Contents

1. What personal information we collect

When we use the term "personal information," we mean information that identifies or can reasonably be linked to you. We may collect the following categories depending on how you interact with our Services:

2. How we collect it

We collect personal information from the following sources:

• Directly from you - when you create an account, place an order, contact support, or communicate with us
• Automatically - through cookies, pixels, and similar tracking technologies when you visit aeska.co (see section 5)
• From our service providers - including Shopify, payment processors, and logistics partners
• From marketing and advertising partners - including Meta (Facebook/Instagram), Google, and TikTok, when you interact with our ads on those platforms

3. How and why we use your information

The table below explains how we use your personal information and, for EU/EEA/UK customers, the legal basis under GDPR for each purpose.

4. Who we share your information with

We share your personal information only for the purposes described above, with the following categories of recipients:

We do not sell your personal information to data brokers or unrelated third parties for their own marketing purposes.

5. Cookies and tracking technologies

We use cookies and similar tracking technologies on aeska.co. A cookie is a small text file stored on your device. Below is an overview of the types of cookies we use and their purpose.

Managing your cookie preferences

When you first visit aeska.co, you will be presented with a cookie consent banner where you can accept or decline non-essential cookies. You can change your preferences at any time via the cookie settings link in our website footer.

You can also manage cookies through your browser settings. Note that disabling certain cookies may affect website functionality.

If you have the Global Privacy Control (GPC) opt-out signal enabled in your browser, we will treat this as a request to opt out of the sale or sharing of your personal information for users in jurisdictions where this is required by law. To learn more about GPC, visit globalprivacycontrol.org.

We do not respond to other "Do Not Track" browser signals.

6. International data transfers

As an international e-commerce business, your personal information may be transferred to and processed in countries other than where you reside, including Sweden (our headquarters), the United States (Shopify, Meta, Google, TikTok, Klaviyo), and countries where our fulfillment partners operate.

For transfers of personal information from the European Economic Area or the United Kingdom to countries not deemed to provide an adequate level of protection, we rely on the European Commission's Standard Contractual Clauses (SCCs) or equivalent transfer mechanisms approved by the relevant UK authority.

Please note that when your order is shipped, your name and delivery address will be shared with our fulfillment and logistics partners, which may include parties located in China or other countries. This is necessary to fulfill your order.

7. Data retention

We retain your personal information for as long as necessary to fulfill the purposes described in this policy, subject to the following general guidelines:

• Order and transaction records - typically 7 years to comply with accounting and tax obligations in Sweden and other jurisdictions
• Customer account data - for the duration of your account, plus a reasonable period after closure
• Marketing preferences and opt-out records - until you request deletion or withdraw consent
• Support communications - up to 3 years after resolution
• Cookie and analytics data - per the retention periods of the respective third-party tools (typically 13-26 months for Google Analytics)

8. Your rights and choices

All customers

• Unsubscribe from marketing emails at any time using the unsubscribe link in our emails
• Contact us to request access to, correction of, or deletion of your personal information

EU and EEA customers (GDPR)

• Right to access your personal information
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object to processing based on legitimate interest or for direct marketing purposes
• Right to withdraw consent at any time (where processing is based on consent)
• Right to lodge a complaint with your national data protection authority. A list of EU supervisory authorities is available at edpb.europa.eu. In Sweden, the supervisory authority is Integritetsskyddsmyndigheten (IMY), at imy.se.

UK customers (UK GDPR)

You have the same rights as EU customers above. You may also lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

California residents (CCPA / CPRA)

• Right to know what personal information we collect, use, disclose, and sell
• Right to delete your personal information
• Right to correct inaccurate personal information
• Right to opt out of the sale or sharing of your personal information for cross-context behavioral advertising
• Right to limit the use of sensitive personal information
• Right to non-discrimination for exercising your rights

Other US state residents (Virginia, Colorado, Connecticut, Texas, and others)

Residents of US states with applicable consumer privacy laws have similar rights to access, delete, correct, and opt out of certain processing of personal information. Contact us to exercise these rights.

Australian customers

Under the Australian Privacy Act 1988, you have the right to access and correct your personal information, and to complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au if you believe we have breached the Australian Privacy Principles.

To exercise any of these rights, contact us at support@aeska.co. We may need to verify your identity before processing your request. We will respond within the timeframe required by applicable law (typically 30 days for GDPR, 45 days for CCPA). We will not discriminate against you for exercising your rights.

9. Children's data

The Services are not directed at children under the age of 16 (or the applicable age of majority in your jurisdiction). We do not knowingly collect personal information from children.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@aeska.co and we will delete it promptly.

We do not knowingly sell or share personal information of individuals under 16 years of age.

10. Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, loss, or misuse. These include encryption of data in transit (SSL/TLS), access controls, and use of PCI DSS-compliant payment processors.

No method of transmission over the internet or electronic storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security. We recommend you do not share account credentials with others.

11. Changes to this policy

We may update this Privacy and Cookie Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. We will post the updated policy on this page and update the "Last updated" date. For material changes, we will provide notice as required by applicable law, which may include an email notification to registered customers.

12. Contact and complaints

If you have questions, concerns, or complaints about how we handle your personal information, please contact us first. We will do our best to resolve your concern promptly.

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection or consumer protection authority. For EU customers, contact IMY (Sweden) or your national DPA. For UK customers, contact the ICO. For Australian customers, contact the OAIC. For California customers, contact the California Privacy Protection Agency (CPPA).