Privacy policy
Last updated: April 25, 2026
Carateu operates this store and website, including all related information, content, features, tools, products and services (the “Services”), in order to provide you with a curated shopping experience. The Services are operated by Carateu AB (Swedish company registration number 5595225144).
Carateu AB is the data controller responsible for the processing of your personal information under applicable data protection laws.
Carateu is powered by Shopify, which enables us to provide the Services to you. This Privacy Policy describes how we collect, use, and disclose your personal information when you visit, use, or make a purchase or otherwise interact with the Services. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.
By using and accessing the Services, you acknowledge that you have read this Privacy Policy and understand the collection, use, and disclosure of your information as described below.
Personal Information We Collect or Process
When we use the term “personal information,” we refer to information that identifies or can reasonably be linked to you.
We may collect or process the following categories of personal information:
-
Contact details including your name, billing address, shipping address, phone number, and email address.
-
Financial information including payment card details, payment confirmations, transaction details, and form of payment. Payment card data is processed securely by our payment providers.
-
Account information including username, password, preferences, and settings.
-
Transaction information including items viewed, added to cart or wishlist, purchased, returned, exchanged, or cancelled.
-
Communications including customer support inquiries and correspondence.
-
Device information including IP address, browser type, device identifiers, and network information.
-
Usage information regarding how you interact with the Services.
Personal information does not include anonymized or de-identified information.
Personal Information Sources
We may collect personal information:
-
Directly from you when you create an account, place an order, or contact us.
-
Automatically through cookies and similar technologies when you use the Services.
-
From service providers who process information on our behalf.
-
From partners or other third parties where permitted by law.
How We Use Your Personal Information
We may use your personal information to:
Provide, Tailor, and Improve the Services
To process payments, fulfill orders, manage your account, arrange shipping, facilitate returns, and provide customer support.
Marketing and Advertising
To send marketing communications (where permitted by law) and to display advertisements based on your interactions with our Services. You may opt out at any time.
Security, Fraud Prevention, and Compliance
To authenticate accounts, secure transactions, detect and prevent fraudulent, illegal, malicious, or sanctions-related activity, and comply with anti-money laundering, export control, and other legal obligations.
Communication
To respond to inquiries and maintain our business relationship with you.
Legal Obligations
To comply with legal requirements, enforce our terms, and protect our rights.
Legal Basis for Processing (EU/EEA and UK)
If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal information on the following legal bases:
-
Performance of a contract – to process orders and provide Services.
-
Compliance with legal obligations – including accounting, tax, anti-money laundering, and sanctions compliance requirements.
-
Legitimate interests – to prevent fraud, secure our Services, and operate our business efficiently.
-
Consent – where required, for marketing communications or non-essential cookies. You may withdraw consent at any time.
How We Disclose Personal Information
We may disclose personal information:
-
To Shopify and service providers (IT, payment processing, shipping, analytics, cloud storage).
-
To business and marketing partners, subject to applicable law.
-
Where required to comply with legal obligations.
-
In connection with corporate transactions such as mergers or restructuring.
Relationship with Shopify
The Services are hosted by Shopify. Shopify processes personal information to provide and improve the Services. Shopify may also process data to support certain enhanced features. For more information, please visit:
Third-Party Websites
We are not responsible for the privacy practices of third-party websites linked from our Services.
Children's Data
The Services are not intended for children. We do not knowingly collect personal information from children under the age of majority in their jurisdiction. If you believe a child has provided personal information, please contact us.
As of the date of this Privacy Policy, we do not have actual knowledge that we sell or share personal information of individuals under 16 years of age.
Security and Retention of Information
We implement appropriate technical and organizational measures to protect personal information.
We retain personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy, including compliance with legal and regulatory requirements.
For example:
-
Transaction and accounting records may be retained for up to seven years in accordance with Swedish bookkeeping and tax laws.
-
Information processed for fraud prevention, anti-money laundering, or sanctions compliance may be retained longer where required by law.
Your Rights and Choices
Depending on your location, you may have the right to:
-
Access your personal information
-
Request correction of inaccurate data
-
Request deletion of personal information
-
Restrict or object to processing
-
Data portability
-
Withdraw consent (where processing is based on consent)
You may exercise your rights by contacting us at info@carateu.com.
If you reside in the EEA, you may lodge a complaint with your local data protection authority. In Sweden, the supervisory authority is Integritetsskyddsmyndigheten (IMY).
International Transfers
Personal information may be transferred outside your country of residence. Where transfers occur outside the EEA or UK, we rely on recognized safeguards such as the European Commission’s Standard Contractual Clauses unless the destination country has been deemed to provide an adequate level of protection.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will post the revised version on our website and update the “Last updated” date.
Contact
If you have questions about this Privacy Policy or wish to exercise your rights, please contact:
Carateu AB
c/o Places AB
Karlavägen 64
114 49 Stockholm
Sweden
Email: info@carateu.com
For the purposes of applicable data protection laws, Carateu AB is the data controller of your personal information.
