Privacy policy

Last updated: July 22, 2026

Still Puzzling ("we," "us," "our") operates stillpuzzling.com (the "Services"). This Privacy Policy explains what personal information we collect, why, and what rights you have over it, in line with the EU General Data Protection Regulation (GDPR) and Swedish data protection law.

If there is a conflict between our Terms of Service and this Privacy Policy regarding the handling of personal information, this Privacy Policy controls.

1. What Personal Information We Collect

Contact details — name, delivery and billing address, phone number, email address.
Order and transaction information — items purchased, order value, order history, returns and exchanges.
Payment information — handled directly by our payment providers (see Section 5); we do not store full card numbers ourselves.
Account information — if you create an account: username, order history, saved addresses.
Communications — anything you send us via email or contact forms, e.g. customer support requests.
Device and usage information — IP address, browser type, pages viewed, and similar data collected automatically via cookies and analytics tools (see Section 4).

2. Where This Information Comes From

Directly from you — when you place an order, create an account, sign up for our email list, or contact us.
Automatically — through cookies and analytics when you browse the site.
From our service providers — payment processors and shipping carriers share order-status information back with us (e.g. confirming a payment or a delivery).

3. Why We Process Your Information, and Our Legal Basis

Purpose	What we use	Legal basis
Processing your order, payment, and delivery	Contact details, order info, payment confirmation	Performance of a contract with you
Customer support and responding to enquiries	Contact details, your message	Performance of a contract / our legitimate interest in resolving your enquiry
Sending order confirmations, shipping updates, and service messages	Contact details, order info	Performance of a contract
Sending marketing emails (new puzzles, offers)	Email address	Your consent, given when you sign up for our email list — you can withdraw it anytime
Analytics (understanding site traffic and behaviour)	Device/usage data via Google Analytics	Your consent, given via our cookie banner
Advertising (Meta/Instagram)	Device/usage data via Meta Pixel	Your consent, given via our cookie banner
Bookkeeping and tax compliance	Order and payment records	Legal obligation under Swedish bookkeeping law
Preventing fraud and keeping the store secure	Order, device, and account information	Our legitimate interest in protecting the business and our customers

4. Cookies

We use cookies and similar technologies for three purposes:

Necessary cookies — required for the store to function (cart, checkout, security). These are always active and don't require consent.
Analytics cookies — Google Analytics, to understand how visitors use the site.
Advertising cookies — Meta/Instagram Pixel, to measure and improve our ads and show relevant ads on Meta platforms.

When you first visit stillpuzzling.com, a cookie banner lets you accept or decline non-essential cookies. You can change your choice at any time through the cookie settings link in the site footer, or by adjusting your browser settings.

5. Payment Processing

Checkout is handled through Shopify and the following payment providers, depending on what you choose:

Shopify Payments (card payments)
Klarna
PayPal
Apple Pay / Google Pay

Each provider processes your payment details directly under its own privacy policy and is an independent data controller for that processing. We only receive confirmation that payment was successful, plus the transaction details needed to fulfill your order.

6. Who We Share Your Information With

We share personal information only where necessary, with:

Shopify, our e-commerce platform, which hosts the store and processes data on our behalf.
Payment providers listed in Section 5, to process your payment.
Shipping carriers, to deliver your order and provide tracking.
Google Analytics and Meta/Instagram, only if you've accepted analytics/advertising cookies.
Authorities, where required by law (e.g. tax reporting, legal requests).

We do not sell your personal information.

7. International Data Transfers

Some of our service providers (e.g. Shopify, Google, Meta) may process data outside the European Economic Area, including in the United States. Where this happens, we rely on recognised safeguards such as the European Commission's Standard Contractual Clauses, or transfers to countries recognised by the EU as providing adequate protection.

8. How Long We Keep Your Information

Order and financial records are kept for at least 7 years, as required by Swedish bookkeeping law (Bokföringslagen).
Account information is kept for as long as your account is active, plus a reasonable period afterward.
Marketing data (email address for our newsletter) is kept until you unsubscribe.
Customer support communications are kept as long as needed to resolve your enquiry and for a reasonable period after, in case of follow-up.

9. Your Rights

Under GDPR, you have the right to:

Access the personal information we hold about you.
Correct inaccurate information.
Delete your information, subject to our legal obligations (e.g. we can't delete records we're required to keep for tax purposes).
Restrict or object to certain processing, including marketing and advertising.
Withdraw consent at any time for anything based on consent (e.g. marketing emails, analytics/advertising cookies), without affecting processing done before withdrawal.
Data portability — receive your data in a portable format, or have it transferred to another provider, where technically feasible.

To exercise any of these rights, contact us at hello@stillpuzzling.com. We may need to verify your identity before acting on a request.

Complaints. If you believe we have not handled your personal information properly, you can contact us directly, or lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se, or with the data protection authority in your own EU/EEA country.

10. Children

Our Services are not directed at children, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

11. Security

We use reasonable technical and organisational measures to protect your information, including relying on Shopify's and our payment providers' security infrastructure. No online service can guarantee perfect security, so please avoid sending sensitive information (like full payment card numbers) to us directly by email.