⚠️ DRAFT — not legal advice. Generated from a code audit on 2026-08-07 and
not reviewed by a lawyer. Confirm every[FILL IN: …]and the "Assumptions &
open questions" section before publishing.
Last updated: [FILL IN: date of publication]
1. Who we are
This website (surfface.se) is operated by [FILL IN: legal entity name],
[FILL IN: registered address], Sweden. For any privacy question or to exercise
your rights, contact us at [FILL IN: contact email — e.g. the site contact address].
We have not appointed a Data Protection Officer, as we are not required to.
[Confirm — remove this line if a DPO is appointed.]
2. What data we collect and why
We only collect data you actively send us. We do not run analytics, advertising,
or visitor-tracking tools.
| Data | When / source | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Name, email, city, country | You submit the contact form and/or newsletter form | Reply to your enquiry; send you updates you asked for | Consent (Art. 6(1)(a)) / your request |
| Email content / message | Contact form | Respond to you | Consent / legitimate interest |
| Admin login email | Site administrators only, at login | Secure access to the content-management area | Legitimate interest (site security) |
| Payment & order data | Only if/when the merch shop is active — handled by Stripe | Process your purchase | Contract (Art. 6(1)(b)) |
We do not knowingly collect special-category data (health, biometric, religion,
political opinion, etc.) or data from children. [Confirm — see open questions.]
Newsletter/contact submissions are stored in our database (Google Firebase Realtime
Database) with a timestamp and a "read" flag used internally to track follow-up.
3. Who your data is shared with (processors)
We share data only with the service providers that run this site:
| Provider | What they process | Location |
|---|---|---|
| Google Firebase (Hosting, Firestore, Realtime Database, Storage, Auth, Cloud Functions) | Site hosting; contact/newsletter submissions; admin auth | EU (europe-west1); Google is a US company — international transfer safeguards apply |
| Stripe | Payment processing — only when the shop is active | EU/US — international transfer safeguards apply |
| Google Maps | Loads a map on the Contact page only after you allow marketing cookies | US — international transfer safeguards apply |
| BARADATA (bara-cookie) | Records your cookie consent decision (choice, timestamp, policy version) as an audit trail | EU |
We do not sell your data or share it for advertising.
4. International transfers
Some providers above are US-based or transfer data outside the EU/EEA. Such transfers
rely on [FILL IN: Standard Contractual Clauses / EU–US Data Privacy Framework — confirm
which each provider uses].
5. How long we keep it
[FILL IN: retention period.] The codebase does not currently define an automatic
retention/deletion period for contact and newsletter submissions — they are kept until
manually removed by an administrator. A concrete retention period should be decided and
stated here.
6. Your rights
Under the GDPR you have the right to access, rectify, erase, restrict, port, and object
to the processing of your personal data, and to withdraw consent at any time. To exercise
any of these, email [FILL IN: contact email] and we will action your request.
Note (accuracy): there is no self-service data export or account-deletion feature
built into the site. Requests are handled manually by an administrator, who can delete
your submission from the database. Do not promise automated self-service here.
You also have the right to lodge a complaint with the Swedish Authority for Privacy
Protection (Integritetsskyddsmyndigheten, IMY).
7. Cookies
See our separate Cookie Policy for the cookies and third-party
embeds this site uses and how to control them.
Non-essential cookies are blocked until you choose. You can change or withdraw your
consent at any time via "Cookie settings" in the footer of every page.
8. Children
This site is not directed at children and we do not knowingly collect their data.
9. Changes to this policy
We may update this policy; the "Last updated" date above reflects the latest version.
Material changes will be posted on this page.
Assumptions & open questions (must be resolved before publishing)
[FILL IN]— legal entity name, address, and contact email are unknown from the code.- Retention period is undefined in the codebase — a real period must be chosen.
- Legal basis per purpose is a best-guess mapping — a lawyer should confirm whether
newsletter/contact rests on consent vs. legitimate interest. - International-transfer mechanism for Google/Stripe must be confirmed (SCCs / DPF).
- Confirm no special-category or children's data is ever collected via free-text fields.
- Stripe/merch rows apply only when the shop is relaunched (currently hidden). Remove
or keep depending on launch timing. - Confirm whether a DPO is required (assumed not).