Privacy Policy

Last updated: 29 September 2026

1. Who we are

This Privacy Policy explains how Mohammad Rajeh, sole proprietor (enskild firma) trading as Ravarea ("Ravarea", "we", "us", "our"), organisation number 080829-7758, with business address [Norra Stationsgatan 5A, 633 44, Eskilstuna, Sweden] , processes your personal data when you visit our website, buy our products (including Ravarea Beetroot Gummies), create a customer account, subscribe to our newsletter or contact us.

Ravarea is the data controller for the processing described in this policy under the EU General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Swedish Data Protection Act (2018:218).

Contact for all privacy matters: ravarea.co@gmail.com

We have not appointed a Data Protection Officer because we are not legally required to do so.

2. Who this policy applies to

Our website and products are currently offered to consumers in Sweden. This policy applies to everyone whose personal data we process in connection with the website: visitors, customers, account holders, newsletter subscribers and people who contact us.

3. What personal data we collect

Identity and contact details: name, email address, phone number, delivery address and billing address.
Order and transaction data: products bought, quantities, prices, discount codes, order number and history, refunds and returns.
Payment data: the payment method used, payment status and transaction reference. We do not receive or store your full card number; it is handled by our payment providers (see section 9).
Delivery data: delivery address, chosen delivery option, tracking number and delivery status.
Account data: your email, your password (stored only in protected, hashed form by our e-commerce platform), saved addresses and order history.
Communications: emails and other messages you send us, and our replies.
Marketing data: whether you have subscribed to or unsubscribed from our newsletter, and how you interact with our emails (for example whether you open or click them).
Technical and usage data: IP address, browser type, device type, operating system, language, pages viewed, referring website and approximate location based on IP address, collected through cookies and similar technologies and server logs.
Fraud-prevention data: signals and risk assessments generated by our platform and payment providers to detect suspicious orders.

We do not ask for your personal identity number (personnummer) and we do not intentionally collect special categories of personal data (see section 8).

4. How we collect your data

From you, when you place an order, create an account, subscribe to our newsletter or contact us.
Automatically, through cookies, server logs and similar technologies when you use the website.
From our service providers, such as payment providers (payment confirmation and fraud checks), our carrier (delivery status) and our e-commerce platform.

You do not have to give us your personal data, but we cannot process your order without the information needed for payment and delivery (name, contact details, delivery address and payment).

5. Why we use your data and on what legal basis

To process and deliver your order (taking payment, sending order confirmations and delivery updates, handling returns and refunds). Legal basis: performance of a contract, GDPR Art. 6(1)(b).
To manage your customer account. Legal basis: performance of a contract, Art. 6(1)(b).
To provide customer service and handle questions, complaints and consumer-rights claims. Legal basis: performance of a contract and our legitimate interest in providing good service, Art. 6(1)(b) and (f).
Bookkeeping, accounting and tax compliance. Legal basis: legal obligation, Art. 6(1)(c), including the Swedish Accounting Act (1999:1078).
Compliance with consumer, food-safety and product-safety rules, including handling product complaints and reports of adverse reactions. Legal basis: legal obligation, Art. 6(1)(c).
Fraud prevention and security of our website, systems and customers. Legal basis: legitimate interest, Art. 6(1)(f).
Establishing, exercising or defending legal claims. Legal basis: legitimate interest, Art. 6(1)(f).
Newsletters and email marketing. Legal basis: your consent, Art. 6(1)(a) (see section 6).
Strictly necessary cookies (cart, checkout, security). Legal basis: legitimate interest and necessity to provide the service you request, Art. 6(1)(f).
Analytics cookies and similar technologies to understand and improve the website. Legal basis: your consent, Art. 6(1)(a), as required by the Swedish Electronic Communications Act (2022:482).
Business transfers, for example if Ravarea is sold or merged. Legal basis: legitimate interest, Art. 6(1)(f).

Where we rely on legitimate interest, we have weighed our interests against your rights and freedoms. You can ask us for information about this assessment.

Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before you withdrew it.

6. Email marketing and newsletters

We send newsletters and marketing emails using Shopify Email only to people who have agreed to receive them, for example by ticking the newsletter box at checkout or when creating an account, or by subscribing through a form on our website.
We do not use pre-ticked boxes. Creating an account or placing an order does not by itself sign you up for marketing.
Where the law allows us to contact existing customers about similar products based on their earlier purchase, we do so only if you were given a clear and easy way to object when we collected your email address, and you can object in every message.
Every marketing email contains an unsubscribe link. You can also opt out at any time by emailing ravarea.co@gmail.com. We will stop sending marketing without delay. Objecting to direct marketing is an absolute right.
Our email tool records whether marketing emails are opened and clicked so we can see what is relevant to customers.
Service messages such as order confirmations and delivery updates are not marketing and will still be sent.

We do not currently send SMS marketing or abandoned-cart reminders. If we introduce them, we will do so only with your consent and after updating this policy.

7. Cookies and similar technologies

Cookies are small files stored on your device. Our website uses:

Strictly necessary cookies that keep items in your cart, complete checkout, remember language and currency (SEK/EN) and keep the store secure and protected against fraud. These do not require consent.
Analytics cookies that give us statistics about how the website is used. These are used only if you accept them in our cookie banner.

We currently do not run paid advertising and do not use advertising or retargeting cookies. If this changes, we will update this policy and ask for your consent first.

You can accept, reject or change your cookie choices at any time through the cookie settings on the website, and you can delete or block cookies in your browser settings. Blocking strictly necessary cookies may stop the shop from working properly. More detail about individual cookies is available in our Cookie Policy [LINK, add once published].

8. Health-related information and product safety

Ravarea Beetroot Gummies are food supplements. Please do not send us health information (such as medical conditions, medication, pregnancy or allergies) unless it is necessary, for example when reporting a suspected adverse reaction to a product.

If you send us such information, it is a "special category" of personal data under GDPR Article 9. We process it only with your explicit consent (Art. 9(2)(a)), where necessary to establish, exercise or defend legal claims (Art. 9(2)(f)), or where required by law. We limit access to it, keep it only as long as necessary, and never use it for marketing or profiling.

Our products are not medicines and are not intended to diagnose, treat, cure or prevent any disease. Information on the website is general and is not medical advice. Our products are intended for adults (18+). If you are pregnant or breastfeeding, are taking medication or have a medical condition, speak to a doctor or pharmacist before use. Do not exceed the recommended daily intake.

If you experience an adverse reaction, stop using the product and seek medical advice if needed, and contact us at ravarea.co@gmail.com so we can handle your report.

9. Who we share your data with

We do not sell your personal data. We share it only when necessary, with the following recipients:

Shopify (Shopify International Limited, Ireland, and Shopify Inc., Canada), our e-commerce platform. Shopify hosts our store, processes orders, customer accounts, checkout, fraud analysis and email (Shopify Email). Shopify acts as our processor and, for some purposes, as an independent controller. See Shopify's privacy policy at shopify.com/legal/privacy.
Payment providers: Shopify Payments (card payments), Klarna (including invoice and instalment options; Klarna performs its own credit assessment and identity checks and acts as an independent controller under its own privacy policy), PayPal, and digital wallets Apple Pay and Google Pay.
PostNord, our carrier, which receives your name, address, phone number and email address so that your parcel can be delivered.
Google (Gmail), the email service we use to communicate with you.
Accounting and tax: [ACCOUNTING SOFTWARE OR FIRM], for bookkeeping and tax reporting.
Authorities, such as the Swedish Tax Agency, food-safety authorities, police or courts, where we are legally required to disclose information.
Professional advisers such as lawyers and insurers, where needed.
A future owner of the business, in connection with a sale or merger, under confidentiality.

We share only the data each recipient needs. Where a recipient acts as our processor, it may process your data only on our instructions and under a data processing agreement or equivalent terms.

10. Transfers outside the EU/EEA

Some of our providers, such as Shopify and Google, may process personal data outside the EU/EEA, for example in Canada or the United States. We ensure a lawful transfer mechanism is in place, such as an adequacy decision from the European Commission (including for certified companies under the EU–US Data Privacy Framework and for commercial organisations in Canada), the EU Standard Contractual Clauses with additional safeguards where needed, or another mechanism allowed under GDPR Chapter V. You can request more information about these safeguards by contacting us.

11. How long we keep your data

Order, invoice and payment records: seven (7) years after the end of the calendar year in which the financial year ended, as required by the Swedish Accounting Act.
Customer account: until you ask us to delete it, or after 24 months of inactivity, whichever comes first. Order records are kept separately as stated above.
Customer service emails and messages: 12 months after the matter is closed, or longer if needed to handle or defend a legal claim.
Newsletter subscription: until you unsubscribe or withdraw consent. We then keep a minimal record of your opt-out so that we do not contact you again.
Analytics and cookie data: for the period stated in the cookie settings, and no longer than 24 months.
Adverse-reaction reports and product complaints: as long as required by law or needed to handle the case and follow up on product safety.
Fraud-prevention data: up to 24 months, and longer if fraud is confirmed.

When the retention period ends, we delete or anonymise the data. Shopify and our other providers may keep data for the periods stated in their own policies.

12. Automated decisions and profiling

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. Our platform and payment providers may run automated fraud checks on orders. If an order is stopped, you can contact us and we will review it manually.

13. Your rights

Under GDPR you have the right to:

Access your personal data and receive a copy (Art. 15).
Rectification of inaccurate or incomplete data (Art. 16).
Erasure of your data when there is no longer a legal reason to keep it (Art. 17). We cannot delete data we are legally required to keep, such as accounting records.
Restriction of processing in certain situations (Art. 18).
Data portability, meaning to receive data you gave us in a structured, commonly used, machine-readable format (Art. 20).
Object to processing based on legitimate interest, and to object at any time to direct marketing (Art. 21).
Withdraw your consent at any time (Art. 7(3)).
Not be subject to solely automated decisions with significant effects (Art. 22).
Lodge a complaint with a supervisory authority (see section 18).

How to exercise your rights: email us at ravarea.co@gmail.com. This includes asking us to delete your customer account or to send you a copy of your data. We may need to verify your identity first. We answer without undue delay and 14 days. This period can be extended by up to two further months for complex or numerous requests, and we will tell you if that happens. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive, in which case GDPR allows us to charge a reasonable fee or refuse.

14. Security

We use appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, disclosure and alteration. These include encrypted (HTTPS) connections, secure hosting and payment handling by our platform and payment providers, restricted access to our store and customer data (only the owner has access), and protected login to our administration tools.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please choose a strong, unique password for your customer account and keep it confidential.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Swedish Authority for Privacy Protection (IMY) within 72 hours where required, and inform affected individuals without undue delay where the risk is high.

15. Age limit

Our website and products are intended for persons aged 18 or older. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it promptly.

16. Links to other websites

Our website may contain links to third-party websites. We are not responsible for their content or privacy practices, so please read their privacy policies.

17. Changes to this policy

We may update this policy, for example when our services, providers or the law change. The current version is always available on our website with the "Last updated" date at the top. If we make material changes, we will inform you in a suitable way, for example by email or a notice on the website, and ask for your consent again where required.

18. Complaints

If you believe we process your personal data in breach of the law, please contact us first so that we can try to resolve the matter. You also have the right to complain to the Swedish supervisory authority:

Integritetsskyddsmyndigheten (IMY)
Box 8114, 104 20 Stockholm, Sweden
Website: www.imy.se
Email: imy@imy.se

19. Governing law

This policy is governed by Swedish law and applicable EU law. Nothing in this policy limits your mandatory rights as a consumer or as a data subject.

20. Contact

Ravarea [Mohammad Rajeh], sole proprietor (Enskild Firma)
Organisation number: 080829-7758
Address: Norra Stationsgatan 5A, 633 44, Eskilstuna, Sweden
Email: ravarea.co@gmail.com