Privacy policy
This privacy policy describes how we process your personal data when you shop at pumplab.se, create an account, take part in PUMPLAB Loyalty, write a review or contact us.
We process your data in accordance with the General Data Protection Regulation (GDPR) and Swedish data protection legislation. Please read through it so you know what we collect and what rights you have.
1. Who is responsible for your data
The data controller is:
PumpLabSupplements AB, company reg. no. 559392-1678
Kungsängsvägen 17A, 753 23 Uppsala
Email: info@pumplab.se
We do not have a designated data protection officer, but you can always reach us at info@pumplab.se for questions relating to your personal data.
2. What data we collect
Data you provide yourself
- Account: name, email address, password (stored encrypted by Shopify), phone number, delivery and billing address, gender and, if you wish to provide it, your date of birth.
- Orders: what you bought, payment method (we never see full card numbers, which are handled by the payment provider), delivery address and order history.
- PUMPLAB Loyalty: points balance, total purchase amount, total earnings, tier, gender, date of birth, status of redeemed points and a list of which products you have received a review bonus for.
- Reviews: name (or initials) and the review you write. Reviews are published publicly on the site.
- Contact with us: what you write when you get in touch with customer service.
Data we collect automatically
- Technical information such as IP address, device, browser and how you use the site, via cookies and similar technology (see section 8).
3. Why we process the data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Complete purchases and delivery | Performance of a contract |
| Create and manage your account | Performance of a contract |
| Operate PUMPLAB Loyalty (points, tiers, benefits) | Performance of a contract / consent |
| Bookkeeping | Legal obligation (the Swedish Bookkeeping Act) |
| Send newsletters and offers | Consent |
| Publish product reviews | Consent / legitimate interest |
| Analyze and improve the site | Legitimate interest |
| Marketing and retargeting (ads) | Consent (via cookies) |
| Prevent fraud and misuse of the Program | Legitimate interest |
Where we rely on legitimate interest, we have assessed that the processing is necessary and that it does not infringe your rights. You can always object (see section 7).
4. Who we share data with
In order to run the store, we share data with suppliers who help us. With those who process data on our behalf (data processors), we have data processing agreements. Some, such as payment providers, are themselves data controllers and process your data in accordance with their own policy.
- Platform and operations: Shopify (e-commerce platform, accounts, order management) and Cloudflare (runs our loyalty function).
- Payment: Klarna and other payment providers at checkout. They are separate data controllers. See each provider's privacy policy.
- Shipping: DHL and Early Bird (home delivery), to deliver your orders.
- Reviews: Judge.me (product reviews) and Trustpilot (store rating).
- Email marketing: Klaviyo (if you have chosen to receive newsletters).
- Analytics and advertising: Meta (Facebook/Instagram), Google and TikTok. This sharing only takes place with your consent via cookies, and is used for statistics and to show you relevant ads.
We never sell your personal data.
5. Transfers outside the EU/EEA
Some of our suppliers (including Shopify, Cloudflare, Meta, Google and TikTok) may process data in the USA or other countries outside the EU/EEA. When this happens, we ensure protection through approved transfer mechanisms: the European Commission's Standard Contractual Clauses (SCC) or, where the provider is enrolled, the EU-US Data Privacy Framework.
6. How long we keep the data
| Data | Retention period |
|---|---|
| Purchase and order data (bookkeeping) | 7 years (legal requirement) |
| Account data | Until you delete your account |
| Loyalty data (points, purchase amount, tier, gender, date of birth) | Until you delete your account |
| Newsletters | Until you unsubscribe |
When a retention period has expired, we delete or anonymize the data.
7. Your rights
Under the GDPR, you have the right to:
- Access the data we hold about you.
- Rectify inaccurate data.
- Erase your data ("the right to be forgotten").
- Restrict the processing.
- Obtain and transfer your data (data portability).
- Object to processing based on legitimate interest.
- Withdraw consent at any time, e.g. for newsletters or cookies.
If you want to exercise any of these rights, get in touch with us at info@pumplab.se. To protect you, we may need to confirm your identity before we respond.
If you delete your account, your participation in PUMPLAB Loyalty ends at the same time: points balance, total purchase amount, total earnings, tier, gender and any saved date of birth are reset.
If you are not satisfied with how we handle your data, you can complain to the Swedish Authority for Privacy Protection (IMY), imy.se.
8. Cookies and tracking
We use cookies and similar technology to make the site work, for statistics and for marketing. Cookies are divided into:
- Necessary. Required for the site and checkout to work (e.g. remembering your cart). These cannot be opted out of.
- Analytics. Help us understand how the site is used so we can improve it.
- Marketing. Used to show you relevant ads, including via pixels from Meta, Google and TikTok.
Analytics and marketing cookies are only used if you have consented to them. You can control your cookie choices via your browser settings, or via our cookie banner if/when it is active on the site.
9. Children
The service is not directed at children, and we do not knowingly collect data about children under 16. If you are a guardian and believe that your child has provided data to us, get in touch and we will delete it.
10. Security
We protect your data with technical and organizational measures. Traffic on the site is encrypted (TLS), payments are handled by PCI-DSS-certified providers, passwords are stored encrypted and our loyalty function uses verified, secured calls. No solution is completely infallible, so avoid sending sensitive data to us via insecure channels.
11. Changes to this policy
We may update the policy, for example when the service or laws change. The latest version is always available here with the date of the most recent update. In the event of significant changes, we will inform you.
12. Contact
If you have questions about how we process your personal data, or want to exercise any of your rights:
PumpLabSupplements AB
Kungsängsvägen 17A, 753 23 Uppsala
Email: info@pumplab.se
Version: 1.1, 2026-06-26.