Date: 27 march 2024

§ 1. Background This privacy policy ("Policy") sets out rules and guidelines for how personal data is handled on the Hilke Collection AB website (www.hilkecollection.se). The Policy outlines how personal data is collected, used, how website users have control over the handling of their personal data, and how they can contact the responsible party with questions. The Policy applies to all parts of the website.

§ 2. Purpose The purpose of the Policy is to provide website users with information about how their personal data may be processed on the website.

§ 3. Definition of Personal Data The term personal data includes all information that, either directly or indirectly, can identify a living physical person. Direct personal data refers to information that alone can identify a specific person, while indirect personal data can identify a person in conjunction with other personal data.

§ 4. Consent

a) Obtaining Consent In order for personal data to be processed, consent must first be obtained from website users. The consent should be informative and clear so that all users understand its meaning.

We obtain consent in the following ways:

By providing your personal data, you consent to the use of your information to deliver the service you expect. • Fulfilling agreements with customers e.g., delivery address and processing of returns • To create and manage your personal login account • To contact you in case of any issues when delivering goods to you • Newsletter/Advertising (with customer consent and unsubscription upon registration of a new order) • Trustpilot to collect reviews about the company (with customer consent and unsubscription)

b) Withdrawal of Consent A user who has given consent may withdraw it at any time, which is done as follows:

Email us at: info@hilkecollection.se

c) Right to Have Personal Data Deleted When consent has been withdrawn, users, if desired, can also request that their information be deleted from all servers associated with the website. This is done via email sent to info@hilkecollection.se.

§ 5. Processing of Personal Data

a) Personal Data Processed The following personal data is collected on the website and processed by us: • Personal data that you register when creating a login account such as name, address, mobile number, and email address • Information related to purchases such as delivery address. • Information that you provide via our customer service or via email to our other departments. • We save all data submitted to us through the store's contact forms directly in the platform for 30 days. All submitted data is available to our supplier Vendre (Optimizers Nordic AB) for a period of 30 days.

b) Purpose of Processing Personal Data The personal data is saved and processed for the following purposes: By providing your personal data, you consent to the use of your information to deliver the service you expect.

• Fulfilling agreements with customers e.g., delivery address and processing of returns • To create and manage your personal login account • To contact you in case of any issues when delivering goods to you • Newsletter/Advertising (with customer consent and unsubscription upon registration of a new order) • Trustpilot to collect reviews about the company (with customer consent and unsubscription)

c) Sharing of Personal Data Personal data may be shared with third parties as follows:

• Newsletter/Advertising (with customer consent and unsubscription upon registration of a new order) • Trustpilot to collect reviews about the company (with customer consent and unsubscription)

d) Period of Time Personal Data is Saved Personal data may only be saved for as long as necessary for the purpose.

§ 6. Security and Encryption The website has an SSL certificate (Secure Socket Layer) that ensures that users' personal data is transferred in a secure and confidential manner by encrypting the information. The website has further implemented appropriate security measures to prevent the loss or unauthorized use of personal data stored on the website. Access to the personal data collected is limited to authorized persons, and the information will be treated confidentially. In the event of a personal data incident, affected users will be notified, and the Data Protection Authority will be informed.

§ 7. Users' Rights

a) Right to Access Personal Data Upon giving consent, users of the website have the right to obtain a record of processing confirming whether their personal data is being processed. If personal data is being processed, users have the right to access it. Requests for records are made by email sent to info@hilkecollection.se. The record will be provided in written form, either digitally or by post.

b) Right to Information and Right to Rectification After giving consent, users of the website have the right to contact us to find out what personal data is stored and to have incorrect data corrected. If any information is missing, users also have the right to supplement it.

c) Right to Restriction of Processing In certain cases, a person whose personal data is being processed may request that the processing be restricted. This is the case, for example, when the person in question has already requested rectification due to incorrect data. During this time, processing of the incorrect data may also be restricted.

d) Data Portability In certain cases, a person who has provided their personal data has the right to have it transferred to another service, such as a media service. The party that first received the personal data must facilitate such a transfer.

e) Right to Object In certain cases, a person has the right to object to how their personal data is processed. This applies when personal data is processed to perform a task of public interest, as part of official authority, or based on a balancing of interests.

f) Right to Erasure Users of the website have the right to have their personal data erased if desired. There are exceptions to this right, but in the following cases, data must be deleted:

If the data is no longer needed for the purposes for which it was collected,
If consent is withdrawn,
If the personal data is used for direct marketing and the user objects to it,
If there are no legitimate reasons outweighing the individual's interest in deleting the information,
If the personal data has been processed unlawfully,
If deletion is required to fulfill a legal obligation,
If the personal data has been collected in connection with a minor creating a profile on a social network.
g) Automated Decision Making Users have the right not to be subject to automated decisions if such decisions may have legal consequences for the individual or significantly affect them in a similar manner.

h) Identification If a user requests information or requests deletion of information, the person in question must be identified. This is done by emailing us at info@hilkecollection.se, and we will assist further.

i) Complaints If a user believes that their personal data is being processed in violation of the GDPR on the website, a complaint can be filed first with us and secondly with the Data Protection Authority.

j) Compensation In a situation where a user's personal data has been processed in violation of the GDPR, the user may be entitled to compensation. A claim for compensation can be brought in a court of general jurisdiction, with the district court as the first instance.

§ 8. Changes to the Policy This policy was published on March 23, 2024. This policy may be subject to change, and users of the website are encouraged to review the policy regularly. Users will also be notified of changes as follows: If there are changes to this policy, this page will be updated with the date of the change.

§ 9. Contact For questions regarding the website and its content, please contact us via email at info@hilkecollection.se. Response time for email inquiries: within a few days.