Privacy Policy

Who we are

Our website address is: https://pouchpick.com.

PouchPick is operated by Åre Taxi & Transport AB, Swedish company registration number 559449-2893, registered at Vik 718, 837 97 Åre, Sweden.

Contact: support@pouchpick.com

PouchPick Club

This section explains how we process personal data for PouchPick Club, our free loyalty programme (see the PouchPick Club terms), and for the account emails we send to every customer. The operator named above is responsible for this processing (the controller). Contact: support@pouchpick.com.

What we process.

• your account email address, and your name if you add it to your account;
• your membership: status, member id, when you joined, left or rejoined, the terms version you accepted, and when you confirmed your email address;
• your confirmation that you are of legal age to buy nicotine products where you live, with its date;
• your points, rewards and Club level, and the orders that earn or use points (order number, eligible amount, currency);
• your referral code and referral records;
• your birthday (month and day), if you save it in My Club;
• your language and region;
• your communication choices and their history;
• records of the account and Club emails we sent you: which email, when, and whether Klaviyo accepted it. Never the link it contained.

If you sign up through a member’s link or code, we record the referral: your account, a coded form of your email address, and your first order and its amount. The member who referred you sees a masked form of your address and the referral’s status. A cookie keeps the referral code for 30 days.

To join, you need an account email address, and you must accept the Club terms and confirm your age. Everything else is optional.

Why, and on what legal basis.

• Running your membership, on the basis of performing the Club terms you accepted (GDPR Article 6(1)(b)). This covers:
  • confirming your email address;
  • keeping your points, rewards, level and referrals;
  • the service and security emails membership needs: email confirmation, password reset and change notices, email-change notices and membership status;
  • points, reward and referral notices, which you can switch off in My Club.
• Member news, offers and birthday messages by email, on the basis of your consent (Article 6(1)(a)). We send them only if you tick “Email me member news and offers” or switch them on in My Club. You can withdraw your consent at any time in My Club or through the unsubscribe link. Joining never depends on it.
• Preventing fraud and abuse of points, rewards and referrals, including giving the welcome bonus only once per person: our legitimate interest in a fair programme (Article 6(1)(f)).
• Keeping the programme’s financial records (points movements and rewards): our legal obligations as a business, and our legitimate interest in being able to show your balance (Article 6(1)(c) and (f)).

Klaviyo. We use Klaviyo, Inc. (United States) to send account emails, for every customer account whether or not it is a Club member, and Club emails. As our processor, Klaviyo receives:

• your email address and Club member id;
• your first name, if you gave one;
• your language and region;
• a record of your Club activity: joining or leaving, email confirmation, points earned (with the order number) or used, your balance, rewards, level and referral status;
• what each email needs, such as a confirmation or reset link and when it expires;
• your marketing choices, but only if you made one.

Klaviyo also records delivery and engagement with these emails, such as link clicks.

Transfers to the United States rely on Klaviyo’s certification under the EU–U.S. Data Privacy Framework and on the EU Standard Contractual Clauses in Klaviyo’s data processing agreement. When you ask us to erase your data, we also ask Klaviyo to delete your profiles.

Hosting. The website and its Club data are hosted by Kinsta in a data centre in London, United Kingdom. The United Kingdom has an EU adequacy decision.

How long we keep it.

• Membership details: kept while your account exists. If you ask us to erase your data, we delete your birthday, language, level, referral and offer codes and the copy of your confirmed address, and your membership ends.
• Points and rewards records: 7 years after the end of the financial year in which they were made.
• Referral records: 3 years after their last change. A confirmed referral may be kept as a reduced record, for as long as that rule exists, so that the same person cannot receive the friend offer twice.
• Marketing choices: 5 years after you withdraw or change them.
• Other Club records, including the records of emails sent to you: 3 years. Two kinds are kept longer:
  • the checks of rewards used on an order, which are kept with that order;
  • the latest record of what we sent to Klaviyo, which is kept while Klaviyo may still hold your profile.
• Welcome-bonus check: the coded identity record that limits the welcome bonus to once per person, kept for as long as that rule exists.

Your rights. You can ask for:

• access to your data;
• correction, erasure or restriction of your data;
• a portable copy of your data.

You can also object to processing based on our legitimate interests, and withdraw your marketing consent at any time without affecting earlier processing. Write to support@pouchpick.com.

You may complain to a data protection authority. In Sweden this is the Swedish Authority for Privacy Protection (IMY); you can also go to the authority where you live or work.

Comments

When visitors leave comments on the site we collect the data shown in the comments form, and also the visitor’s IP address and browser user agent string to help spam detection.

An anonymized string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available here: https://automattic.com/privacy/. After approval of your comment, your profile picture is visible to the public in the context of your comment.

Media

If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website.

Cookies

If you leave a comment on our site you may opt-in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year.

If you visit our login page, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.

When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select "Remember Me", your login will persist for two weeks. If you log out of your account, the login cookies will be removed.

If you edit or publish an article, an additional cookie will be saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after 1 day.

Embedded content from other websites

Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.

These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.

Who we share your data with

If you request a password reset, your IP address will be included in the reset email.

How long we retain your data

If you leave a comment, the comment and its metadata are retained indefinitely. This is so we can recognize and approve any follow-up comments automatically instead of holding them in a moderation queue.

For users that register on our website (if any), we also store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.

What rights you have over your data

If you have an account on this site, or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes.

Where your data is sent

Visitor comments may be checked through an automated spam detection service.