1. Who we are
The data controller is Scoutshelfstorypuls Fika Studio AB, a Swedish limited company with company number 559312-4871 and registered address at Götgatan 42, 118 26 Stockholm, Sweden. We operate the café at that address and the website at scoutshelfstorypuls.motorcycles. You can reach us at [email protected].
2. Data we collect
- Contact form. Your name, email address, chosen topic, optional preferred date and the content of your message.
- Bookings and workshops. Name, email, phone number, party size, date, dietary requirements you choose to tell us, and payment confirmation references. Card details are entered directly with our payment processor and never reach our systems.
- Gift cards and pre-orders. Purchaser and recipient names, delivery address where posting is requested, and order contents.
- Website usage. With your consent, aggregated analytics data such as pages viewed, approximate location at city level, device type and referring site. Without consent we collect only server logs containing a truncated IP address, timestamp and requested page, kept for security.
- In the studio. Card payments are processed by our terminal provider; we do not see card numbers. We do not operate CCTV.
3. How we use it and on what legal basis
- To respond to enquiries and manage bookings, on the basis of performance of a contract or steps taken at your request before a contract (GDPR Article 6(1)(b)).
- To keep accounting records of sales, on the basis of our legal obligation under the Swedish Bookkeeping Act (Article 6(1)(c)).
- To secure the website and prevent abuse, on the basis of our legitimate interest in running a safe service (Article 6(1)(f)).
- To measure how the guides are read and to remember your preferences, on the basis of your consent given through the cookie banner (Article 6(1)(a)), which you may withdraw at any time.
We do not sell personal data, and we do not use it for automated decision-making or profiling.
4. Cookies
We use essential cookies and local storage to run the site and remember your cookie choice, and, only with consent, analytics and functional cookies. A full list with names, purposes and lifetimes is in our Cookie Policy, which also explains how to change your choice or block cookies in your browser.
5. Third-party processors
We share data only with service providers who process it on our instructions under written data processing agreements.
| Provider | Purpose | Location |
|---|---|---|
| EU-based web host | Serving this website and storing server logs | Sweden / Finland |
| Stripe Payments Europe Ltd | Processing workshop and gift card payments | Ireland, with US sub-processors |
| Google Ireland Ltd (Google Analytics 4) | Website analytics, only if you consent | Ireland, with US sub-processors |
| Email service provider | Sending booking confirmations and replies | European Union |
| Accounting firm | Statutory bookkeeping and VAT returns | Sweden |
6. International transfers
Where a processor transfers data outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses or on an adequacy decision such as the EU–US Data Privacy Framework. Copies of the relevant safeguards are available on request from our data protection officer.
7. Retention
- Contact form enquiries: 12 months from the last correspondence, then deleted.
- Booking and workshop records: 24 months for operational purposes; the financial record is kept for 7 years as required by Swedish law.
- Gift card records: until redemption plus 12 months, or 7 years for the financial entry.
- Analytics data: 14 months, the shortest retention period the analytics tool allows.
- Server logs: 30 days.
8. Your rights
Under the GDPR you have the right to access the personal data we hold about you, to have inaccurate data rectified, to have data erased where there is no longer a legal reason to keep it, to restrict processing, to receive your data in a portable format, to object to processing based on legitimate interest, and to withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
If you are a California resident, the CCPA gives you the right to know what personal information we collect and how it is used, to request deletion, to opt out of the sale or sharing of personal information (we do not sell or share it in the CCPA sense), and not to be discriminated against for exercising these rights.
To exercise any right, email our data protection officer. We respond within one month and may ask you to confirm your identity first. There is no charge unless a request is manifestly unfounded or excessive.
9. Data protection officer
Our data protection officer can be reached at [email protected] or by post to Data Protection Officer, Scoutshelfstorypuls Fika Studio AB, Götgatan 42, 118 26 Stockholm, Sweden.
10. Complaints
If you believe we have handled your data unlawfully you may complain to the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm, or to the supervisory authority in the EU country where you live or work. We would appreciate the chance to resolve the matter first.
11. Changes to this policy
We review this policy at least once a year and whenever we change a processor or introduce a new way of collecting data. Material changes will be flagged on the home page for 30 days. The date at the top tells you when it was last revised.