Last updated: 20 October 2026
This policy explains how Mr-Parts Sweden AB handles your personal data when you visit luftfjadring24.se, buy from us, create an account or contact us. Information about cookies is on the Cookie Policy page.
Who is responsible for your personal data?
Mr-Parts Sweden AB is the data controller for the processing described here, unless stated otherwise.
Mr-Parts Sweden AB
Company registration number: 556909-5150
Skyttevägen 18A, 133 36 Saltsjöbaden, Sweden
Email for data protection matters: [email protected]
Phone: +46 (0)8 559 22 549
What personal data do we process?
- Contact and delivery details: name, address, phone number and email address that you provide when you buy or create a customer account.
- Order information: what you bought, amounts, chosen payment and shipping method, order history, returns and complaints.
- Payment information: we do not receive or store your card details. Payments are handled by PayPal or Swish. We receive a confirmation that the payment went through and a transaction reference.
- Communication: what you write to us by email, phone or contact form.
- Account details: email address and password (stored encrypted) if you create an account.
- Reminders: your email address and the product you want to be notified about, if you ask to be told when an item is back in stock.
- Technical information: IP address, browser, device, operating system, pages you visit and items you add to your cart.
- Advertising data: information about how you reached our website and what you do there, if you have consented to marketing cookies.
Where do we get data from?
Most data comes from you. We also receive confirmation of approved payments from PayPal and Swish, delivery status from the carriers, and statistics and conversion data from Google and Meta if you have consented to statistics and marketing cookies.
Why do we process your data and on what legal basis?
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Process your order, deliver and receive payment | Contact, delivery and order data | Contract (Art. 6.1 b) | Until the order is completed, then as required for accounting below |
| Handle returns, complaints and warranty cases | Contact and order data, correspondence | Contract (Art. 6.1 b) | Up to 3 years after the case is closed |
| Customer service and enquiries by email, phone or form | Contact data, order data, your message | Contract (if you are a customer), otherwise legitimate interest in answering your enquiry (Art. 6.1 f) | Until the case is closed and 12 months afterwards |
| Customer account | Contact, order and account data | Legitimate interest in providing an account you created yourself (Art. 6.1 f) | Until you delete the account or it has been inactive for 3 years |
| Back-in-stock reminders | Email address, product | Consent (Art. 6.1 a). You can unsubscribe at any time | Until the reminder is sent or you withdraw it |
| Accounting and tax rules | Invoice records, order data, payment references | Legal obligation (Art. 6.1 c), Swedish Accounting Act | Current year plus 7 years |
| Security, troubleshooting and fraud prevention | IP address, logs, order patterns | Legitimate interest (Art. 6.1 f) | Logs up to 90 days, otherwise as long as needed for the purpose |
| Web statistics (Google Analytics 4) | Technical information, browsing behaviour | Consent (Art. 6.1 a) | 14 months |
| Advertising and measurement (Google Ads, Meta) | Technical information, browsing behaviour, conversions | Consent (Art. 6.1 a) | According to cookie lifetime, see the cookie policy |
| Handle your requests to exercise GDPR rights | Identity and contact data, your request and the data it concerns | Legal obligation (Art. 6.1 c, Art. 12 and 15–21) | 12 months after the case is closed. Disclosed extracts and portability files are deleted after 30 days |
| Establish, exercise or defend legal claims | Relevant data in the case | Legitimate interest (Art. 6.1 f) | As long as the case is ongoing |
Balancing of interests. Where we rely on legitimate interest, we have assessed that the processing is necessary to sell and deliver goods, provide service and keep the website secure, and that it does not affect your interests more than necessary. We do not process sensitive personal data. You can always object, see the section on your rights.
Profiling
If you consent to marketing cookies, information about how you use the website is used to measure our ads and show you more relevant ads on Google and Meta. This is profiling, but it has no legal effects for you and does not affect prices or what you can buy from us. We make no decisions based solely on automated processing that have legal or similarly significant effects on you.
Who can access your data?
We only disclose data when needed for the purposes above.
Data processors (process data on our behalf)
- Cloudflare, Inc. – protection and delivery of the website (CDN and security).
- Google Ireland Limited – web statistics (Google Analytics 4).
- IT and accounting providers – operation of the website and bookkeeping.
Independent controllers
- PayPal (Europe) S.à r.l. et Cie, S.C.A. – card and PayPal payments. PayPal is responsible for its own processing under its privacy policy.
- Swish (Getswish AB and your bank) – Swish payments.
- Carriers: PostNord, DHL Freight, DHL Express, UPS and FedEx receive your delivery details (name, address, phone, email) to deliver your order. They are responsible for their own processing under their own policies.
- Google Ireland Limited and Meta Platforms Ireland Limited – advertising and ad measurement, only if you have consented to marketing cookies.
- Authorities – when required by law, for example the Swedish Tax Agency or a court.
If the business is sold, data may be transferred to the buyer, who will continue to process it under this policy. We never sell your personal data. We have written agreements with our data processors that limit processing to our instructions.
Is data transferred outside the EU/EEA?
Some of our providers (including Google, Meta, Cloudflare, PayPal, UPS and FedEx) may process data in the USA or other countries outside the EU/EEA. Transfers are then based on the European Commission's adequacy decision (EU–US Data Privacy Framework) for certified companies, or on the Commission's standard contractual clauses and supplementary safeguards. Contact us for more information about the safeguards applied.
How do we protect your data?
All traffic to and from the website is encrypted with SSL/TLS. Data is stored on password-protected servers with firewalls, and access is limited to those who need it. If a personal data breach occurs that poses a risk to you, we report it to the Swedish Authority for Privacy Protection (IMY) and inform you when the law requires. No data transmission over the internet can be guaranteed to be completely secure, so please keep your login details secret.
What are your rights?
- Access: find out what data we process about you and get a copy.
- Rectification: have incorrect or incomplete data corrected.
- Erasure: have your data deleted when it is no longer needed or you have withdrawn consent. We must still keep data required by law, such as accounting records.
- Restriction: ask us to restrict processing, for example while a correction is investigated.
- Data portability: receive the data you provided in a structured, machine-readable format when processing is based on contract or consent.
- Objection: object to processing based on legitimate interest.
- Withdraw consent: at any time, without affecting earlier processing. You withdraw cookie consent by deleting cookies in your browser or by contacting us.
Send your request to [email protected]. We reply free of charge and within one month. To protect you, we may ask you to verify your identity. For manifestly unfounded or excessive requests, especially repeated ones, we may charge a reasonable administrative fee or refuse the request.
Objection to processing and direct marketing
You have the right to object to processing based on legitimate interest. We will then continue only if we can show compelling grounds that override your interests, or if the data is needed for legal claims. You can always object to your data being used for direct marketing, and we will then stop sending you such marketing.
How do you make a complaint?
If you believe we process your data incorrectly, you may complain to the supervisory authority:
- Sweden: Swedish Authority for Privacy Protection (IMY)
- Norway: Datatilsynet
- Denmark: Datatilsynet
- Finland: Office of the Data Protection Ombudsman
Children and young people
Our products are aimed at vehicle owners and workshops. We do not knowingly collect data about people under 18. Contact us if you believe a child has given us data, and we will delete it.
Links to other websites
The website may contain links to other sites. We are not responsible for how they process personal data. Read their policies before you provide data there.
Changes to this policy
We update this policy when our services or legal requirements change. The latest version is always here, with the date of the last update at the top. For material changes we inform you on the website or by email. If a change concerns processing based on your consent, we will ask for your consent again.
