CircuCity AB. Last updated: February 13, 2026
Your privacy is important to CircuCity AB ("CircuCity", "we", "our", or "us"). We are committed to handling your personal data responsibly, transparently, and in compliance with the General Data Protection Regulation (GDPR) and other applicable laws.
This policy explains:
- Why we collect data
- What data we collect
- How we use and share it
- How long do we keep it
- Your rights and how you can exercise them
Please read this policy carefully before using our services.
Data Controller
CircuCity AB has not appointed a Data Protection Officer, as we are not required to do so under Article 37 of the GDPR. Matters relating to personal data protection are handled by CircuCity AB's management team.
CircuCity AB is the controller of your personal data.
Contact Information:
- Address: Gruvgatan 17C, 93148 Skellefteå, Sweden
- Email: circucity2024@gmail.com / hr@circucity.com
What Data Do We Collect?
To provide our marketplace services (buying, selling, swapping, eco-points, CO₂ impact tracking, premium features, and AI-driven tools), we process personal data. We collect data in three main ways:
Data You Provide to Us
- Personal and contact information: First name, last name, address, telephone number, email, password
- Payment details: Bank account information for payouts (payment card details are stored only by our payment providers)
- Profile data: Username, profile picture, eco-points balance, swap history
- Communications: Customer service requests, chat messages with other users, surveys, and feedback forms
- Optional data: Any information you choose to provide in your profile or marketplace listings
Data We Collect Automatically
- Service usage: Items you browse, buy, sell, swap, or favorite
- Transaction data: Purchase history, swap transactions, fees, billing details
- Device and access data: IP address, browser type, operating system, language, time zone, screen resolution, referral/exit pages, error logs
- Activity data: Log-ins, time spent on features, responses to eco-points challenges
- Technical data: Cookies and usage statistics
Data from Third Parties
- Payment providers: Confirmation of payments, withdrawals, and fraud checks
- Logistics providers: Delivery/collection updates
- Marketplaces & analytics providers: Demographic insights, service usage metrics
- Social media logins: If you use Facebook, Google, or other integrations, we may receive login and profile information
- Advertising partners: Information on ad performance and engagement (with your consent)
How Do We Use Your Data?
We process your personal data only where we have a legal basis under the GDPR:
Purposes:
- To provide and operate our services: Orders, payments, account management, notifications
- To improve and personalize services: Recommendations, analytics, eco-points, AI tools
- For communication: Support, surveys, newsletters
- For legal and security reasons: Fraud prevention, compliance
Legal Bases:
- Contractual necessity (Art. 6(1)(b) GDPR): To register and manage your CircuCity account. To process transactions, payments, and deliveries.
- Legitimate interests (Art. 6(1)(f) GDPR): To maintain the security and integrity of our platform. To prevent fraud, misuse, and ensure safe transactions. To analyze usage and improve our services.
- Consent (Art. 6(1)(a) GDPR): For optional features such as marketing communications, newsletters, or personalized recommendations. For the use of non-essential cookies.
- Legal obligations (Art. 6(1)(c) GDPR): To comply with tax, accounting, and regulatory requirements.
Who Has Access to the Data?
We share data only when necessary and permitted. We never sell your personal data.
Data Sharing Categories:
- Service providers: Logistics, IT hosting, payment processors, customer support
- Authorities: Police, regulators, or tax agencies when required by law
- Business transfers: If CircuCity is acquired, merged, or sells assets, data may be transferred
- With Your Consent: Other users: To complete transactions/swaps. Analytics providers: To improve our services. Advertising partners: To show you relevant offers.
International Data Transfers
We aim to process your data within the EU/EEA. If data must be transferred outside the EU/EEA, we ensure:
- EU Standard Contractual Clauses (SCCs)
- Adequate technical and organizational safeguards
Data Storage and Retention
We retain your personal data only for as long as necessary:
- User accounts: Deleted or anonymized after 36 months of inactivity
- Financial/transaction records: 7 years (required by Swedish accounting laws)
- Marketing/consent-based data: Until you withdraw consent
- Legal requirements: Longer where mandatory (e.g., investigations)
If you delete your account, your data will be erased (unless retention is legally required). Deleted accounts cannot be restored.
Cookies and Tracking Technologies
CircuCity uses cookies and similar tools to:
- Enable login and account functions
- Personalize recommendations and ads
- Measure service performance and eco-points activities
- Ensure platform security
You can manage cookie preferences via your browser settings or our cookie banner. Non-essential cookies (such as analytics and marketing cookies) are used only with your consent. You can change or withdraw your consent at any time via our cookie banner or browser settings. Detailed information about cookies may be provided in a separate Cookie Policy.
Security of Personal Data
We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, destruction, or alteration. While we strive to protect your data, no method of transmission over the internet is completely secure.
Children's Privacy
CircuCity is not directed at individuals under the age of 16, and we do not knowingly process their personal data. If we discover that such data has been collected, it will be deleted. Unless otherwise required by local law in other jurisdictions, a lower age limit may apply.
Your GDPR Rights
You have the following rights:
- Right of access (Art. 15) — Get a copy of your data
- Right to rectification (Art. 16) — Correct inaccuracies
- Right to erasure (Art. 17) — Request deletion
- Right to restriction (Art. 18) — Limit processing in certain cases
- Right to data portability (Art. 20) — Transfer your data to another service
- Right to object (Art. 21) — To marketing or legitimate interest processing
- Right to withdraw consent (Art. 7) — Anytime
- Right to complain (Art. 77) — To the Swedish Authority for Privacy Protection (IMY)
How to Exercise Your Rights:
You can exercise these rights via:
Updates to This Policy
We may update this policy as our services evolve. If we make major changes, we will notify you in advance through our platform or by email.
Complaints and Contact
If you are not satisfied with how we process your data, you can contact:
Swedish Data Protection Authority: Integritetsskyddsmyndigheten (IMY)
CircuCity AB:
- Address: Gruvgatan 17C, 93148 Skellefteå, Sweden
- Email: circucity2024@gmail.com / hr@circucity.com
This Privacy Policy represents our commitment to protecting your personal data and ensuring transparency in our data processing practices.
