CHARLIE AK MEMBERSHIP
Your privacy

Privacy policy

Last updated: 16 September 2026

1 About this privacy policy

Your privacy is important to us. This privacy policy describes how Charlie AK AB collects, uses, stores and shares personal data within Charlie AK Membership and on medlem.charlieak.com.

The policy also describes your rights and how to contact us.

2 Data controller

Charlie AK AB is the data controller for the processing of personal data described in this policy.

Charlie AK AB
Registration number: 559449-7785
Ålstensgatan 13B
167 65 Bromma, Sweden
Email: info@charlieak.com

3 What personal data do we process?

We may process the following categories of personal data:

Account and contact details

  • first and last name
  • email address
  • phone number, if you provide it
  • password in encrypted or technically protected form
  • language preference
  • member ID
  • account status
  • the date your membership was created

We do not have access to your password in readable form.

Membership details

  • membership tier
  • points balance
  • earned and used rewards
  • coupons and validity periods
  • membership benefits
  • which membership terms you have accepted
  • date and time of accepted terms
  • your choices for voluntary marketing

Purchase and transaction data

When a purchase is linked to your membership, we may process:

  • date and place of the purchase
  • order or receipt number
  • purchase amount
  • qualifying products or purchases
  • used discounts and coupons
  • returns and refunds
  • points and rewards arising from the purchase

We do not normally process full payment card details within the membership programme.

Bookings and events

When you book or take part in a member experience, we may process:

  • the chosen event or experience
  • date and time
  • number of participants
  • booking status
  • rebooking or cancellation
  • messages relating to the booking
  • wishes that you yourself provide

Do not provide sensitive personal data in free-text fields. If we need information such as allergies, we will clearly inform you about how it is processed and only collect what is necessary.

Invitations

When you invite someone, we may process:

  • your member ID
  • invitation code or personal link
  • the type of invitation
  • the date the invitation was created
  • whether the invitation has been opened or accepted
  • whether the invitation has led to a qualifying membership or purchase

If Charlie AK sends an invitation on your behalf, we may also process the recipient's name, email address or phone number.

We primarily recommend that members share a personal invitation link themselves. That way Charlie AK does not need to collect the recipient's contact details before the person opens the link.

Technical information

When you use the website, we may process:

  • IP address
  • browser and device type
  • operating system
  • language
  • date and time
  • session information
  • security logs
  • pages visited
  • referring page
  • approximate country
  • technical errors and performance information
  • cookie choices

Non-essential web analytics are used only after you have given consent.

Communication and support

When you contact us, we may process:

  • your contact details
  • the content of the message
  • previous communication in the case
  • information needed to answer and follow up on the enquiry

4 Where does the personal data come from?

We primarily receive personal data directly from you when you:

  • create a member account
  • update your profile
  • shop and identify yourself as a member
  • book or attend an event
  • use a reward or coupon
  • send or receive an invitation
  • choose to receive voluntary marketing
  • contact our customer service

We may also receive information:

  • from the Charlie AK store and online shop when a purchase is linked to your membership
  • from a member who creates an invitation
  • automatically from the website's security and sign-in systems
  • from web analytics, if you have approved analytics cookies

If we receive your contact details from a member to send an invitation, we inform you about the processing in connection with the first contact.

5 Why do we process personal data?

Create and administer the membership

We process account and contact details to:

  • create and administer your account
  • identify you as a member
  • give you access to the membership features
  • manage sign-in and security
  • show your membership tier, points and rewards
  • provide the benefits included in the membership

Legal basis: performance of a contract.

Without necessary account and contact details, we cannot create or administer the membership.

Calculate points, tiers and rewards

We process membership and purchase data to:

  • register qualifying purchases
  • calculate points and cashback
  • determine membership tier
  • create and administer coupons and rewards
  • correct points after returns or refunds
  • prevent errors and misuse of the membership programme

Legal basis: performance of a contract.

For security checks and the prevention of misuse, the processing may also be based on our legitimate interest in protecting the membership programme and our systems.

Manage bookings and member experiences

We process data to:

  • receive and administer bookings
  • send booking confirmations and reminders
  • inform about changed times or cancelled events
  • manage participant lists
  • hold events and member experiences

Legal basis: performance of a contract.

Send membership communication

The membership includes membership-related communication, such as:

  • personal invitations to member events
  • information about bookings and member experiences
  • information about points, coupons and rewards
  • information about membership tier and available benefits
  • security messages
  • important changes to the membership or the membership terms

This communication is part of the membership and is needed for us to provide the membership programme.

Legal basis: performance of a contract.

Membership communication is limited to information with a clear connection to the membership. You can end your membership if you no longer wish to receive such communication.

Send news and marketing

If you have made a voluntary choice, we may send:

  • news
  • inspiration
  • product information
  • information about new collections
  • general offers and campaigns

Legal basis: consent.

Consent is voluntary. You can create and use your membership without consenting to voluntary marketing.

You can unsubscribe at any time via the link in the email, via the settings in your profile or by contacting us. A withdrawn marketing consent does not affect the membership or necessary membership communication.

Manage personal invitations

We process data to:

  • create personal invitation links
  • show who sent an invitation
  • connect an accepted invitation to the right member
  • handle welcome gifts and rewards
  • prevent duplicate accounts and misuse

Legal basis: performance of the membership agreement and our legitimate interest in administering and protecting the invitation function.

If an invitation is sent directly by Charlie AK to someone who is not yet a member, we make a specific assessment of the rules on electronic communication and marketing.

Provide support

We process data to:

  • answer questions
  • solve technical problems
  • handle complaints
  • investigate incorrect points, rewards or bookings
  • document how a case has been handled

Legal basis: performance of a contract or our legitimate interest in providing service and handling enquiries.

Protect the website and member accounts

We process technical information and security logs to:

  • protect accounts against unauthorised access
  • detect and prevent fraud
  • handle technical errors
  • maintain the security of the website
  • check suspicious or automated traffic

Legal basis: our legitimate interest in providing a secure service and protecting our members and systems.

Web analytics

If you have approved analytics cookies, we process information about how the website is used to:

  • measure visits and usage
  • identify technical problems
  • understand which features are used
  • improve the website's function and user experience

Legal basis: consent.

You can withdraw your consent at any time via Cookie settings in the website footer.

Comply with legal obligations

We may process and store data when required by law, for example for:

  • accounting
  • taxes
  • handling of consumer rights
  • decisions by authorities
  • legal claims

Legal basis: legal obligation.

6 How long do we keep personal data?

We do not keep personal data longer than necessary for each purpose.

As a starting point:

Member account

Account and membership details are kept for the duration of the membership. When the membership ends, we delete or anonymise the data within 12 months, unless it needs to be kept longer by law or for a legal claim.

Points, rewards and purchase history

Data needed to calculate and verify points, tiers and rewards is kept for the duration of the membership and as long as a reward or claim can be made.

Accounting records are kept for as long as bookkeeping law requires.

Bookings and events

Booking data is kept until the event or experience has been held and normally for a maximum of 12 months thereafter, unless needed for an ongoing case or a legal obligation.

Unaccepted invitations

Contact details for an invitation that is not accepted are normally deleted within 30 days after the invitation has expired.

Technical information about the invitation may be kept longer in a limited form to prevent misuse.

Support cases

Support communication is kept as long as needed to handle the case and normally for a maximum of 24 months after the case has been closed.

Security logs

Security and system logs are normally kept for between 30 and 90 days. Data may be kept longer if needed to investigate a security incident, suspected fraud or a legal claim.

Voluntary marketing

Data for voluntary marketing is processed until you withdraw your consent or until we consider the consent no longer relevant.

We may keep a limited suppression record after unsubscribing to ensure we do not send further marketing.

Web analytics

Analytics data is kept for a limited period according to our analytics provider's settings. A temporary session id is used for about 30 minutes.

7 Who do we share personal data with?

We may share personal data with providers who help us run the membership programme and the website.

This may include:

  • Supabase for database, authentication and member accounts
  • Cloudflare for website delivery, security and protection against malicious traffic
  • Lovable and its sub-processors for website hosting and, with consent, web analytics
  • Resend or a comparable email provider for member messages and email campaigns
  • Shopify or another commerce platform when purchases and returns are linked to the membership
  • providers who help us hold events and member experiences
  • legal, financial and technical advisors when needed

Providers processing personal data on our behalf may only process the data according to our instructions and under data processing agreements.

We may also provide data to authorities when we are required to do so by law or by an authority decision.

We do not sell members' personal data.

8 Transfers outside the EU and EEA

Some providers may process personal data in countries outside the EU and EEA.

If personal data is transferred to a country without an adequacy decision, we use a permitted transfer mechanism, such as the EU Commission's standard contractual clauses. Where necessary, we also use supplementary technical and organisational safeguards.

You can contact us if you would like more information about the safeguards used.

9 Cookies and similar technologies

We use necessary cookies for security, sign-in, session handling and the website's basic functions.

Non-essential web analytics are used only after you have given consent.

You can read more and change your choices in our cookie policy and via the Cookie settings link in the website footer.

10 Automated calculations

The membership programme may automatically calculate:

  • points
  • cashback
  • coupons
  • rewards
  • membership tier
  • whether the conditions for a membership benefit are met

The calculations follow the rules in the membership terms.

We do not make decisions with legal or similarly significant effects for you based solely on automated processing.

If you believe an automatic calculation is incorrect, you can contact us and request a manual review.

11 Your rights

Depending on the circumstances, you have the right to:

Request access

You can request information about which personal data we process about you and receive a copy of the data.

Request rectification

You can request that incorrect or incomplete data be corrected.

Request erasure

You can in some cases request that personal data be erased. The right does not apply if we must keep the data to comply with the law or handle a legal claim.

Request restriction

You can in some cases request that processing be restricted while a question about the accuracy of the data or the lawfulness of the processing is investigated.

Object to processing

You can object to processing based on our legitimate interest. We will then stop the processing unless we can demonstrate compelling legitimate grounds that outweigh your interests.

You always have the right to object to direct marketing.

Withdraw consent

Where processing is based on consent, you can withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing already carried out.

Request data portability

You can in some cases receive personal data you have provided in a structured, machine-readable format.

Lodge a complaint

If you believe we process your personal data incorrectly, you can lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten):

Integritetsskyddsmyndigheten
Website: www.imy.se

We appreciate it if you contact us first so we have the opportunity to investigate and correct the problem.

12 How to exercise your rights

Contact us at:

hej@charlieak.com

Please write "Personal data" in the subject line.

We may need to verify your identity before we disclose, change or erase data. We only ask for the information needed to identify you and protect the data against unauthorised access.

13 Security

We use technical and organisational security measures to protect personal data against:

  • unauthorised access
  • unlawful use or alteration
  • loss
  • destruction
  • unintentional disclosure

The measures may include, among other things, encryption, access control, security logging, backups and restricted access.

No technical solution is completely risk-free. If a personal data incident occurs, we handle it in accordance with applicable rules and notify affected individuals where required.

14 Children and minors

The membership is not specifically aimed at children.

Personal data about children has special protection. If a minor uses the membership, this must take place in accordance with the membership terms and applicable rules.

We do not knowingly collect more data about minors than necessary.

15 Changes to this privacy policy

We may update this privacy policy if the membership programme, our processing or applicable rules change.

The date at the top shows when the policy was last updated.

If a change is substantial, we will inform you in a clear way before it takes effect, for example by email or a message in your member account.

16 Contact

If you have questions about this privacy policy or our processing of personal data, you can contact:

Charlie AK AB
Registration number: 559449-7785
Ålstensgatan 13B
167 65 Bromma, Sweden
Email: info@charlieak.com