Legal
Privacy policy
Last updated: 20 October 2026
This policy explains what personal data PUHF collects when you visit puhf.store or buy from us, why we collect it, who else touches it, and what you can do about it. It is written to meet the EU General Data Protection Regulation (GDPR).
1. Who is responsible for your data
The data controller is:
Joeledstrom AB
Bryggargatan 31, 904 33 Umeå, Sweden
Company registration number: 559527-2740
Email: hello.puhf@gmail.com
“We”, “us” and “PUHF” below all mean that entity. If you have any question about this policy, or you want to exercise any of the rights in section 9, email us at the address above and a person will answer you.
We have not appointed a Data Protection Officer. We are not required to: we are a small operation, we do not monitor people on a large scale, and we do not process special categories of data.
2. What this policy covers
This policy covers puhf.store and any email we exchange with you about an order or an enquiry. It does not cover our profiles on Instagram or TikTok — when you interact with us there, those platforms are the controllers of that data under their own policies, and we only see what they show us.
3. What we collect
3.1 When you place an order
To sell you a cap and get it to your closest service point, we collect:
- your first and last name
- your billing address and, if it differs, your delivery address
- your email address
- your phone number, if you give it — this field is optional and only used if a delivery goes wrong
- what you ordered, the colourway, the price and the tax applied
- the country your order ships to, which determines the VAT rate
We do not collect or store your card number, expiry date or security code. Those are entered directly into fields hosted by our payment processor and never reach our server. We only ever see the last four digits, the card brand and whether the payment succeeded.
You do not need an account to buy from us. We do not offer customer accounts at all, so there is no password, no stored profile and no login history.
3.2 When you start a checkout and do not finish it
If you type your email address into our checkout and then leave without completing the order, our shop software stores that address together with the contents of your cart. We may use it to send you a reminder that you left something behind.
We think this is a reasonable thing to do and it rests on our legitimate interest in recovering interrupted sales — but it is your address, and you can stop it at any time. Every reminder we send carries an unsubscribe link, and you can also email us and we will delete the record on the spot. We delete these records automatically after 30 days in any case.
3.3 When you contact us
If you email us we keep the message, your address and anything you tell us in it, so that we can answer you and so that we have a record if the same issue comes up again.
3.4 Automatically, when you visit
Like every website, ours records some things without you typing anything:
- Server logs. Our host records the IP address of each request, the time, the page requested, and your browser’s user-agent string. This is how a web server works and how we would investigate an attack or an outage.
- Cookies and similar storage. Listed in full in section 8.
- How you found us. Our shop software records the referring website or campaign that brought you here and attaches it to any order you place, so we can tell which channel a sale came from.
- Fraud signals at checkout. Our payment provider collects device and behaviour signals on the checkout page to tell a real customer from a stolen card. This is described in section 5.
4. Why we use it, and on what legal basis
| What we do | Why | Legal basis (GDPR Art. 6) |
|---|---|---|
| Take payment, pack and ship your order, send order confirmations and delivery updates | To give you the thing you paid for | Performance of a contract, Art. 6(1)(b) |
| Handle returns, exchanges, refunds and complaints | Consumer law and basic decency | Contract, Art. 6(1)(b), and legal obligation, Art. 6(1)(c) |
| Keep invoices and accounting records | Bookkeeping and VAT law require it | Legal obligation, Art. 6(1)(c) |
| Detect and block fraudulent payments | To avoid being defrauded, and to protect the real cardholder | Legitimate interests, Art. 6(1)(f) |
| Send an abandoned-cart reminder | To recover interrupted sales | Legitimate interests, Art. 6(1)(f) — you can object at any time |
| Keep the site up, secure and reasonably fast | To run the shop at all | Legitimate interests, Art. 6(1)(f) |
| Answer your emails | To help you | Legitimate interests, Art. 6(1)(f), or contract if it concerns your order |
Where we rely on legitimate interests, we have weighed our interest against your privacy and concluded that what we do is limited, expected, and would not surprise you. You can ask us to explain that assessment, and you can object to it — see section 9.
We do not profile you, we do not make automated decisions that have a legal effect on you, and we do not sell your data to anyone. Ever, for any price.
5. Who else handles your data
We use a small number of service providers. Each of them processes data on our instructions under a data processing agreement, and each is listed here by name so you can read their own policies:
- Hostinger International Ltd (Lithuania, EU) — hosts the website and its database. Everything you submit to us is stored on their servers.
- Automattic Inc. (United States) — supplies WooCommerce, the shop software, and WooPayments, the payment layer. Order data passes through WooPayments to take payment.
- Stripe Payments Europe Ltd (Ireland) and Stripe, Inc. (United States) — process the actual card payment. Stripe is the party that receives your card details; we never see them. Stripe is a controller in its own right for fraud prevention and regulatory compliance.
- Sift Science, Inc. (United States) — fraud detection, loaded on our checkout page by our payment provider. It collects device and interaction signals to score how likely a payment is to be fraudulent.
- Google Ireland Ltd / Google LLC — serves the web fonts our pages use. Loading a font from Google means your IP address reaches a Google server.
- Automattic Inc. (Gravatar) — serves avatar images on some pages, which likewise means your IP address reaches their server.
- Our shipping carrier — receives your name, delivery address and, where needed, your phone number or email so that your parcel can be delivered and tracked.
Beyond these, we will disclose data only where the law obliges us to — for example to a tax authority, or in response to a valid order from a court or public authority.
6. Where your data goes
Our servers are in the EU. Some of the providers above are established in the United States, so a transfer outside the EEA happens for those specific purposes — payment processing, fraud scoring, fonts and avatars.
Those transfers are covered by the European Commission’s Standard Contractual Clauses and, where the provider is certified, by the EU-U.S. Data Privacy Framework. You can ask us for a copy of the safeguards that apply to a particular transfer.
If you would rather no data reached a US provider at all, the practical answer is not to submit an order — the payment step is where the transfer becomes unavoidable.
7. How long we keep it
- Orders, invoices and accounting records: 7 years from the end of the accounting year in which the order was placed. This is a statutory minimum and we cannot delete them earlier, even at your request.
- Abandoned checkout records: 30 days, then automatically deleted.
- Email correspondence: up to 2 years after the matter is closed.
- Server logs: up to 30 days, in line with our host’s retention.
- Cookies: the lifetimes shown in section 8.
When a retention period ends the data is deleted or irreversibly anonymised.
8. Cookies and similar technologies
A cookie is a small file a website asks your browser to keep. Ours fall into two groups: the ones the shop cannot function without, and the ones set by our payment provider to prevent fraud.
| Cookie | Set by | What it does | Lifetime |
|---|---|---|---|
| woocommerce_cart_hash | PUHF | Tells the site your cart contents have changed | Session |
| woocommerce_items_in_cart | PUHF | Tells the site your cart is not empty | Session |
| wp_woocommerce_session_* | PUHF | Links your browser to your cart on our server | About 2 days |
| sbjs_first, sbjs_current, sbjs_session, sbjs_udata, sbjs_migrations, sbjs_first_add, sbjs_current_add | PUHF (WooCommerce order attribution) | Records the site, search or campaign that brought you here, so an order can be attributed to a channel | About 6 months |
| __stripe_mid | Stripe | Fraud prevention — identifies the browser across sessions | About 1 year |
| __stripe_sid | Stripe | Fraud prevention — identifies the current session | About 30 minutes |
| __ssid | Stripe | Fraud prevention | About 1 year |
You can delete cookies and block future ones in your browser settings. Blocking the WooCommerce cookies will break the cart — the shop will forget what you put in it.
9. Your rights
Under the GDPR you have the following rights over your own data. All of them are free to use, and we will answer within one month.
- Access. Ask what we hold about you and get a copy of it.
- Rectification. Have anything wrong corrected — a misspelt street, an old address.
- Erasure. Have your data deleted. This works for marketing records and correspondence; it does not override our legal duty to keep invoices for the statutory period.
- Restriction. Have us pause processing while a dispute about accuracy or legal basis is resolved.
- Portability. Receive the data you gave us in a machine-readable format, or have it sent to another provider.
- Objection. Object to anything we do on the basis of legitimate interests, including abandoned-cart emails. If you object to direct marketing we stop, full stop, without weighing anything.
- Withdrawal of consent. Where we rely on consent, withdraw it at any time. That does not make what we did beforehand unlawful.
Email hello.puhf@gmail.com to use any of these. We may ask you to confirm something only you and we would know — usually an order number — so that we do not hand your data to somebody pretending to be you.
10. If you are not happy with our answer
Tell us first and we will try to fix it. But you always have the right to go straight to a supervisory authority instead, and you can complain either in the country where we are established or in the country where you live.
Our supervisory authority is Integritetsskyddsmyndigheten (IMY), imy.se.
11. Children
Our shop is not aimed at children and we do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, email us and we will delete it.
12. Security
The site is served over HTTPS, so traffic between your browser and our server is encrypted. Card data never touches our systems. Access to the shop’s admin is limited to the people who run PUHF, and our host maintains the underlying infrastructure.
No system is perfectly secure, and we will not pretend otherwise. If a breach occurs that is likely to result in a risk to your rights, we will notify the supervisory authority within 72 hours and, where the risk is high, tell you directly.
13. Changes to this policy
If we change how we handle your data we will update this page and change the date at the top. For anything significant — a new processor, a new purpose — we will say so clearly rather than quietly editing a sentence.
14. Contact
hello.puhf@gmail.com
Joeledstrom AB, Bryggargatan 31, 904 33 Umeå, Sweden.