Privacy Policy

Last updated: 16 July 2026

This Privacy Policy explains how Kundavai by Chella collects, uses, shares, and protects your personal data when you visit our website, create an account, place an order, contact us, or otherwise use our services.

1. Who Is Responsible for Your Personal Data?

The data controller is:

Legal business name: Kundavai by Chella

Trading name: Kundavai by Chella

Country of establishment: Sweden

Company or registration number: 9104284428

Email: support@kundavaibychella.com

We determine why and how personal data collected through our store is processed.

2. Personal Data We Collect

Depending on how you interact with us, we may collect:

- Identity information, such as your name

- Contact information, including your email address, telephone number, billing address, and delivery address

- Order information, including products purchased, size, colour, personalisation details, transaction value, and order history

- Payment-related information, such as payment status, currency, transaction reference, and limited payment details supplied by our payment provider

- Account information, including login and account preferences

- Communications, such as customer-service messages, return requests, reviews, and survey responses

- Technical information, including your IP address, browser type, device type, operating system, referring page, and website activity

- Marketing preferences, including whether you have agreed to receive promotional communications

- Cookie and analytics information, where permitted by your consent

- Information needed to investigate damaged, defective, lost, or incorrectly fulfilled orders, including photographs or videos you provide

Payment-card details are normally collected and processed directly by our payment provider. We do not ordinarily receive or store complete card numbers or security codes.

Please do not send us sensitive personal data unless we specifically request it and it is necessary to resolve your enquiry.

## 3. How and Why We Use Personal Data

We process personal data only when we have a valid legal basis under the GDPR.

### Processing necessary to perform a contract

We process your data to:

- Process and fulfil your order

- Take payment and confirm transactions

- Arrange printing, personalisation, packaging, and delivery

- Provide order updates

- Process approved returns, replacements, and refunds

- Provide customer support

- Manage your customer account

If you do not provide information required to complete an order, we may be unable to supply the requested products.

### Processing necessary to comply with a legal obligation

We may process and retain information to:

- Maintain accounting, tax, and transaction records

- Comply with consumer-protection and product-safety requirements

- Respond to lawful requests from courts, regulators, or public authorities

- Establish, exercise, or defend legal claims

### Processing based on our legitimate interests

Where your rights do not override our interests, we may process data to:

- Prevent fraud, misuse, and security incidents

- Protect our website, customers, and business

- Keep records of customer-service interactions

- Improve our products, services, and website

- Understand general store performance using strictly necessary or appropriately configured analytics

- Defend or enforce our legal rights

You may ask us for information about the balancing assessment applicable to processing based on legitimate interests.

### Processing based on consent

Where required, we rely on your consent to:

- Send email or other direct marketing

- Place non-essential analytics or advertising cookies

- Use similar tracking technologies

- Publish a review, photograph, or other customer content where separate permission is required

You may withdraw consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

## 4. Cookies and Similar Technologies

Our website may use cookies and similar technologies.

Essential cookies may be used without consent where they are strictly necessary to provide requested services, maintain website security, remember a shopping cart, or complete checkout.

We will request consent before using non-essential analytics, advertising, personalisation, or tracking cookies where required by law. You can accept, reject, or adjust these cookies through our cookie settings. Rejecting non-essential cookies will not prevent you from making a purchase.

More detailed information, including cookie names, providers, purposes, and durations, should be available in our Cookie Policy or cookie-preference centre.

## 5. Marketing Communications

We send promotional messages only when we have a lawful basis to do so. Where consent is required, we will obtain it before sending marketing.

You can unsubscribe at any time by:

- Selecting the unsubscribe link in a marketing email

- Changing your account preferences, where available

- Contacting support@kundavaibychella.com

We may retain limited suppression-list information to ensure that we respect your unsubscribe request.

Service communications concerning an order, account, security issue, return, or policy change are not marketing and may still be sent when necessary.

## 6. Who Receives Your Personal Data?

We share personal data only when necessary with recipients such as:

- Hostinger, which provides website-hosting and related infrastructure

- Printful and its fulfilment partners, which manufacture, personalise, package, ship, and handle fulfilment-related order issues

- Payment processors and financial institutions

- Delivery, postal, and courier companies

- Email, customer-support, and communication providers

- Analytics and cookie-management providers, where enabled

- Accountants, insurers, auditors, legal advisers, and other professional advisers

- Fraud-prevention and website-security providers

- Government bodies, regulators, courts, or law-enforcement authorities where disclosure is legally required

- A purchaser, successor, or adviser involved in a genuine sale, merger, financing, or restructuring of our business, subject to appropriate confidentiality protections

These recipients receive only the information reasonably needed to perform their services or satisfy applicable legal requirements.

Some providers act as processors on our instructions, while others may act as independent controllers for their own regulated activities, such as processing payments or delivering parcels. Their own privacy notices may also apply.

We do not sell personal data.

## 7. International Data Transfers

Our suppliers and fulfilment partners operate internationally. Your personal data may therefore be processed outside the European Economic Area.

Where a destination is not covered by a European Commission adequacy decision, we use an approved transfer mechanism where required, such as the European Commission’s Standard Contractual Clauses, together with supplementary safeguards when appropriate.

You may contact us to request more information about the safeguards used for a particular transfer and how to obtain a copy, subject to appropriate redactions.

## 8. How Long We Keep Personal Data

We retain personal data only for as long as necessary for the purpose for which it was collected, including to meet accounting, tax, consumer-protection, dispute-resolution, and other legal requirements.

Retention periods are determined according to:

- The duration of our contractual relationship with you

- Applicable accounting and tax-retention requirements

- Return, warranty, and chargeback periods

- Applicable limitation periods for legal claims

- Security, fraud-prevention, and dispute-resolution needs

- Whether you have withdrawn consent or objected to processing

Examples include:

- Order and transaction records: for the legally required accounting and tax-retention period

- Customer-service correspondence: for as long as reasonably necessary to resolve the matter and manage related claims

- Account information: while the account remains active and for a reasonable period afterward

- Marketing information: until you withdraw consent or object, after which limited suppression information may be retained

- Cookie information: for the duration stated in our cookie-preference centre

When data is no longer required, we delete or anonymise it securely.

## 9. Your GDPR Rights

Subject to the conditions and exceptions in applicable law, you may have the right to:

- Request access to your personal data

- Request correction of inaccurate or incomplete data

- Request deletion of your data

- Request restriction of processing

- Object to processing based on legitimate interests

- Object at any time to direct marketing

- Receive certain data in a structured, commonly used, machine-readable format and transmit it to another controller

- Withdraw consent at any time

- Lodge a complaint with a data-protection supervisory authority

- Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, subject to applicable exceptions

To exercise your rights, email support@kundavaibychella.com. Please describe your request clearly. We may request information reasonably necessary to confirm your identity and protect your data.

We normally respond within one month. Where a request is particularly complex or numerous, the period may be extended by up to two additional months, and we will inform you where the GDPR permits this.

Exercising your rights is generally free. We may charge a reasonable fee or refuse a request if it is manifestly unfounded or excessive, as permitted by law.

## 10. Complaints

We encourage you to contact us first so that we can try to resolve your concern.

You also have the right to complain to the data-protection authority in the EU or EEA country where you normally live, work, or believe an infringement occurred.

If our business is established in Sweden, the relevant authority is:

Swedish Authority for Privacy Protection — Integritetsskyddsmyndigheten (IMY)

Website: https://www.imy.se/

## 11. Automated Decision-Making

We do not currently make decisions based solely on automated processing that produce legal or similarly significant effects for customers.

We may use automated tools to identify potentially fraudulent or suspicious transactions. Where such processing could have a significant effect, we will provide any additional information and safeguards required by law.

## 12. Information About Children

Our website and products are not directed at children under 16, and we do not knowingly collect personal data directly from children for consent-based online services.

If you believe a child has provided personal data without appropriate permission, contact us so that we can investigate and, where appropriate, delete it. A lower consent age may apply under the law of a particular EU or EEA country.

## 13. Data Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful loss, alteration, destruction, unauthorised access, or disclosure.

No online service is completely secure. You are responsible for keeping any account password confidential and for notifying us if you suspect unauthorised use of your account.

## 14. Data Obtained From Other Sources

Most personal data is collected directly from you. We may also receive information from:

- Payment providers

- Ecommerce or marketplace platforms through which you place an order

- Printful and other fulfilment providers

- Delivery and courier companies

- Fraud-prevention and security providers

- Social networks, if you communicate with us through those services

We use such information to process orders, verify payments, provide support, arrange delivery, prevent fraud, and resolve disputes.

## 15. Links to Other Websites

Our website may contain links to third-party websites or services. We do not control those parties’ data practices. Please review their privacy notices before providing personal data to them.

## 16. Changes to This Policy

We may update this Privacy Policy to reflect changes in our services, suppliers, or legal obligations. The revised version will be posted on this page with an updated revision date.

If a change materially affects how we use personal data, we will provide additional notice or request consent where required.

## 17. Contact Us

For privacy questions or to exercise your rights, contact:

Kundavai by Chella

[INSERT LEGAL BUSINESS NAME]

[INSERT COMPLETE BUSINESS ADDRESS]

Email: support@kundavaibychella.com