Privacy policy

PRIVACY POLICY

Last updated: 2026-10-06

This privacy policy describes how Swopti AB ("we", "us") collects, uses and shares your personal data when you visit, use or make a purchase on swopti.co or otherwise communicate with us.

Swopti AB, company registration number 559484-4713, is the data controller for the processing of personal data carried out within the scope of our services. We value your privacy and want you as a customer to feel secure about how we handle your data.

WHAT DATA WE COLLECT

You may directly or indirectly provide us with information about yourself in several ways, for example when you place an order, contact our customer service, register an account or sign up for our newsletter. This may include:

Contact details: name, address, billing address, shipping address, email address, phone number.

Data from external address sources: for addressed direct marketing, we may obtain names and postal addresses from external address registers and address providers. The address source is stated in connection with the mailing.

Prescription and lens data: sphere, cylinder, axis, addition (ADD), pupillary distance (PD), fitting height and other optical information required to manufacture your lenses. This data is classified as health data under the GDPR and is processed with particular care.

Information about goods and services: products ordered, quantities and amounts.

Payment method and status: payment information and transaction status. We do not store your actual card details; these are handled by our payment provider.

Account information: username, password, order history and preferences if you register an account.

Communication with us: information you provide when contacting our customer service, as well as correspondence by email, chat or other channels.

Technical information: IP address, device type, browser, language settings and other information about how you use our website.

HOW WE PROCESS YOUR PERSONAL DATA

We process your personal data for the following purposes. For each purpose, we describe the data processed, the legal basis we rely on and how long the data is retained.

Orders and purchases

Purpose: to receive, process and deliver your order.

Processing activities: confirming your identity, processing payment, forwarding order information to our lens laboratory for lens production, coordinating delivery, handling complaints and warranty matters.

Personal data: name, contact details, shipping address, billing address, payment method, information about goods and services.

Legal basis: performance of a contract (Article 6.1.b GDPR).

Retention period: up to 7 years in accordance with Swedish accounting legislation.

Prescription and vision data

Purpose: to manufacture lenses according to your individual prescription.

Processing activities: storing prescription data linked to your order and transferring it to our lens laboratory, which requires the data to manufacture the correct lenses.

Personal data: sphere, cylinder, axis, addition, pupillary distance, fitting height and other optical parameters.

Legal basis: your explicit consent (Article 9.2.a GDPR). Prescription data is classified as health data and is processed only with your consent. You provide this consent when placing an order.

Retention period: up to 7 years, linked to your order and in accordance with Swedish accounting legislation.

You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal and may mean that we are unable to complete ongoing or future orders.

Customer service

Purpose: to handle questions, complaints and other communications with you.

Processing activities: communication by email, chat or other channels, investigation of complaints and identification in connection with enquiries.

Personal data: name, contact details, correspondence and case-related information.

Legal basis: legitimate interest (Article 6.1.f GDPR). The processing is necessary to satisfy our and your interest in handling customer service matters.

Retention period: up to 2 years after the most recent contact.

Marketing and newsletters

Purpose: to send relevant information and offers about our products and services.

Processing activities: sending newsletters by email or SMS, measuring open rates and clicks to adapt the content, personalisation based on purchase history.

Personal data: name, email address, possibly phone number, purchase history, click and visit history.

Legal basis: consent (Article 6.1.a GDPR) for those who have signed up to our newsletter, or legitimate interest (Article 6.1.f GDPR) for those who have made a purchase with us.

Retention period: until you unsubscribe. You can unsubscribe at any time via the link in each communication or by contacting us.

Customer analysis and addressed direct marketing

Purpose: to better understand which target groups are relevant to our services and to carry out addressed marketing by post.

Processing activities: we may analyse the names and postal addresses of existing customers to create an overall customer profile and identify relevant target groups. The analysis may be used to select recipients of addressed direct mail. We may also obtain names and postal addresses of potential customers from external address providers. Existing customers included in the customer file used for the analysis are excluded from the mailing selection.

Personal data: name and postal address. Prescription data, vision strength or other health data is not used for this analysis.

Legal basis: legitimate interest (Article 6.1.f GDPR). Our legitimate interest is to understand our target audience and market our services to people who may be interested in them.

Retention period: data provided to our supplier for the customer analysis is deleted or anonymised no later than 30 days after the assignment or campaign has ended. Data that we already hold in our own customer records may be retained for other periods stated in this policy.

You have the right to object at any time to the processing of your personal data for direct marketing. If you object, we will no longer use your personal data for such marketing.

Improvement of our services

Purpose: to evaluate, develop and improve our products, services and website.

Processing activities: analysis of user behaviour, customer surveys and preparation of aggregated statistics.

Personal data: purchase history, click and visit history, technical information about device and browser.

Legal basis: legitimate interest (Article 6.1.f GDPR).

Retention period: up to 3 years.

Security and fraud prevention

Purpose: to protect our services and customers against fraud and misuse.

Processing activities: monitoring suspicious activity, investigating potential fraud and ensuring IT security.

Personal data: IP address, click and visit history, technical device information.

Legal basis: legitimate interest (Article 6.1.f GDPR), or legal obligation (Article 6.1.c GDPR) where applicable.

Retention period: up to 36 months.

Legal obligations

Purpose: to comply with legal obligations, for example relating to accounting, taxation and product liability.

Processing activities: storing transaction data, handling authority requests and documenting product liability matters.

Personal data: name, contact details, transaction data and order history.

Legal basis: legal obligation (Article 6.1.c GDPR).

Retention period: up to 7 years in accordance with Swedish accounting legislation, or longer where other legislation requires it.

WHO WE SHARE YOUR PERSONAL DATA WITH

To operate our service, we share personal data with a number of suppliers and partners. All are bound by agreements governing how the data may be processed, and we only share the data necessary for each respective purpose.

To fulfil your order

Our lens laboratory. Prescription data and necessary order information are shared with the laboratory that manufactures and fits your lenses. The laboratory acts as a data processor on our behalf and is bound by a signed data processing agreement governing how the data may be processed. Geographic location: EU/EEA.

Our third-party warehouse. To handle distribution of return kits, which you use to send your frame to us, we share necessary contact and delivery details with our logistics provider. The logistics provider acts as a data processor on our behalf and is bound by a data processing agreement. Geographic location: EU/EEA.

LensAdvisor (LensAdvisor Pte Ltd). To handle and store your prescription data in connection with your order, and to forward order information to our lens laboratory, we use a specialised app. LensAdvisor acts as a data processor on our behalf and is bound by a data processing agreement. Geographic location: Singapore, with data storage in the USA through Amazon Web Services and Salesforce (Heroku). Transfers are carried out using the European Commission's Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework where applicable.

Google LLC. When you upload a photo of your prescription, Google services are used by our order partner to automatically read the information in the image. Sub-processor to LensAdvisor. Geographic location: USA, with support from the EU-US Data Privacy Framework and Standard Contractual Clauses.

SendGrid (Twilio Inc.). Used by LensAdvisor to send order information to our lens laboratory by email. Sub-processor to LensAdvisor. Geographic location: USA, with support from Standard Contractual Clauses.

Shopify (Shopify International Ltd). Our e-commerce platform processes orders and technical aspects of the website on our behalf. It also sends order confirmations and shipping confirmations to you. Data processor. Geographic location: EU/EEA and USA, with applicable safeguards under the GDPR.

Shopify Payments. Payment transaction data is processed by Shopify Payments. Independent data controller for its own processing. Geographic location: EU/EEA and USA, with applicable safeguards under the GDPR.

PostNord. For delivery of return kits to you and return delivery of your glasses, we share necessary delivery information. Independent data controller for its own processing. Geographic location: EU/EEA.

Sendif (LensAdvisor Pte Ltd). Sends certain reminders and status messages during the order process, for example reminders to upload a prescription or mark fitting height. Operated by the same data processor as LensAdvisor and covered by the same data processing agreement. Geographic location: Singapore, with data storage in the USA. Transfers are carried out using the European Commission's Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework where applicable.

For accounting and finance

Numerra. To handle invoicing and accounting, order-related data is shared with our accounting partner. Data processor. Geographic location: EU/EEA.

For customer service and communication

Gorgias. Our customer service system handles communication with you via email, chat and other channels. Data processor. Geographic location: EU/EEA and USA, with applicable safeguards under the GDPR.

Klaviyo. Our platform for email marketing and newsletters. Data processor. Geographic location: EU/EEA and USA, with applicable safeguards under the GDPR.

For reviews and customer content

Judge.me. Handles publication of customer reviews. Data processor. Geographic location: USA, with applicable safeguards under the GDPR.

Cevoid. Handles customer-generated content such as images and reviews displayed on our website. Data processor. Geographic location: EU/EEA and USA, with applicable safeguards under the GDPR.

For affiliate programmes

Addrevenue. To handle tracking of affiliate conversions, certain order data is shared. Independent data controller for its own processing. Geographic location: EU/EEA.

For marketing and analytics

Optimal Kommunikation (Astice AB). We use Optimal Kommunikation for customer analysis, target group selection, addressing, printing and distribution of addressed direct mail. For analysis of our existing customer base, we share only names and postal addresses. Optimal Kommunikation acts as a data processor when processing our existing customer file and is covered by a data processing agreement for this processing. The customer file is not shared with the external address provider used to identify recipients for the mailing.

IDM Adress (Idédata Marketing AB). Address data for recipients of addressed direct mail may be obtained from IDM Adress. IDM does not receive access to our existing customer file.

The following tools are used only after you have given your consent through our cookie banner. You may change your settings at any time.

Meta (Facebook/Instagram). Platform for retargeting and conversion measurement on social media. Independent data controller for its own processing. Geographic location: USA, with Standard Contractual Clauses.

Google Analytics and Google Ads. Tools for web analytics and advertising. Independent data controller for their own processing. Geographic location: USA, with Standard Contractual Clauses.

Contentsquare. Tool for analysing visitor behaviour on our website. Data processor. Geographic location: EU/EEA and USA, with applicable safeguards under the GDPR.

TripleWhale and BeProfit. Tools for analysing order and sales data. Data processors. Geographic location: USA, with Standard Contractual Clauses.

For cookie management

Consentik. Manages your consent settings for cookies and tracking. Data processor. Geographic location: EU/EEA.

For data synchronisation

Zapier. We use Zapier to synchronise data between our e-commerce system and external tools. Data processor. Geographic location: USA, with applicable safeguards under the GDPR.

Authorities. Where required by law or pursuant to a valid request, we may disclose information to authorities such as the Swedish Tax Agency, the Police and similar authorities.

WHAT WE DO NOT DO WITH YOUR DATA

We never sell your personal data to third parties.

WHERE WE STORE YOUR PERSONAL DATA

We always aim to process your data within the EU/EEA. In some cases, data may be processed outside the EU/EEA by our suppliers, as specified above. Where this occurs, we ensure that the transfer has a lawful basis, for example through the European Commission's Standard Contractual Clauses, the EU-US Data Privacy Framework, or transfers to countries that the EU has determined provide an adequate level of protection.

SECURITY

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or misuse. This includes encrypted transfers, access restrictions and regular reviews of our security procedures.

Because prescription data is classified as health data, we process it using additional security measures, including access restrictions and encrypted storage.

However, we cannot guarantee complete security when information is transferred over the internet. We recommend that you do not send sensitive personal data through unsecured channels.

COOKIES

Our website uses cookies to improve your experience, analyse traffic and enable certain functions. On your first visit, you are given the opportunity to choose which cookies you accept through our cookie banner.

You can change your cookie settings at any time by clicking Cookies in the footer.

YOUR RIGHTS

You have the following rights under the GDPR:

Right of access. You may request a copy of the personal data we hold about you.

Right to rectification. You may request that we correct inaccurate or incomplete information.

Right to erasure. You may request that we delete your personal data, subject to certain exceptions. Certain legal obligations may prevent us from immediately deleting data, for example under Swedish accounting legislation.

Right to restriction. You may request that we restrict processing in certain circumstances, for example while we investigate a possible inaccuracy.

Right to data portability. You may request to receive your data in a structured format or have it transferred to another data controller.

Right to object. You have the right to object to processing based on legitimate interest. If your personal data is processed for direct marketing, you may object to such processing at any time, and we will then stop using your data for direct marketing.

Right to withdraw consent. Where processing is based on your consent, for example the processing of prescription data or newsletters, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, contact us at hello@swopti.co. We will respond to your request within 30 days.

COMPLAINTS TO THE SUPERVISORY AUTHORITY

If you believe that we process your personal data in a way that violates the GDPR, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY). You can contact IMY at imy@imy.se or via imy.se.

CHANGES TO THIS PRIVACY POLICY

We may update this privacy policy from time to time. In the event of material changes, we will notify you by email or through our website. The latest version is always available on swopti.co.

CONTACT

If you have any questions about this privacy policy or how we process your personal data, please contact us at:

Swopti AB
Alingsåsvägen 30
121 48 Johanneshov
Sweden
hello@swopti.co