1. Who we are
The online store grifon.se is owned and operated by Grifon AB, a Swedish limited company, which decides how and why your personal data is used.
- Registered office: ÅLANDS-VÄSTERBY 417, 755 77 VÄNGE, Sweden
- Company registration number (Org.nr): 559256-1822 · VAT number: SE559256182201
- E-mail: info@grifon.se
- Phone: +30 2810 821627 · +30 2810 821730 · +30 6936 545855
You can reach us by phone or by e-mail. For anything concerning your data, it is best to write to us at info@grifon.se, so that both you and we have a written record of your request.
2. What this text covers
It covers the data you give us or leave behind when you visit grifon.se, open an account, apply for wholesale access, place an order or contact us. The store is intended exclusively for businesses; we do not sell to private consumers and we do not knowingly collect data about minors.
3. What we keep, why, and on what legal basis
| What we keep | Why | Legal basis |
|---|---|---|
| First name, last name, e-mail address and password, when you open an account | So that you have an account and can place orders | Performance of the contract with you |
| Company name, address, city, postcode, country, VAT number, contact name and telephone number of your business, and optionally two documents (company certificate, invoice), when you submit a wholesale application | To confirm that you are a business and to open wholesale prices for you | Steps taken before entering into a contract, at your own initiative |
| The status of your application and the reason, if it is not accepted | To reply to you and to know what has been decided | Our legitimate interest in managing our partner network |
| Orders: products, amounts, billing and delivery address, telephone number, carrier | To process and deliver the order | Performance of the contract with you |
| Invoices and accounting records, together with your VAT number | To issue and keep the required documents | A legal obligation we are under |
| Card payment: the card details go directly to the payment provider (Stripe). If you pay with PayPal, the payment is completed on PayPal's own site. We only see whether the payment went through | So that the order can be paid | Performance of the contract with you |
| Messages sent through the contact forms: first name, last name, e-mail address, telephone number, your message and — in two of the three forms — the files you attach. The contact form also asks for a VAT number and an address, and the product form for the product you are interested in | To answer your request | Our legitimate interest in serving anyone who writes to us |
| Newsletter: your e-mail address, the date and the IP address of the subscription | To send you news and offers | Your consent, which you may withdraw at any time |
| Technical operating data: the visit cookie, the automatic check of the forms against automated programs (Google reCAPTCHA), the history of changes made to your data | So that the cart works, so that we are not attacked, and so that we can see what changed | Our legitimate interest in keeping the store working and secure |
| Traffic statistics through Google Analytics, with an anonymised IP address and, when you are logged in, with an identifier of your account | To see which pages are read and to improve the store | Your consent to cookies |
Decisions to approve or reject a wholesale application are taken by a person. The form check scores every submission automatically, solely in order to tell automated programs apart.
4. What we do not keep
We do not store card details. We do not ask for gender, date of birth, marital status, interests, education or occupation. There is no public profile and no username, and no customer comments or reviews are published. We do not monitor your correspondence.
5. Who we give data to
Within the company, your data is seen only by the staff who handle applications, orders and customer service. Outside the company we give it only:
- To our partners in Greece, who fulfil orders from the warehouse in Heraklion, Crete and maintain the store technically.
- To the transport companies that carry out the delivery — Geniki Taxydromiki, ELTA Courier, Multimodal Shipping — and only what they need: name, address, telephone number.
- To our banks, when you pay by deposit or transfer.
- To the payment providers Stripe and PayPal, which carry out the charge.
- To Google, for the traffic statistics and for the form check.
- To the external accounting firm we work with, for the company's records and books.
- To the company that provides us with the store software, for maintenance and for synchronising its services.
- To the public authorities, where the law requires it or in order to defend our rights.
The store and its database are not hosted with an external company: they are on a server belonging to our partner company in Greece, which runs the technical operation of the store on our behalf and on our instructions — that is, within the European Union.
We do not sell or rent out your data. We do not give it to third parties for their own advertising.
6. Transfers outside the European Union
The payment providers and Google are companies established outside the European Union, so part of the data may also be processed outside the EU. These transfers are covered by the standard contractual clauses approved by the European Commission, which the providers apply in their terms of use.
7. How long we keep it
- Your account: for as long as you keep it. When you ask for deletion, the request is checked and — provided there is no legal ground for retention — the account and its data are deleted entirely.
- Orders, invoices and accounting records: seven years from the end of the calendar year in which the financial year ended, as required by the Swedish Accounting Act (bokföringslagen).
- The wholesale application and the documents you uploaded: for as long as we work together. If the application is rejected, they are deleted.
- Form messages: two years. Attached files: one year, unless you ask us to keep them longer.
- Newsletter: until you unsubscribe from it.
- The visit cookie: 20 days. Your answer to the cookie message: up to one year (some browsers, such as Safari, limit this to a few days).
- Live chat conversations: one year.
We keep data beyond the above only where the law requires it or where it is needed for legal proceedings.
8. Security
We take the technical and organisational measures needed to ensure that your data is not lost, altered or placed in the wrong hands. The connection to the store is encrypted. You are responsible for keeping your password secret — we will never ask you for it, except when you log in to the store. No transmission over the internet is completely secure and we cannot guarantee otherwise.
9. Your rights
You have the right:
- to learn what data we hold about you and to obtain a copy,
- to correct anything that is wrong or out of date,
- to ask for it to be deleted,
- to ask for its use to be restricted,
- to receive it in a form that can be transferred elsewhere,
- to object to its use where this is based on our legitimate interest,
- to withdraw your consent at any time — without this affecting what was done beforehand.
You can do most of this yourself from the "My Account" page, where you can view, download and request deletion of your data. For anything else, write to us at info@grifon.se. We reply within one month and free of charge. If we are not certain who is making the request, we may ask you for something additional to confirm it.
If you believe that we have not respected your rights, you may lodge a complaint with the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY): Box 8114, 104 20 Stockholm, Sweden · telephone +46 8 657 61 00 · imy@imy.se · www.imy.se.
10. Cookies
The store uses cookies: some are necessary for the page and the cart to work, others give us traffic statistics. Exactly which ones they are, what each one does, how long it lasts and how you change your mind is explained in the Cookie Policy, at the bottom of every page.
11. Other people's data
If you give us another person's data — for example an employee or a representative of your business — please first make sure you have their consent to disclose it to us and for us to use it as this text describes.
12. Links to other websites
The store contains links to third-party websites, such as the sister wholesale store grifon.gr. We do not control and are not responsible for their practices. Read their own policy before giving them any data.
13. Changes to this text
We may update this policy. The new version is published on this page and applies from the day it is published. Please let us know if any of the data we hold about you needs correcting.