This English version is a machine translation provided for convenience. The Swedish version is the legally binding one and prevails in case of any discrepancy.
Last updated: 15 June 2026
Your privacy is important to us at My Little Cupcake AB. In this privacy policy we describe what personal data we collect about you, why we do it, how we use it and what rights you have under the General Data Protection Regulation (GDPR).
Data controller
My Little Cupcake AB
Grimstagatan 19
162 56 Vällingby, Stockholm
Email: Order [at] mylittlecupcake.se
Phone: 08-128 988 88
If you have questions about how we process your personal data, you can contact us at the email address above.
What personal data do we collect?
Depending on how you use our website, we collect the following personal data:
When you order cupcakes
- Name, address, phone number and email address
- Delivery address or pickup location
- Requested delivery date and time
- Order information (products, quantities, any notes)
- Payment information (handled by Klarna — see below)
- Any company details for corporate orders (company registration number, billing address)
When you contact us
- Name, email address and the content of your message via our contact form or by email
When you sign up for our newsletter
- Email address
- Time and confirmation of your sign-up (consent)
- Newsletter statistics, e.g. whether you open our emails and click on links
When you visit the website
- IP address, browser type, operating system and time of visit
- Statistics on how you use the website (pages visited, clicks, searches) — only if you consent via the cookie banner
- Cookies and similar tracking technologies — see our cookie policy for details
Why do we process your personal data?
We process your personal data for the following purposes, on the following legal bases under Article 6 of the GDPR:
| Purpose | Legal basis |
|---|---|
| Handling and delivering your order | Contract (Art. 6.1 b) |
| Sending order confirmations and delivery updates | Contract (Art. 6.1 b) |
| Handling payment via Klarna | Contract (Art. 6.1 b) |
| Bookkeeping and invoicing | Legal obligation (Art. 6.1 c) — Swedish Bookkeeping Act |
| Customer service and answering enquiries | Legitimate interest (Art. 6.1 f) |
| Preventing fraud and ensuring the security of the website | Legitimate interest (Art. 6.1 f) |
| Website analytics and improving the service | Consent (Art. 6.1 a) — via the cookie banner |
| Marketing and relevant content | Consent (Art. 6.1 a) — via the cookie banner |
| Sending newsletters and discount offers | Consent (Art. 6.1 a) |
Who do we share your personal data with?
We never sell your personal data. We only share it with the following recipients when necessary to fulfil our commitments to you or as required by law:
- Klarna Bank AB — handles payments at checkout. Klarna is the data controller for its own processing. See Klarna's privacy policy.
- Inviso AB — our web hosting provider, which stores the website's data on servers within the EU.
- Couriers and delivery companies — so we can deliver your order to the right address.
- Accounting firm and the Swedish Tax Agency — to meet our obligations under the Swedish Bookkeeping Act.
- Google LLC — website statistics via Google Analytics and Google Tag Manager. Only if you have consented via the cookie banner. Google may transfer data to the USA — see below on third-country transfers.
- Meta Platforms (Instagram) — for embedded content from Instagram on our website. Only if you have consented.
- Automattic Inc. (MailPoet) — handles the sending of our newsletter (MailPoet Sending Service). Only if you have signed up for the newsletter. Automattic may process data in the USA — see below on third-country transfers.
How long do we keep your personal data?
- Order data and invoice records: 7 years under the Swedish Bookkeeping Act
- Contact enquiries: up to 12 months after the matter is closed
- Marketing consent and cookies: until you withdraw your consent or the cookie expires (see the cookie policy)
- Newsletter subscription: until you unsubscribe from the newsletter (every email contains an unsubscribe link)
- Website statistics: up to 26 months (Google Analytics default setting)
Third-country transfers
Some of our suppliers (mainly Google and Automattic/MailPoet) may process data outside the EU/EEA, for example in the USA. In that case we rely on the European Commission's adequacy decision (Data Privacy Framework) or on standard contractual clauses (SCCs) as the legal basis for the transfer. You can withdraw your consent to such processing at any time via ”Manage consent” in the footer.
Your rights
Under the GDPR you have the following rights regarding your personal data:
- Right of access — find out what data we hold about you
- Right to rectification — have incorrect data corrected
- Right to erasure (”the right to be forgotten”) — have your data deleted when it is no longer needed
- Right to restriction — restrict how we process your data
- Right to data portability — receive your data in a machine-readable format
- Right to object — object to processing based on legitimate interest
- Right to withdraw consent — at any time, without affecting the lawfulness of earlier processing
To exercise any of these rights, contact us at Order [at] mylittlecupcake.se. We reply within 30 days.
Complaints to the supervisory authority
If you believe that our processing of your personal data violates the GDPR, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY):
Swedish Authority for Privacy Protection (IMY)
Box 8114, 104 20 Stockholm
Email: imy@imy.se
Web: www.imy.se
Cookies
We use cookies and similar technologies to make the website work, to measure usage and to show relevant content. You decide which cookies you accept via the cookie banner shown the first time you visit the website. You can change your choice at any time via the link ”Manage consent” in the footer.
For a complete list of the cookies we use, see our cookie policy.
Changes to this policy
We may update this privacy policy if our processing changes or if the law requires it. The date of the latest update is shown at the top of the page. Significant changes will be communicated clearly on the website.