Privacy policy & cookies

Equ used AB, org.nr 559083-7844, is the data controller for the processing of your personal data when you use our website and shop with us.

Contact: info@equused.se. For questions about privacy and your rights, use the same address and mark the email “GDPR”.

Customer and order: name, email address, phone number if you provide it, delivery address and order contents.

Account (seller/buyer): details you register in connection with an account with us, including contact and address details needed for the service.

Saved listings, watches etc.: when you are logged in you can save products in a personal list and add watches; these associations are stored with our service provider together with your account so that you find them in your dashboard and on all devices where you log in.

Technical data: IP address, browser type, device and similar logged by our operations provider in connection with page views and API calls (security and troubleshooting).

Payment: card or account details are handled by our payment provider Qliro; we do not store full card numbers.

Performance of a contract (GDPR art. 6.1 b): to handle your order, delivery, payment and customer service.

Legitimate interest (art. 6.1 f): to secure the service, prevent misuse and improve the platform, to the extent the interest is not overridden by your rights.

Consent (art. 6.1 a): when we ask for your explicit consent, for example for certain cookies and where applicable for newsletters or marketing.

Legal obligation (art. 6.1 c): accounting, tax and other requirements that follow from law.

We use carefully selected providers that process data on our behalf (processors), with agreements under the GDPR.

Qliro (payments, within the EU/EEA or with appropriate safeguards under Qliro’s terms).

Supabase (database, authentication and storage — operated in the region chosen for the service, often within the EU/EEA).

Vercel or equivalent hosting for the web application (may include processing outside the EU if stated in their terms; we strive for appropriate safeguards).

Resend or equivalent for sending certain transactional emails where enabled.

We do not sell your personal data to third parties.

Order data is kept for as long as needed to perform the contract, handle complaints and meet accounting and tax rules (normally at least seven years for accounting records under Swedish practice where applicable).

Account data remains until you request deletion or close the account, unless longer retention is required by law.

Logs and security data are purged successively according to our internal routine.

You have the right to information, access to your data, rectification of inaccurate data and under certain conditions erasure, restriction of processing and data portability.

When processing is based on consent you have the right to withdraw consent at any time (does not affect processing that has already taken place lawfully).

You have the right to object to certain processing based on legitimate interest.

You have the right to lodge a complaint with Integritetsskyddsmyndigheten (IMY), www.imy.se.

We strive to protect personal data and the service through appropriate technical and organisational measures, for example encrypted connection (HTTPS) to the website, limited internal access, and use of established providers with a strong security tradition.

Database, authentication and files in the cloud are handled via Supabase, which provides encryption of data at rest and in transit according to industry standard, access control and infrastructure that follows common cloud security routines. Operations take place in the region chosen for the service, in practice often within the EU/EEA; see also section 4 on providers.

Security is also about you as a user: use a unique, strong password, log out on shared devices, and notify us if you suspect unauthorised use of your account.

Login and account are based on Supabase Auth. Passwords are hashed with modern, one-way algorithms; they are not stored in plaintext and cannot be read by Equ used, and we do not see, store or recreate your password. If you use “Forgot password”, the system sends a reset link according to the ordinary routine.

After login, session tokens and cookies that our service provider sets according to established auth standards are used, so that you can stay logged in without the password being sent repeatedly.

As elsewhere: if you reuse the same password on many services you risk more than if you have unique ones per service. We recommend a password manager where that suits you.

Cookies are small text files stored in your browser. In some cases local storage (localStorage) is also used where needed for functionality that works before or without login, for example the basket.

Saved listings, watches and other such data belonging to your account are instead stored with our service provider when you are logged in, so that the lists follow your account and not only a single browser. Logged out you shop as a guest with the basket locally; account-based saving requires an account as above.

Necessary cookies and storage: required for the website to function (e.g. session/login via our auth provider, security). These do not require consent under ePrivacy Directive practice when they are strictly necessary.

Optional categories (analytics, marketing): used only if you approve them via our cookie banner. At present some functions may be prepared without extra scripts being loaded until they are technically activated.

The service is intended for adult consumers. We do not knowingly collect personal data about persons under 18 without a guardian’s consent.

We may update this policy when routines or legal requirements change. The publication date is stated below. In the event of material changes we may inform via the website or email.