Privacy Policy – Zetenr App
Last updated: 28 September 2026
1. General
This Privacy Policy explains how Grovie AB, company registration number 559593-7276, Postia 1054, 214 13 Malmö, Sweden, which operates the Zetenr app (“Zetenr”, “we”, “us” or “our”), collects, uses, stores and protects your personal data when you use the Zetenr app and related services (the “Service”).
Grovie AB is the data controller for the processing described in this policy. You can contact us at hello@zetenr.app.
The Service is available in Sweden and Spain. We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Swedish Act (2018:218) with supplementary provisions to the GDPR, and, for users in Spain, the Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (“LOPDGDD”).
2. Personal Data We Collect
Depending on how you use the Service, we collect the following categories of personal data.
Account Information
- Name
- Email address
- Phone number
- Login credentials or authentication information
- Account and profile information
- Other information you choose to provide
Purchase and Transaction Information
When you make a purchase through the Service, we process information about the transaction, such as:
- Purchase and order details
- Seller information
- Country where the purchase is made (Sweden or Spain)
- Amount, currency and date
- Transaction status and transaction identifiers
- Limited payment information, such as card brand and the last four digits of the card
Payments are processed by Worldline for purchases in Sweden and by Stripe for purchases in Spain (see section 6). Zetenr does not receive or store your full card number, expiry date or security code (CVC).
Device and Technical Information
When you use the Service, we automatically collect certain technical information, including:
- Device type
- Operating system
- App version
- IP address
- Device identifiers
- Language and country/region settings
- Log information
- Information about your use of the Service
Communications
If you contact us, we collect the information you provide, including your name, email address, message and any other information you choose to share.
3. How We Use Your Personal Data
We use your personal data to:
- Create and manage your account
- Provide and operate the Service
- Authenticate users and maintain account security
- Process and manage purchases, refunds and disputes
- Facilitate transactions between users and sellers
- Provide customer support
- Communicate with you about the Service and send service-related notifications
- Maintain and improve the Service, including through analytics
- Detect, investigate and prevent fraud, misuse and security incidents
- Comply with legal obligations, including bookkeeping and tax rules in Sweden and Spain
- Establish, exercise or defend legal claims
4. Legal Basis for Processing
We process personal data on the following legal bases under Article 6(1) GDPR:
| Legal basis | Purposes |
|---|---|
| Performance of a contract (art. 6.1.b) | Creating and managing your account, providing the Service, processing purchases, facilitating transactions with sellers, customer support |
| Legal obligation (art. 6.1.c) | Bookkeeping and tax obligations, anti-fraud and anti-money-laundering rules, responding to lawful requests from authorities |
| Legitimate interests (art. 6.1.f) | Security, fraud prevention, improving the Service through analytics, service communications, defending legal claims |
| Consent (art. 6.1.a) | Marketing communications where consent is required, non-essential cookies, other optional processing |
Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You can request more information about this assessment and object to the processing (section 11).
You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you. Our payment providers may carry out automated fraud checks under their own responsibility (section 6).
5. Sharing of Personal Data
We share personal data only where necessary to operate the Service or comply with the law. Recipients include:
- Payment service providers – Worldline (purchases in Sweden) and Stripe (purchases in Spain), to process payments, prevent fraud and meet their legal obligations
- Sellers – the company you buy from, as described in section 7
- Cloud hosting and infrastructure providers – to store and operate the Service
- Analytics and technology providers – to understand and improve how the Service is used
- Customer support and communication providers – to handle requests and send notifications
- Professional advisers – such as auditors, accountants and lawyers, under confidentiality
- Authorities and other third parties – where required by law or to protect our legal rights
Service providers that process personal data on our behalf (processors) do so only on our instructions and under a data processing agreement (art. 28 GDPR). Payment providers and sellers process personal data as independent controllers under their own privacy policies.
We do not sell your personal data.
6. Payments
The payment provider depends on the country where the purchase is made:
| Purchases in Sweden | Purchases in Spain | |
|---|---|---|
| Payment provider | Worldline | Stripe |
| Data the provider receives | Payment card or other payment details you enter, name, email, amount, currency, order reference, and device and IP data used for fraud checks | Same categories as Sweden |
| Provider’s role | Independent controller for payment processing, fraud prevention, strong customer authentication and its own legal obligations (e.g. anti-money-laundering rules) | Independent controller for the same purposes |
Your payment details are entered in the provider’s secure payment form and sent directly to the provider, which is certified under the PCI DSS security standard. Zetenr receives only transaction-related information, such as payment status, transaction identifiers, amount, card brand, the last four digits of the card and purchase information. We never receive or store your full card number, expiry date or security code.
Where a payment provider acts as independent controller, its own privacy policy governs that processing and you may exercise your rights directly with it. Your bank or card issuer may also process your data to authenticate the payment (for example 3-D Secure or BankID).
7. Sellers and Purchases
Zetenr allows users to purchase products or services from companies using the Service (“sellers”). Purchases are made directly between you and the relevant seller.
When necessary to complete or manage a purchase, we share with the seller your name, contact information, order details and other information needed to fulfil the purchase.
The seller processes this personal data as an independent controller under its own privacy policy and terms, and is responsible for that processing. Questions about how a seller uses your data should be directed to the seller.
8. Cloud Services and International Data Transfers
We aim to store and process personal data within the EU/EEA. Some service providers may process personal data outside the EU/EEA.
Where personal data is transferred outside the EU/EEA, we ensure the transfer is lawful under Chapter V GDPR, through:
- an adequacy decision by the European Commission, including the EU–US Data Privacy Framework where the recipient is certified; or
- the European Commission’s Standard Contractual Clauses, with supplementary measures where needed.
You can request a copy of the relevant safeguards by contacting us.
9. Data Retention
We keep personal data only as long as necessary for the purposes in this policy:
| Data | Retention period |
|---|---|
| Account information | As long as your account is active; deleted or anonymised within 30 days after account deletion |
| Purchase and accounting records – Sweden | 7 years after the end of the calendar year of the transaction (Swedish Bookkeeping Act, 1999:1078) |
| Purchase and accounting records – Spain | 6 years from the last entry (Spanish Commercial Code, art. 30), or longer if tax law requires |
| Customer support communications | Up to 24 months after the matter is closed |
| Technical and log data | Up to 12 months |
| Data needed for disputes or legal claims | Until the matter is finally resolved and the limitation period has expired |
For users in Spain, when data is no longer needed for its original purpose, it is blocked and kept only for the period required by law before deletion (LOPDGDD art. 32). When personal data is no longer required, we delete or anonymise it.
10. Data Security
We use appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, loss or destruction. These include encryption in transit, access controls and agreements with our service providers.
No internet transmission or electronic storage system is completely secure. If a personal data breach occurs, we notify the competent supervisory authority within 72 hours where required, and inform you without undue delay if the breach is likely to result in a high risk to you.
You are responsible for keeping your account credentials confidential and for notifying us if you believe your account has been accessed without authorisation.
11. Your Data Protection Rights
You have the right to:
- Access the personal data we hold about you and receive a copy
- Correct inaccurate or incomplete personal data
- Have your personal data deleted
- Restrict processing
- Receive your personal data in a portable format
- Object to processing based on our legitimate interests
- Object at any time to processing for direct marketing, after which we will stop
- Withdraw consent where processing is based on consent
- Lodge a complaint with a supervisory authority (section 17)
Users in Spain may also give instructions about the use of their personal data after their death (LOPDGDD art. 3 and 96).
Some rights are subject to legal limitations, for example where we must keep data to meet bookkeeping obligations.
To exercise your rights, contact us at hello@zetenr.app. We respond within one month. This may be extended by two further months for complex or numerous requests, in which case we will inform you. We may ask you to verify your identity. Requests are free of charge unless manifestly unfounded or excessive.
12. Account Deletion
You can delete your Zetenr account in the app or by contacting us. We will then delete or anonymise your personal data, except information we must keep by law, for accounting purposes, to resolve disputes, to prevent fraud, or to establish, exercise or defend legal claims (see section 9).
13. Children’s Privacy
The Service is intended only for persons aged 18 or older. You must be at least 18 years old to create an account or make purchases through the Service.
We do not knowingly collect personal data from persons under 18. If you believe that someone under 18 has provided personal data to us, please contact us and we will delete it.
14. Cookies and Similar Technologies
The Service uses cookies, mobile identifiers, local storage and similar technologies that are necessary to operate and secure the Service.
We use non-essential technologies, such as analytics cookies, only with your consent, in line with the Swedish Electronic Communications Act (2022:482) and the Spanish Law 34/2002 on Information Society Services (LSSI, art. 22). You can withdraw consent at any time in the Service or through your device or browser settings.
15. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes to the Service, applicable laws or our data processing practices. We will notify you of material changes in the Service or by email before they take effect. The updated policy is effective from the date stated at the top.
16. Contact Us
If you have questions about this Privacy Policy or wish to exercise your rights, contact us:
Grovie AB (Zetenr App)
Company registration number: 559593-7276
Postia 1054, 214 13 Malmö, Sweden
Email: hello@zetenr.app
17. Data Protection Authority
You have the right to lodge a complaint with the supervisory authority in the EU country where you live, work, or where you believe an infringement occurred. As Grovie AB is established in Sweden, the Swedish authority is our lead supervisory authority.
- Sweden: Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm – www.imy.se
- Spain: Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid – www.aepd.es
We appreciate the opportunity to address your concerns before you contact an authority.