Privacy & cookies.
What we collect when you buy or get in touch, who else sees it, and how to have it removed. We keep as little as we can, and we never sell anything about you.
01 Who we are
NOVO is a brand of ArcticSpritz AB (Org.nr 559152-8145), Halmstad, Sweden. We are the data controller for the personal data described on this page, which means we decide why and how it is used.
You can reach us any time at hello@novo-soda.shop.
02 What we collect, and why
We only collect what a given task actually needs. There is no account to create, and we do not build profiles of visitors who simply read the site.
We do not sell personal data, and we do not share it for anyone else's marketing.
03 Cookies & tracking
When you first arrive we ask whether you accept advertising cookies. Until you accept, no advertising or analytics code runs at all — nothing is loaded, no request is sent, and no identifier is set. Declining costs you nothing: every part of the site works exactly the same either way.
What runs regardless
Two small pieces of information are stored in your own browser and never sent to us or anyone else:
- your cookie choice, so we do not ask again on every page;
- a marker on the order confirmation page, so that refreshing it does not record your purchase twice.
If you pay by card, Stripe sets its own cookies on its checkout page to process the payment securely and prevent fraud. Those are necessary for the payment itself.
What runs only if you accept
We use the TikTok pixel to measure whether our advertising works — for example, how many people who saw an ad went on to buy. It records which products you looked at, whether you started a checkout, whether you joined the CO2 waiting list, and any completed purchase. TikTok may link that to your TikTok account.
When an order is confirmed we also send TikTok a scrambled version of your email address, so it can tell that the sale came from an ad it showed. The scrambling (a one-way SHA-256 hash) happens before it is sent: your actual address is never passed on, and the result cannot be turned back into an address. This too only happens if you accepted cookies.
Measuring from our own server
Ad blockers and browser privacy features often stop the pixel reporting a sale that really happened. So we also report checkouts, waiting-list signups and completed orders from our server, where those obstacles do not apply. Each is sent with the same reference as its browser counterpart, so TikTok recognises the two as one event rather than counting your purchase twice.
To let TikTok recognise you as the same person, these reports include your IP address, your browser's user-agent string, and TikTok's own click and cookie identifiers. Your email and phone number are scrambled first, exactly as above. Nothing is reported this way if you declined cookies — declining stops the server reporting too, not just the pixel.
Changing your mind
You can withdraw consent at any time by clearing this site's data in your browser settings, which resets the choice and stops the pixel loading. Email us if you would like help with that.
04 Who else sees it
We use a small number of established companies to run the shop. They may only act on our instructions, and each is bound by a data processing agreement.
We may also disclose information where the law requires it, or to establish or defend a legal claim.
05 Transfers outside the EEA
Some of the companies above are based in the United States or process data there. Where that happens, the transfer is covered by the European Commission's Standard Contractual Clauses, or by the company's certification under the EU–US Data Privacy Framework.
You can ask us for details of the safeguards that apply to any particular transfer.
06 How long we keep it
We keep personal data only as long as the purpose requires:
- Order and accounting records are kept for seven years after the end of the financial year, as Swedish accounting law requires.
- Support emails are kept while your matter is open and for a reasonable period afterwards, in case you come back to us about it.
- Waiting-list addresses are deleted once CO2 refills launch and you have been told, or as soon as you ask.
- Server logs are kept only briefly, as part of running and securing the site.
07 Your rights
Under the GDPR you may ask us to:
- give you a copy of the personal data we hold about you;
- correct anything that is wrong or incomplete;
- delete it, where we have no continuing reason to keep it;
- restrict how we use it, or object to a use based on our legitimate interests;
- transfer it to another provider in a machine-readable form.
Where we rely on your consent — advertising cookies and the waiting list — you can withdraw it at any time. Doing so does not affect anything done before you withdrew it.
We answer requests within one month and never charge for them.
08 Contact & complaints
Write to hello@novo-soda.shop with any question about this policy, or to exercise any of the rights above.
If you think we have handled your data wrongly, we would very much like the chance to put it right first. You also have the right to complain to the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), at imy.se.
Something unclear?
Ask us anything about how your data is handled — we answer within one working day.
Contact support