Privacy policy

Privacy Policy

Last updated: July 2026

At Allytah, we believe that trust extends beyond skincare—it includes how we collect, use and protect your personal information.

This Privacy Policy explains how we collect, use, store and share your personal data when you visit www.allytah.com, create an account, place an order, contact us, subscribe to our newsletter or otherwise interact with our website and services (collectively, the "Services").

Our website is powered by Shopify, which provides the e-commerce platform that enables us to offer our products and services. As part of providing these Services, certain personal information is processed by Shopify on our behalf or, in limited circumstances, by Shopify as an independent controller for its own legitimate business purposes.

Please read this Privacy Policy carefully. By accessing or using our Services, you acknowledge that you have read and understood how we collect and process your personal information.

If you have any questions regarding this Privacy Policy, please contact us at hello@allytah.com.

1. Who We Are

This website is owned and operated by:

Allytah

Lönnebergagatan 3B
212 45 Malmö Sweden

Organization Number: 870223-3647
VAT Number: SE870223364701

Email: hello@allytah.com

Throughout this Privacy Policy, the terms "Allytah," "we," "our," and "us" refer to Allytah.

For the purposes of the General Data Protection Regulation (GDPR) and other applicable privacy legislation, Allytah is the data controller for the personal information collected through this website, except where otherwise stated.

2. Personal Information We Collect

Depending on how you interact with our Services, we may collect different categories of personal information.

Contact Information

Including:

Full name
Billing address
Shipping address
Email address
Telephone number

Order & Transaction Information

Including:

Products purchased
Order history
Shopping cart contents
Wishlist items
Returns
Exchanges
Refunds
Payment confirmations
Transaction records

Please note that payment card details are processed securely by our payment providers. Allytah does not store your complete payment card information.

Account Information

If you create an account with us, we may collect:

Username
Encrypted password
Account preferences
Saved addresses
Order history

Customer Support Information

When you contact us, we may collect information such as:

Emails
Messages
Customer service enquiries
Photos you voluntarily provide
Product-related questions
Feedback and reviews

Device & Technical Information

When you visit our website, we may automatically collect information including:

IP address
Browser type
Operating system
Device identifiers
Time zone
Language settings
Referring website
Website usage statistics

Website Activity

We may collect information regarding how you interact with our website, including:

Pages viewed
Products viewed
Search terms
Time spent on pages
Click behaviour
Shopping cart activity
Checkout activity

Some of this information is collected through cookies and similar technologies. For further information, please refer to our Cookie Policy.

3. How We Collect Your Personal Information

We collect personal information in several ways.

Information You Provide Directly

You may provide information when you:

place an order;
create an account;
subscribe to our newsletter;
contact Customer Support;
leave a review;
participate in promotions or giveaways;
communicate with us via email or social media.

Information Collected Automatically

When you visit our website, certain technical information is collected automatically through cookies, server logs and similar technologies.

This helps us:

improve website functionality;
analyse website performance;
remember your preferences;
personalise your shopping experience;
maintain website security.

Information Received From Third Parties

We may receive personal information from trusted partners, including:

Shopify
Payment providers
Shipping and fulfilment partners
Fraud prevention providers
Analytics providers
Advertising partners
Social media platforms (where you choose to interact with us)

These providers process information only to the extent necessary to provide their services.

4. How We Use Your Personal Information

We use your personal information to operate our business and provide our Services.

This includes:

Processing Orders

Including:

processing payments;
preparing orders;
arranging shipment;
providing order updates;
handling returns and refunds.

Customer Support

To:

answer questions;
resolve complaints;
provide after-sales support;
improve customer satisfaction.

Improving Our Website

We analyse how visitors use our website in order to:

improve navigation;
optimise website performance;
develop new features;
improve product recommendations;
enhance your shopping experience.

Marketing Communications

Where permitted by law or where you have provided your consent, we may send you:

newsletters;
skincare tips;
exclusive product launches;
promotional offers;
personalised recommendations.

You may unsubscribe at any time by clicking the unsubscribe link included in every marketing email or by contacting us directly.

Security & Fraud Prevention

We use personal information to:

detect fraud;
prevent unauthorised transactions;
protect customer accounts;
secure our website;
comply with legal obligations.

5. Legal Bases for Processing (GDPR)

If you are located within the European Union (EU), European Economic Area (EEA) or the United Kingdom, we process your personal information only where we have a lawful basis under applicable data protection legislation.

Depending on the circumstances, these legal bases include:

Performance of a Contract

To process your orders, deliver products, provide customer support and fulfil our contractual obligations.

Legal Obligations

To comply with accounting, tax, consumer protection and other legal requirements.

Legitimate Interests

To improve our Services, prevent fraud, maintain website security, analyse website performance and develop our business, provided that these interests are not overridden by your fundamental rights and freedoms.

Consent

Where required by law, we rely on your consent for activities such as sending marketing communications or placing non-essential cookies on your device. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before your withdrawal.

6. Sharing Your Personal Information

To operate our business and provide our Services, we may share your personal information with carefully selected third parties where necessary and only for legitimate business purposes.

We do not sell your personal information.

We only share personal information as described in this Privacy Policy or where required or permitted by applicable law.

Service Providers

We work with trusted service providers that help us operate our website and deliver our products and services.

These providers may process personal information on our behalf, including:

Shopify (our e-commerce platform)
Payment service providers
Shipping and logistics partners
Order fulfilment partners
Customer support providers
Website hosting providers
Cloud storage providers
Fraud prevention and security providers
Analytics providers
Email and marketing service providers

These providers are only permitted to process your information to the extent necessary to perform services on our behalf and are required to protect your information in accordance with applicable data protection laws.

Payment Processing

Payments made through our website are securely processed by trusted payment providers.

Allytah does not receive or store your complete payment card information.

Payment providers process payment information in accordance with their own privacy policies and applicable payment security standards.

Shipping & Order Fulfilment

To process and deliver your orders, we share the personal information necessary to fulfil your purchase with our fulfilment and logistics partners.

This information may include:

your name;
delivery address;
telephone number (where required by the carrier);
email address (where required for delivery notifications);
order details.

These partners process your information solely for the purpose of preparing, shipping and delivering your order.

Analytics & Website Performance

We use analytics tools to better understand how visitors interact with our website.

This information helps us:

improve website functionality;
understand customer behaviour;
optimise website performance;
improve our products and services.

Where required by law, analytics technologies are only used after obtaining your consent.

Marketing & Advertising

Where you have provided your consent or where otherwise permitted by applicable law, we may work with trusted advertising partners to:

measure advertising performance;
personalise advertisements;
understand customer interests;
improve future marketing campaigns.

These partners may include advertising networks and social media platforms.

You may withdraw your consent to marketing at any time.

Legal Requirements

We may disclose personal information where necessary to:

comply with applicable laws;
respond to lawful requests from public authorities;
comply with court orders or legal proceedings;
establish, exercise or defend legal claims;
investigate suspected fraud or unlawful activity;
protect the rights, property or safety of Allytah, our customers or others.

7. Shopify's Role

Our online store is powered by Shopify Inc., which provides the e-commerce platform that enables us to sell our products and services.

When you visit our website, place an order or otherwise interact with our Services, certain personal information is processed through Shopify's infrastructure.

Depending on the circumstances, Shopify may process personal information:

as a data processor acting on behalf of Allytah; or
as an independent data controller for certain activities necessary to operate, secure and improve the Shopify platform.

For more information about how Shopify processes personal information, please refer to Shopify's Privacy Policy.

8. International Transfers of Personal Information

Allytah is based in Sweden.

However, some of our trusted service providers operate internationally.

As a result, your personal information may be transferred to, stored or processed in countries outside your country of residence.

Where personal information is transferred outside the European Economic Area (EEA) or the United Kingdom, we ensure that appropriate safeguards are implemented in accordance with applicable data protection legislation.

These safeguards may include:

European Commission Standard Contractual Clauses (SCCs);
UK International Data Transfer Agreement (IDTA), where applicable;
transfers to countries recognised by the European Commission as providing an adequate level of data protection;
other lawful transfer mechanisms permitted under applicable legislation.

9. Cookies & Similar Technologies

Our website uses cookies and similar technologies to improve your browsing experience, remember your preferences, analyse website performance and support our marketing activities.

Depending on your location, we may ask for your consent before placing non-essential cookies on your device.

For detailed information regarding the cookies we use, their purposes and how you can manage your preferences, please refer to our Cookie Policy.

10. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes described in this Privacy Policy.

The retention period depends on several factors, including:

the nature of the information;
legal requirements;
accounting obligations;
tax legislation;
consumer protection laws;
the need to resolve disputes;
enforcement of our legal rights.

When personal information is no longer required, it will be securely deleted, anonymised or otherwise disposed of in accordance with applicable law.

11. Data Security

Protecting your personal information is important to us.

We implement appropriate technical, organisational and administrative security measures designed to protect your personal information against:

unauthorised access;
accidental loss;
misuse;
alteration;
disclosure;
destruction.

While we strive to use commercially reasonable security measures, no method of electronic transmission or storage can be guaranteed to be completely secure.

For this reason, we cannot guarantee absolute security of information transmitted through the internet.

12. Children's Privacy

Our website and products are intended for individuals who have reached the legal age required to enter into contracts in their country of residence.

We do not knowingly collect personal information from children.

If you believe that a child has provided us with personal information, please contact us immediately so that we can investigate and, where appropriate, delete such information.

13. Your Privacy Rights

Depending on where you live, you may have certain rights regarding your personal information under applicable data protection laws.

These rights are not absolute and may be subject to legal limitations or exceptions.

Right of Access

You may request confirmation of whether we process your personal information and obtain a copy of the personal data we hold about you.

Right to Rectification

You have the right to request that inaccurate or incomplete personal information be corrected.

Right to Erasure ("Right to be Forgotten")

You may request that we delete your personal information where applicable law grants this right.

Please note that we may be required to retain certain information to comply with legal obligations, resolve disputes or enforce our legal rights.

Right to Restrict Processing

Under certain circumstances, you may request that we temporarily restrict the processing of your personal information.

Right to Object

Where we process personal information based on our legitimate interests, you may object to such processing where permitted by applicable law.

You also have the right to object at any time to the processing of your personal information for direct marketing purposes.

Right to Data Portability

Where applicable, you may request a copy of your personal information in a structured, commonly used and machine-readable format and request that it be transferred to another service provider.

Right to Withdraw Consent

Where we rely on your consent to process personal information, you may withdraw that consent at any time.

Withdrawing consent does not affect the lawfulness of processing carried out before your consent was withdrawn.

Right to Manage Marketing Preferences

You may unsubscribe from our marketing communications at any time by:

clicking the unsubscribe link included in our emails;
adjusting your account preferences (where available); or
contacting us directly.

Please note that even if you opt out of marketing communications, we may still send important service-related messages regarding your orders or account.

14. Exercising Your Rights

If you wish to exercise any of your privacy rights, please contact us using the details provided at the end of this Privacy Policy.

To protect your privacy, we may ask you to verify your identity before processing your request.

We will respond within the timeframes required by applicable data protection legislation.

Where permitted by law, you may also appoint an authorised representative to exercise your rights on your behalf.

15. Complaints

If you believe that we have processed your personal information in a way that does not comply with applicable data protection laws, we encourage you to contact us first so that we have the opportunity to resolve your concerns.

If you reside within the European Union (EU), European Economic Area (EEA) or the United Kingdom, you also have the right to lodge a complaint with your local data protection authority.

For customers located in Sweden, the competent supervisory authority is:

The Swedish Authority for Privacy Protection (IMY)

www.imy.se

16. Third-Party Websites

Our website may contain links to third-party websites or services that are not operated by Allytah.

We are not responsible for the privacy practices, security or content of third-party websites.

We encourage you to review the privacy policies of any third-party websites before providing your personal information.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

changes in applicable legislation;
changes to our business operations;
improvements to our Services;
new technologies;
changes to our service providers.

The latest version of this Privacy Policy will always be available on this page.

The "Last updated" date at the top of this Privacy Policy indicates when it was most recently revised.

Where required by applicable law, we will notify you of material changes.

18. Contact Us

If you have any questions regarding this Privacy Policy or wish to exercise your privacy rights, please contact us.

Allytah

Lönnebergagatan 3B
212 45 Malmö Sweden

Email
hello@allytah.com

GDPR Representative

For the purposes of the General Data Protection Regulation (GDPR), Allytah is the data controller for the personal information collected through this website, except where another controller is identified under applicable law.

Privacy Requests

You may contact us at any time to request: