We collect only the personal data necessary to fulfil your order, provide support, and operate our store lawfully — nothing more, and we don't retain it beyond what's described below.

Under the GDPR we need a lawful basis for every use of your data: contractual necessity to fulfil your order, legitimate interest for fraud prevention, legal obligation for tax compliance, and consent for marketing.

You may unsubscribe from marketing at any time via the link in any email, or contact us to withdraw consent — without affecting the lawfulness of prior processing.

We share data only with service providers essential to running our store and fulfilling your order. We never sell your personal data to anyone, for any purpose.

Shopify processes data on our behalf as a data processor under Article 28 GDPR, on our documented instructions and subject to a data processing agreement. Its own privacy policy is available at shopify.com/legal/privacy.

Cankind is established in Sweden and sells to customers in the United States, so your data necessarily moves between the EU and the US.

Order data is processed on Shopify's infrastructure, which stores data primarily in the United States and Canada. Where personal data leaves the EEA, we rely on a transfer mechanism permitted under Chapter V GDPR — typically the EU–US Data Privacy Framework adequacy decision for certified US recipients, or the European Commission's Standard Contractual Clauses where no adequacy decision applies.

We use cookies for essential site functions, analytics, and (with your consent) advertising. You can control this via our consent banner and your browser settings.

Analytics and marketing cookies are only set after you accept them via our consent banner; you can change this choice at any time. We honor Global Privacy Control and browser Do Not Track signals where technically feasible. California residents may opt out of sharing for cross-context advertising by emailing info@cankind.com with subject “CCPA — Opt Out of Sharing.”

Because Peter Hulspas, Sole Proprietorship is established in Sweden, the GDPR applies to our processing, and these rights are available to all our customers regardless of where they live.

If you believe we've handled your data unlawfully, you may lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, 104 20 Stockholm, Sweden — imy.se. US residents may also contact the FTC or their state attorney general.

California residents have additional rights under the CCPA/CPRA, sitting alongside the GDPR rights above — you may rely on whichever gives stronger protection.

We do not sell your personal information as defined under the CCPA. To exercise your rights, email info@cankind.com with subject “CCPA Request.” We acknowledge within 10 business days and respond in full within 45 days (extendable by a further 45 with notice). You may designate an authorized agent to make a request on your behalf with your written, signed permission.

No system is 100% secure. If a personal data breach occurs, we will notify the Swedish Authority for Privacy Protection (IMY) within 72 hours where required under Article 33 GDPR, and notify affected customers directly where the breach poses a high risk, in line with applicable US state breach notification laws.

We review this Privacy Policy periodically. For material changes affecting your privacy rights, we'll post a notice on cankind.com before the changes take effect, and email you where required.