Privacy policy

Effective October 25, 2026.

Who is responsible

The controller of your personal data is William Wigertz Wåhlström, Rgo 962 X, 106 43 Stockholm, Sweden, operating Marlowe Keepsakes (marlowekeepsakes.com). Contact: william@bruket.co. Because the controller is established in the European Union, the EU General Data Protection Regulation (GDPR) applies to all customers, including customers in the United States.

What we collect

Order and contact details: name, email, phone, shipping and billing address, and order history.
Payment details: processed by Shopify's payment provider. We see only limited information, such as the last four digits of a card.
Messages you send us.
Device and usage data, collected with cookies and similar tools: pages viewed, products added to cart, device and browser type, approximate location and referring ad.

Why we use it, and our legal basis

To process, ship and support your order: necessary for our contract with you.
To keep order and accounting records: legal obligation.
To prevent fraud and secure the store: our legitimate interest in protecting customers and the business.
To send marketing emails, only if you opt in: consent. You can unsubscribe in any email.
To measure and improve our advertising with tools such as the Meta Pixel and Conversions API: your consent, given through our cookie banner. You can change your choice at any time.

Providing order details is needed to fulfil an order. We don't use automated decision-making that has legal or similarly significant effects on you.

Who we share it with

Shopify (store, checkout and payment processing).
Our suppliers and their warehouses and carriers, to ship your order.
Meta Platforms, for ad measurement and delivery, when you consent. For data collected through Meta's tools, we and Meta are joint controllers for the collection and transmission of that data.
Authorities, when the law requires it.

We don't sell personal information for money. Some data shared with advertising partners may count as "sharing" or "targeted advertising" under US state laws; you can opt out as described below.

International transfers

Your data may be processed in the EU, the United States, Canada and China (our suppliers). Where the destination isn't covered by an EU adequacy decision, we rely on safeguards such as the European Commission's standard contractual clauses.

How long we keep it

Order and accounting records: up to 6 years, or longer if the law requires. Marketing data: until you unsubscribe. Support messages: up to 2 years after the last contact.

Your rights

You can ask for access, correction, deletion, restriction, portability, and object to processing, including direct marketing, and withdraw consent at any time. Email william@bruket.co. You can also complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) or the data protection authority where you live.

US residents: you can opt out of the sale or sharing of personal information and of targeted advertising on our Your Privacy Choices page. We honour Global Privacy Control (GPC) signals as an opt-out. We don't respond to other "Do Not Track" browser signals. Third parties such as Meta may collect information about your activity over time and across websites when you consent to cookies.

You can also opt out of interest-based ads from many companies at optout.aboutads.info.