Privacy policy
Privacy Notice
Data privacy is of high importance for H&M Group and we want to be open and transparent with our processing of your personal data.
We therefore have a policy setting out how your personal data will be processed and protected.
Who is responsible for your personal data?
GODSENT is the controller and responsible for the personal data processing activities operating under the brand Creator Studio hereinafter referred to as “We” or “Us”.
GODSENT AB
Registration number: 559128-3253
Address: Jöns Filsgatan 2 , 211 43 Malmö, Sweden
VAT: SE559128-325301
What are your rights?
Right to access
You have the right to request information about the personal data we hold on you at any time. Please contact us, in accordance with the below, and we will provide you with your personal data via e-mail.
Right to portability
You have the right to get a copy of your data transferred to you or to another party. This only includes the personal data you have submitted to us, not such data we have obtained from third parties (if any).
Right to rectification
You have the right to request rectification of your personal data if the information is incorrect, for example rectification of your contact details, including the right to have incomplete personal data completed.
Right to erasure
You have the right to have your personal data erased unless:
*you have an ongoing matter with Customer Service
*you have an open order which has not yet been shipped or partially shipped
*you have an unsettled debt with us, regardless of the payment method
*if you are suspected or have misused our services within the last four years
*your debt has been sold to a third party within the last three years or one year for deceased customers
*if you have made any purchase, we will keep your personal data in connection to your transaction for book-keeping purposes
Right to object
You have the right to object to processing based on our or third parties’ legitimate interest and if you believe our processing is not lawful. Upon your objection, we will cease the processing your personal data unless we show you that our or third parties’ legitimate interests overrides your interest and rights or due to legal claims.
Right to restriction of processing
You have the right to request restriction, meaning that you are entitled to restrict our processing of your personal data under the following circumstances.
* where you have contested the accuracy of the personal information being processed by us
* where our processing is unlawful, and you have opposed the erasure of your personal data and requests restriction instead; or
*where we no longer need your personal information, but you have opposed the erasure because you need it to establish, exercise or defend a legal claim.
How do you exercise your rights?
Making a request
We take data protection very seriously and therefore we have dedicated customer service personnel to handle your requests in relation to your rights stated above. You can make a request for access, portability, rectification, erasure or objection by contacting Customer Service at support@godsent.gg.
Data Protection Officer
We have appointed a Data Protection Officer to ensure that we continuously process your personal data in an open, accurate and legal manner. You can contact our Data Protection Officer at dataprotection.se@hm.com and write DPO as subject matter.
Right to complain with a supervisory authority
If you consider us to process your personal data in an incorrect way, please contact us at support@godsent.gg. You also have the right to raise a complaint to a supervisory authority.
When and why do we process your data?
When shopping from us
Whenever you shop from us, we use your personal data to provide you with the products and services ordered from us. Specifically, we use your personal data to be able to process your purchase order and payment, to have your order produced and delivered, handle returns and warranty claims.
Before you place a purchase order, we use your personal data to verify your identity and your capacity to enter into a contract. We also process your personal data to verify that financial information you provide us is correct and to prevent fraud and other malicious activities against us and our trusted partners.
When you contact Customer service
Whenever you contact our Customer service, we will ask you to submit personal data to be able to manage your queries, to handle complaints and warranty matters and to provide you with technical support. We do this through e-mail, chat, telephone and through social media. We may also reach out to you by e-mailing you if there is a problem with your order.
Business relations
We will use your personal data to evaluate potential business partners and manage existing business relations including communication, procurement, contract signing and financial transactions.
Development and improvement
We may use your personal data to develop and improve our products, services, systems, and supply chain. This includes analyses to make our services more user-friendly.
We will only use aggregated data on pseudonymized level for developing and improvement purposes.
What are the legal grounds to process your personal data?
We are not allowed to collect and process your personal data without a proper legal justification.
When making products and services available to you we will process your personal data to the extent necessary to conclude a contract with you and to fulfil any obligations derived from that contract.
It is in our legitimate interest as a business to give you an outstanding customer experience and improve and develop our product and services.
It’s also our legitimate interest to manage business relations and provide business partners access to our systems.
As a business we must comply with different laws and regulations. In some case we must process your personal data to comply with such laws and regulations, for example, compliance with applicable tax and accounting legislation.
What types of personal data do we process?
We only use personal data that is provided by yourself for carrying out the tasks above, such as creating and developing your order, contact information, billing and delivery address and order and delivery information automatically generated when placing a purchase order. Only in case of fraud prevention we use data in public records.
We will never ask you to provide more data than necessary.
How long do we process and store your data?
We will not process your data longer than necessary to fulfill your requests and to ensure a secure transaction. We will save your personal data, including shopping history for a maximum of 6 months.
For tax and accounting reasons we will save relevant personal data for 7 years.
Who has access to your data?
Personal data provided to us is shared with trusted third parties assisting us in carrying out certain tasks or to provide a requested service. For example, we engage with Moteefe as a provider of the e-commerce platform. Moteefe then exchange personal data with independent printing suppliers as well as with carriers making sure you get the right products on time.
We never pass on, sell or swap your data for marketing purposes to third parties except as explicitly stated in this Privacy Notice.
Where do we store your data?
All personal data relating to the purchase order fulfillment is stored within the European Union but may be transferred for necessary processing operations to countries outside the European Economic Area (EEA). Any such transfer of your personal data will be carried out in compliance with applicable laws and without undermining your statutory rights.
From time to time we may transfers personal data from the EU/EEA to a third country not being approved by European commission as a safe country for such transfer (adequacy decision). Whenever applicable we will use Standard Contractual Clauses to ensure an equivalent level of protection as granted within the EU/EEA or other lawful grounds for transfer.
California privacy rights
This part applies for visitors, users, and others who reside in the State of California. To the extent any provision in this California Privacy Policy conflicts with a provision of the Privacy Notice, the California Privacy Policy shall govern with respect to visitors, users, and others who reside in the State of California.
Collection of Personal Information
We may collect information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household (“personal information”). In particular, we may collect the following categories of personal information:
A. Identifiers, such as real name, alias, postal address, unique personal identifier, online identifier, internet protocol address, email address, account name, or other similar identifiers.
B. Categories of personal information described in Cal. Civ. Code § 1798.80(e), such as name, signature, physical characteristics or description, address, telephone number, bank account number, credit card number, debit card number, or any other financial information.
C. Characteristics of protected classifications under California or federal law, such as age, citizenship, and sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions).
D. Commercial information, such as records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
E. Biometric information, as defined in Cal. Civ. Code § 1798.40(b).
F. Internet or other electronic network activity information, such as browsing history, search history, and information regarding a consumer’s interaction with an internet website, application, or advertisement.
G. Geolocation data.
H. Audio, electronic, visual, thermal, olfactory, or similar information.
I. Inferences drawn from other personal information to create a profile about a consumer reflecting a consumer’s preferences, characteristics, and trends.
Personal information does not include: publicly available information lawfully made available from government records, deidentified or aggregated consumer information, or information excluded from the California Consumer Privacy Act.
Use of Personal Information
We may use or disclose the personal information collected for one or more of the following business or commercial purposes:
To fulfill or meet the reason for which the information is provided. For example, to create your personal account or to process your orders.
To provide you with information, products, or services that you request from us, including answering your queries and to notify winners in promotions.
To provide you with phone calls, text message notifications, email alerts, and other notices concerning our products or services. For example, to notify you of delivery status, to be able to send you relevant marketing offers and information such as newsletters and our catalogues, to contact you in the event of a problem with delivery of your items, and to inform you of new or changed services.
To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection and managing your account by carrying our credit checks.
To be able to analyze your personal data to provide you with relevant marketing offers and information.
To be able to validate that you are of legal age for shopping online.
To improve our website.
Testing, research, analysis, and product and service development.
As necessary or appropriate to protect the rights, property, or safety of us, our employees, our customers, or others.
To respond to law enforcement requests and as required by applicable law, court order, or government regulations.
As described to you when collecting your personal information.
Sale of Personal Information:
We do not, and will not, sell your personal information.
Rights of California Residents:
California residents have the following rights:
1. Right to Know About Personal Information Collected, Disclosed, or Sold
You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable consumer request (instructions and description below), we will disclose to you:
The categories of personal information we collected about you;
The categories of sources for the personal information we collected about you;
Our business or commercial purpose for collecting or selling that personal information;
The categories of third parties with whom we share that personal information;
The specific pieces of personal information we collected about you; and/or
If we sold or disclosed your personal information for a business purpose, including lists of sales, identifying the categories of personal information that each category of recipient purchased or obtained.
We may have collected the following categories of personal information from consumers within the last twelve (12) months:
A. Identifiers, such as real name, alias, postal address, unique personal identifier, online identifier, internet protocol address, email address, account name, or other similar identifiers.
B. Categories of personal information described in Cal. Civ. Code § 1798.80(e), such as name, signature, physical characteristics or description, address, telephone number, bank account number, credit card number, debit card number, or any other financial information.
C. Characteristics of protected classifications under California or federal law, such as age, race, color, ancestry, national origin, citizenship, marital status, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, and genetic information.
D. Commercial information, such as records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
E. Biometric information.
F. Internet or other electronic network activity information, such as browsing history, search history, and information regarding a consumer’s interaction with an internet website, application, or advertisement.
G. Geolocation data.
H. Audio, electronic, visual, thermal, olfactory, or similar information.
I. Inferences drawn from other personal information to create a profile about a consumer reflecting a consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
We have obtained the categories of personal information listed above from the following categories of sources:
Directly from you, the consumer;
Indirectly from third parties and service providers, including partners and affiliates;
Directly and indirectly from our website.
We collected the categories of personal information listed above for the following business or commercial purposes:
To fulfill or meet the reason for which the information is provided. For example, to create your personal account at hm.com or to process your orders;
To provide you with information, products, or services that you request from us, including answering your queries and to notify winners in promotions;
To provide you with phone calls, text message notifications, email alerts, and other notices concerning our products or services. For example, to notify you of delivery status, to be able to send you relevant marketing offers and information such as newsletters and our catalogues, to contact you in the event of a problem with delivery of your items, and to inform you of new or changed services;
To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection and managing your account by carrying our credit checks;
To be able to analyze your personal data to provide you with relevant marketing offers and information;
To be able to validate that you are of legal age for shopping online;
To improve our website;
Testing, research, analysis, and product and service development;
As necessary or appropriate to protect the rights, property, or safety of us, our employees, our customers, or others;
To respond to law enforcement requests and as required by applicable law, court order, or government regulations; and/or
As described to you when collecting your personal information.
We shared the categories of personal information listed above with the following categories of third parties:
Affiliates, including H&M USA;
Service providers;
Third parties to which consumers authorized us to disclose personal information in connection with products or services provided to consumers.
2. Right to Request Deletion of Personal Information
You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request (instructions and description below), we will delete, and direct our service providers to delete, your personal information from our records, unless an exception applies.
We may deny your request to delete your personal information if retaining the information is necessary for us or our service providers to:
Complete the transaction for which we collected the personal information, fulfill the terms of a written warranty or product recall in accordance with federal law, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform a contract with you;
Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity;
Debug or identify and repair errors that impair existing intended functionality;
Exercise free speech, ensure the right of another consumer to exercise that consumer’s right of free speech, or exercise another right provided for by law;
Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546, et seq.;
Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when our deletion of the information is likely to render impossible or seriously impair the achievement of such research, if you have provided informed consent;
Enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us;
Comply with a legal obligation; and/or
Make other internal and lawful uses of the personal information that are compatible with the context in which you provided it.
3. To exercise your right to know about, access, or delete personal information, please submit a verifiable consumer request to us by either:
Calling us at: 855-HNM-SHOP [855-466-7467 (Toll-free)]
Emailing us at: dataprotection.us@hm.com
Only you or a person registered with the California Secretary of State that you authorize to act on your behalf may make a verifiable consumer request related to your personal information. You or your authorized agent may only make a verifiable consumer request for access or data portability twice within a 12-month period.
Your verifiable consumer request must:
Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information, or an authorized representative;
Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.
We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.
4. Right to Non-Discrimination
We will not discriminate against you for exercising any of your rights under the California Consumer Protection Act. Unless permitted by the California Consumer Privacy Act, we will not:
Deny you goods or services;
Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;
Provide you a different level or quality of goods or services; or
Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.
California Shine the Light Law
California Civil Code Section 1798.83 permits our visitors who are California residents to request certain information regarding our disclosure of personal data to third parties for their direct marketing purposes. To make such a request, please contact Customer Service.
Online Tracking
Please note that our Sites may not support “Do Not Track” browser settings and may not currently participate in any “Do Not Track” frameworks that would allow us to respond to signals or other mechanisms from you regarding the collection of your personal or non-personally identifiable information.
Last Updated: December 2019
Updates to our Privacy Notice
We may need to update our Privacy Notice. The latest version of the Privacy Notice is always available on our website. If practicable possible we will communicate any material changes that affects you by e-mail.