Privacy notice
Version 1.2, 4 October 2026
1. Data controller
Dabao Food AB, organisation number 559604-2407, Gustav III:s Boulevard 39, 169 73 Solna, Sweden, is responsible for the processing of your personal data on dabao.se. Contact: order@dabao.se.
2. What we collect
When you order we store your name, email address, mobile number, what you ordered and when, your language, and for home delivery your address, door code, floor and any note for the driver. We store no card details; payment is handled by Swish, which gives us a payment reference. If you came to us through a tagged link, a friend's link or from another site and order or join the waitlist during the same visit, we note the link's tag or the site's name with the order or the signup. The same goes for your answer if you tell us how you heard about us. If you answer our short question after an order, we keep the answers with the order. From your paid orders we count the stamps on your stamp card, and we keep the codes for free boxes you have been given. If you join the waitlist, we keep your email address, your postcode if you give it, and whether you want to be a tester. If you leave your email to hear when we deliver to your postcode, we keep the address and postcode until we have told you.
3. Why, and on what basis
To prepare, hand over or deliver your order, to send the confirmation, reminder and notices about changes and refunds, and to help you if something goes wrong. The basis is our contract with you; that also covers the stamp card and the codes for free boxes. Data required for bookkeeping is kept to comply with the Swedish Accounting Act. Troubleshooting technical errors, and seeing which channels bring customers to us, rest on our legitimate interest in a working service and in knowing what reaches people. Two days after an order we send one email asking how the food was, and about two weeks after your latest order one reminder with a link to order the same again. Both rest on our legitimate interest; you can say no to them at checkout and with one click in every such email. We send newsletters only if you ticked the box, at most two a month, and you unsubscribe with one click. The waitlist gets one email when we open. We share no data with others for marketing.
4. For how long
Name, contact details and address are deleted or anonymised 24 months after your last order. The order itself (what, when and amount) is kept for seven years under the Accounting Act, no longer linked to you once the contact details are gone. The link to your order stops working 30 days after the pickup or delivery day. Waitlist addresses are deleted no later than twelve months after we have opened. Your newsletter choice stands until you unsubscribe.
5. Who processes data for us
Data is stored on our own server at Hetzner in the EU. Email is sent through Resend, a company in the United States: the messages leave from servers in Ireland, but Resend stores the recipient address, the message and the delivery log in the United States. That transfer rests on the EU's standard contractual clauses and the EU–US Data Privacy Framework. Email you send to us arrives in our mailbox at Loopia in Sweden. Payments are handled by Getswish AB (Swish), which is its own controller for the payment. Visitor statistics are collected with Umami on our own server, without cookies and without storing your IP address. Technical errors may be reported to Sentry in the EU, without personal data. Apart from that, we transfer no data outside the EU/EEA.
6. Cookies and what your browser keeps
We use no cookies for tracking or marketing, and therefore no cookie banner. Your browser keeps locally what the functions you use need: your cart, your latest order so you can order the same again, the postcode you checked, your contact and delivery details so the next order is quicker, and a friend's code if you came through a friend's link. That stays in your browser and can be cleared there. How you found us is not saved in your browser. The only cookies we set are the administrator's login and, for invited testers, the tester code so the checkout recognises you.
7. Your rights
You have the right to know what data we hold about you, to have it corrected or deleted (except what the Accounting Act requires us to keep), to receive it in a common format, and to object to processing based on legitimate interest. Email order@dabao.se. You can also complain to the Swedish Authority for Privacy Protection (imy.se).
8. Changes
We update this notice when the service changes. The version number and date are at the top of the page.