Privacy Policy

Your privacy matters to us, and this page lays out exactly what we do with your data — in plain English, with none of the vague filler. noggos. is a brand of X Beauty AB, and this policy explains what personal data we collect when you visit noggos.com or place an order, why we collect it, who we share it with, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR).

1. Who we are (data controller)

The data controller responsible for your personal data is X Beauty AB, part of the X Beauty AB Group, a limited company registered in Sweden. noggos. is its brand.

2. What personal data we collect

We only collect what we need to run the shop and support you. Depending on how you use the site, that includes:

• Identity and contact details — your name, email address and phone number.
• Addresses — your shipping address and billing address.
• Order history — the products you buy, order value, dates and returns.
• Payment metadata — handled by Stripe. We receive confirmation of payment and limited metadata (for example the card type, the last four digits and the authorisation result). We never receive or store your full card number.
• Technical and security data — your IP address and related log data, used for security and fraud prevention.
• Cookie and consent data — your cookie choices and consent records. See our Cookie Policy.
• Messages you send us — the content of emails, support requests and any other correspondence.

3. Why we use your data and our legal basis

Under the GDPR we must have a legal basis for every use of your personal data. The table below sets out what we do and why.

Where we rely on your consent (marketing and analytics), you can withdraw it at any time — see section 6. Where we rely on legitimate interests, we have weighed those interests against your rights, and you can object (also section 6).

4. Who we share your data with

We do not sell your personal data. We share it only with the service providers (processors) who help us run the shop, and only to the extent they need it to do their job:

• Stripe — payment processing. Stripe handles your card details directly so we never see them.
• SendGrid and Twilio — transactional and support messages (order confirmations, shipping updates, email and SMS).
• Vercel — hosting of the website.
• Supabase — database hosting within the EU.
• Cloudflare — DNS, security and protection against abuse.

We have data-processing agreements in place with each of these providers, and we keep your data within the EU/EEA wherever possible. Where a provider processes data outside the EU/EEA, that transfer is safeguarded by the European Commission’s Standard Contractual Clauses (SCCs) or another valid transfer mechanism. We may also disclose data where we are legally required to do so.

5. How long we keep your data

We keep your data only as long as we need it for the purpose it was collected, then delete or anonymise it.

6. Your rights under the GDPR

You have the following rights over your personal data, free of charge:

• Access — ask for a copy of the personal data we hold about you.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — ask us to delete your data (the “right to be forgotten”), subject to legal retention duties such as accounting records.
• Restriction — ask us to limit how we use your data in certain circumstances.
• Portability — receive your data in a structured, machine-readable format, or have it transferred to another controller.
• Objection — object to processing based on our legitimate interests, including profiling.
• Withdraw consent — withdraw consent at any time where we rely on it, without affecting processing carried out before you withdrew.
• Lodge a complaint — complain to a data protection authority (see section 7).

To exercise any of these rights, email us at info@noggos.com. We will respond within one month.

7. Supervisory authority

If you believe we have mishandled your personal data, you can lodge a complaint with the Swedish data protection authority, the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY). You may also complain to the data protection authority in your own EU/EEA country. For cross-border online purchases, the EU also provides an Online Dispute Resolution platform.

8. Cookies

We use cookies and similar technologies to run the site, remember your preferences and — with your consent — measure usage. You can manage your choices at any time. For the full details, see our Cookie Policy.

9. Children

noggos. is not directed at children. We do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Changes to this policy

We may update this policy from time to time, for example to reflect changes in our services or the law. When we do, we will revise the “last updated” date at the top of this page. The current version was last updated on 5 October 2026. Significant changes will be communicated where appropriate.

11. Contact

For any question about this policy or your personal data, or to exercise your rights, contact us at info@noggos.com or by post: