How can we help you?

We need to process information about you in order to complete your purchase. If you do not specify your information, we will not be able to complete your purchase from us. We also need to process your information in order to comply with statutory or other requirements, such as the Swedish Bookkeeping Act’s requirement to keep records.

Purpose: To be able to manage online purchasing

Processing that is carried out:

Personal data that is processed:

Lawful basis: Fulfillment of purchase contract, legal obligation and balance of interests.

The processing of these personal data is necessary in order to enable us to fulfil our obligations under the purchase contract. If you do not specify your information, we will not be able to complete your purchase from us.

Managing any exercise of the right of withdrawal is necessary in order to enable us to comply with consumer protection legislation and thus fulfil a legal obligation.

Retention period: The information is processed from the time that you make your purchase and is subsequently processed for three (3) months.

In addition to the above, your personal data is also processed by the payment service supplier you choose to pay with - DIBS, Paypal or Ideal, in order to complete your payment. They are an independent personal data controller for your processing and informs you separately about how your data is processed.

 

Purpose: To manage product ratings, reviews and product questions online

Processing that is carried out:

Personal data that is processed:

Lawful basis: Balance of interests.

The processing is justified by our legitimate interest in being able to contact you with a request to review or rate the product or products that you have purchased.

Retention period: The personal data is processed for 90 days after publication.

In order to create and fulfill what follows from your membership in our loyalty club, we need to process your information. If you do not provide your personal information to us, we will not be able to create or manage your membership. Therefore, if you do not want to enter the information, you cannot be a member of us.

Based on your member profile, we will also market our products to you in your digital channels. If you do not want marketing from us, you are always entitled to refuse it. Read more about your rights below.

 

Purpose: To create and manage your membership and your member pages

Processing that is carried out:

Personal data that is processed:

Lawful basis: Fulfilment of contract

The processing is necessary to create and administer your member pages in accordance with the member terms and thereby to fulfill our agreement with you.

Retention period: The data is processed until you terminate your membership. If your membership has been inactive for 24 months, we will delete your membership and associated information, provided you have no liabilities to us. With inactivity, we mean that you have not registered a member purchase.

 

Purpose: To administer your bonus

Processing that is carried out:

Personal data that is processed:

Lawful basis: Fulfilment of contract

The processing is necessary to manage your bonus in accordance with our member terms and thereby to fulfill our agreement with you.

Retention period: Your earned points will be saved for 24 months or until your membership ends.

 

Purpose: To show current and previous purchases

Processing that is carried out:

Personal data that is processed:

Lawful basis: Fulfilment of contract

The processing is necessary in order to administer your member pages in accordance with the membership terms & conditions and thus fulfil our contract with you.

Retention period: The data is processed for 36 months from the date of purchase.

 

Purpose: To manage and send marketing

Processing that is carried out:

Personal data that is processed:

For personalised communication, we also process:

Lawful basis: Fulfilment of contract

The processing is necessary in order to fulfil our contract with you when you have chosen to join our customer club for the purpose of receiving personalised special offers and information about new arrivals, promotions and discounts. We clearly inform you about this when you choose to become a member.

Retention period: The data is processed from the time that you become a member and for as long as you remain a member (see the time limit above). But the processing ceases if you expressly opt out of marketing.

 

Purpose: To offer you personalised communication based on the age of your child(ren)

Processing that is carried out:

Personal data that is processed:

Lawful basis: Consent

You give your consent by voluntarily providing the date of birth of your child(ren). No other information is retained about your child(ren).

Retention period: The data is processed until the child reaches the age of 13 years or until you expressly withdraw your consent.

 

Purpose: To send customer satisfaction and marketing surveys

Processing that is carried out:

Personal data that is processed:

Lawful basis: Legitimate interest

Our lawful basis for processing is our legitimate interest in being able to send customer satisfaction and marketing surveys to you.

Retention period: The data is processed for the duration of the process necessary to send and administer customer satisfaction or marketing surveys to you. You can opt out of future mailings by using the unsubscribe function in the email.

 

Purpose: To provide you with updated information

Processing that is carried out:

Personal data that is processed:

Lawful basis: Fulfilment of contract

The processing is carried out in order to provide you with updated information about our member terms & conditions, which is necessary in order to fulfil our contract with you. The processing to provide information about our updated Privacy Policy is necessary to comply with the relevant statutory and regulatory requirements for data protection.

Retention period: The data is processed for as long as you remain a member with us (see time limit above).

 

Purpose: Information about product safety or product liability

Processing that is carried out:

Personal data that is processed:

Lawful basis: Balance of interests

The processing is justified by our legitimate interest in being able to contact you in order to make sure that you receive information about an unsafe product after we have discovered such a product, especially since we sell products for children.

Retention period: The data is processed for as long as you remain a member with us (see time limit above).

We process your personal data to communicate with you, e.g. to handle customer service
matters. In order to be able to collect personal data for analysis and marketing as described
below, we use cookies. In our information about cookies, we explain in more detail how this
is done.

Purpose: Provide customized marketing in digital channels

Processing that is carried out:

Personal data that is processed:

Lawful basis: Consent

We obtain your consent to be able to provide you as a customer customized marketing that is relevant to you based on the information we have about you, e.g. based on what you have shown interest in on our website.

Retention period: You will see marketing from us for 13 months from your visit to our website.

 

Purpose: To be able to manage and complete competitions

Processing that is carried out:

Personal data that is processed:

Lawful basis: Fulfilment of contract

Our lawful basis is that the processing is necessary in order for us to be able to administer your participation in the competition, i.e. our contract about taking part in the competition.

Retention period: Your personal data is stored until the competition is over.

 

Purpose: To be able to administer social channels

Processing that is carried out:

Personal data that is processed:

Lawful basis: Balance of interests

The processing is based on our legitimate interest in being able to administer social media and being able to satisfy your interest in interacting with us.

Retention period: The personal data remains in the flow on social media.

 

Purpose: To be able to market our products in social channels and on our website

Processing that is carried out:

When you post images with #polarnopyret on Instagram, in certain cases we request your permission to post (regram) the image in our flow on Instagram or display it on our website. We do this for the purpose of displaying our customers’ own images featuring our clothes.

Personal data that is processed:

Lawful basis: Consent

We always request your consent via www.polarnopyret.se/yespolarn.

Retention period: The personal data remains in the social media flow. If we no longer display your image on our website, it will not be retained by us for longer than 60 days. The image will also be removed if you withdraw your consent or if anyone reports your image or until we sell out of the item or items shown in the image on the website. But we only process your IP address in a non-anonymised form until we have saved your image.

 

Purpose: To be able to manage customer service cases

Processing that is carried out:

Personal data that is processed:

Lawful basis: Legitimate interest

Our lawful basis for processing is our legitimate interest in being able to help you with your case, as well as to maintain a high level of security for our employees.

Retention period: The data is processed for six months from the date on which you have contacted our customer service. Any recorded telephone calls are only processed during the period in which the case is under investigation.

We perform high-level analyzes of purchase behavior on our website. In order to collect personal data for analysis as below, we use cookies. In our information about cookies, we explain in more detail how this is done.

Purpose: To use analysis for improve the customer experience on the website

Processing that is carried out:

Personal data that is processed:

Lawful basis: Consent

We obtain your consent to analyze how you use our website in order to give you a better experience. You can avoid Google Analytics by downloading and installing this browser program.

Retention period: The personal information will be stored for 13 months from your visit and anonymized thereafter. You can read more about how Google processes your personal data in their privacy policy.

We process certain personal data so that you as a customer feel an enhanced sense of security when you shop with us on both our e-commerce sites and in our stores. We also do this in order to fulfil our legal obligations and manage claims, as well as prevent crimes against our customers, our employees and our company.

Purpose: To fulfil legal obligations

Processing that is carried out:

Personal data that is processed:

Lawful basis: Legal obligation

The processing is necessary in order to comply with mandatory legislation, i.e. the Swedish Bookkeeping Act and money laundering legislation.

We are required by law to carry out this personal data collection. If the information is not provided, we will be unable to fulfil our legal obligation and we will have no choice but to refuse your purchase

Retention period: Documentation in which the information may appear in, is processed until the end of the seventh financial year in accordance with the Accounting Act and money laundering legislation.

 

Purpose: To be able to manage complaints and other claims

Processing that is carried out:

Personal data that is processed:

Lawful basis: Legal obligation and balance of interests

Processing is necessary to enable us to act in accordance with consumer protection legislation. We also have a legitimate interest in being able to defend ourselves against any legal claims.

Retention period: The personal data is processed from the time that you complain and is processed for as long as the claim is in progress.

 

From whom do we collect personal data about you?

 

Who has access to your personal data?

Your personal data is processed primarily by us at Polarn O. Pyret, as well as our parent company
RNB Retail and Brands AB (RNB). We share your personal data with RNB because RNB helps us to
manage delivery IT errands.

We also share your personal data with our external IT suppliers, so that we are able to manage our
obligations to you and run our business. RNB and our IT suppliers only process your personal data on our behalf and only have access to the data in order to fulfil their obligations towards us.

In addition to this, we share your personal data with certain categories of receivers in order to fulfil
our obligations towards you in a good and effective way, or to market our membership, our products
and service. Read more about which categories of recipients we share your personal information
with below. If you want more detail information about which we share your information with, you
are welcome to contact us.

 

When you shop online ­

- For the purpose of managing your purchase, we will share your personal data with the payment service supplier we use in order to manage the payment;

­- For payment by invoice (credit), the payment service supplier may run a credit check;

- ­To be able to deliver your items to your home or to a collection point, as well as to be able to manage any returns, we will share your personal data with the carrier that you have selected at the checkout. These carriers process your personal data either as our personal data assistant or as an independent personal data controller.

 

When you are a member of Polarn O. Pyret's loyalty club

- ­In order to market our products and services to you on your digital channels, we
share your information with the digital marketers who provide the marketing
services;

 

Do we share your personal data outside the EU/EES?

Polarn O. Pyret uses IT suppliers who, on our behalf and according to our instructions, process and therefore transfer your personal data outside the EU/EES. We only transfer your personal data outside the EU/EES if we have support for this transfer under the EU’s General Data Protection Regulation (GDPR).

When we transfer your personal data outside the EU/EES, we will make sure that this is done in compliance with the relevant statutory and regulatory requirements for data protection. This means that the transfer can be based on e.g. EU Commission decisions, or standard contract clauses.

If you have any questions about how we share your personal data or if you would like a copy of the appropriate safety precautions that we have taken, you are welcome to contact us.

 

What rights do you have to influence how we process your personal data?

You have certain rights in connection with the processing of your personal data. See below for a more detailed description of your rights. In order to exercise your rights, you are welcome to contact us via the contact details specified in the introduction to this Privacy Policy.

 

Withdrawing your consent

If you have consented to allow us to process your personal data, you have the right at any time to withdraw all or part of the consent that you have given. The withdrawal of your consent, however, will have no effect on our processing of your personal data for the period before the withdrawal occurred.

 

Right of access

You have the right to receive confirmation that personal data relating to you is being processed by us, as well as access to information about how the personal data is processed, e.g. the purposes of the processing and the categories of personal data to which the processing applies. You also have a right to receive a copy of the personal data that is being processed by us. You will receive these details as soon as possible and no later than within one month. Depending on how complicated the request is and the number of requests received, the period can be extended by an additional two months as necessary. If the period is extended, you will be informed of this. You make a request by contacting us via the contact details specified in the introduction to this Privacy Policy.

 

Right to rectification

You also have the right to have inaccurate personal data rectified without unnecessary delay, as well as to have incomplete personal data completed by providing that information. If you have a Polarn O. Pyret membership, you also have the option of changing your personal data by logging in to My Pages.

 

Right to erasure (the right to be forgotten)

In certain circumstances, you have the right to request erasure of your personal data. These circumstances exist if:

- the personal data is no longer necessary for the purpose for which you originally collected or processed it;

- if you withdraw your consent on which the processing is based and there is no other lawful basis for the processing;

- if you object to processing and there is no legitimate reason to continue the processing that overrides your legitimate reason to not continue;

- when personal data has been processed unlawfully; or

- if the personal data must be erased in order to fulfil a legal obligation with which Polarn O. Pyret must comply.

Polarn O. Pyret erases your personal data on your request, on condition that Polarn O. Pyret is under no legal obligation to store the personal data to comply with relevant statutory and regulatory requirements.

If you are a member of our customer club, we will erase your personal data without your request if you have not made a club purchase for 24 months.

 

Right to restrict processing

In certain circumstances, you have the right to request that the processing of your personal data be restricted. These circumstances exist if:

- you contest the accuracy of the data (but only during a period that gives us a chance to verify the data);

- if the processing is unlawful and you oppose erasure and request a restriction on the use of the data instead;

- you need the personal data in order to exercise or defend a legal claim, despite the fact that we no longer need the personal data for our processing purposes; or

- if you have objected to our processing and we have not yet verified whether our legitimate interest in processing your personal data overrides your legitimate reason for restricting the processing of your personal data.

 

Right to object to processing

You have the right to object to the processing of your personal data at any time, based on a balance of interests. But this will not apply if we can show compelling legitimate reasons for processing that override your interests, rights and freedoms, or if processing is carried out in order to establish, exercise or defend legal claims.

You also have the right to object to processing of your personal data for marketing purposes and profiling. This means that you have the right to say no to newsletters and other marketing from us. If you object to marketing, your personal data will no longer be processed for such purposes.

 

Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority (without prejudice to any other administrative or judicial remedy). A complaint of this kind is best made to the supervisory authority in the EU/EES Member State where you have your habitual residence, where you work or where the infringement of the relevant statutory and regulatory requirements for data protection is alleged to have occurred. The supervisory authority in Sweden is the Swedish Data Protection Authority.

 

Right to data portability

In certain circumstances, you have the right to receive the personal data that you have provided to us in a structured, commonly used and machine readable format; you also have the right to transfer these to another personal data controller (data portability). The right to data portability exists when:

- processing is based on your consent or on a contract; and

- the processing is carried out by automated means.

You have the right to transfer personal data directly from us to another personal data controller when this is technically possible.

 

How do we balance interests when the lawful basis is our legitimate interest?

For certain purposes, Polarn O. Pyret processes your personal data based on a balance of interests as lawful basis for processing. In this balancing of interests, we have assessed that our legitimate interest in carrying out the processing overrides your interests and your basic rights to not have your personal data processed. What counts as our legitimate interest is shown in the tables above. If you would like to find out more about how we have made this assessment, you are welcome to contact us. You will find our contact details in the introduction to this Privacy Policy.

-------------------------------------------------------------------------------------------------

This Privacy Policy was uppdated by Polarn O. Pyret AB on December 4th 2020.

Polarn O. Pyret is committed to detect and prevent all kinds of irregularities that may seriously harm our business or employees. It is therefore important that such information is noted and investigated as early as possible. We have therefore implemented an internal whistleblower function as a complement to our normal internal reporting routines to allow for an anonymous reporting channel of suspected irregularities.

This information may be reviewed and amended by Polarn O. Pyret at any time.

What the whistleblower function is

Through the whistleblower function, reporting persons (e.g. employees) can report suspicious misconduct that has taken place in a work-related context and constitutes information that is of public interest that it is brought forward and acted upon or when the misconduct constitutes a violation of certain EU-law.

The whistleblower function is administered by PwC and PwC’s whistleblowing team is the first recipient of all the reports.

When to use the whistleblowing function

The function can be used if you suspect incidences of fraudulent conduct, corruption or other suspected malpractices. This can include incidents such as bribery, fraud, theft or other situations where someone gets a private gain or benefit because of his or her position or that a related party benefits in some way. Criminal violations, more serious misconduct and deviations from internal rules and guidelines that fall within the area of ​​irregularity must also be reported.

It should be noted that the whistleblower function is a complement to our normal internal reporting routines and not a substitute. Employees can always choose to report matters internally to managers or other superiors.

When not to use the whistleblowing function

The function is not suitable for reporting complaints and general views on leadership, work environment, business planning etc. It is also not suitable for reporting certain HR issues linked to individuals. If you feel uncomfortable or for other reasons do not want to talk to your manager or other superiors, you can turn directly to your HR function or any union representative.

Who can report?

You can report and receive protection if you in a work-related context have learned of or obtained information about misconduct, and are a reporting person, i.e., an employee, job seeker, volunteer, trainee, those hired by temporary work agencies or otherwise performing work under Polarn O. Pyret’s control and management, self-employed employee, part of Polarn O. Pyrets’s administrative, management or supervisory body, or an active shareholder in Polarn O. Pyret. The fact that you have ended your work-related relationship with Polarn O. Pyret, or that it has not yet begun, is not an obstacle to reporting misconduct under this policy.

How to file a report

It is important to make sure the information contained in the report you submit is as concrete as possible so that it can be processed and investigated in the appropriate manner.

A report can be submitted in writing via a web-based reporting system through a template that guides the reporting person using several questions with the purpose to clarify and specify the reported information. A report can also be submitted verbally in the web-based reporting system through a voice recording functionality. The reporting person can also book a physical meeting with PwC’s team through the web-based reporting system.

The reporting person can choose whether to disclose its identity or remain anonymous, and to report in local language. 

All reporting is made through this link: https://whistleblowersoftware.com/secure/966e4017-cb3d-4d8c-bceb-abd1bf6597ab

Please do not include sensitive personal information (or any personal data irrelevant for the case) about people mentioned in your report if it is not necessary to describe your case. Sensitive personal data is information about; ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, a person's sex life or sexual orientation, genetic data, and biometric data used to uniquely identify a person.

PwC will retain written reports and documentation of oral whistleblowing reporting as long as necessary, but no longer than two years after the follow-up case has been closed.

How reports are managed

Polarn O. Pyret has appointed designated persons (“Case Handlers”) to manage incoming reports in the internal whistleblowing function.

When a report has been received in the whistleblower function PwC’s whistleblowing team receives it and conducts an initial assessment. The report is then forwarded to Polarn O. Pyret’s Case Handlers who then decide how the case should be managed, for instance if it should be dismissed, if an internal investigation should be initiated or if there is a need for an investigation to be conducted by an external party.

Through the web-based system, PwC’s Whistleblowing team the Case Handlers communicate with the reporting person and provide confirmation in the system within seven days that the report has been received. Further feedback regarding the reported case, for instance if it is dismissed due to it not constituting a whistleblowing report or measures that have been taken such as the initiation of an investigation, will also be communicated to the reporting person through the web-based system within three months. The confirmation will be provided regardless of whether the reporting person has reported via the web form, by voice recording or at a physical meeting. 
A reporting person can follow-up a previously reported case via a unique login credential which is provided to the reported person in the whistleblower function when a case is reported. The login credentials enable the reporting person to communicate in the internal whistleblower function with PwC’s whistleblowing team and Polarn O. Pyret’s Case Handlers.

Upon receiving a report of concern, Polarn O. Pyret is responsible for conducting a thorough investigation within a reasonable timeframe. The company must also ensure that the whistleblower is protected and maintains a satisfactory work environment, taking necessary actions to prevent any form of retaliation.

Information reported through the whistleblower function is treated confidentially and in a manner which ensures a secure and effective case for those who chose to use the whistleblower function as well as individuals and third parties that may be regarded by whistleblower reports. To the extent permitted by law, and in keeping with the need to conduct a competent internal investigation, we will make every effort to maintain the confidentiality of the person reporting a whistleblowing concern. Similarly, the identity of the subject(s) of the investigation will be maintained in confidence with the same limitations.

External reporting channels

Irregularities can also be reported externally to supervisory or other public authorities.

An external reporting channel is a channel established by an authority for managing reporting on violations that are within the authority's area of responsibility, and which may include misconduct by any public or private entity. If you choose to report externally, you will receive the same level of protection as if you report internally. However, any follow up measures with regards to your report will in case of external reporting primarily be performed by the competent authority and not by Polarn O. Pyret or its appointed recipient.

You are always free to externally report potential violations of laws or regulations to the appropriate authorities. We then refer you to contact the relevant competent authority. An external reporting channel can, for example, be used if the reporting person does not believe that reporting to the internal whistleblowing function would be managed appropriately.

Sweden
On the following link, on the homepage of Swedish Work Environment Authority, you can find a list of external authorities for reporting certain types of whistleblowing concerns in Sweden: https://www.av.se/om-oss/visselblasarlagen/extern-rapporteringskanal/lista-over-myndigheter-med-ansvar-enligt-ansvarsomrade-enligt-forordning-2021949/

Finland
The following link on the homepage of the Finnish Chancellor of Justice introduces the process for external reporting in Finland and provides further guidance on how the reporting can be made. You can find the reporting page here: https://oikeuskansleri.fi/ilmoittajansuojelu

Norway
On the following link, on the homepage of the The Norwegian Labour Inspection Authority, you can find a list of external authorities for reporting concerns in Norway: https://www.arbeidstilsynet.no/tema/varsling/Slik-kan-du-varsle-om-kritikkverdige-forhold/

Protection against retaliation

Retaliation against any employee who reports issues of concern is strictly prohibited. This includes any negative actions, such as threats, harassment, discrimination, or adverse changes in employment conditions, taken as a result of the employee's decision to report. It is also prohibited to prevent the filing of the report.

If an employee presents information suggesting retaliation, the burden of proof lies with the employer to demonstrate that no such retaliation has occurred.

In Norway, employees are entitled to seek redress and compensation in the event of retaliation. Disputes concerning retaliation may be brought before the Norwegian Anti-Discrimination Tribunal (Nw; Likestillings- og diskrimineringnemnda), with the exception of dismissal cases.

Freedom of communication and freedom of procurement

In Sweden, the rights a person has under the Freedom of the Press Act (Sw. Tryckfrihetsförordningen) and the Fundamental Law on Freedom of Expression (Sw. Yttrandefrihetsgrundlagen) with regards to freedom of communication and freedom of procurement, are not limited by the Swedish Whistleblower law or this policy.

In Norway, an employee's right to freedom of expression, including the ability to voice criticisms internally within a company, is protected under Norwegian legislation. This encompasses raising issues through established whistleblowing procedures or other appropriate channels, reflecting the company's organizational structure. Such actions are underpinned by the fundamental principles of freedom of expression.

In cases where there are claims of restrictions on an individual's freedom of expression, the burden of proof lies with the party asserting such limitations. Additionally, employers are tasked with the responsibility of proving that any whistleblowing was not in accordance with these provisions.