Privacy policy

Privacy Policy

Last updated: 8 September 2026

This Privacy Policy explains how Eighteens Group AB, trading as Curly (“Curly”, “we”, “us” or “our”), collects, uses, stores and shares your personal information when you visit our website, place an order, contact us or otherwise use our services.

1. Who controls your personal information?

The data controller responsible for your personal information is:

Eighteens Group AB

Box 363
SE-931 24 Skellefteå
Sweden

Email: info@curly-sthlm.se
Website: https://curly-sthlm.com

2. Personal information we collect

Depending on how you interact with us, we may collect:

  • Your name

  • Billing and delivery addresses

  • Email address

  • Telephone number

  • Order details and purchase history

  • Payment status and limited payment information

  • Returns, refunds and complaint information

  • Account information, where you create an account

  • Communications with our customer service team

  • IP address

  • Browser, device and operating-system information

  • Website activity, such as pages viewed, products clicked and shopping-cart activity

  • Cookie identifiers and advertising identifiers

  • Marketing preferences

  • Information used to detect fraud or misuse

Payment-card details are generally processed directly by our payment providers. We do not normally receive or store your complete card number.

3. How we collect your information

We collect personal information:

  • Directly from you when you place an order, create an account, subscribe to marketing or contact us

  • Automatically when you visit or use our website

  • From payment, delivery and fulfilment providers

  • From advertising, analytics and ecommerce platforms

  • From fraud-prevention and security providers

  • From social media platforms when you interact with our advertisements or accounts

4. How and why we use your information

Processing orders

We use your information to:

  • Process payments

  • Confirm and fulfil orders

  • Arrange delivery

  • Provide tracking information

  • Manage returns, exchanges and refunds

  • Contact you regarding your order

Our lawful basis is that processing is necessary to perform our contract with you.

Customer service

We use your information to answer questions, handle complaints and provide support.

Our lawful basis is performance of our contract with you and our legitimate interest in providing effective customer service.

Fraud prevention and security

We may use personal information to verify transactions, protect our website, prevent fraud and enforce our terms.

Our lawful basis is our legitimate interest in protecting our customers and business and, where applicable, compliance with legal obligations.

Legal and accounting obligations

We process and retain information where necessary to comply with tax, accounting, consumer-protection and other legal requirements.

Our lawful basis is compliance with a legal obligation.

Marketing

If you subscribe to our emails or SMS marketing, we may use your contact information to send product news, offers and other marketing communications.

Where required, our lawful basis is your consent. You may withdraw your consent at any time by:

  • Clicking the unsubscribe link in an email

  • Following the opt-out instructions in an SMS

  • Contacting info@curly-sthlm.se

We may retain limited information about your opt-out request to ensure that we respect it.

Analytics and website improvement

With your consent where required, we use cookies and similar technologies to understand how visitors use our website, measure performance and improve our services.

Personalised advertising

With your consent where required, we may use cookies, pixels and similar technologies to measure advertisements and show you more relevant advertising through platforms such as Meta and Google.

You can change or withdraw your cookie choices using the cookie settings available on our website.

5. Cookies and similar technologies

Our website uses cookies and similar technologies for:

  • Essential website and checkout functions

  • Shopping-cart functionality

  • Security and fraud prevention

  • Remembering your preferences

  • Website analytics

  • Advertising measurement and personalisation

Essential cookies may operate without consent where they are necessary for the website to function. We request consent before using non-essential analytics or advertising cookies where required by law.

More information is available in our Cookie Policy and through the cookie settings on our website.

6. Who we share information with

We may share personal information with trusted providers that help us operate our business, including:

  • Shopify, which hosts and powers our online store

  • Payment providers and banks

  • Warehousing, fulfilment, shipping and delivery providers

  • Customer-support providers

  • Email and SMS marketing providers

  • Analytics and website-performance providers

  • Advertising platforms such as Meta and Google

  • Fraud-prevention and security providers

  • Accountants, auditors, insurers and professional advisers

  • Government authorities or regulators where legally required

These providers may only use personal information for the relevant services or as otherwise permitted by law.

We do not sell personal information for money. Certain advertising activities may, however, be treated as “sharing” personal information under some privacy laws.

7. International transfers

We are established in Sweden and use service providers that may process information in Sweden, the United Kingdom, the European Economic Area, the United States and other countries.

Where personal information is transferred internationally, we use safeguards required by applicable data protection law. These may include:

  • UK adequacy regulations

  • The UK International Data Transfer Agreement

  • The UK Addendum to the EU Standard Contractual Clauses

  • Other legally recognised transfer safeguards

You may contact us for further information about the safeguards used for international transfers.

8. How long we retain information

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, including:

  • Order, transaction and accounting records: generally seven years, where required under Swedish accounting law

  • Customer-service and complaint records: generally up to three years after the matter is closed, unless a longer period is necessary

  • Marketing information: until you unsubscribe or withdraw consent

  • Cookie and analytics information: according to the lifespan shown in our cookie settings

  • Fraud-prevention records: for as long as reasonably necessary to protect our business and customers

Information may be retained longer where required by law or where necessary to establish, exercise or defend legal claims.

9. Your rights

Subject to applicable law, you may have the right to:

  • Request access to your personal information

  • Request correction of inaccurate or incomplete information

  • Request deletion of your information

  • Request restriction of processing

  • Object to processing based on legitimate interests

  • Object to direct marketing at any time

  • Request a portable copy of certain information

  • Withdraw consent at any time

  • Complain to a data-protection authority

These rights are not absolute and may be subject to legal exceptions.

To exercise your rights, email info@curly-sthlm.se. We may need to verify your identity before processing your request.

10. Complaints

Please contact us first if you have concerns about how we handle your personal information:

info@curly-sthlm.se

You also have the right to complain to the UK Information Commissioner’s Office:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
United Kingdom

Website: https://ico.org.uk/make-a-complaint/
Telephone: 0303 123 1113

As a Swedish company, we are also supervised by:

Integritetsskyddsmyndigheten (IMY)
Website: https://www.imy.se/

11. Automated decision-making

Our payment and fraud-prevention providers may use automated systems to assess transactions for suspected fraud or security risks.

This may result in a transaction being delayed, reviewed or declined. Contact us if you believe an order has been incorrectly affected.

12. Children’s privacy

Our website and products are not directed at children under the age of 16, and we do not knowingly collect personal information from children under 16.

If you believe a child has provided us with personal information, please contact us so that we can investigate and delete it where appropriate.

13. Data security

We use reasonable technical and organisational measures designed to protect personal information from loss, misuse, unauthorised access, alteration or disclosure.

However, no online service or transmission method is completely secure, and we cannot guarantee absolute security.

14. Third-party websites

Our website may contain links to third-party websites or services. Their handling of personal information is governed by their own privacy policies, and we are not responsible for their practices.

15. Changes to this policy

We may update this Privacy Policy to reflect changes to our services, legal requirements or data-processing practices.

The latest version will always be published on this page with the updated revision date.

16. Contact us

For questions, requests or concerns regarding this Privacy Policy or your personal information, contact:

Eighteens Group AB
Box 363
SE-931 24 Skellefteå
Sweden

Email: info@curly-sthlm.se