer account confirmations);
• Sending satisfaction surveys;
• Internal analysis of purchasing behavior and segmentation according to interest groups in preparation for marketing measures; 
  
  Legal basis: Legitimate interest in accordance with Art. 6 (1) (f) GDPR in improving customer loyalty.
• Compliance with legal regulations and retention obligations.
  
  Legal basis: Compliance with legal obligations in accordance with Art. 6 (1) (c) GDPR.
  
  b) If the circumstances of your orders require it (e.g. in the case of bulky goods), we will forward your telephone number, which we request as part of your order, to the shipping service provider. This is done for the following purpose:
• Direct coordination of delivery time and delivery location (especially for bulky goods)
  
  Legal basis: Contract fulfillment according to Art. 6 (1) (b) GDPR. Without the provision of the data, delivery and thus fulfillment of the contract is not possible.
  
  We store all invoice-relevant data for 10 years in order to comply with our retention obligations under commercial and tax law. Data that is not relevant to invoicing, such as date of birth or telephone number, is deleted after 3 years, at the end of the year, provided that no further orders were placed during this time. If creditworthiness data is available, it will be deleted after 3 years, at the end of the year, provided that no further orders were placed during that time.
  
  c) If you want to rate and review your purchased products, we also process your data, in particular your e-mail address and other information on your person or the purchased product that you provide to us, for the following purpose:
• Administration of customer ratings and reviews to ensure authenticity;
• Email marketing: Sending personalized advertising mailings with information and updates on our goods, promotions and events for the purpose of promoting sales.
  
  Legal basis: Consent in accordance with Art. 6 (1) (a) GDPR, which you can withdraw at any time by contacting us using the contact details above or (in the case of promotional mailings) by using the unsubscribe link. 

3.    Newsletter subscribers
a) We process the name and contact details that you provide to us when registering for our newsletter for the following purposes:

• Sending personalized advertising mailings with information and updates on our goods, promotions and events for the purpose of promoting sales and acquiring new customers;
• Verification of the e-mail address via the double opt-in procedure.

b) We process pseudonymous information about how our newsletter is used (click behavior, opening rate and time, length of stay) for the following purpose:

• Performance measurement to optimize our content and for product improvement.

The legal basis for data processing in connection with our newsletter is your consent in accordance with Art. 6 (1) (a) GDPR, which you can withdraw at any time by contacting us using the contact details above or by using the unsubscribe link.

4.    Competition participants
We may run various types of competitions in collaboration with our cooperation partners (then under joint responsibility). Unless otherwise stated in the information on the competition, the following applies:

a) We process your data that you provide to us to participate in the competition. This includes your name, contact details, address and any other information related to your participation. We process this data for the following purposes: 

• Carrying out, processing and determining the winners;
• Communication and dispatch: Information to winners via the respective contact channel (email, Instagram, post), dispatch of the prize;
• Publication of the winners on our website, social media or in our print media. 
  
  Winners' data will only be passed on to other third parties (e.g. tour operators) if this is necessary for the provision of the prize.

Legal basis: Contract fulfillment according to Art. 6 (1) (b) GDPR. Participation in the competition is not possible without providing the data.

b) We also process your email address, which you have provided to us as part of the competition, for the following purposes:

• Email marketing: Sending personalized advertising mailings with information and updates on our goods, promotions and events for the purpose of promoting sales;
• Custom Audience: Forwarding your email address in pseudonymized form to third parties such as Google and Meta to display advertisements.

Legal basis: Consent in accordance with Art. 6 (1) (a) GDPR, which you gave us when participating in the competition and which you can withdraw at any time by contacting us using the contact details above or (in the case of promotional mailings) by using the unsubscribe link.

5.    Event participants
Fjällräven organizes various types of events. For the processing of data in this regard, the responsible controller is our sister company Fjällräven International AB, Box 209, 89125 Örnsköldsvik, Sweden, possibly in collaboration with their cooperation partners (then under joint responsibility). For more information on how Fjällräven International AB processes your data in connection with your participation in an event, please visit https://experience.fjallraven.com/uk/en-gb/legal/privacy-policy.

6.    Social media visitors
a) Responsibility of the social media providers

When you visit Fjällräven’s social media pages (Facebook, Instagram, LinkedIn, Youtube) on which Fjällräven is presented as a company, certain information about you as a visitor is processed.

Further information:
Facebook and Instagram: Privacy Policy of Meta Platforms Ireland Limited
LinkedIn: Privacy policy of LinkedIn Ireland Unlimited Company
Youtube: Privacy policy of Google Ireland Limited

b) Joint controllership of the social media providers and Fjällräven International AB (joint controllers) 

The social media providers collect and process event data and send us anonymized statistics and data for our pages that help us gain insights into the various activities that visitors perform on our site (so-called “Page Insights”). These Page Insights are created based on certain information about people who have visited our page(s).

Further information: 
Facebook and Instagram:
- Joint Controller Agreement
- Data subject rights can also be asserted against Meta. Further information can be found in the privacy policy.
LinkedIn:
- Joint Controller Addendum
- Data subject rights can be asserted via this contact form at LinkedIn. You can contact LinkedIn's data protection officer via this link.
- LinkedIn and Fjällräven International AB have agreed that the Irish Data Protection Commission is the competent supervisory authority overseeing the processing of Page Insights. You can lodge your complaint with the Irish Data Protection Commission (see www.data protection.ie) or with another supervisory authority.

c) Under the control of Fjällräven International AB
Fjällräven International AB processes information that you have made available to them via their social media channels on the respective social media platform. This information may be the name used, contact information or a message to Fjällräven. Fjällräven International AB processes this information for the following purpose:

•  Communicating with interested parties and followers to strengthen the brand and attracting new customers.

Legal basis: Legitimate interest in accordance with Art. 6 (1) (f) GDPR in communicating with interested parties and followers.

d) Embedding your social media content on our website via Flowbox

For the processing of data in connection with embedding your social media content on our website, the responsible controller is Fjällräven International AB. If you would like your social media content to be featured on our website, you can share and tag it with @fjallraven and #yesfjallraven. Fjällräven may also contact you via a social media platform to ask whether we may embed one of your contents on our website for marketing purposes. More information and conditions for the use of your images by Fjällräven can be found here. When embedding your social media content, Fjällräven processes the photo or video you posted and your username of the respective social media platform for the following purposes: 

• Making our website more interesting;
• Allowing our website visitors to interact with social media profiles of other outdoor enthusiasts. 

Legal basis: Consent in accordance with Art. 6 (1) (a) GDPR, which you can withdraw at any time by contacting us using the contact details above. 

7.    Contact persons at service providers, suppliers and business partners
We process data that you provide to us about yourself and the company in which you work, such as your name, e-mail address and telephone number, for the following purposes:

• Fulfillment of the contract with the company where you work (this includes contract administration, documentation on ongoing cooperation, billing and communication).

Legal basis: Legitimate interest persuant to Art. 6 (1) (f) GDPR in the performance of the contract between the company in which you work and us.

8.    Applicants
For information on how we process your data in case of an application, please visit the privacy notice on our career site: https://career.fjallraven.com/privacy-policy