Privacy policy
In force since .
The controller of your personal data is Portfoliobox Stockholm AB, org. no. 556894-4382, VAT no. SE556894438201, Rånövägen 30, 168 39 Bromma, Sweden, hello@exerciseimages.com. Write to us about anything in this policy.
What we hold, and why
A purchase. When you buy the exercise illustrations: your email, your country and, for a business, the VAT number, with the licence, the amount, the VAT and the receipt. The email is where the receipt and the download link go, and where a new link goes when you ask for one. The card details stay with Mollie.
Messages. When you write to us through the contact page, we receive what you send by email: your name, your email and your message.
Technical data. Our host keeps short-lived request logs with IP addresses and times, to run and protect the service. We count page visits with Plausible Analytics, which is cookieless, stores no personal data and runs in the EU: it sees the page, the referrer, the browser and the country, and an event when the illustrations are bought, never who you are.
Legal bases
| Purpose | Legal basis |
|---|---|
| Selling and delivering the illustrations | Contract, article 6(1)(b) of the GDPR |
| Receipts, bookkeeping and tax | A legal obligation, article 6(1)(c) |
| Answering messages | Our legitimate interest, article 6(1)(f), or steps before a contract |
| Security, preventing abuse, handling disputes | Our legitimate interest, article 6(1)(f) |
| Counting visits, without cookies or anything that says who you are | Our legitimate interest, article 6(1)(f) |
Who sees it
The companies we use to run the service, each bound by an agreement with us:
| Sub-processor | What it does | Where |
|---|---|---|
| Fly.io, Inc. | Hosting of the service and its database | Amsterdam, the Netherlands. A US company: Standard Contractual Clauses |
| Mollie B.V. | Payments | The Netherlands |
| Plus Five Five, Inc. (Resend) | Sending email | United States: Standard Contractual Clauses |
Authorities, when the law requires it.
We do not sell your data and we do not share it for advertising.
Where it is kept
The service and its database run in Amsterdam, in the European Union, and every connection is encrypted. When a company we use is outside the EU, the transfer is covered by the European Commission's Standard Contractual Clauses.
How long
| Data | Kept |
|---|---|
| A purchase, with the email it was bought with | Seven years after the end of the year, as Swedish bookkeeping law requires; the email keeps your download link working |
| Messages to us | Twelve months after the last contact |
| Request logs at our host | A short time, under the host's own rules |
Cookies
None. The site sets no cookie, and the visit counting above sets none.
Your rights
You may ask for a copy of your data, have it corrected, have it erased where the books do not need it, have its use restricted, object to processing based on our legitimate interest, and receive the data you gave us in a machine-readable form. Write to us and we answer within a month.
You may also complain to the Swedish Authority for Privacy Protection (IMY), imy.se, or to the authority where you live.
Changes
When this policy changes, we update the date above.