Privacy policy for loyalty program and digital solutions

When you create an IKEA account, join the IKEA Family program, shop at our online store, use the IKEA App services and/or agree to receive direct marketing, you provide personal data that we will process. By providing your personal data you confirm that your personal data is accurate and correct and that you are at least 18 years old.

If you notice any inaccuracies, you should immediately correct your data. The categories of your personal data that we process as well as the purposes and legal basis for the processing are the following:

Description
When you create your IKEA account and/or use the online store services on our website or IKEA application we will process your data. We do that to allow you to create the account and take advantage of services offered to registered users (see the order details, purchase history etc.). Also, for the purpose of administration and maintenance of the online store, to recognise you when you lodge inquiries, to notify you of any changes in the terms and conditions (privacy policy, changes in terms and conditions, etc.), or to contact you (in case of any problems regarding the account or order in case some items are lost etc.).

Your email and phone number shall be processed to notify you of the status of your order and expected date of pick-up or delivery and for sending interim confirmations. We also process certain data about you for statistical purposes, as described in point 1.5. “Statistical analysis”.

In your IKEA account, you can see which of your personal data we process, including IKEA Family details (if you register as an IKEA Family member), edit information about yourself, change your preferences regarding direct marketing, participate in games and/or contests/competitions etc.

To shop at our online store, you have to provide certain personal data. If you refuse to provide your personal data, you will be unable to create an IKEA account and/or shop at the online store. If you order products and/or services at an online store for or in the name of another person, you must notify the person and obtain the person’s consent to provide his/her personal data to us and ensure that the person has understood and familiarised himself/herself with this privacy policy. The afore-mentioned information of the other person shall be used as defined in this point.

In case you order the delivery service, we shall process the information as indicated in point 1.7. “Home delivery” of the General privacy policy. In case of withdrawal from the purchase-sale contract or return of the goods – as indicated in point 1.11. “Returns” of the General privacy policy. In case you send the list of products in your shopping cart by email, or we send a notice of your abandoned cart or notify you of the products that are back in stock, your personal data shall be processed as indicated in point 1.4. hereof.

For more information on how the third parties (payment service providers that administer payments via the online store) process payment data, we advise you to read their privacy policies.

Categories of personal data

• Email 
• Name 
• Surname 
• Phone number 
• Login details and password (hashed) 
• List of products and/or favourite items
• Viewed items 
• Actions within the IKEA account 
• Preferences (subscriptions, registration in loyalty program, etc.)
• Details of the IKEA Family loyalty program, as specified in point 1.2 (if you registered)
• Information you provide when ordering direct marketing, as specified in point 1.4 (if you order/subscribe)
• Details of emails, including subject line, sender, recipient and content of the email (e.g., when you create an IKEA account and we send a confirmation email, or when you request to remind the forgotten password) 
• Details of short messages, including subject line, sender, recipient and content (e.g., when you create an IKEA account and we send a confirmation code) 
• Shopping cart 
• Address (es) 
• Point of collection of goods 
• Payment data (including bank account number)  
• Purchase history  
• Purchase and other related documents (VAT invoice, etc.) 
• Service ordered
• Signatures (e.g., in the transfer and acceptance act of the goods) 
• Information on returns

Legal basis for the processing
Conclusion and performance of a contract with you.

Description
If you want to become a member of the IKEA Family loyalty program, receive your IKEA Family card and its benefits, and you agree with the IKEA Family terms and conditions, then we collect certain information about you. We use this data to provide you with the IKEA Family card, to identify you in case of queries, to manage the activities necessary for you to use discounts and other IKEA Family benefits, to communicate by email about your membership (e.g., changes of privacy policy, terms and conditions, etc.). We also process your certain personal data for statistical purposes, as described in point 1.5. “Statistical analysis”.

If you want to join the IKEA Family program, you have to agree with IKEA Family terms and conditions and provide your personal data. If you do not provide it, you cannot join the IKEA Family loyalty program.

When registering for the IKEA Family card or having logged in to your IKEA account, you can decide, whether you want to participate in games and/or competitions for IKEA Family members. Participation is not obligatory you are free to choose. Having expressed consent to participate in games and/or competitions, you agree and understand that your details concerning the IKEA Family card you provided earlier, once the terms and conditions of a game and/or competition are met, will be automatically included in all IKEA Family games and/or competitions without any additional registration or notification. You also agree that your IKEA Family card number will be publicly announced in case of winning.

If you agree to participate in IKEA Family games and/or competitions, we will process your personal data for the purposes of organisation, execution, administration of games and/or competitions, determination of winners, announcement of winners, presentation of prizes and/or other gifts. In case a complaint is received regarding games and/or competitions, personal data is processed to lay, satisfy claims, or defend legal claims. For more details about how we process personal data for the purpose of games and/or competitions, how long we retain such data and whom we transfer it, see point 1.4. „Games and/or contests” of General privacy policy. You have the right to withdraw your consent to process your personal data for the purpose of IKEA Family games and/or competitions at any time, without prejudice to the lawfulness of data collection and processing before the withdrawal of the consent. You can do that, also correct information about yourself that was provided by registering for the IKEA Family membership, in your IKEA account or by contacting us (contact details are provided below).

Categories of personal data

• Email  
• IKEA Family card and account number 
• Purchase history with IKEA Family card 
• Start date of the membership

• Name 
• Surname 
• Date of birth 
• Phone number  
• Country 
• Type of the IKEA Family card (physical or digital)

Legal basis for the processing
Performance of a contract with you when you register for the IKEA Family loyalty program. For IKEA Family games and/or competitions your consent.

Description
We process your personal data to provide you with an opportunity to use the IKEA Application, to ensure proper administration, functioning of it and operation of all its features. To function properly, the IKEA Application needs to have access to certain information on your device, i.e., when you download and install the IKEA Application, it will access device type, operating systems and their versions, etc.

If you give separate permission (consent), the IKEA Application may have access to your mobile device's camera, files, media, etc. You can manage your permissions in your mobile device settings.

If you permit to receive notifications, we will provide you with information about the changes to the IKEA Application rules, privacy policy, working hours, status of the order, etc. as well as marketing offers, as indicated in this privacy policy. To provide you with relevant notifications, we may use automated analysis of this information. This analysis does not have any legal or similar significant effect on you.

In addition, to ensure our legitimate interest, we use the aforementioned personal data to produce statistics about how the IKEA Application is used and take measures to improve and develop it.

If you use the IKEA application with the IKEA account, your personal data will be processed as described above, and consent to the processing of personal data provided during primary registration (if not changed later) is valid.

Without these processing activities and collecting your personal data, we would not be able to provide you with access to the IKEA Application. If you do not agree that your personal data will be processed as described above, do not download or install the IKEA Application, and if you downloaded and installed without reading this privacy policy, delete the IKEA application from your mobile device immediately.

Please note, that deleting or uninstalling the IKEA Application does not delete your IKEA account and/or terminate your IKEA Family membership. So even after deleting the IKEA Application, we will continue to process your information in line with the conditions of this privacy policy, unless you delete the IKEA account and/or terminate your IKEA Family membership, or the retention period indicated below will expire.

Categories of personal data

• IKEA application user token
• Technical information related to the IKEA Application and device 
• Information about how you interact with the IKEA Application (e.g., date of latest login, activity)
• IKEA Application settings: selected language, video autoplay configuration, etc.
• Wish list
• Shopping list
• Inspirations, range
• Search history, last viewed, scanned goods
• Crash data

• Notifications
• Camera access
• Access to files and media

Legal basis for the processing
Performance of a contract with you. Processing is also necessary to ensure our legitimate interest in evaluating and improving the IKEA Application. Your consent for specific permissions.

Description
If you give us consent to receive direct marketing offers, we will provide information about our products, services, offers and promotions, notify you of the products that are back in stock and inform you about the abandoned cart in the online store.

If you email a list of products in your shopping cart or a notice of the products that are back in stock to another person, you must notify the person and obtain the person’s consent to provide his/her personal data to us and ensure that the person has understood and familiarised himself/herself with this privacy policy. The aforementioned information of the other person shall be used as defined in this point.

Sometimes we can invite you to special events or ask you to participate in activities. We do that to learn more about your preferences and to better tailor our offerings to your needs. This information is purely voluntary, and you are not obliged to participate in the event or activity.

If you have provided additional data of your choice, we provide you with direct marketing offers based on limited profiling (i.e., your gender, city, living with children under 12 years old, list of products, a list of favourite items, purchase history, etc.). These direct marketing offers are not personalised marketing, but they are tailored to a specific group of customers.

If you agree to receive marketing offers by email, we will track the interaction of email (information if it was read, when it was read, how many times it has been read or opened, if it has been forwarded, what operating system or email server was used, including its location). We do this to better understand if the information we send is relevant to you.

You can unsubscribe from direct marketing offers by changing your choices in the IKEA account, by clicking the unsubscribe link in each email or by contacting us (contact details are provided below).

Categories of personal data

• Name 
• Email 
• List of products (shopping cart) 
• List of favourite items 
• Purchase history (including purchases with the IKEA Family card)
• IKEA Family card number
• Country (in relation to the IKEA Family cards issued till July 8th, 2019)
• Date of birth (where such data is collected till 08 July 2019)
• Preferences 
• Wish list
• Inspirations
• Details of communication, including subject line, sender, recipient, content 
• Tracking interactions of email (information if it was read, when it was read, how many times it has been read (or opened), if it has been forwarded, what operating system or email server was used, including its location) 
• Information collected via cookies, including online browsing behaviour
• History of direct marketing

• Gender 
• Living with children under 12 years old 
• City 
• Language

Legal basis for processing

Please note, based on our legitimate interest in offering products and/or services that better meet your needs, we are doing limited profiling. This profiling does not have any adverse legal effect towards you.

Description
We also process personal data by automated means for statistical purposes. For instance, we analyse what products you add to the list of your favourite items since such details help us have a generalized overview of the IKEA customer and determine market strategies, once we know the needs of the IKEA customers – improve the IKEA products and services. Actions of statistical analysis have no legal or any similar significant effect

Categories of personal data

• Gender 
• The fact of having children under 12 years old 
• City 
• Language 
• Purchase history (including purchases with the IKEA Family card) 
• List of products 
• List of favourite items 
• Wish list
• Data of returns
• Age (in relation to the IKEA Family cards issued till July 8th, 2019) 
• Country (in relation to the IKEA Family cards issued till July 8th, 2019)

Legal basis for the processing
Our legitimate interest, which means collection of statistical data and preparation of reports required for the business purposes specified above.

We obtain information about you when you provide personal data to us by registering for the IKEA Family membership, creating, or using your IKEA account, using the online store services, contacting us, using the IKEA Application, the IKEA Family card or other services, subscribe for our offers, etc. When you pay in the online store, we receive your payment details from the bank.

We may also receive your data from the user of the online store where he/she orders products and/or services in the online store for you or in your name, sends the list of products in the shopping cart or a notice of the products that are back in stock by email with your consent.

a)    IKEA Family data will be stored until you terminate your IKEA Family membership or otherwise request us to delete your data, or 61 months from your last action.
b)    IKEA account data will be stored 61 months from the last action or till the date when you decide to delete the account. 
c)    Details of emails (e.g., when you create an IKEA account on the website and receive a confirmation email, request to remind the forgotten password, send a list of products in the shopping cart to your email, or receive a notice of the abandoned cart) shall be stored for the following period:

• content of the email – for 72 hours,
• subject line, sender, recipient – for 15 days. 

d)    In case you request to send a notice of the products that are back in stock, your personal data shall be stored: 

• not longer than 3 months, if the products are not back in stock during the afore-mentioned period and no notice was sent,
• if the notice was sent, see the point c).

e)    The details of short messages (e.g., when you create your IKEA account and receive a confirmation code) shall be stored for 7 days. 
f)    The personal data contained in the purchase-sale contract and payment documents (VAT invoice, etc.) shall be stored for 10 years. 
g)    Data for statistical analysis will be stored for the same period as the IKEA account, IKEA Family and/or IKEA Application and/or direct marketing data.
h)    Personal data for direct marketing will be stored as long as you want to receive it from us. If you withdraw the consent, your personal data will be deleted within 1 month.  
i)    Information related to the IKEA Application and your device as well as information about your use of the IKEA Application will be stored for as long as you use the Application.

We disclose your personal data to:

4.1.    Companies we work with
We work with several trusted service providers who carry out services on our behalf, i.e., our data processors. These companies are required to adequately safeguard your personal data, but not to use this data for any unauthorised purposes, and to ensure that their suppliers do the same.

1. IT maintenance/service companies, IT support companies, and companies that provide IT systems and/or solutions. These companies process personal data within the European Union/European Economic Area and the USA. Data to the USA shall be transmitted based on signed EU Standard Contractual Clauses.
2. The company that manages our email marketing subscribers’ list and helps us to send emails to our subscribers. The company was established within the European Union/European Economic Area. It shall also involve sub-processors to which data are transferred to the USA. Data to the afore-mentioned sub-processors in the USA shall be transmitted based on EU Standard Contractual Clauses.
3. The company that provides email-sending services, established in the USA. Data shall be transmitted based on EU Standard Contractual Clauses.
4. The company that provides SMS centre services and processes personal data within the European Union/European Economic Area.
5. Companies that provide analytic services. These companies process personal data within the European Union/European Economic Area.

4.2.    Other
In case of dispute or insurance case, we can transfer your personal data to legal advisers and/or insurance. Furthermore, when you shop at the online store and order services, like delivery, and assembly, we shall transmit the personal data necessary for delivery, and assembly to these companies. When you settle accounts in the online store, we shall transfer your order-related personal data to the payment service provider and the technical service provider of the payment portal chosen by it.

We may share the personal data we collect with other organisations in the Inter IKEA Group where those other companies support various operations and business processes (such as IKEA Latvia, IKEA Lithuania, etc).

4.3.    State and local government institutions, other persons performing functions assigned to them by law
We transfer your personal data to state and local government institutions and other persons performing functions assigned to them by law upon their legal request or to meet our legitimate interest in establishing, claiming and defending legal claims.

We take the following precautions concerning the personal data you provide us:

5.1.    Security
We take the security of your personal data very seriously. We have implemented various strategies, controls, policies and measures to keep your data secure and keep these measures under close review. We protect your data by using encryption techniques and we use other safeguards such as firewalls and password protection, processes for regular testing, assessing, and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing, etc. This means that your data is protected and only accessible by co-workers who are trained and need it to carry out their job responsibilities. We also ensure that there are strict physical controls in our buildings which restrict access to your personal data to keep it safe.

5.2.    Transfer of your personal data outside the EU/EEA
The companies mentioned above mainly process personal data within the European Union/European Economic Area. Sometimes we may need to transfer your personal data to our service providers which are established outside the EU/EEA, i.e. in a third country, for example, the USA.

Other third countries may not have the same data protection laws as the European Union/European Economic Area so your personal data may not be subject to the same protections. However, in such cases, we will make sure that any transfer of your personal data to countries outside the European Union/European Economic Area is subject to appropriate safeguards set out in data protection laws (e.g. data can be transmitted based on signed EU Standard Contractual Clauses).

Your rights are:

6.1.    6.1.    The right to access – you have the right to obtain a confirmation from us as to whether or not we process your personal data and, when we do, access the personal data. That’s why we inform you in advance about our processing activities via this privacy policy. If you have any questions or would like to learn more about what information we process from you, you are always welcome to contact us, and we will provide you with further information.
6.2.    The right to rectification – you have a right to request a correction of any inaccurate personal data.
6.3.    The right to erase – under some circumstances, you have the right to the erasure of your personal data if you believe there’s no longer any need for us to keep it. Or, if you previously have given your permission, you can just decide to withdraw it. This does not apply if the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation or the establishment, exercise, or defence of legal claims.
6.4.    The right to receive yourself or transfer your personal data to another company in certain circumstances (known as the right to data portability). This applies when data processing is based on your consent or a contract and whenever processing is carried out by automated means.
6.5.    The right to restrict – in some circumstances you have the right to restrict the processing of your personal data. This means we will continue to store your information, but we’ll temporarily stop any other processing. Why would you want to do this? For example, if you’ve asked us to fix incorrect information. In this situation you may want us to stop processing until the information is correct.
6.6.    The right to object – you have the right to object to our processing. This applies when data processing is based on legitimate interests pursued by us or by a third party. You can do this when you believe that your personal interest outweighs ours. 
6.7.    The right to object – you have the right to object to our processing of your personal data for direct marketing purposes.
6.8.    Object to automated decision-making which produces legal effects concerning you or similarly significantly affects you.
6.9.    The right to withdraw your consent to the processing at any time.

In order to carry out the aforementioned rights please provide a written request to us or the Data protection officer (contacts mentioned below).

You also have the right to complain to the Estonian Data Protection Inspectorate (https://www.aki.ee), 39 Tatari St., 10134, Tallinn, Estonia, tel. +372 627 4135, e-mail: info@aki.ee, if you believe that the processing of personal data by us does not comply with the applicable legislation.

We revise our Privacy Policy regularly. Please regularly check this policy to ensure you are aware of the most updated version. This version was updated on the 1st of July, 2024.

If you have any questions about the processing of your data, any requests, or if you would like to give us feedback, please contact:
OÜ Runikon Retail, registration number 14611049, legal address: Kangrumetsa St. 1, Kurna, 75307 Harju maakond, Republic of Estonia phone number: +372 330 4000, e-mail address: info@IKEA.ee.

Data protection officer: dpo@ikea.ee
You also can contact our Data protection officer by sending a letter to us at the above mentioned address and addressing it to the Data protection officer.