PMA Nordic AB, trading as Buzzin' Bees (“we”, “us”, “our”), operates the website buzzin-bees.com. This Privacy Policy explains how we collect, use, and protect your personal data in accordance with the EU General Data Protection Regulation (GDPR) and Swedish law.

1. Data Controller

PMA Nordic AB (trading as Buzzin' Bees)
Org. no. 559588-2159
Svinninge, 184 92 Åkersberga, Sweden
Email: info@buzzin-bees.com

2. What Data We Collect

When you contact us

Name and email address, the content of your message. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

When you place an order

Name, delivery address, email address, order and payment reference. Card payments are processed by Stripe (card, Klarna, Apple Pay) — we never receive or store your full card details. If you pay by Swish instead, the money reaches us as an ordinary bank transfer: no payment processor is involved, and what we see is what any bank transfer shows — the sender’s name, the amount and the message you wrote. Legal basis: contract performance (Art. 6(1)(b) GDPR).

When we send your order onward

To post your parcel we pass your name, address, email and phone number to Shipmondo and to the carrier you chose (DHL or UPS), who need them to print the label and tell you when it has arrived. To email you we pass your name, email address and the contents of your order to Resend. Legal basis: contract performance (Art. 6(1)(b) GDPR).

Website analytics and ad measurement — only with your consent

From 11 September 2026 we use Google Analytics 4, provided by Google Ireland Limited, to understand how the site is used — but only if you press Accept in the cookie question. Since 23 September 2026 the same consent also runs the Google Ads tag, which lets us see which of our advertisements led to an order. If you reject, or do not answer, no script is loaded at all and Google receives nothing.

What it records: the pages you view (with order numbers and access keys removed from the addresses before they are sent), the site you came from, your approximate location (country and city, derived from your IP address, which Google Analytics 4 does not store), your device and browser type, and interactions such as scrolling and clicks on outbound links. These are tied to a random identifier in the _ga cookie, not to your name, email or orders. We have switched off Google signals (cross-device linking) and personalised advertising. The Google Ads tag adds one thing to this: if you arrive from one of our advertisements, the identifier Google gave that click is kept in a _gcl_* cookie so an order can be counted back to the advertisement. No customer data is sent with it, no advertising audience is built from it, and there is no profiling.

Legal basis: your consent (Art. 6(1)(a) GDPR, and ch. 9 § 28 of the Swedish Electronic Communications Act for the cookies). Retention: 2 months for the recorded events; reports are aggregated. Google may process the data in the USA; Google LLC is certified under the EU–US Data Privacy Framework. You can withdraw your consent at any time with Cookie settings at the bottom of every page — the analytics and advertising cookies are deleted at once.

Since 3 October 2026 the same consent also runs the Meta pixel, provided by Meta Platforms Ireland Limited, for the advertisements we run on Facebook and Instagram. It records the pages you view and, if you arrived from one of our advertisements, keeps the identifier Meta gave that click in a _fbc cookie. It is not loaded at all on pages whose address contains an order number or an access key, and we have switched off Meta's “automatic advanced matching”, which would otherwise read what you type into forms on the site.

One thing goes further than Google, and we state it rather than bury it. If you arrived from one of our Meta advertisements and then place an order, our server sends Meta that click identifier together with your email address in hashed form (SHA-256, a one-way code), so the sale can be matched to the advertisement. Meta never receives the address itself. Nothing else is sent from our server: no name, no telephone number, no postal address, no IP address and no list of what you bought. The pixel in your browser is different: like every request a browser makes, the ones it sends to Meta carry your IP address and your browser's user agent, and that cannot be switched off. An order that did not come from a Meta advertisement is not reported to Meta at all. We build no advertising audiences and ask for no personalised advertising.

3. How We Use Your Data

To fulfil and deliver orders
To respond to enquiries
To comply with Swedish food safety and tax obligations

We do not sell, rent or share your personal data with third parties for marketing purposes.

4. Data Retention

Order data: 7 years (Swedish Bookkeeping Act, Bokföringslagen)
Contact messages: 2 years or until resolved
The honey list (“tell me when the honey is in”): until you unsubscribe — the link is in the email, and the address is deleted when you do

5. Third-Party Processors

Supabase (database hosting, EU region) — Privacy policy
Vercel (web hosting, EU edge) — Privacy policy
Resend (transactional email, EU/USA) — receives your name, email address and order contents so we can send your confirmation and payment instructions — Privacy policy
Shipmondo and the carrier you choose, DHL or UPS (shipping, EU) — receive your name, address, email and phone number to produce the label and notify you when the parcel arrives at the service point
Stripe (payment processing, EU/USA) — Privacy policy
Google Ireland Limited (Google Analytics and Google Ads, EU/USA) — only if you accept the cookie question; see “Website analytics and ad measurement” above — Privacy policy
Meta Platforms Ireland Limited (Meta pixel and Conversions API, EU/USA) — only if you accept the cookie question; receives a hashed email address for orders that came from one of our advertisements, see above — Privacy policy

All processors are bound by GDPR-compliant Data Processing Agreements.

6. Your Rights

Under GDPR you have the right to:

Access — request a copy of your personal data
Rectification — correct inaccurate data
Erasure — request deletion (“right to be forgotten”)
Restriction — limit how we process your data
Portability — receive your data in a portable format
Object — object to processing based on legitimate interest

To exercise any right, email info@buzzin-bees.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Swedish Data Protection Authority (IMY — Integritetsskyddsmyndigheten).

7. Cookies

We use strictly necessary cookies (sign-in) and — only if you accept — Google Analytics, Google Ads and Meta pixel cookies. Videos load from YouTube (Google) only when you press play on one; until then your browser does not contact YouTube. For full details see our Cookie Policy.

8. Changes to This Policy

We may update this policy. Material changes will be notified on the website. Continued use of the site after changes constitutes acceptance.