Romanihouse
Romanihouse
Last updated: October 13, 2026
Your privacy matters to us. In this privacy policy we describe how Romanihouse processes personal data when you visit our website, send an enquiry or shop in our webshop. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and other applicable data protection legislation.
The controller responsible for the processing of your personal data is Romanihouse. Contact details for data protection matters: Email: info@romanihouse.com If you have questions about how we process your personal data, please contact us at the email above.
Which data we process depends on how you use the website. For purchases: first and last name, email address, phone number, delivery and billing address (street, postal code, city, country), order information (products, order number, payment status, delivery information) and communication about the order. We do not store full card details, as payment is handled by Stripe. For customer accounts: name, email address, phone number, order history and account settings. Passwords are stored only in hashed form, never in plain text. For enquiries via the form: name, company/organisation (if you provide it), email address, phone number, preferred date, location, chosen service and the content of your message. Please do not submit sensitive personal data in the form unless we expressly ask for it. For other contact: data you provide yourself, for example via email or forms. Technical data: IP address, browser type, device type and technical logs needed for operation and security. Cart and login state are stored locally in your browser. We use no analytics or marketing cookies.
To handle orders: receiving and administering orders, delivering products, handling payments, sending order confirmations and managing returns and complaints. The legal basis is normally performance of a contract. To meet legal obligations: for example accounting and tax rules. The legal basis is legal obligation. For customer service and enquiries: answering questions, handling enquiries, providing quotes and communicating with customers. The legal basis is contract, pre-contractual measures or legitimate interests depending on the situation. The enquiry form additionally asks for your consent before sending. To protect the website: detecting security threats, fraud and misuse and maintaining operations. The legal basis is legitimate interests.
We process personal data on one or more of the GDPR legal bases: performance of a contract, pre-contractual measures, legal obligation, legitimate interests and consent. Which basis applies depends on the purpose of the processing and the circumstances of the individual case.
Payments are handled by our payment provider Stripe. When you pay, Stripe processes the data required to execute and verify the payment. We normally receive only information about payment status, payment reference, amount and currency. We do not store full card numbers or security codes on our own servers. Stripe's own processing is governed by Stripe's terms and privacy policy.
To fulfil our commitments we may need to share relevant data with, for example, carriers, payment providers, email providers and hosting and operations providers. We disclose only the data needed for the purpose in question.
External suppliers that process personal data on our behalf (such as hosting, database operations, email and payments) are engaged as data processors, and the processing is governed by data processing agreements under the GDPR.
Certain technical suppliers (such as payment or hosting providers) may process personal data in countries outside the EU/EEA. Such transfers take place only with a valid legal basis and appropriate safeguards under the GDPR. Contact us if you want to know more about current suppliers and transfer mechanisms.
We keep personal data only as long as necessary for the purpose or as long as the law requires. Order and accounting information is kept under bookkeeping legislation (normally seven years). Account data is kept while the customer account is active and is deleted or anonymised thereafter unless longer retention is required by law. Enquiries and contact messages are kept as long as needed to handle the matter and meet legal requirements. Technical logs are kept for the period required for security, troubleshooting and operations.
Under the GDPR you have, depending on the circumstances, the right to request access to your personal data, rectification of inaccurate data, erasure, restriction of processing, to object to certain processing, data portability, and to withdraw consent where processing is based on consent. The rights are not absolute and exceptions may apply by law. Contact us at info@romanihouse.com to exercise your rights.
Where processing is based on your consent you may withdraw it at any time, for example by contacting us. A withdrawn consent does not affect the lawfulness of processing carried out before the withdrawal.
We currently send no newsletters or marketing messages. Should that change, marketing takes place in accordance with applicable rules and you may always object to direct marketing, for example via an unsubscribe link or by contacting us.
We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, alteration and unauthorised disclosure, including encrypted communication (HTTPS/TLS), access controls and permission management, hashed passwords, security logging, backups and restricted administrative access. No internet-based service can however be guaranteed entirely risk-free.
The website is not specifically aimed at children and we do not knowingly collect personal data from children in breach of the law. If you suspect a child has provided us with data that should not have been provided, please contact us.
We do not use personal data for automated decision-making with legal or similarly significant consequences for you.
We may update this policy when our services, technical systems or legal requirements change. The latest version is published on the website and the date of the latest update is shown at the top of the page.
If you have questions or are dissatisfied with how we process your personal data, please first contact us at info@romanihouse.com. You also have the right to lodge a complaint with the supervisory authority, the Swedish Authority for Privacy Protection (IMY, imy.se).
For questions about personal data and privacy: Romanihouse info@romanihouse.com