TONOREX PRIVACY NOTICE
This Privacy Notice is applicable to customers of Tonorex, including current, former, potential customers, users and recipients of a product or service offered by us, visitors to our official websites or stores or members of our loyalty programs or communities.
Tonorex refers to the company TONOREX DESIGN AB, and its brands; Tonorex Furniture, Tonorex Carpet, and Tonorex Stone.
What is personal data?
Personal data is any kind of information that can be directly or indirectly attributed to you. Examples of personal data are name, address, e-mail address, telephone number, payment information and purchase order. Usage history, IP address, member id are also examples of personal data, so can be other types of information you provide when contacting our customer service.
Who is responsible for processing your personal data?
Tonorex Design AB, Karlbergsvägen 29B, 113 27 Stockholm is responsible for most of the processing of personal data described within this Privacy Notice.
Tonorex Design AB (Controller) is throughout this Privacy Notice referred to as “we” or “us”.
When can we process your personal data?
We are not allowed to collect, process, use or store personal data without a valid lawful basis. Lawfulness may be derived from the following basis:
• Consent: When you give us your consent, we will process your personal data for the specific purpose you have consented to. This basis is for example used when you request us to send you one of our newsletters with offers and product updates.
• Contract: When making products and services available to you we will process your personal data necessary for fulfilment of a contract (such as purchase agreement) with you and to fulfil any obligations derived from that contract.
• Legitimate Interest: We may process your personal information when necessary for our legitimate interests and when these interests do not outweigh your own rights and interests. This covers processing for purposes such as our customer service support, improving or developing our products and services; and security purposes including fraud prevention.
• Legal requirement: Whenever the processing of your personal data is necessary for us to fulfil our legal obligations of the country of operation.
For each specific purpose of processing of personal data, we will inform you about which of the above lawful basis that will apply.
How do we process your personal data and why?
Depending on how you interact with us or what type of service you are using we will process your personal data for the following purposes:
1. Online shopping/ Order
1-1) Purpose for processing
To be able to process your purchase order and handle payment transactions (including Klarna credit when applicable).
To be able to manage your deliveries, claims, warranty matters, returns and refunds in a secure and effective manner.
To be able to deliver requested services on the website or app, identify and contact you when needed.
1-2) Type of personal data
• Contact information (e.g., phone number, email address, delivery address)
• Member id (when applicable) and transactional data
• Payment data
- Lawful basis:
When making products and services available to you we will process your personal data
necessary for fulfilment of a contract with you and to fulfil any obligations derived from that contract, whether the contract refers to a purchase order and payment, or the use of other services provided by us or by third parties. When you need to make a return or claim a consumer right, we will process your personal data to fulfil obligations derived from concluding a contract with us, whether the contract refers to a purchase transaction, or the use of other services provided by us or by third parties. For any other purpose referred to herein, the process of your personal data is based on our legitimate interest as a business.
1-4) Retention time:
We will keep and process your personal data no longer than necessary for us to perform our contractual and consumer obligations.
2. In store shopping
2-1) Purpose for processing
To be able to process your purchase order and handle payment transactions (including Klarna credit when applicable).
To be able to manage your deliveries, claims, warranty matters, returns and refunds in a secure and effective manner.
To be able to deliver requested services on the website or app, identify and contact you when needed.
2-2) Type of personal data
• Contact information (e.g., phone number, email address, delivery address)
• Member id and transactional data
• Payment data
2-3) Lawful basis
When making products and services available to you we will process your personal data necessary for fulfilment of a contract with you and to fulfil any obligations derived from that contract, whether the contract refers to a purchase order and payment, or the use of other services provided by us or by third parties. When you need to make a return or claim a consumer right, we will process your personal data to fulfil obligations derived from concluding a contract with us, whether the contract refers to a purchase transaction, or the use of other services provided by us or by third parties. For any other purpose referred to herein, the process of your personal data is based on our legitimate interest as a business.
2-4) Retention time
We will keep and process your personal data no longer than necessary for us to perform our contractual and consumer obligations.
3. Marketing and Promotions
3-1) Purpose for processing
To be able to generate and distribute marketing materials, such as newsletters, including style and shopping recommendations, push notifications and marketing surveys, through multiple communication channels.
To be able to provide you with a personalized online experience.
3-2) Type of personal data
• Contact information (e.g., phone number, email address, delivery address)
• Member id (if applicable)
• IP address
• user-generated data (e.g., purchase, click and browsing history).
Further info: Marketing and promotions will be sent and displayed to you according to your preferences through email, text messages and postal mail as well as displayed in your mobile app, social media channels or web browser.
We also provide you with a personalized online experience by giving you personalized marketing based on your interactions with us and analytics of your customer behavior on our websites, such as your purchase and browsing history.
Advertising partners: To be more efficient in our marketing we collaborate with different social media, search engine and advertising network providers (“Advertising Partners”).
We collaborate with advertising partners such as Facebook, Instagram, Snapchat, Pinterest, TikTok and YouTube for advertising on social networks and with Google for online advertising networks such as Google Ads and Google Marketing Platform.
How this works: Advertising partners use data provided by us and collected from cookies and other tracking technologies to predict your preferences and interests and take this into account when creating your personalized ad. This is standard industry practice commonly known as “retargeting”. Retargeting allows us to run relevant advertising campaigns to you and to measure the efficiency and reach of the advertising materials. It also helps us to measure the advertising partners’ performance and efficiency of campaigns.
Advertising partners use cookies and similar technologies to trace your usage of our websites and services by accessing data stored on your device or in apps.
Our Advertising Partners enable us to identify and engage with the right target audience, to create and distribute personalized marketing content across platforms and services. To be able to choose the content that fits your interests, we can use information obtained from you when you signed-up for newsletter or created an account, membership or made a purchase with us.
We may share this information and a customer identifier, e.g., an encrypted email address or device id, with our Advertising partners. The purpose is to show relevant ads to you on third party websites and apps. To do this, your data is matched with the database of the Advertising partner. If a match is found, you will receive relevant promotional content in your feed or search engine. If no match is found your data is securely destroyed. Your personal data is handled in a secure manner using a technique called hashing. This ensures your data is scrambled in a manner that makes it unreadable to anyone other than the recipient for the explicit given purpose.
Each Advertising Partner is responsible for their part of the processing as controllers, including (if any) transfers of personal data to non-EEA countries.
3-3) Lawful basis:
We will obtain your consent when you sign up for personalized newsletters and text messages. We will also ask for your consent regarding marketing that is based on cookie data or other tracking technologies. If you’re a member, account holder or a subscriber you may hear from us in other channels, such as social media. For this processing we rely on our legitimate interest as business to promote our marketing to you.
3-4) Retention time:
We will process your data no longer than necessary to provide you with marketing and promotions. We will cease processing your data for marketing purposes once you have closed your customer account or membership and/or actively rejecting further marketing communication from us.
4. Membership/Loyalty program (when applicable)
4-1) Purpose for processing
To be able to provide you with our loyalty programs and a tailormade experience of our brands including personalized offers, promotions and recommendations, services, events and much more organized by us or our partner companies.
To be able to create, manage and keep your membership up-to date and always current, and to give you all the granted benefits and rewards.
To be able to provide you with your shopping history, details about your orders, and your member status.
To be able to send you invitations for upcoming events, competitions, and customer surveys.
To be able to contact you and act in case of acts of noncompliance to the Tonorex Membership Terms & Conditions or suspected fraudulent behavior is detected.
4-2) Type of personal data
• Contact information such as name, delivery address, e-mail address and phone number
• Date of birth
• Gender preference
• Member id
• IP address
• User-generated data (eg purchase, click and browsing history).
Purchase order and payment data may be used to detect non-compliance with the Tonorex Membership Terms & Conditions, and to detect online loss and fraud.
4-3) Lawful basis:
The processing of your personal data to create and manage your membership account and to provide you with the personalized services of the membership is necessary to fulfil the membership agreement.
Processing your personal data to email you offers, style updates, bonus vouchers, birthday offers and special invites to sales and events is based on your consent to receive marketing from us. For any other purpose referred to herein, the process of your personal data is based on our legitimate interest as a business.
4-4) Retention time:
We keep and continue to process your personal data for as long as necessary to fulfil the membership agreement. You have the right to terminate your membership at any time. If you choose to do so, your membership will cease to exist, and your personal data will be deleted. We will keep your personal data for a longer period of time if there are any legal requirements or if there is an ongoing dispute.
5. My Account (when applicable)
5-1) Purpose for processing
To be able to create and administrate your account, such as identify and certify you as the user of the account. To be able to make your purchase information and history available to you and to bring you a personalized account experience.
5-2) Type of personal data
• Contact information such as name, e-mail address and telephone number
• Date of birth
• Purchase history General Information
• User-generated data (e.g., purchase, click and browsing history).
If you have signed-up to receive marketing and promotions, we will use your account data to make the marketing you receive from us more relevant to you.
5-3) Lawful basis:
The processing of your personal data for your account is based on your consent when you create your account. The processing of your personal data to provide you with a personalized account experience such as product recommendations is based on our legitimate interest as a business.
5-4) Retention time:
We will use your personal data no longer than necessary for making the account available to you. Personal data solely collected and used for the purpose of providing you with an account will be erased upon termination.
6. Customer Service
6-1) Purpose for processing
To be able to manage your questions, handle complaints and warranty matters and to provide technical support as well as to improve customer experience.
To be able to contact you, if needed, through email, telephone, social media, or any other means in response to your enquiries regarding order, delivery or return questions or to request your participation in a customer survey.
6-2) Type of personal data
• Contact information such as name, e-mail address and telephone number
• Member id and interaction log
• User generated content, such as emails and chat transcript
To resolve your case, we may also need to access and use transaction data such as order, payment, and delivery information.
To support training and development of employees, we may occasionally co-listen your calls and conversation when you are in contact with us.
6-3) Lawful basis:
The processing of your personal data to provide you with the best possible Customer Service is based on our legitimate interest as a business. Before we record any conversations with you, we will always ask for your consent.
6-4) Retention time:
We will keep your data for as long as we need to be able to support you regarding your case and, to be able to handle potential legal claims from you as a customer. We may continue to keep and use your data if we have outstanding obligations to you or by any other reasons are prevented from erasure.
7. Competitions, Giveaways & Events
7-1) Purpose for processing
To be able to administrate and follow up on competitions and events, such as confirming participation, contact winners, deliver, and follow up on prize deliveries, reach out to you with relevant information about the competition and/or event and grant you access to the venue where the event is held.
To be able to market our events improve our services, marketing, customer relationships and experiences and to plan better future events and attendee experience.
7-2) Type of personal data
• Contact information such as name, address, e-mail address and telephone number
• information submitted in the contest
• Photo/video
We sometimes film and photograph at our events, and the content will be used to market our services and to promote future events on our website, social media channels and in marketing materials. We will also use the content for internal use.
You will be notified if we intend to photograph/film at an Event. There will always be photo free zones for your convenience.
7-3) Lawful basis:
The processing of your personal data to make a competition or an event available to you is based on our legitimate interest as a business.
7-4) Retention time:
We will keep your personal data for as long as necessary for us to fulfil the purposes mentioned above and to fulfil any legal obligations connected.
8. Development & Improvement
8-1) Purpose for processing
To be able to evaluate, develop and improve our products, services, customer experience, supply chain and store premises. This includes analysis to make our services more user friendly, such as modifying the user interface to simplify the flow of information or to highlight features that are commonly used by our customers. To be able to reach out to you to respond to enquiries and surveys. In such case, any personal data used and obtained from you will only be processed for the specific purpose described therein.
8-2) Type of personal data
• Delivery address
• Purchase history
• Customer number
• Gender
• Order number
• Payment information
• User-generated data (e.g., purchase, click and browsing history).
Any data used for the purpose of development and improvement have been collected for different objectives. We may for example use online transaction data for the purpose of developing our online order system. All analysis is carried out on an aggregated data level.
8-3) Lawful basis:
The processing of your personal data for the purpose to develop and improve our services and products, is based on our legitimate interest as a business.
8-4) Retention time:
We will process your personal data no more than necessary for us to fulfil the purpose. Thereafter the data will be immediately erased for this type of use.
9. Compliance with Laws
9-1) Purpose for processing
To comply with certain legal obligations. In order to comply with local law, we are obliged to process certain personal data. Such obligations may vary from country to country stipulated in for example tax, accounting, book-keeping, and consumer legislations.
9-2) Type of personal data
What type of personal data we process are stipulated by the applicable law.
9-3) Lawful basis:
The processing of your personal data is necessary for Tonorex to fulfil its legal obligations of the country of operation.
9-4) Retention time:
The data retention time will vary depending on the purpose, context and specific local legal requirements.
10. Security & Safety
10-1) Purpose for processing
To be able to protect our customers, users, visitors, assets and business against violence, fraud, theft, misuse, and other malicious activities. To be able secure the safety of our visitors and staff and to detect and prevent thefts and fraud we use camera surveillance within our stores.
10-2) Type of personal data
• order history
• payment data
• shopping behavior
• Camera surveillance footage
10-3) Lawful basis:
Unless there is a specific legal obligation, the processing of your personal data for security and safety purposes is based on our legitimate interest.
10-4) Retention time:
We will keep your personal data no more than necessary for each purpose. We will keep images from our surveillance cameras for a maximum period of 30 days unless we are obliged by law or public authority to keep and/or process data for a longer period.
11. Content shared by you
11-1) Purpose for processing
To be able to provide you with a service for customer engaged marketing.
To be able to share your photos and/or videos on our official websites, in our stores, on our social media pages and in other promotional channels. This includes other brands within Tonorex, as well as other external parties outside Tonorex which we collaborate with, like for example marketplaces.
11-2) Type of personal data
• Photo
• Video
• Username
11-3) Lawful basis:
The processing of your personal data is based on the contract of the service that you have agreed to.
11-4) Retention time:
We will keep your username and generated content for 24 months from the date of posting. If you want to remove the content, please contact the customer service. Please note, by hashtagging your picture or video clip you voluntarily share the content and other personal data with Instagram or other social media platforms. This relationship is outside of Tonorex’s control and a matter between you and the social media service provider.
12. Wi-Fi in Store/ Showroom (when applicable)
12-1) Purpose for processing
To be able to provide you with Wi-Fi solution in our stores. To be able to collect statistics to gain better insights on how to operate our stores, such as optimized assortment, floor space and staff utilization.
12-2) Type of personal data
• MAC address (Media Access Control Address), a unique identifier assigned to your device for use as a network address when using the Wi-Fi service.
12-3) Lawful basis:
When you connect to our free Wi-Fi service, you permit us to collect and use your personal data necessary to provide the requested Wi-Fi service (fulfilment of a contract) and, by using anonymization techniques, turn personal data into anonymized (non-personal data) for statistical purpose (legitimate interest).
12-4) Retention time:
We will keep your personal data as long as necessary for us to provide the Wi-Fi service in accordance with the agreed Terms & Conditions and to ensure your compliance with these.
Personal data used for statistical purpose is anonymized by technical means after collection. Once your data is anonymized, your personal data is irreversibly erased.
Who do we share your personal data with?
Your personal data is available and accessible only by those who need the data to accomplish the intended processing purpose. We may share your personal data within Tonorex whenever necessary to fulfil the intended processing purpose such as order fulfilment, payment processing, book-keeping systems, software development and development tools, as well as marketing content creation.
We reserve the right to transfer any personal data we have about you in the event that we merge with or are acquired by a third party, undergo other business transactions such as a reorganization, or should any such transaction be proposed.
Personal data processors:
Whenever necessary to fulfil the intended processing purpose we share your personal information with companies that act as so-called personal data processors. A personal data processor is a company that processes the information on our behalf and according to our instructions. We have personal data processors who help us with:
• Logistics (postal services, logistics and shipping suppliers).
• Customer service (externally operated call centers)
• Order fulfilment and payment processing (banks and other payment service providers).
• Ads & Promotions (print and distribution, social media platforms, media agencies or advertising agencies, data analytics companies).
• Customer events (e.g., PR agencies).
• IT services (companies that handle necessary operations, technical support, maintenance of our IT solutions and other IT services and solutions).
• Security & Safety (companies that help us detect and prevent potential fraud and thefts).
• Insurance companies for claim handling
• Internet service providers when granting you access to the internet via the Wi-Fi service.
We make sure all personal data processors can provide adequate guarantees regarding the security and confidentiality of your personal data. We have written agreements with all personal data processors through which they guarantee the security of the personal data processed.
Companies that are independently responsible for personal data:
We may also share your personal data with companies that are independently responsible for personal data processing. This means that we are not in control of how the information provided to the company is to be processed. For example, when you engage with us on social media platforms, such as Facebook and Instagram, all text messages and pictures are shared with us and the named platform provider. You do this according to the platform’s terms of use and privacy policy to which you have agreed when you signed-up as a user.
Independent personal data controllers with whom we may share your personal data are:
• Social media platforms that you interact with.
• Companies that handle general goods transport (logistics companies and freight forwarders).
• Companies that offer payment solutions (card redeeming companies, banks and other payment service providers such as Klarna).
• Public authorities (the police, tax agencies or other authorities) if we are obliged to do so by law or in case of suspicion of crime.
When your personal data is shared with a company that is independently responsible for personal data, the company’s privacy policy and personal data management apply.
Where do we process your personal data?
The personal data that we collect from you is processed within a country of the European Union or the European Economic Area (“EU/EEA”).
What are your rights?
Data protection is a fundamental right, and you have several rights in accordance with applicable data protection legislation. These rights are:
Right to access:
You have the right to request information about the personal data we hold on you at any time.
Right to portability:
Whenever we process your personal data, by automated means based on your consent or based on an agreement, you have the right to get a copy of your data transferred to you or to another party. This only includes the personal data you have submitted to us.
Right to rectification:
You have the right to request rectification of your personal data if the information is incorrect, including the right to have incomplete personal data completed.
Right to erasure:
You have the right to erase any personal data processed by us at any time except for the following situations:
• you have an ongoing matter with Customer Service
• you have an open order
• you have an unsettled balance with us
• if you have made any purchase, we will keep your personal data in connection to your transaction for book-keeping purposes
Right to restriction:
You have the right to request that we restrict the processing of your personal data under the following circumstances:
• if you object to a processing based on our legitimate interest, we will restrict all processing of such data pending the verification of the legitimate interest.
• if you have claimed that your personal data is incorrect, we must restrict all processing of such data pending the verification of the accuracy of the personal data.
• if the processing is unlawful, you can oppose the erasure of personal data and instead request the restriction of the use of your personal data instead
• if we no longer need the personal data but it is required by you to defend legal claims.
Right to withdraw your consent:
For each processing purpose you have given us your consent, you have the right to withdraw your consent at any time. If you do so, we will stop the processing of your personal data for that specific purpose.
If you, however, continue to receive marketing communication from us displayed in your social media feed or web browser, this is a matter entirely between you and your platform provider.
You can revoke your consent or object from further marketing communication by the following means: • following the instruction in each marketing post
• by editing the settings of your account
• configurate the privacy settings on your social media account or browser
• contact Customer Service
• disable your account and/or membership/loyalty program.
Right to object to processing based on our legitimate interest:
You have the right to object to processing of your personal data that is based on our legitimate interest. We will not continue to process the personal data unless we can demonstrate legitimate grounds for the process which overrides your interest and rights or due to legal claims.
How do you exercise your rights?
If you have an account or are a member of a loyalty program, you can exercise your right to access, portability and rectification under your account pages, where you also can delete your account.
You can contact us at any time if you have any questions regarding our privacy policy or the processing of your data: info@tonorex.se
Right to complain with a supervisory authority:
If you have complaints about the way Tonorex processes and protects your personal data and privacy you have the right to make a complaint to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten – IMY) or any other competent a supervisory authority in the country of residence.
Updates to our Privacy Notice:
We may need to update our Privacy Notice. The latest version of our Privacy Notice is always available on our website.
January 2023
