DRAFT, version draft 2026-10-21. The text has not been reviewed by a lawyer. If you place an order, this version applies to the order; if we change the text later, the change only applies to new orders.
Privacy policy for MyDoorPass, version draft 2026-10-21. How we process the personal data you provide when you design and order wristbands. Translations are provided for convenience; the English version prevails.
1. Who is responsible
MyDoorPass is the controller of the personal data processed on mydoorpass.com and in our orders.
2. What data, why and for how long
| Data | Why | Legal basis (GDPR Art. 6(1)) | How long |
|---|---|---|---|
| Contact person: name, email, phone. Names and phone numbers of the delivery recipients (one per delivery address). Addresses for copies of the order emails. | Confirm and deliver the order, answer questions, take payment | Legitimate interest (f) in performing the contract with your company. Contract (b) if you are a sole trader. | As long as the order and the complaint period last, then as accounting records for 7 years |
| Company, registration number, VAT number, delivery address, your reference | Bookkeeping, delivery, VAT checks | Legal obligation (c) and contract (b) | 7 years after the end of the calendar year in which the financial year ended (Swedish Bookkeeping Act, chapter 7, section 2) |
| The order: proof, design, quantities, price, event date, comment, time of approval of the proof and the terms | Manufacture, prove what was ordered, handle complaints | Contract (b) and legitimate interest (f) | 7 years, as accounting records |
| Original file (logo) that you uploaded to an order | Printing and reprinting | Contract (b) | With the order for 7 years. We delete the file earlier if you ask us to. |
| Contact details in a started checkout that did not become an order (email, name, company, phone) | Get in touch if the order was not completed | Legitimate interest (f) | 30 days, then deleted automatically |
| Shared drafts and approvals that did not become an order (the design, names and emails of you and your colleague, message) | Show the proof, share the design and send the approval link | Legitimate interest (f) | 12 months, then deleted automatically |
| Questions via Email us: name, email, the question and, if you wish, a link to the design | Answer the question | Legitimate interest (f) | 12 months, then deleted automatically |
| The chat with our AI assistant: the questions and answers, the page where the chat was used and, in the configurator, a summary of the design and the price. No name and no IP address. Do not write personal data in the chat. | Answer the question and see what customers ask, so that the answers and the website get better | Legitimate interest (f) | 90 days, then deleted automatically |
| Logos and images uploaded but not part of an order | Show the proof | Legitimate interest (f) | Until we delete them. We delete them when you ask us to. |
| A hashed form of the IP address when you place an order, save a checkout, send an approval request, ask a question or write in the chat, and a hashed form of your colleague's email | Protect the checkout against scripts and abuse | Legitimate interest (f) | At most 2 days |
| Technical logs at our web host (IP address, time, page) | Operations and security | Legitimate interest (f) | According to the web host's short standard period |
If you are a sole trader, your registration number may be your personal identity number. We only use it in our bookkeeping.
3. Data in your browser
The configurator saves your draft, and any pending approval, in your browser's local storage (localStorage) so that it is still there if you reload the page. The draft in the browser is deleted when the order is placed, and you can clear it yourself in the browser.
Logos, images and original files that you add are uploaded to our file storage straight away so that they can be shown on the proof. If you share a draft or ask a colleague to approve it, we save a copy of the design. We use no cookies for analytics or marketing.
4. Who receives the data
| Recipient | Role | Where | Safeguard for transfers |
|---|---|---|---|
| Vercel Inc. | Web hosting | USA and EU | EU–US Data Privacy Framework (certified), data processing agreement |
| Supabase Inc. | Database and file storage | EU (Stockholm) | Data processing agreement with the EU standard contractual clauses |
| Resend | Sending order emails | USA | EU–US Data Privacy Framework (certified), data processing agreement |
| Shopify | Payment at checkout: name, email, delivery address, the order and the payment | EU (Ireland), Canada and USA | Shopify's data protection terms (data processing agreement) |
| Anthropic PBC | The AI assistant in the chat: receives the questions, the answers in the same chat and the design summary in order to write the answer | USA | Data processing agreement with the EU standard contractual clauses (Anthropic's data protection terms) |
| Carrier (DHL, PostNord) | Delivery: name, address, phone | EU | Independent controller |
| Manufacturer in China | Receives the print file and the order number, but no contact details | China | No personal data is transferred (see section 5) |
We never sell personal data.
5. Outside the EU
Print files are sent to the manufacturer in China with the order number, without names, addresses or contact details. If a design contains personal data, such as names or photos of people, we first agree on it with you and sign the EU standard contractual clauses with the manufacturer.
6. Your rights
You have the right to know what data we hold about you and to have it corrected, erased or restricted. You also have the right to object to processing based on legitimate interest and to receive the data in a machine-readable format. Data required by the Swedish Bookkeeping Act cannot be erased until the retention period has passed. Contact us, and we will reply within one month. You can complain to the Swedish Authority for Privacy Protection (imy.se) or to the data protection authority in your own country.
7. Security
Orders and files are kept in a database and a private file storage with access control. The link to your order and the link to an approval contain a random key. Only share them with the people who should see the order.
8. Changes
We date every version of this policy. We notify customers with ongoing orders of major changes.