Privacy policy
Last updated: 19 October 2026
1. Data controller
Ourroots AB is the data controller for the processing of your personal data.
2. What data we collect
We collect the following categories of personal data:
- Contact details — name, email address, phone number and delivery address when you purchase or use the contact form.
- Order details — order number, products, amounts and payment reference.
- Account details — email and password (hashed) for the club and seller portal.
- Hair analysis — email address, uploaded images and questionnaire answers. Images are stored only for the duration of the analysis and are deleted automatically afterwards.
- Technical data — IP address, browser type and page views. Visitor statistics via Google Analytics are only collected if you have accepted analytics cookies.
3. Purposes and legal basis
- Performance of a contract — processing orders, deliveries and customer service (Art. 6.1 b GDPR).
- Legitimate interest — improving our services, analysing aggregated usage statistics and preventing abuse (Art. 6.1 f GDPR).
- Consent — sending newsletters and marketing, and measuring visitor statistics with Google Analytics if you have accepted analytics cookies. You may withdraw your consent at any time (Art. 6.1 a GDPR).
- Legal obligation — bookkeeping and tax law require us to retain certain data (Art. 6.1 c GDPR).
4. How long we keep data
- Order data — 7 years (Swedish Bookkeeping Act).
- Account details — until the account is deleted.
- Hair analysis images — deleted immediately after analysis.
- Newsletter subscription — until you unsubscribe.
- Visitor statistics in Google Analytics — 14 months, then deleted automatically.
5. Recipients of data
We share personal data with the following categories of recipients, always with appropriate safeguards:
- Payment provider — to process transactions.
- Carriers — to deliver physical products.
- Fortnox — bookkeeping and invoicing.
- OpenAI — hair analysis and AI chat (both the public chat widget and the portal assistant). Data is sent encrypted and is not stored by OpenAI for training under our enterprise configuration.
- Google (Google Ireland Ltd) — Google Analytics 4 for visitor statistics, only if you have accepted analytics cookies. Google's advertising features are not used.
- Hosting provider (Railway) — infrastructure within the EU/EEA.
6. Transfers outside the EU/EEA
We aim to keep all data within the EU/EEA. When transferring to a third country (e.g. OpenAI's and Google's servers in the USA), we ensure adequate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) or an adequacy decision.
7. Your rights
Under the GDPR you have the right to:
- Access your personal data (subject access request).
- Rectify inaccurate data.
- Erase data ("the right to be forgotten").
- Restrict processing.
- Object to processing based on legitimate interest.
- Data portability — receive your data in a machine-readable format.
- Withdraw consent for newsletters and marketing.
You can exercise your rights in two ways. The fastest is to email hej@roots.nu from the email address we have on file for you. For formal requests — e.g. power of attorney or if you want the reply by post — write to Ourroots AB and mark the envelope "Data protection".
We respond to requests within 30 days under GDPR Art. 12.3.
9. Security
We take technical and organisational measures to protect your data, including encryption (TLS), hashed passwords (Argon2id), access control and regular security reviews.
10. Complaints
If you believe we handle your personal data incorrectly, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), www.imy.se.
11. Changes
We may update this policy. Material changes will be announced by email or on the website. The date at the top shows the latest version.