Privacy Policy
Last updated: 06 October 2026
Data Controller
Nelumbo Labs AB (corporation number 559456-0889), Ryttmästaregatan 3, 415 05 Gothenburg.
Contact: orders@gourmetmushrooms.se
What data we process and why
| Purpose | Information | Legal basis (GDPR) | How long |
|---|---|---|---|
| Order requests with pickup (form) | Name, email, phone (optional), type, quantity, pick-up date, message | Agreement, art. 6.1 b | 24 months after last download |
| Corporate orders in the online store | Name, company, corporate ID number, address, email, phone, order history | Agreement, art. 6.1 b | 24 months after last order |
| Accounting (invoices and payments) | Name, amount, date, payment method | Legal obligation, Art. 6.1 c | 7 years according to the Accounting Act (1999:1078) Chapter 7, Section 2 |
| Waiting list "Notify me"” | Email, type, approximate amount and frequency | Consent, Article 6(1)(a) | Deleted 90 days after the message, at the latest after 12 months |
| Newsletter | Consent, Article 6(1)(a) | Until you unsubscribe | |
| Customer service and complaints | What you write to us | Legitimate interest, Art. 6.1 f | 12 months after case closure |
You can view, revoke or cancel your request via a personal link in our emails. We do not use your data for marketing purposes without your consent and we never sell it.
Receiver
We only share data with suppliers who are needed for the service and who have a personal data processing agreement with us:
- Web hosting and email: Strato (strato.se)
- Card payment: Länsförsäkringar Bank
- Accounting: Ceylon Service Center (CSC), Stockholm
Swish payments are handled by your and our bank. We do not transfer personal data to countries outside the EU/EEA.
Your rights
You have the right to:
- request access to your data,
- have incorrect information corrected,
- have your data deleted,
- request restriction of processing,
- receive your data in a machine-readable format (data portability),
- object to processing based on legitimate interest,
- withdraw consent at any time.
Contact us at orders@gourmetmushrooms.se. If you are dissatisfied with how we process your data, you can file a complaint with the Swedish Data Protection Authority (IMY), www.imy.se.
Cookies
Read more in our cookie policy.
Payment with Swish
When you pay with Swish, we receive your name, your mobile number (partially masked), the amount and the message you write in the payment.
Purpose: to link the payment to your order, to make any refunds and to fulfill our accounting obligations.
Legal basis: performance of contract (Article 6.1 b GDPR) and legal obligation under the Accounting Act (Article 6.1 c GDPR).
Storage period: information included in our accounting is saved for seven years after the end of the calendar year in which the financial year ended, according to the Accounting Act (1999:1078).
Recipient: the payment is mediated by Länsförsäkringar Bank and Getswish AB, which are independent data controllers for their own processing.
We never use data from Swish for marketing and do not disclose it to others, except when required by law.
