Privacy policy
Updated 28 September 2026 — pre-launch review. EPROLO's data-transfer arrangements, cookie inventory, analytics retention and consent behaviour still require verification before launch. Review notes identify unfinished details. This notice does not certify that all operational GDPR requirements have been completed.
Controller and contact
Yelson Ramirez Grönroos, trading as Arc & Day, is the controller for personal data we use to operate arcandday.com and serve customers. Contact ramirezgronroos@gmail.com, +46 724 45 00 85, or Hasselstigen 4, 313 32 Oskarström, Sweden, including for privacy questions and rights requests.
This notice covers visitors, customers and people contacting us. Reading it or using the website is not consent to optional tracking or marketing.
Information and sources
You provide contact details, billing/delivery addresses, product selections, order information, account information, messages and relevant complaint evidence through the store or correspondence. Please do not send unnecessary identity documents, passwords, complete card numbers or sensitive personal details in support messages.
Shopify operates the storefront, hosted accounts, cart and checkout. It processes connection/device information such as IP address, browser, session identifiers and store interactions. Commerce, payment and fulfilment providers supply transaction-status and delivery updates. Payment details are handled by the checkout provider you use; the storefront has no custom card form. Payment-provider setup is currently pending.
Where permitted by your consent choices, analytics can record pages and products viewed, cart/checkout events, approximate location, device information and online identifiers. Google Analytics is connected through the Google & YouTube Shopify channel. Event collection and consent behaviour still need verification.
Purposes and GDPR legal bases
Contract — Article 6(1)(b): process contact, order and delivery information to take steps you request before buying, fulfil purchases, provide requested accounts and handle contractual order communications and returns.
Legal obligation — Article 6(1)(c): maintain required accounting/tax records, respond to lawful authority requests and fulfil consumer and data-protection duties.
Legitimate interests — Article 6(1)(f): use relevant messages, logs and transaction information for general support, fraud prevention, security and legal claims, where necessary and balanced against your rights. These interests do not replace consent required for optional tracking.
Consent — Article 6(1)(a): optional analytics, advertising/personalisation tracking and marketing where consent is required. You can shop without accepting optional marketing. Transactional service messages are separate.
Required checkout details are needed to arrange your purchase and delivery. Without them, we may be unable to perform the requested service. Optional consent is not a purchasing condition.
Recipients
Shopify provides commerce services, often as our processor under its Data Processing Addendum. It also acts as a controller for its own services and enhanced services described below.
EPROLO and delivery partners receive information needed for fulfilment, customs and resolving order problems, including recipient name/address, necessary contact details, ordered items and relevant claim evidence. EPROLO identifies operations in Shenzhen, China. Sharing should be limited to what is needed; unnecessary personal details in complaint evidence should be removed. Arc & Day remains your contact for our processing.
Google receives permitted Analytics events through the connected channel under the applicable settings and choices. Analytics connection is not itself consent to advertising. Other relevant recipients include email/support providers, payment providers when available, carriers, professional advisers and authorities where needed or legally required. A provider acting for its own legal purposes may be a separate controller.
Shopify enhanced services
Shopify Network Intelligence is enabled. Shopify can combine interactions with our store with information from other merchants and Shopify for enhanced services, including personalisation, advertising and understanding shopping activity. Information can be shared with Shopify and relevant third parties in other countries. Shopify is responsible for its own controller processing for these services.
Read the Shopify Consumer Privacy Policy at https://www.shopify.com/legal/privacy/app-users and use https://privacy.shopify.com/en for Shopify privacy choices. Store controls include Cookie preferences in the footer and https://arcandday.com/pages/data-sharing-opt-out. Where applicable, the opt-out page addresses uses treated as sale, sharing or targeted advertising under local law. Those controls do not replace prior consent required in Europe. Shopify's integrated controls recognise Global Privacy Control where applicable.
Cookies and choices
Essential storage supports requested features such as the bag, checkout, security and remembering consent choices. Optional analytics, advertising and personalisation require your prior choice where applicable. You can decline optional purposes and later change or withdraw your choice through Cookie preferences in the footer. Withdrawing consent does not affect earlier lawful processing. Browser settings can remove stored cookies; blocking essential cookies may prevent requested shopping functions.
Shopify's cookie banner is enabled in its configured European regions, with Accept, Decline and preference controls. [Before launch: verify all applicable regions and checkout coverage; test Google and other pixels before consent, after decline and after withdrawal. Add an accessible inventory of actual cookie/storage names, providers, purposes and lifetimes. Confirm GA4 retention and advertising settings. These checks have not yet passed.]
International transfers
Shopify admin reports an EU hosting location. This does not mean all app, support and service processing stays in the EEA. Providers may process data abroad, including Canada, the United States and China, depending on the service.
Transfers need a valid GDPR basis. Shopify describes its applicable adequacy decisions, binding corporate rules and contractual safeguards in https://www.shopify.com/legal/dpa. Shopify's arrangements do not automatically cover EPROLO or other independent apps.
[Before transferring customer orders to EPROLO: verify the contracting entity, roles, recipient countries/subprocessors, data-processing agreement, transfer mechanism and required assessment/safeguards. Confirm Google's applicable arrangements as well. EPROLO contractual safeguards have not been verified for this store.] You can contact us about applicable safeguards and obtaining a copy, subject to lawful redaction.
Retention and security
Information is retained for its purpose and relevant legal obligations. Accounting records subject to Swedish bookkeeping law must be kept for seven years after the calendar year in which the financial year ended; this does not justify retaining all browsing information for that period.
Account information is kept while needed for the requested account. Support and claim records are kept to resolve the matter and for the relevant legal-claims or statutory period where necessary. Consent and minimal suppression records may be kept to demonstrate and respect choices. Unnecessary information should be erased or anonymised. [Before launch: document and implement retention/deletion reviews for support, inactive accounts and analytics, including provider backups. The actual GA4 event-retention setting is unverified.]
We use Shopify's hosted services and access controls. No system can promise absolute security. Reported incidents must be assessed and any required notifications made under applicable law.
Your rights
Under GDPR you may request access, correction, erasure, restriction and, where applicable, data portability. You may object to legitimate-interest processing and always object to direct marketing. You may withdraw consent without affecting earlier lawful processing. Legal obligations and other lawful exceptions can limit particular requests; we will explain any refusal.
Use our contact details above. We respond without undue delay and normally within one month. Where a lawful extension is needed, we explain it within that first month. Identity checks must be proportionate. Requests are normally free, subject to statutory exceptions. You can complain directly to Sweden's Integritetsskyddsmyndigheten, https://www.imy.se/en/, or the competent authority where you live, work or where an alleged infringement occurred. You need not complain to us first.
Our current merchandising design does not make decisions producing legal or similarly significant effects about you. Payment/fraud providers may use automated checks under their notices when enabled. Contact us about a disputed decision; any applicable rights to human review and contesting it remain available.
Children, other regions and changes
The shop is intended for an adult shopping audience. We do not seek sensitive information about children; contact us if a child has provided information that should be removed. Customers elsewhere may have additional local rights, including an appeal or authorised-agent request where applicable. Contact us to exercise them; we do not penalise you for doing so. Further market-specific obligations must be reviewed before expanding sales or data uses.
We update this notice when practices change, show the revision date and give additional notice or request consent where required. A revised notice does not retrospectively authorise an incompatible use.