Privacy policy.

BHLML AB (org. nr. 559000-0000), with registered address in Stockholm, Sweden, is the data controller for the personal data processed through this website and our order fulfilment systems.

You can reach our data protection contact at privacy@bhlml.com.

We only collect what we need to run the shop. That means:

• Order data: name, shipping and billing address, email, phone, items ordered.
• Account data (if you create one): email, password hash, order history.
• Payment data: handled directly by our payment provider; we never see card numbers.
• Site usage: IP address, browser, pages viewed. Used in aggregate to keep the site working.
• Newsletter (optional): email address only, with explicit opt-in.

• To process orders, deliver products, and handle returns.
• To send shipping notifications and necessary service emails.
• To provide customer support when you contact us.
• To comply with Swedish bookkeeping and consumer protection law.
• To send marketing emails only if you've opted in. You can unsubscribe any time.

We process your data under Article 6(1)(b) (contract performance), (c) (legal obligation, e.g. tax records), (f) (legitimate interest, e.g. fraud prevention), and (a) (consent, for marketing).

We share data only with processors needed to run the business:

• Payment providers (Stripe, Klarna).
• Shipping carriers (PostNord, DHL, UPS).
• Email and hosting providers operating under EU data agreements.
• Selfnamed, our production partner, for order fulfilment.

We never sell personal data. Ever.

• Order and invoice data: 7 years (Swedish Bookkeeping Act).
• Account data: until you delete your account.
• Newsletter data: until you unsubscribe.
• Support emails: 24 months from last contact.

Under the GDPR you can:

• Request a copy of the data we hold on you.
• Ask us to correct or delete it.
• Object to processing or restrict it.
• Withdraw consent for marketing at any time.
• Complain to the Swedish data authority (Integritetsskyddsmyndigheten / IMY).

Email privacy@bhlml.com and we'll respond within 30 days.

We use strictly necessary cookies to keep the cart working and to remember your session. We use a minimal first-party analytics cookie to count visits. No third-party advertising cookies. No cross-site tracking.

We update this policy when the law or our practice changes. The "last updated" date below always reflects the current version. Material changes are announced by email to account holders.