Privacy policy

Data controller

Lalicic Trading AB
Reg. no. 556819-4533
Kometgatan 19, 254 73 Ödåkra, Sweden
info@onervo.com

When you shop

We process your name, address, email address, phone number and what you have ordered in order to deliver your order and handle payment, returns, withdrawals and complaints. Legal basis: contract (GDPR Art. 6(1)(b)).

You must provide these details to be able to buy from us. Without them we cannot complete the purchase. Keeping accounting records is required by law, and some technical data is processed so that the website works, see the section Running the website. What you choose to use yourself is voluntary: the chat, the form on the B2B & Resellers page, watching sold-out flavours, the customer account and ad measurement. If you do not provide the details for a voluntary service, only that service will not work.

We send your basket to the checkout without any personal data, only which items and how many. You enter your name, address and other details in the checkout at kassa.onervo.com.

Orders are handled in Abicart, our platform for orders and checkout. Abicart AB processes the personal data on our behalf as a data processor, under Abicart's data processing agreement (Appendix 1 to Abicart's general terms and conditions). Server operation and data storage are handled by Abicart's parent company Textalk AB, Krokslätts fabriker 12, 431 37 Mölndal, Sweden. Under the agreement, personal data may be transferred to a country outside the EU/EEA only if that country has an adequate level of protection or appropriate safeguards are in place, such as the EU standard contractual clauses; otherwise our consent is required.

If you want to withdraw from your purchase, you can use the withdrawal function Withdraw from contract here, which is in the footer and on the page Right of withdrawal. The function is on our website and runs through Abicart's withdrawal service: you enter the email address you ordered with and your order number, Abicart emails you a link to confirm, and once you have confirmed, Abicart sends an acknowledgement of receipt. We process the data to handle your right of withdrawal. Legal basis: contract (GDPR Art. 6(1)(b)). Data that is accounting information is kept as described under Bookkeeping.

The checkout is Kustom Checkout. Kustom and the payment providers in the checkout, for example Klarna and Stripe, process payment data as independent data controllers, under their own terms. Kustom describes its processing in the Kustom Checkout privacy notice, which we link on the Payment page. If you choose Klarna, Klarna may run its own credit check under its terms. We never store card details.

Business customers in Sweden may be able to buy on invoice. Before the invoice is approved, a credit check may be carried out, by us or by the payment provider, based on details about the company and the contact person, for example name, company registration number, address and email address. We do this to decide whether we can offer an invoice. Legal basis: legitimate interest (GDPR Art. 6(1)(f)), namely avoiding credit losses. If an invoice is not approved, you can pay in advance instead.

To be able to deliver, we pass your name, address and contact details to the carrier. For private customers within Sweden this is normally PostNord. You can see the delivery options for your order in the checkout.

Bookkeeping

Order and payment details that are accounting records are kept until the end of the seventh year after the calendar year in which the financial year ended, under the Swedish Bookkeeping Act (bokföringslagen). Legal basis: legal obligation (GDPR Art. 6(1)(c)).

Other details from your order, for example your phone number, are kept as long as they are needed to handle returns, withdrawals, complaints and any claims relating to the purchase.

When you contact us

If you email info@onervo.com, we process your name, your email address and what you write so that we can reply. Legal basis: legitimate interest (GDPR Art. 6(1)(f)), namely being able to answer your question. We delete the emails three years after the case has been closed. Emails that belong to our bookkeeping are kept for seven years, under the Swedish Bookkeeping Act (bokföringslagen).

Our email is handled by Google (Google Workspace) as our processor. Google LLC is certified under the EU–U.S. Data Privacy Framework.

Inquiries from the B2B & Resellers page

If you send the form on the B2B & Resellers page, we process the company's name, your name, your email address, your phone number if you give it, the country and what you write, so that we can reply to your inquiry. Abicart sends the inquiry to us as an email and processes the data on our behalf as our processor, under the same agreement as for orders. Legal basis: legitimate interest (GDPR Art. 6(1)(f)), namely being able to answer the inquiry. The inquiry is kept as an email with us and deleted three years after the case has been closed.

The form is protected against automated submissions by Google reCAPTCHA, which Abicart requires in order to accept the message. Google reCAPTCHA loads only once you start filling in the form, not when you open the page. Google LLC then receives, among other things, your IP address, details about your browser and device and about how you use the page, and Google may store cookies and other information in your browser. Google processes the data under its own privacy policy. Google LLC is certified under the EU–U.S. Data Privacy Framework, which is the basis for transferring the data to the USA. Legal basis: legitimate interest in protecting the form against abuse (GDPR Art. 6(1)(f)). If you do not want Google reCAPTCHA to load, you can email us instead.

The customer chat

The chat on onervo.com is an AI assistant run by Basio (basio.ai) on our behalf. The chat's program code is fetched from Basio's server, which runs at Vercel, on every page: when you first click, scroll or press a key, or a few seconds after the page has loaded. That is why Basio and Vercel see your IP address and details about your browser. Vercel is certified under the EU–U.S. Data Privacy Framework.

The chat sets no cookies. Once it has been fetched, it stores a random session ID (basio_sid_onervo-product) in your browser's local storage until you clear the site data. With it, the chat can remember your previous conversation in the same browser.

What you write in the chat is stored in Basio's database. The messages are deleted automatically 90 days after they were written, and the conversation 90 days after your last message. Basio also stores your IP address, to stop misuse of the chat and limit the number of requests. This happens when you open the Messages tab in the chat window, even if you do not write anything, and when you write a message, leave a rating or use Forget me. The IP address is deleted automatically within two days after you last did any of these.

Below the chat's replies are the buttons Good answer and Bad answer. If you press one of them, Basio stores your rating, the beginning of the reply you rated (at most 200 characters) and the chat's session ID. If you choose Bad answer, you can also write what was wrong, and that text is stored too. After five messages from you, the chat may ask you to give a rating of one to five stars. Basio then stores the rating and the chat's session ID. This is voluntary. We use it to correct wrong answers and improve the chat. Do not write any personal data in the field for what was wrong. Basio also stores technical operating data for every reply, for example what the reply cost and which checks were run, linked to the session ID but without what you wrote. Ratings, star ratings and operating data are deleted automatically 90 days after they were stored, and immediately if you use Forget me.

To produce the reply, what you write is sent via OpenRouter to an AI model from Anthropic. If that model does not respond, the same question is sent instead to a model from DeepSeek, also via OpenRouter. OpenRouter may process the data in the USA or other countries outside the EU/EEA, and passes it on to the model's provider. Which provider receives the data, and where, is decided by OpenRouter. The model's provider processes the data under its own terms. According to OpenRouter, some providers may store the data or use it to improve their models. OpenRouter states in its privacy policy that it transfers data outside the EU/EEA on the basis of the European Commission's standard contractual clauses (GDPR Art. 46).

If you ask about an order, the chat can look it up in Abicart. You only get an answer about your order once you have written both the order number and the email address you ordered with. The order number, order date, delivery status, payment status and total are then sent to the AI model so that it can answer you. If you want to return something and give an order number, the chat also checks in Abicart whether the order exists, but that answer is not sent to the AI model.

If you want to return something, or need help from a person, the chat can hand the case over to us. Basio then stores a note about the handover. It is deleted automatically 30 days after the case has been closed or has expired. The chat also shows a button that opens a ready-made email to info@onervo.com with the latest messages in the conversation. The email is only sent if you send it yourself.

You can delete the conversation yourself with the Forget me button in the chat, or by emailing us. Legal basis: legitimate interest (GDPR Art. 6(1)(f)), namely being able to answer your questions about our products and your order, being able to correct wrong answers and improve the chat, and protecting the chat against misuse.

You can get a copy of the safeguards for transfers outside the EU/EEA that we mention on this page, for example the European Commission's standard contractual clauses, by emailing info@onervo.com. The clauses are also available on eur-lex.europa.eu (Decision (EU) 2021/914).

Customer account

If you have a customer account with us, it is in Abicart, on kassa.onervo.com. Your contact details and your order history are stored there on our behalf, so that you can see your orders. We keep the account for as long as it exists, or until you ask us to delete it. Order data that is accounting information is kept as described under Bookkeeping. Legal basis: contract (GDPR Art. 6(1)(b)).

The basket

What you put in the basket is stored in your browser, not with us.

Watching a sold-out flavour

If you ask us to tell you when a sold-out flavour is back in stock, we pass your email address to Abicart, which stores it on our behalf as our processor and uses it only for that message. We keep the address until the watch has ended or until you withdraw your consent. Legal basis: your consent (GDPR Art. 6(1)(a)). You can withdraw your consent at any time by contacting us.

In the chat you can also ask for an email when an item is back in stock. Basio then stores your email address, which flavour you want to watch and the chat's session ID on our behalf, and uses them only for that email. The data is deleted automatically 180 days after you signed up, or 30 days after we have sent the email. Legal basis: your consent (GDPR Art. 6(1)(a)). You can withdraw it by emailing info@onervo.com or by using Forget me in the chat.

Ad measurement

If you accept marketing cookies, we load Meta's pixel, which tells Meta that you have visited a page on our site. This involves processing, among other things, your IP address, information about your browser, the address of the page and a cookie identifier. Legal basis: your consent (GDPR Art. 6(1)(a) and the Swedish Electronic Communications Act, chapter 9, section 28). If you do not accept, the pixel is not loaded at all.

For the collection and transfer to Meta, we and Meta are joint controllers. What Meta then does with the data is Meta's responsibility. Meta Platforms, Inc. is certified under the EU–U.S. Data Privacy Framework, which is the basis for transferring the data to the USA.

We do not store any data from the pixel ourselves. How long Meta keeps it is decided by Meta under its own privacy policy. If you withdraw your consent, the page reloads without the pixel, and no further data is sent to Meta.

You can withdraw your consent at any time under Cookies.

Running the website

The website runs at Vercel, which processes the data as a data processor under Vercel's data processing agreement. Vercel is certified under the EU–U.S. Data Privacy Framework, and the agreement includes the EU's standard contractual clauses for transfers to the USA. Vercel's server logs are kept for 1 day. Legal basis: legitimate interest (GDPR Art. 6(1)(f)), namely that the website works and is secure.

Automated decisions

We make no decisions about you that are based solely on automated processing and have legal effects for you. The chat answers questions but decides nothing about you. If you choose Klarna, Klarna may run its own credit check under its terms, and for business customers a credit check may be carried out before an invoice is approved. The decision on invoices for business customers is ours, and if an invoice is not approved you can pay in advance instead.

Your rights

You have the right to know what data we hold about you and to get a copy (Art. 15), to have errors corrected (Art. 16), to have data erased (Art. 17), to restrict processing (Art. 18) and to receive data you have provided in a machine-readable format (Art. 20). Write to info@onervo.com.

You also have the right to object at any time to processing based on legitimate interest (Art. 21). We then stop, unless we have compelling grounds to continue.

You can withdraw consent at any time. This does not affect processing that took place before you withdrew it.

How to delete your data

Write to info@onervo.com from the email address you used and write “Delete my data”. We confirm that we have received the request and delete your data within one month, except what we are required by law to keep, for example the bookkeeping. We tell you in our reply what we have to keep. If it concerns the chat: also write roughly when you chatted, or the value of basio_sid_onervo-product in your browser's local storage, so that we can find the conversation. You can also delete the chat conversation directly with the Forget me button in the chat.

Complaints

If you are unhappy with how we process your data, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), imy.se (GDPR Art. 77).

Contact

Questions about your personal data: info@onervo.com · Lalicic Trading AB