Integritetspolicy

Last updated: 21 September 2026

This policy explains how we collect, use and share your personal data when you visit marvilleroad.com, shop with us, book an appointment in our store or contact us, and how you can exercise your rights.

1. Who we are

The data controller is House of Appeal AB (org. no. 556821-2749), Birger Jarlsgatan 16, 114 34 Stockholm, Sweden. House of Appeal AB runs the brand Marville Road ("we", "us", "our").

For any privacy question or request, email customercare@marvilleroad.com.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and supplementary Swedish law, including the Swedish Electronic Communications Act and the Swedish Marketing Act. Where other laws apply to you, such as the UK GDPR or US state privacy laws, see section 11.

2. What we process, why, and on what legal basis

Purpose	Personal data	Legal basis
Processing, paying for and delivering your order	Name, address, email, phone, order details, payment confirmation	Contract (Art. 6(1)(b))
Returns, exchanges and complaints	Name, contact details, order details, reason for return	Contract (Art. 6(1)(b)); legal obligation under consumer law (Art. 6(1)(c))
Customer account, wishlist, loyalty program and reviews	Name, email, password, order history, points balance, saved items, review content	Contract (Art. 6(1)(b))
Booking in-store appointments	Name, email, phone, appointment time, any message you add	Contract (Art. 6(1)(b))
Customer service, via chat and email	Name, contact details, message content, order details	Legitimate interest in answering and helping you (Art. 6(1)(f))
Newsletter by email	Name, email, purchase history, email opens and clicks	Consent (Art. 6(1)(a))
Personalized product recommendations on the site	Browsing and purchase behavior, cookie ID	Consent (Art. 6(1)(a))
Website analytics and session recordings	Device and browser data, IP address, pages visited, clicks, scrolling and mouse movement	Consent (Art. 6(1)(a))
Targeted advertising and ad measurement, including server-side conversion data	Hashed email and phone, IP address, device data, cookie IDs, events such as page view, add to cart and purchase	Consent (Art. 6(1)(a))
Bookkeeping and tax	Order and payment records	Legal obligation under the Swedish Bookkeeping Act (Art. 6(1)(c))
Fraud prevention and site security	IP address, device data, order and payment details	Legitimate interest in preventing fraud and misuse (Art. 6(1)(f))
Establishing, exercising or defending legal claims	Relevant order and communication data	Legitimate interest (Art. 6(1)(f))

We receive personal data directly from you, from your device via cookies and similar technologies (only with your consent where required), and from Shopify and our payment providers.

We only use your data for the purposes above, or for purposes compatible with them. Before using it for an unrelated purpose, we'll inform you and, where required, ask for your consent.

You don't have to give us your data. Without the details needed for an order, however, we can't deliver your purchase.

3. Cookies and tracking

We only use cookies, pixels and similar technologies that aren't strictly necessary after you consent in our cookie banner. This covers analytics, personalization and marketing.

Strictly necessary: Keep the shop working, such as the cart, checkout, login and storing your cookie choice. These don't require consent.
Analytics: Google Analytics and Microsoft Clarity. Clarity records how you interact with pages, such as clicks, scrolling and mouse movement. Text you type in form fields is masked.
Personalization: Depict, for product recommendations based on what you browse.
Marketing: Meta (Facebook and Instagram), Google Ads, TikTok and Klaviyo, for targeted ads, ad measurement and email personalization.

Consent also covers data we send server-side to advertising platforms, such as Meta Conversions API and TikTok Events API. If you decline marketing cookies, we don't send this data.

You can change or withdraw your consent at any time via the "Cookie settings" link in the footer of our website. Our Cookie Policy lists every cookie we use, its purpose and its lifetime.

We treat the Global Privacy Control (GPC) signal as an opt-out of targeted advertising for that browser.

We share personal data only with the parties below, and only as needed for the purposes in section 2. Processors act on our instructions under a data processing agreement. Independent controllers process data under their own privacy policies.

Recipient	Role	Purpose
Shopify	Processor for our store data; independent controller for Shop Pay and Shopify account services	E-commerce platform, hosting and checkout. See Shopify's Privacy Policy at shopify.com/legal/privacy
Shopify Payments (Stripe)	Independent controller	Card payments and fraud checks
Klarna Bank AB	Independent controller	Invoice, installment and card payments, including credit checks
PayPal	Independent controller	PayPal payments
Swish (Getswish AB and your bank)	Independent controllers	Swish payments
PostNord, DHL and Budbee	Independent controllers	Delivery and delivery notifications
Klaviyo	Processor	Newsletter
Meta Platforms Ireland	Joint controller for data collected via pixel and Conversions API, then independent controller (consent only)	Advertising on Facebook and Instagram
Google Ireland	Processor for Google Analytics; independent controller for Google Ads (consent only)	Analytics and advertising
TikTok	Joint controller for data collected via pixel and Events API, then independent controller (consent only)	Advertising on TikTok
Microsoft (Clarity)	Independent controller (consent only)	Session recordings and heatmaps
Depict	Processor (consent only)	Product recommendations
Growave and Smile	Processors	Reviews, wishlist and loyalty program
Intercom	Processor	Customer service chat and email
Yayloh	Processor	Returns and exchanges
Meety	Processor	In-store appointment booking
Pandectes	Processor	Consent management and data requests
Accountants, auditors and legal advisors	Processors or independent controllers	Bookkeeping, audit and legal advice
Authorities	Independent controllers	When required by law, such as to the Swedish Tax Agency or police

Joint controllers: For data collected on our website via the Meta pixel and Conversions API, we and Meta Platforms Ireland are joint controllers for the collection and transmission of that data to Meta. The same applies to TikTok for data collected via the TikTok pixel and Events API. We are responsible for informing you and obtaining your consent. Meta and TikTok are responsible for handling your rights regarding the data once they receive it. After transmission, Meta and TikTok process the data as independent controllers. The essence of these arrangements is set out in Meta's Controller Addendum at facebook.com/legal/controller_addendum and TikTok's Jurisdiction Specific Terms at ads.tiktok.com/i18n/official/policy/jurisdiction-specific-terms. You can exercise your rights against us or against Meta or TikTok.

Klarna may carry out a credit check when you choose to pay by invoice or installments. Read more in Klarna's privacy notice at klarna.com.

We may also disclose data in connection with a sale, merger or restructuring of the business, subject to confidentiality.

We don't sell your personal data for money. See section 11 on "selling" and "sharing" as defined in some US state laws.

5. Transfers outside the EU/EEA

Some recipients process data outside the EU/EEA, mainly in the US and Canada. These include Shopify, Klaviyo, Meta, Google, TikTok, Microsoft, Intercom, PayPal, Stripe, Growave and Smile.

Transfers rely on one of the following safeguards:

An adequacy decision by the European Commission, for example for Canada, the UK, or US companies certified under the EU-US Data Privacy Framework.
The European Commission's Standard Contractual Clauses (SCCs), with supplementary measures where needed.

You can request information about the safeguards for a specific recipient at customercare@marvilleroad.com.

6. How long we keep data

We keep personal data only as long as needed for the purpose it was collected for, or as required by law.

Data	Retention
Order and payment records	7 years after the end of the financial year, as required by the Swedish Bookkeeping Act
Order data needed for returns and complaints	3 years after purchase, the consumer complaint period
Customer account, wishlist and loyalty points	Until you delete the account, or 36 months after your last activity
Reviews	As long as they're published, or until you ask us to remove them
In-store appointment bookings	12 months after the appointment
Customer service messages	24 months after the case is closed
Newsletter subscription	Until you unsubscribe or withdraw consent
Cookies and tracking data	Per the lifetimes in our Cookie Policy. Your consent choice is stored for 12 months
Data needed for a legal claim	Until the claim is resolved

7. Profiling and automated decisions

With your consent, we use your browsing and purchase behavior to personalize product recommendations on our site (Depict), newsletter content (Klaviyo) and ads (Meta, Google, TikTok).

This profiling doesn't produce legal or similarly significant effects for you. We don't make decisions based solely on automated processing. The exception is payment providers such as Klarna, which may make automated credit and fraud decisions as independent controllers under their own policies.

8. Your rights

Right to object: You can object at any time to processing based on our legitimate interest. We'll stop unless we have compelling legitimate grounds, or need the data for a legal claim. You can always stop marketing: use the unsubscribe link in any newsletter, or email us.

You also have the right to:

Access your personal data and get a copy of it
Rectification of inaccurate or incomplete data
Erasure of your data, unless we must keep it by law, for example for bookkeeping
Restriction of processing, for example while we check a disputed fact
Data portability: get data you gave us under contract or consent in a machine-readable format, or have it sent to another company
Withdraw consent at any time, for example via "Cookie settings" or the unsubscribe link. Withdrawal doesn't affect processing that took place before it

To make a request, email customercare@marvilleroad.com or use the data request form on our website. We may ask you to verify your identity. We answer within one month, which may be extended by two months for complex requests.

Complaints: If you're unhappy with how we handle your data, contact us first. You also have the right to complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se, or to the supervisory authority where you live or work.

9. Security

We protect your data with technical and organizational measures. These include encrypted connections (HTTPS), access control, and data processing agreements with every processor.

No transmission over the internet is completely secure. If a personal data breach is likely to put your rights at high risk, we'll inform you without undue delay.

10. Other

Children: Our services are not directed at children under 13, and we don't knowingly collect their data. If you believe a child has given us personal data, contact us and we'll delete it.

Reviews: Reviews you publish on our website are public, together with your first name or the display name you choose.

Social media: When you follow or interact with Marville Road on Instagram, Facebook, TikTok or other platforms, that platform's own privacy policy also applies. We are joint controllers with Meta for statistics on our Facebook and Instagram pages.

Third-party websites: Our website may link to other websites. This policy doesn't cover them, so read their privacy policies.

Changes: We may update this policy. The latest version is always published here with its date, and we'll notify you by email about material changes.

11. Customers outside the EU/EEA

We sell worldwide and apply this policy to all customers. The following additions apply depending on where you live.

United Kingdom: You have the same rights under the UK GDPR as described in section 8. You can complain to the Information Commissioner's Office (ICO) at ico.org.uk.

United States: Some state laws, such as the California Consumer Privacy Act (CCPA/CPRA), treat sharing data with advertising partners for targeted ads as "selling" or "sharing" personal information.

In the past 12 months we have disclosed identifiers (such as hashed email and cookie IDs), commercial information (such as purchase events) and internet activity (usage data) to Meta, Google and TikTok for this purpose.
You can opt out via "Cookie settings" or by enabling the Global Privacy Control signal in your browser.
You have the right to know, delete, correct and access your personal information, and to not be discriminated against for exercising these rights. You may use an authorized agent to make a request on your behalf.
We don't knowingly sell or share personal information of consumers under 16, and we don't use sensitive personal information to infer characteristics about you.
If we deny your request, you can appeal by replying to our decision.

Other countries: Where local law gives you additional rights, contact us and we'll handle your request accordingly.

12. Contact

House of Appeal AB (Marville Road) Org. no. 556821-2749 Birger Jarlsgatan 16 114 34 Stockholm, Sweden customercare@marvilleroad.com