Privacy policy

Who is responsible

Alder Parfums (company registration in progress), Stockholm, Sweden, is the controller for the personal data described here. This policy will be updated with full company details once registration is complete. Contact for all privacy matters: hello@alderparfums.com.

What we collect

When you sign up: your email address, your first name if you choose to give it, the time you gave and confirmed consent, the language of the page, and how you found us (campaign tags in the link you followed and the referring website).

When you open our emails: whether an email was delivered, opened or clicked, as recorded by our email service.

When you visit the site: your IP address and technical request data (browser, time of request) are processed by our hosting provider to deliver the page and protect it against abuse.

If you accept analytics cookies: which pages you view, how you arrived, approximate location (country/city), device and browser type, and a random identifier stored in a cookie — collected with Google Analytics and TWIPLA via Google Tag Manager.

Why, and on what legal basis

To tell you when Alder launches and, occasionally, about our perfumes — based on your consent (Article 6(1)(a) GDPR), given by ticking the box and confirming by email.

To understand which channels bring people to us and how our emails perform — based on our legitimate interest in improving our communication (Article 6(1)(f)).

To see how the site is used and improve it with Google Analytics and TWIPLA — only with your consent (Article 6(1)(a)), given in the cookie dialog.

To keep the site and sign-up form secure and free of spam and bots — based on our legitimate interest in security (Article 6(1)(f)).

Giving us your data is voluntary. Without an email address we cannot notify you. We do not make automated decisions about you, and we never sell your data.

Who processes the data

Klaviyo, Inc. (USA) — our email service, which stores the list and sends our emails.

Cloudflare, Inc. (USA) — hosting of the website and Turnstile, a bot check on the sign-up form that analyses technical signals from your browser. See Cloudflare's Turnstile privacy notice at cloudflare.com/turnstile-privacy-policy.

Google (Google Tag Manager and Google Analytics) — statistics about visits, only if you accept cookies. Google signals and advertising features are switched off.

TWIPLA (Germany) — statistics about visits, only if you accept cookies. Data is processed within the EU.

Google (Google Workspace) — if you email us, your message is stored in our mailbox.

Each acts as our processor under a data processing agreement and may only use the data on our instructions.

Transfers outside the EU

Klaviyo, Cloudflare and Google may process data in the United States. These companies are certified under the EU–U.S. Data Privacy Framework, which the European Commission has found to provide an adequate level of protection; the EU Standard Contractual Clauses apply as an additional safeguard.

How long we keep it

If you do not confirm your address, it is deleted within 30 days. Confirmed addresses are kept until launch and for at most 12 months afterwards, or until you unsubscribe or ask us to delete them. After you unsubscribe, we keep only your email address on a suppression list so that we never write to you again.

Technical request data held by our hosting provider is kept only briefly, for security and troubleshooting.

Google Analytics data is kept for 14 months and TWIPLA data for at most 14 months, then deleted. The analytics cookies themselves expire after at most 2 years, or when you withdraw consent.

Cookies

Analytics cookies are only set if you click Accept in the cookie dialog: _ga and _ga_<ID> from Google Analytics, which distinguish visitors and sessions (expire after at most 2 years), and TWIPLA's analytics cookies. These are loaded through Google Tag Manager. If you decline, neither Tag Manager nor any analytics code is loaded at all.

Your choice is saved in your browser's local storage (alder-cookie-consent) so we don't ask again — this is strictly necessary and needs no consent. The bot check on the sign-up form likewise processes only what is strictly necessary to protect it against abuse.

You can change or withdraw your consent at any time via Cookie settings at the bottom of every page; the analytics cookies are then deleted. We do not use cookies for advertising.

Your rights

You may withdraw your consent at any time — through the unsubscribe link in every email or by writing to us. Withdrawal does not affect processing that took place before it.

You have the right to access your data, to have it corrected or erased, to restrict or object to processing (including processing based on legitimate interest), and to receive your data in a portable format. Write to us and we will respond within one month.

You may also lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se.

Changes

If we change this policy, the new version is published here with a new date. If the changes are significant, we will tell you by email.