Privacy policy

Tonal Matter AB
Last updated: June 10, 2026

This Privacy Policy explains how Tonal Matter AB ("we", "us", "our") collects, uses, and protects your personal data when you visit our website, make purchases, or interact with our services. We are committed to protecting your privacy in accordance with the EU General Data Protection Regulation (GDPR) and applicable Swedish data protection laws.

1. Data Controller

Tonal Matter AB
Org. nr: 559567-5181
VAT: SE559567518101
Hammars backe 8, 443 38 Lerum, Sweden
Email: privacy@tonalmatter.com

2. Data We Collect

2.1 Information You Provide

Account & Purchase Data: Name, email address, billing address, country, and payment method (e.g., card type and last four digits, where provided by payment processor) when you make a purchase. We do not store full credit card details.
Communication Data: Email address and message content when you contact support or subscribe to our newsletter.
Survey & Feedback Data: Responses you voluntarily provide to surveys or feedback requests.

2.2 Information Collected Automatically

Device & Browser Data: IP address, browser type, operating system, and device identifiers.
Usage Data: Pages visited, time spent on site, click patterns, and referral sources.
Cookies: See Section 6 for details on cookies and tracking technologies.

3. How We Use Your Data

We use your personal data for the following purposes:

Order Processing: To process purchases, deliver products, and manage your account. (Legal basis: Contract performance)
Customer Support: To respond to inquiries and provide technical assistance. (Legal basis: Contract performance / Legitimate interest)
Email Marketing: To send newsletters, product updates, and promotional offers if you have opted in. (Legal basis: Consent)
Analytics & Improvement: To understand how our website is used and improve our products and services. (Legal basis: Consent for non-essential analytics cookies; Legitimate interest for aggregated analysis)
Fraud Prevention & Security: To protect against fraudulent transactions and secure our services. (Legal basis: Legitimate interest)
Legal Compliance: To comply with tax, accounting, and other legal obligations. (Legal basis: Legal obligation)

4. Third-Party Service Providers

We share data with the following categories of service providers (processors), who act on our instructions:

Shopify (E-commerce platform) — Processes orders, payments, and stores customer data. Privacy Policy: shopify.com/legal/privacy
Shopify Payments / Stripe (Payment processing) — Handles payment transactions securely. We do not store full credit card details.
Klarna (Payment option) — If you choose Klarna, your data is shared with Klarna Bank AB for payment processing under Klarna's own terms.
Klaviyo (Email marketing) — Manages newsletter subscriptions and email campaigns. Privacy Policy: klaviyo.com/legal/privacy
Fortnox (Accounting) — Processes invoice and transaction data for bookkeeping and tax compliance.
Native Instruments (Product delivery/authorization) — Where a Product is delivered or authorized via Native Access, account and license data are processed to enable delivery.
All service providers are bound by data processing agreements and process your data only for specified purposes.

5. Data Retention

Purchase and accounting records: 7 years (Swedish Bookkeeping Act requirement)
Account data: Until you request deletion or 3 years of inactivity
Marketing data: Until you unsubscribe or withdraw consent
Support communications: 2 years after resolution
Analytics data: Retained for up to 14 months in identifiable form (where applicable)

6. Cookies & Tracking

Our website uses cookies and similar technologies:

Essential Cookies: Required for the website to function (shopping cart, checkout, security). Cannot be disabled.
Analytics Cookies: Help us understand website usage. Set only with your consent.
Marketing Cookies: Used for targeted advertising and retargeting. Set only with your consent.

Non-essential cookies are placed only after you give consent through our cookie banner. You can change or withdraw your preferences at any time via the cookie banner or your browser settings. For the full list of cookies we use, see our Cookie Policy at www.tonalmatter.com/policies/cookies.

7. Your Rights (GDPR)

Under GDPR, you have the right to:

Access: Request a copy of the personal data we hold about you.
Rectification: Request correction of inaccurate data.
Erasure: Request deletion of your data ("right to be forgotten"), subject to legal retention requirements.
Restriction: Request limited processing of your data.
Portability: Receive your data in a structured, machine-readable format.
Object: Object to processing based on legitimate interest or for direct marketing.
Withdraw Consent: Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, email us at privacy@tonalmatter.com. We will respond within 30 days. We may ask you to verify your identity before acting on a request.

8. International Data Transfers

Some of our service providers (e.g., Shopify, Klaviyo) may process data outside the EU/EEA. Such transfers are protected by appropriate safeguards, including Standard Contractual Clauses (SCCs) or adequacy decisions, ensuring your data receives an equivalent level of protection.

9. Data Security

We implement appropriate technical and organizational measures to protect your data, including SSL/TLS encryption, secure payment processing, access controls, and regular security reviews.

10. Data Breaches

In the event of a personal data breach, we will notify the Swedish Authority for Privacy Protection (IMY) within 72 hours of becoming aware, where the breach is likely to result in a risk to your rights and freedoms. Where the breach is likely to result in a high risk, we will also notify affected individuals without undue delay, describing the nature of the breach and the measures taken or proposed to address it.

11. Children's Privacy

Our services are not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately and we will delete it.

12. Complaints

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se, or with the supervisory authority in your country of residence.

13. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email or a notice on our website. The "Last updated" date at the top indicates the current version.

14. Contact Us

For privacy-related inquiries:
Email: privacy@tonalmatter.com
Tonal Matter AB, Hammars backe 8, 443 38 Lerum, Sweden
Website: www.tonalmatter.com

Your cart is empty