Privacy policy

This policy covers the shop at shop.marciasini.com: what happens to your information when you buy, register interest in a piece or write to us. For marciasini.com and Le Registre, the hotel's register, the policy at marciasini.com/privacy applies, also when you check in from the shop.

Who is responsible

Marciasini Studios AB, org. no. 559600-1577, is the controller of the personal data processed in the shop. The address is c/o Poyan Katebi, Parallellvägen 12, 132 43 Saltsjö-Boo, Sweden. Write to bonjour@marciasini.com or call +46 73 534 51 87.

What we collect and why

When you buy we receive your name, your delivery address and your e-mail address, your phone number if you give it, what you buy, how you pay and the IP address of the device you order from. We use the information to receive the order, deliver it, send the order confirmation and handle withdrawals, returns and complaints. The legal basis is the contract with you, Article 6(1)(b) of the General Data Protection Regulation (GDPR). We need your name, your address and your e-mail address to be able to receive an order: without them we cannot sell to you. The phone number is optional.

Every order is checked for fraud by Shopify on our behalf, for example by comparing the location of the IP address with the delivery address. The legal basis is our legitimate interest in not being exposed to fraud, Article 6(1)(f).

When you pay the card details go to Shopify Payments, the shop's payment service, and we never see the full card number. If you choose Klarna, Klarna Bank AB (publ) is itself responsible for its handling of your information, as described in Klarna's privacy notice at klarna.com. If you pay with Shop Pay, Apple Pay or Google Pay, that service handles your information under its own terms.

When you log in with your e-mail address, Shopify keeps an account for you with your orders and addresses. The legal basis is the contract with you, Article 6(1)(b). If you choose to save your details with Shop for a faster checkout, Shopify handles this under Shop's own terms and privacy policy.

If you tick the box for Le Courrier at checkout, we check you in to Le Courrier, the letters from the house, and keep your e-mail address with that choice. Your address and a room number calculated from it go to Resend, which sends the letters and records when a letter is opened or a link in it is clicked; the policy at marciasini.com/privacy applies to the letters. We may also write to you once about a checkout you did not finish. Every e-mail has a link to unsubscribe, and unsubscribing from the shop's e-mails also checks you out of Le Courrier. The legal basis is your consent, Article 6(1)(a).

When you register interest in a piece that is not yet in the shop, we keep your e-mail address, the piece, the colour or size you wrote, the time and a room number calculated from your e-mail address, as on marciasini.com. We write to you once, when the piece arrives. If you also tick Le Courrier, you check in to the register, and marciasini.com/privacy applies to that. The legal basis is your consent, Article 6(1)(a).

When you withdraw from a purchase with the form Withdraw from a purchase, we receive your name, your order number, your e-mail address and which items you are sending back, and we send a receipt with the time we received the withdrawal, as Chapter 2, Section 10 a of the Swedish Distance and Off-Premises Contracts Act (2005:59) requires. The legal basis is a legal obligation, Article 6(1)(c).

When you write to us or make a complaint we keep what you write and your order number so that we can answer you and resolve the matter. The legal basis is the contract with you, Article 6(1)(b), and otherwise our legitimate interest in answering you, Article 6(1)(f).

If a product has been dangerous and you tell us, we record it in our register of product safety complaints, with only the information needed to investigate the matter, as Articles 9(12) and 9(13) of the EU General Product Safety Regulation (EU) 2023/988 require. If a product we have sold you is recalled, we use your order details to notify you directly (Article 35(1)). The legal basis is these legal obligations, Article 6(1)(c).

Accounting. Orders, receipts and refunds are accounting records, which the Swedish Accounting Act (1999:1078) requires us to keep. The legal basis is a legal obligation, Article 6(1)(c).

Cookies. The cookies the shop needs to work, for example for the cart and the checkout, are always set. The law allows this without consent when it is necessary for a service you have expressly requested (Chapter 9, Section 28 of the Swedish Electronic Communications Act (2022:482)). Cookies for statistics and marketing are set only if you say yes in the cookie banner, and you can change your choice at any time under Cookie settings at the foot of every page. All cookies are listed on the Cookies page.

Meta (Facebook and Instagram) receives information about your visit and what you buy only if you say yes to marketing cookies.

We never sell your information.

Who receives the information

These services handle your information on our behalf and according to our instructions:

• Shopify runs the shop, the checkout, the order e-mails and the customer accounts. The shop is hosted by Shopify, which processes your information when you visit the shop and buy. Shopify's own privacy policy is at shopify.com/legal/privacy/consumers, and at privacy.shopify.com you can exercise your rights towards Shopify.
• PostNord receives your name and address, and your phone number or e-mail address if you have given them, to deliver the parcel and tell you where it is.
• Google provides our e-mail at bonjour@marciasini.com and stores the withdrawals and registrations of interest we receive.
• Resend sends the receipt for a withdrawal, the e-mail about a piece you are waiting for and, if you tick the box for Le Courrier at checkout, the letters from the house. It stores the list of registrations of interest and of guests. The e-mails are sent via Ireland.
• Vercel runs the forms for withdrawal and registration of interest and keeps ordinary server logs.
• Fortnox is used for the accounting.
• Gelato prints and sends our posters. On an order with a poster, Gelato receives your name, delivery address, e-mail address and phone number if you have given it, and the carrier that delivers the poster receives your name and address.

Klarna, and Shopify for Shop and Shop Pay, are themselves responsible for their handling of your information, as described above.

Transfers outside the EU

Shopify may process your information in countries where Shopify, its companies or its suppliers are located, including Canada and Singapore. Transfers from the EU to other Shopify companies follow Shopify's binding corporate rules, and transfers to countries without an EU adequacy decision are made under the European Commission's standard contractual clauses, Commission Implementing Decision (EU) 2021/914.

Google, Resend and Vercel are established in the United States. Transfers there are covered by the European Commission's adequacy decision for the EU-US Data Privacy Framework, Commission Implementing Decision (EU) 2023/1795 of 10 July 2023, and by standard contractual clauses where the decision does not apply.

Write to us if you would like a copy of the safeguards.

How long we keep the information

• Orders and accounting records: until the end of the seventh year after the end of the calendar year in which the financial year ended, as Chapter 7, Section 2 of the Swedish Accounting Act requires.
• Customer service, withdrawals and complaints: 24 months after the matter is closed.
• Product safety complaints: as long as needed to investigate them, and never longer than five years after they were registered.
• Your account: until you ask us to close it. The orders in the account are kept as accounting records.
• Registrations of interest: until we have written to you about the piece.
• News and offers: until you unsubscribe.
• Cookies: as listed on the Cookies page.

Your rights

Under the GDPR you have the right to a copy of the personal data we hold about you (Article 15), to have it corrected (Article 16), to have it erased (Article 17), to have our processing of it restricted (Article 18), to receive it in a machine-readable format (Article 20) and to object to processing based on our legitimate interest (Article 21). What the law requires us to keep, for example the accounting records, we keep even if you ask us to erase it (Article 17(3)(b)).

Where the processing is based on your consent, you can withdraw your consent at any time (Article 7(3)). This does not affect what we did before you withdrew it.

Write to bonjour@marciasini.com and we will answer.

If you think we have handled your information wrongly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), imy.se (Article 77).

Changes

If the policy changes, we update this page and the date below.

Last updated 1 November 2026.