Integrity policy

The data controller for the processing of your personal data is: Bjarebyte AB Organization number: 559571-8585 Email: info@schackeriet.se We are responsible for processing your data in accordance with the EU General Data Protection Regulation (GDPR) and Swedish data protection legislation. Contact us via email with any questions about how we handle your personal data.

We process the following categories of personal data: Identity and contact information: • Name • Email address • Phone number • Delivery and billing address Purchase and order data: • Order history and receipts • Products purchased • Order-related correspondence Payment information: • Handled by Shopify Payments and Klarna • We never store card details on our own servers Technical data: • IP address • Browser type, device and operating system information Behavioral data (only with your consent): • Page views and clicks (Google Analytics) • Session recordings via Microsoft Clarity (sensitive information is automatically masked) Communication: • Emails and messages you send us

GDPR requires that every processing operation has a legal basis. For Schackeriet: To fulfill the purchase contract (legal basis: contract) • Process orders, delivery and payment • Send order confirmations, delivery information and receipts • Handle right of withdrawal, returns and complaints To comply with legal obligations (legal basis: legal obligation) • Retain invoice records and accounting (Swedish Bookkeeping Act — 7 years) • Disclose information to authorities when legally required To improve the service (legal basis: legitimate interest) • Error tracking via Sentry • Security and fraud prevention • Aggregated anonymous statistics (Vercel Analytics) With your consent (legal basis: consent) • Google Analytics 4 — website analytics • Microsoft Clarity — session recordings and heatmaps • Any future marketing communications You can withdraw your consent at any time via the cookie banner or by contacting us.

We retain your data only as long as needed for the purpose it was collected, or as long as required by law. Retention periods by category: • Order data, invoices and accounting records: 7 years (Swedish Bookkeeping Act) • Contact details without active orders: until you request deletion • Contact form and email correspondence: 12 months after last contact • Microsoft Clarity recordings: 30 days (automatic deletion) • Google Analytics data: 14 months • Sentry error reports: 90 days • Cookies: see the separate cookies section for individual cookie lifetimes

We share your personal data with data processors who handle data on our behalf under data processing agreements (DPAs). They may not use your data for their own purposes. E-commerce and payments: • Shopify Inc. (Canada/USA) — operates the web shop and Shopify Payments • Klarna Bank AB (Sweden) — payment service Delivery and supply chain: • Sunrise Chess & Games Sp. z o.o. (Poland) — supplier that ships products directly to you (dropshipping). Receives shipping address and name. • BaseLinker (Poland/EU) — syncs orders between Shopify and Sunrise Analytics and service improvement (with your consent): • Google Ireland Ltd / Google LLC — Google Analytics 4 (data may be transferred to the USA) • Microsoft Ireland / Microsoft Corporation — Clarity session recordings and heatmaps (USA) Operations and error tracking: • Vercel Inc. (USA) — web hosting and analytics • Functional Software Inc. / Sentry (USA) — error tracking International transfers: some of our processors are based outside the EU/EEA (mainly the USA). Such transfers are made on the basis of the EU-US Data Privacy Framework, Standard Contractual Clauses (SCCs), or other valid safeguards under GDPR. We never sell your personal data to third parties.

You have the following rights when we process your personal data: • Right of access — to know what data we hold about you • Right to rectification — to have inaccurate data corrected • Right to erasure ("right to be forgotten") — to have your data deleted, unless required by law • Right to restriction of processing • Right to data portability — to receive your data in a structured format • Right to object to processing based on legitimate interest • Right to withdraw consent — at any time, via the cookie banner or by contacting us To exercise any of these rights, contact us at info@schackeriet.se. Complaints to supervisory authority: If you believe we are processing your data unlawfully, you have the right to file a complaint with the Swedish Authority for Privacy Protection (IMY): • Web: www.imy.se • Email: imy@imy.se • Phone: +46 8-657 61 00

We use cookies to improve your experience on Schackeriet. Cookies are small text files stored on your device. • 1. NECESSARY COOKIES (always active) → authToken: Keeps you logged in to your account → cart: Saves shopping cart contents for 7 days → cookieConsent: Saves your cookie consent for 1 year → _shopify_*: Shopify cookies for secure checkout and payment • 2. ANALYTICS COOKIES (require consent) → _ga, _ga_*: Google Analytics 4 - tracks page views, user behavior and e-commerce events (product views, purchases). Stored for 14 months. IP addresses are anonymized → _gid: Google Analytics - distinguishes users. Stored for 24 hours • 3. BEHAVIOR ANALYTICS - MICROSOFT CLARITY (requires consent) → _clck, _clsk, CLID, ANONCHK, MR, MUID, SM: Microsoft Clarity cookies for session analytics → We use Microsoft Clarity to understand how visitors interact with our site via session recordings (mouse movements, clicks, scrolling) and heatmaps. This helps us identify UX issues and improve the user experience → Sensitive information such as passwords, emails and payment details are automatically masked and never recorded → Recordings are stored for a maximum of 30 days and then automatically deleted → More info: https://privacy.microsoft.com/privacystatement • 4. ERROR REPORTING AND PERFORMANCE → Sentry: We use Sentry to capture and report technical errors. Includes stack traces and technical diagnostics. IP address may be included but is not used for identification → Vercel Analytics & Speed Insights: Anonymous measurement of page views and performance. No personal data is stored, no cookies are set • 5. SHOPIFY E-COMMERCE Our web shop is powered by Shopify which handles payment, order management and shopping cart securely. Shopify sets cookies to enable the checkout process and protect against fraud. • YOU CAN MANAGE COOKIES → Accept/deny via cookie banner on first visit → Delete cookies in browser settings (Chrome: Settings → Privacy → Cookies) → Install Google Analytics Opt-out: tools.google.com/dlpage/gaoptout → Microsoft Clarity opt-out: contact us at info@schackeriet.se Note: If you block necessary cookies, login and shopping cart may stop working.

Security: We implement technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure or destruction. This includes: • Encrypted connections (HTTPS/TLS) • Access controls and secure authentication • Trusted cloud providers (Shopify, Vercel) • Regular security reviews Payment details are handled by Shopify Payments and Klarna and never touch our systems directly. Changes to this policy: We may update this privacy policy. We will never reduce your rights without notifying you. The current version is always available at schackeriet.se/privacy-policy. Contact: For questions about this policy or to exercise any of your rights: Bjarebyte AB Organization number: 559571-8585 Email: info@schackeriet.se