Privacy policy

Earius International AB (reg. no. 559060-9748), referred to below as “Rius Legacy”, is the data controller for the processing of your personal data. We process your data in accordance with the EU General Data Protection Regulation (GDPR) and supplementary Swedish legislation.

Postal address: Hermelinsvägen 21, 132 46 Saltsjö-Boo, Sweden
Contact: info@riuslegacy.com

When you make a purchase: name, email address, phone number, delivery or pickup address, payment information. Full card details are handled by Stripe — we never receive or store them.

When you contact us or apply: the details you enter in the form (typically name, email, phone and message).

When you subscribe to the newsletter: your email address, which is handled in our own sending system via our email provider Resend.

When you are registered as a seller in a group: your name and (optionally) your email address. The sales administrator enters this — you become a seller at the group's initiative.

When you are a sales administrator: your name, email address, phone number, billing address, organization details, the group's Swish number.

IP address: collected temporarily for rate-limiting (protection against abuse) via Upstash. Stored for a maximum of 24 hours and deleted automatically. One exception: when a group contact person applies for cooperation we save the IP address and timestamp as proof that the partnership terms were accepted — see the retention periods in section 4.

Cookies and local storage: a limited number of technically necessary cookies for the cart, login and consent choice. Details in section 12 below.

Technical error logs: when technical errors occur, a stack trace is sent to Sentry for troubleshooting. It contains the URL, browser type and any error message text — no form values or full customer data.

We use Google Analytics 4 for aggregated, anonymized website statistics. Google Analytics only loads once you choose “Allow all” in the cookie banner. Before that, and if you choose “Necessary only”, no analytics is loaded and nothing is sent to Google (no cookies, no IP transfer). You can change your choice at any time via “Manage cookies” in the footer.

Meta Pixel (Facebook and Instagram):we use the Meta Pixel to measure the effect of our advertising and to reach relevant audiences. The pixel only loads once you have consented to “Advertising” in the cookie banner — before that, and if you decline, nothing is loaded and nothing is sent to Meta. When active, Meta receives which of our pages you visited, the time, browser type, screen size, IP address and the _fbp cookie.

The pixel runs only on our public pages. It is disabled at checkout, on order confirmations, on logged-in pages (sales administrator, seller, admin) and in account and newsletter link flows. The addresses of such pages, and the one-time links used there, are therefore never shared with Meta. We do not use automatic advanced matching — we do not let the pixel read form fields on the pages where it runs.

Meta Conversions API (purchases):once you have completed a purchase and consented to “Advertising”, we report that purchase to Meta from our own server rather than from your browser. We do this because many purchases with us are confirmed after the fact — in group purchases the group administrator marks the payment, sometimes several days later — and the purchase can no longer be measured in the browser.

We send the order total, currency, number of items and your email address and phone number in hashed form(SHA-256, a one-way computation) together with Meta’s own cookie identifiers. Hashing lets Meta match you against an existing account without the data travelling in clear text, but it does not make the data anonymous — it remains personal data, which is why the transfer requires your consent. We never send names, addresses, product names, message text or payment details. If you have not consented to advertising, the purchase is not reported at all.

For the collection and transmission of pixel data, Rius Legacy and Meta Platforms Ireland Ltd are joint controllersunder article 26 GDPR. For Meta’s own subsequent use of the data, Meta is the sole controller and the processing is governed by Meta’s own privacy policy. You can withdraw your consent at any time via “Manage cookies” in the footer — we then stop sending data to Meta.

If you withdraw consent after a purchase but before it has been reported, we clear the consent and the attribution identifiers on that order so it is not reported. This happens automatically in the browser where you withdraw. If you purchased from another device, or cleared your browser storage, contact us at info@riuslegacy.com and we will do it manually. Either way, the attribution identifiers are deleted automatically after eight days, since a purchase cannot be reported to Meta after that.

To meet the GDPR transparency requirement, we list each purpose with the legal basis we rely on and how long the data is kept:

When you shop via a group's web shop (URL in the format riuslegacy.com/lag/[groupname] or /lag/[groupname]/[seller]) we share your contact and delivery details with the sales administrator and the seller linked to the purchase. This is necessary for the group's distribution of the products to work and for them to be able to reach you if there are questions about the order.

What is shared: name, email address, phone number, delivery address, ordered products, total amount, payment status.

What is NOT shared: your personal identity number, your payment card details, your IP address history or other information we don't need to handle the group purchase.

This sharing only happens after your explicit consent — for group purchases you tick a separate box at checkout in addition to the general terms. Without the tick, the purchase cannot be completed.

We engage the following providers that process personal data on our behalf. We have a data processing agreement (DPA) with all of them under GDPR art. 28.

• Stripe Payments Europe Ltd (Ireland, card payments and payment processing)
• Supabase Pte. Ltd (database hosting, EU region; the company is registered in Singapore)
• Netlify Inc. (web hosting and CDN; the company is registered in the US)
• Resend (transactional email and newsletter/marketing sends, EU region)
• Google Ireland Ltd (Google Analytics — aggregated website statistics; the parent company Google LLC in the US is DPF-certified)
• Meta Platforms Ireland Ltd (Meta Pixel and the Meta Conversions API — measuring and evaluating ads on Facebook and Instagram; the Conversions API reports completed purchases with a hashed email address and hashed phone number). Meta is not merely a processor: for the collection and transmission we are joint controllers under art. 26 GDPR, and for Meta’s own subsequent use Meta is the sole controller.
• Upstash Inc. (Redis for rate-limiting and email queue, EU region)
• Sentry / Functional Software Inc. (error logging, EU region)
• Carriers (Early Bird, PostNord, DHL) — name and address for delivery, only for home delivery

We never sell your personal data to third parties.

Once the group has received your contact and delivery details under section 5, the group is an independent data controller for its own processing of the data — mainly to contact you about delivery or distribution and to handle any questions about the order.

The group's processing is governed by the same GDPR principles as our own. We require in our partnership terms that groups may only use the data to fulfil the order and must delete or return it once the purpose has been met. If you have questions about how a specific group handles your data, you can contact the group's administrator directly or reach out to us and we'll facilitate the contact.

Several of our providers are registered outside the EU/EEA — including Supabase (Singapore) and Netlify, Upstash and Sentry (US). With Stripe, Google and Meta we contract with their Irish entities, but group companies outside the EU may be involved. Where data is actually transferred outside the EU/EEA, we rely on the following safeguards under GDPR art. 44–49:

• EU-US Data Privacy Framework (DPF) — for providers that are certified (e.g. Google and Meta). The DPF is the European Commission's adequacy decision since 2023.
• Standard Contractual Clauses (SCC) — for providers not covered by an adequacy decision (e.g. Netlify and Supabase). SCCs contain binding contractual safeguards approved by the European Commission.
• EU-region hosting — for Supabase, Resend, Upstash and Sentry, data is hosted in their EU regions (Frankfurt, Stockholm or Ireland), which minimizes actual third-country transfer.

We have taken appropriate technical and organizational measures under GDPR art. 32:

• Encryption in transit — all traffic to the site goes over HTTPS/TLS 1.2+
• Encryption at rest — database and backups are encrypted by Supabase
• Row-level access control — Row Level Security in the database ensures one group can never read another group's data
• Passwords — hashed with bcrypt by Supabase Auth; plaintext is never stored
• PCI DSS — card payments are handled by Stripe (PCI DSS Level 1-certified); we are never exposed to card data
• Rate-limiting — protection against brute force on login, contact and checkout
• Log monitoring — errors are reported via Sentry for quick detection of any security events

You have the right to:

• Request a copy of your data (what data we hold about you)
• Request rectification of incorrect data
• Request erasure (“the right to be forgotten”)
• Request restriction of processing
• Object to processing based on legitimate interest
• Data portability (receive your data in a machine-readable format)
• Withdraw consent at any time

Contact us at info@riuslegacy.com to exercise your rights. We respond within 30 days.

For erasure requests: accounting records under section 4 must be kept for 7 years (Bookkeeping Act ch. 7 § 2), but we anonymize personally identifying information so that the remaining data cannot be linked to you.

We do not use automated decision-making or profiling that has legal consequences for you under GDPR art. 22.

Stripe uses automatic fraud detection (Radar) on card payments to block suspicious transactions. This assessment may in rare cases lead to a payment being declined. In cases where this affects you, you can contact us for a manual review.

When you visit the website you get to choose between “Necessary only” and “Allow all” via the cookie banner. Your choice is saved and you can change it at any time via “Manage cookies” in the footer.

Necessary cookies (always active): cart (rius_cart_v2), consent choice (rius_cookie_consent), login session for sales administrators and sellers (Supabase Auth), active-group cookie for multi-team admins (rius_active_team), CSRF protection.

You consent to website statistics and advertising independently. Ticking “Website statistics” loads Google Analytics; ticking “Advertising” loads the Meta Pixel, sets the _fbp cookie, and reports a completed purchase to Meta via the Conversions API. “Allow all” grants both. If you choose “Necessary only”, or leave a box unticked, nothing loads for that purpose and no purchase is reported.

Stripe places technically necessary cookies for the payment process — exempt from the consent requirement under the Swedish Electronic Communications Act ch. 6 § 18a (cookies required to deliver a service the user has requested).

Detailed cookie information is available on our cookie page.

We do not primarily target children under 16. Because we sell clothing via fundraising campaigns where players/students may be young, our assumption is that a guardian is involved in the purchase.

If we become aware that a person under 13 has provided personal data directly to us without a guardian's consent (GDPR art. 8 + the Swedish age limit of 13 for digital consent) we delete that data without delay. Contact info@riuslegacy.com with any questions.

If you believe we process your personal data incorrectly, you can file a complaint with the Swedish Authority for Privacy Protection (IMY) at imy.se.

We're always happy to receive your feedback directly at info@riuslegacy.com.

This policy was last updated in August 2026. For significant changes we inform existing customers by email or via a clear notice on the website.