Privacy Policy

Evelli AB

Last updated: 27 March 2026

1. Introduction

Evelli AB, company registration number 559225-2836, with its registered office at Sturegatan 44 A, 114 36 Stockholm, Sweden (hereinafter referred to as "Evelli", "we", "us", or "our"), is firmly committed to protecting the privacy and personal data of our customers, users, and all individuals with whom we interact. We recognise that privacy is a fundamental right and that you should have clear, transparent information about how your personal data is collected, used, stored, and protected.

This Privacy Policy describes in detail the personal data we collect across the various points of interaction with Evelli, including when you visit our website, create a customer account, make a purchase in our online store, use our application, subscribe to our newsletter, or contact us for support. It also explains the legal bases on which we rely to process your data, with whom we may share it, how long we retain it, and what rights you hold in relation to it.

Evelli AB is the data controller for the personal data processed as described in this policy, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (the General Data Protection Regulation, or GDPR) and applicable Swedish data protection legislation.

If you have any questions, concerns, or requests relating to the processing of your personal data, you are welcome to contact us at support@evelli.com. We will endeavour to respond to all enquiries promptly and thoroughly.

2. Personal Data We Collect and Why

We collect and process personal data only for specific, legitimate purposes, and only to the extent necessary to fulfil those purposes. The following sections describe the categories of data we collect and the reasons for which we process them.

2.1 Purchases and Order Fulfilment

When you make a purchase through our online store, we process the personal data necessary to complete your order and deliver your products. This includes your full name, delivery and billing address, email address, telephone number, and, where applicable, your personal identification number. Personal identification numbers are processed exclusively in connection with payment via Klarna and are handled by Klarna acting as an independent data controller, subject to Klarna's own privacy policy.

We also maintain records of your order history and customer relationship data. These records are used to fulfil our contractual obligations to you, manage product deliveries, handle warranty claims and returns, and provide effective after-sales customer support. The legal basis for this processing is the performance of a contract to which you are a party.

2.2 Customer Accounts

When you register for a customer account with Evelli, we process the information you provide during registration, including your name, email address, and login credentials. Your account enables a more efficient and personalised purchasing experience, providing you with easy access to your order history, saved preferences, and product-related features and services.

The legal basis for processing account data is the performance of a contract, as the account is a service we provide to you at your request. You may request the deletion of your account at any time by contacting us at support@evelli.com.

2.3 Use of Our Application

When you use the Evelli application, we process personal data that is necessary to provide the application's functionality and to support you as a user. Depending on the features you use, this may include:

• Account information associated with your Evelli profile

• Technical information about your device, including operating system and firmware version

• System environment data relevant to the performance of the application

• Usage data and interaction logs, used to understand how the application is used and to identify areas for improvement

• Product serial numbers linked to your customer account

• Diagnostic and troubleshooting data generated during your use of the application

These data are processed for the purposes of ensuring the proper functionality of the application, enabling wireless control and configuration of your Evelli products, improving application performance, conducting troubleshooting, and further developing our products and services. The legal basis for this processing is the performance of a contract, supplemented by our legitimate interest in improving and maintaining the quality of our offerings.

2.4 Customer Support and Enquiries

When you contact us via our contact form, by email, or through any other support channel, we process the personal data you voluntarily provide, including your name, contact details, and the content of your message or enquiry. This data is used solely for the purpose of responding to your query and providing appropriate support. We may retain records of our communications with you in order to track ongoing matters and improve the quality of our support services. The legal basis for this processing is our legitimate interest in providing responsive and effective customer service, as well as the performance of a contract where your enquiry relates to a purchase or product issue.

2.5 Newsletter and Marketing Communications

If you choose to subscribe to our newsletter, we process your email address for the purpose of sending you information about our products, services, promotions, and company news. Subscription to our newsletter is entirely voluntary, and your consent constitutes the legal basis for this processing.

You may unsubscribe from our marketing communications at any time, either by clicking the unsubscribe link included in every newsletter or by contacting us directly at support@evelli.com. Withdrawal of consent will not affect the lawfulness of any processing that took place prior to your withdrawal.

3. Marketing and Analytics

We use a range of analytics and marketing tools to better understand how our website is used and to deliver relevant, targeted advertising to current and prospective customers. The tools we currently use include Google Analytics, Meta Pixel (Facebook Pixel), and Hotjar. These services help us to:

• Analyse visitor behaviour and traffic patterns on our website

• Identify the most visited pages and most used features

• Measure the effectiveness of our marketing campaigns and advertising spend

• Display personalised advertisements on social media and third-party platforms

• Improve the overall usability and content of our website

Where required by applicable data protection law, the use of these tools is based on your consent, which you may provide or withdraw through our cookie consent banner. In other cases, processing is carried out on the basis of our legitimate interest in developing and promoting our business effectively. For further details on the specific cookies and trackers used, please refer to our Cookie Policy.

We also conduct business-to-business (B2B) marketing activities directed at corporate contacts. In this context, we process professional contact information, such as name, job title, and business email address, on the basis of our legitimate interest in marketing our products and services to relevant organisations. Recipients of B2B marketing communications always have the right to opt out.

4. Legal Basis for Processing

We process personal data only where we have a lawful basis for doing so under the GDPR. The legal bases we rely on are as follows:

• Contract performance is the primary legal basis for processing data in connection with purchases, order fulfilment, account management, and use of our application. Without this data, we would be unable to deliver the products and services you have requested. 

• Performance of a contract: Certain processing activities are required in order to comply with applicable legal obligations, including accounting and bookkeeping requirements under Swedish law (e.g., the Swedish Accounting Act). 

• Legal obligation: We process certain data on the basis of our legitimate interests in operating and developing our business, improving our products and services, and conducting marketing activities, provided that these interests are not overridden by your fundamental rights and freedoms. 

• Legitimate interests: Where we rely on consent as a legal basis, such as for newsletters or certain cookies, we will always ask for your explicit agreement before processing begins. You may withdraw your consent at any time without affecting the lawfulness of prior processing. Consent:

5. Sharing of Personal Data

In order to operate our business and deliver our products and services effectively, we share personal data with a carefully selected group of partners and service providers. We share only the data that is strictly necessary for the purposes described in this policy, and we require all recipients to handle personal data responsibly and in accordance with applicable law.

Our current categories of data recipients include:

• Payment providers: Klarna processes payment data as an independent data controller in connection with purchases made through our online store.

• Logistics and warehousing partners: We share delivery information with third-party logistics providers (3PLs) for warehousing and fulfilment purposes.

• Shipping carriers: Delivery address and contact information is shared with shipping partners such as but not limited to Sendify, DHL, UPS, and PostNord to enable the physical delivery of your order.

• Technology and platform providers: We use Webflow as our website platform, Pipedrive for customer relationship management, and Fortnox for accounting and financial administration.

• Analytics and marketing providers: Personal data may be shared with providers such as Google and Meta in connection with our analytics and advertising activities, subject to your consent where required.

Where third-party providers process personal data on our behalf, we have entered into data processing agreements (DPAs) in accordance with Article 28 of the GDPR to ensure that your data is handled appropriately and only for the purposes we specify. We do not sell personal data to third parties, and we do not permit our service providers to use your data for their own marketing purposes without your consent.

6. International Transfers of Personal Data

Evelli sells and delivers products to customers around the world. As a result, personal data may be processed in countries outside the European Union or the European Economic Area (EU/EEA) in connection with international deliveries, the use of global service providers, or the servicing of customers located outside the EU/EEA.

Whenever personal data is transferred to a country outside the EU/EEA that has not been deemed to provide an adequate level of data protection by the European Commission, we ensure that appropriate safeguards are in place to protect your data. Such safeguards may include:

• Standard Contractual Clauses (SCCs) approved by the European Commission

• Binding Corporate Rules (BCRs) where applicable

• Other appropriate legal mechanisms recognised under the GDPR

You may request further information about the specific safeguards applicable to any international transfer of your data by contacting us at support@evelli.com.

7. Data Retention

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our general retention principles are as follows:

• Customer and order data: Retained for up to three years following the date of your most recent transaction or interaction with us, unless a longer retention period is required by law or is necessary to resolve an ongoing dispute.

• Accounting and financial records: Retained for seven years in accordance with the Swedish Accounting Act (Bokföringslagen).

• Account and application data: Retained for as long as your account remains active or for as long as is necessary to provide you with our services. If you close your account, we will delete or anonymise your data in accordance with our standard procedures, subject to any legal retention obligations.

• Marketing and newsletter data: Retained until you withdraw your consent or until we determine that the data is no longer needed for marketing purposes.

• Support and correspondence records: Retained for a reasonable period following the resolution of your enquiry, in order to maintain a record of our customer interactions.

When personal data is no longer required for any legitimate purpose, it is securely deleted or irreversibly anonymised in accordance with our internal data management procedures.

8. Your Rights Under GDPR

As a data subject under the GDPR, you have a number of important rights in relation to the personal data we hold about you. These rights are described below, along with information on how to exercise them.

• Right of access: You have the right to request a copy of the personal data we hold about you, along with information about how it is being processed.

• Right to rectification: You have the right to request the correction of any inaccurate or incomplete personal data we hold about you.

• Right to erasure: In certain circumstances, you have the right to request the deletion of your personal data, for example where the data is no longer necessary for the purposes for which it was collected.

• Right to restriction of processing: You have the right to request that we restrict the processing of your data in certain circumstances, for example while the accuracy of the data is being contested.

• Right to data portability: Where processing is based on your consent or on a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format.

• Right to object: You have the right to object to processing carried out on the basis of legitimate interests, including profiling for direct marketing purposes.

• Right to withdraw consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please contact us at support@evelli.com. We will respond to your request within the timeframes prescribed by applicable law (generally within one month of receipt). We may request proof of identity before processing your request in order to protect the security of your data.

If you are not satisfied with our response, or if you believe that we are processing your personal data in a manner that is not compliant with applicable law, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), which is the supervisory authority responsible for data protection matters in Sweden.

9. Data Security

The security of your personal data is of paramount importance to us. We implement a range of appropriate technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction.

Our security measures include, among other things, the use of encryption for data in transit and at rest, access controls that restrict access to personal data to authorised personnel only, regular security assessments and reviews, and internal policies and procedures governing the handling of personal data. Employees who have access to personal data are trained in data protection obligations and are bound by confidentiality requirements.

In the event of a personal data breach that is likely to result in a high risk to the rights and freedoms of affected individuals, we will notify those individuals without undue delay, in accordance with our obligations under Article 34 of the GDPR. We will also notify the relevant supervisory authority within 72 hours of becoming aware of the breach, where required by law.

10. Children's Privacy

Our products, services, and website are intended for use by adults and are not directed at children under the age of 13. We do not knowingly collect or process personal data from children under the age of 13. If we become aware that we have inadvertently collected personal data from a child under this age without appropriate parental or guardian consent, we will take prompt steps to delete such data from our records.

If you believe that we may have collected personal data from a child under the age of 13, please contact us immediately at support@evelli.com.

11. Changes to This Privacy Policy

We reserve the right to update and amend this Privacy Policy from time to time in order to reflect changes in our data processing practices, developments in applicable legislation, or updates to our products and services. The most current version of this policy will always be available on our website, together with the date on which it was last revised.

Where changes are material, we will take reasonable steps to bring them to your attention, for example by displaying a prominent notice on our website or by sending a notification to the email address associated with your account, where appropriate. We encourage you to review this policy periodically to stay informed about how we protect your personal data.

If you have any questions about this Privacy Policy or about our data protection practices generally, please do not hesitate to contact us at support@evelli.com.

Evelli AB  ·  Sturegatan 44 A, 114 36 Stockholm, Sweden  ·  559225-2836  ·  support@evelli.com