Privacy policy

Brobox AB (org.no. 559438-3975) is the data controller for the processing of your personal data. Contact us at contact@znakegrips.com.

When you make a purchase we collect: name, email, phone, shipping address and payment details. Card data is handled by Stripe and never stored by us.

• Process your order and delivery
• Send order confirmation and shipping info
• Handle returns and complaints
• Improve our website and service
• Send newsletters (with your consent)

We process your personal data based on: contract performance (purchase), legitimate interest (customer service, web analytics, marketing to you as a customer of ours) and consent (newsletter if you have not purchased from us, cookies).

If you have purchased from us, we send offers and tips about our own similar products. This is done under the existing-customer exception in the Swedish Marketing Act (marknadsföringslagen). You can decline already at checkout, and every email we send contains an unsubscribe link.

If you have not purchased from us, we only send email if you have signed up for our newsletter yourself, and then only after you have confirmed your email address.

We use necessary cookies for site functionality (e.g. cart, locale). Analytical cookies are used with your consent to improve the experience. A first-party cookie called bx_attr also stores how you reached us (for example via an ad or a newsletter) for up to 180 days, so we can see which marketing leads to orders. It is not necessary for the website to work. The campaign labels in the link (utm_source, utm_medium, utm_campaign and similar) are always stored; the ad click's id is stored only if you have accepted cookies, and is deleted from the cookie if you decline.

• Stripe — payment processing
• Brobox — order management
• Bring/UPS — delivery and pickup points
• Vercel — web hosting
• Google (Google Analytics and Google Ads) — web analytics and advertising measurement
• Meta (Facebook and Instagram) — advertising measurement
• Shelfless/Dreamlogistics — warehousing and delivery
• Mailjet — sending order and customer e-mails

Google and Meta may process data in the United States; the transfer is made under the EU–US Data Privacy Framework and the European Commission's standard contractual clauses. Stripe and Vercel process data within the EU/EEA or under equivalent safeguards.

We measure both in your browser and from our server. The cookie banner only governs the first.

Meta's pixel is not loaded until you have consented. Google's measurement script loads straight away, but with consent set to denied — no cookies, only your IP address, your browser and which page you are looking at. If you accept cookies, Google also measures what you look at, add to the basket and buy.

If you have accepted cookies, our server reports when you have looked at a product, added something to the basket, started a checkout or entered payment details — with your IP address, your browser and Meta's cookie id in clear text, plus your contact details in hashed form if you have already filled them in. On a purchase we send the order number, amount, currency, items, the same hashed contact details and a customer number we hold for you — then whatever you answered in the cookie banner. Refunds are never sent to Meta.

To Google we send, on a purchase, the order number, amount, currency, time and items, whatever you answered in the cookie banner; on a refund, the order number, amount and currency. If Google's analytics cookie exists, its id goes along, otherwise a technical id we derive from the order. Your browser additionally hands over your e-mail address and your telephone number in hashed form on a purchase, and the click id from the ad if you have accepted cookies.

A hash is one-way — the data is never sent in clear text. But it is stable, so the recipient can match it against its own records and recognise you.

The legal basis is our legitimate interest in knowing which marketing leads to sales. You can object to that — see the section on your rights.

You have the right to request access to, correction or deletion of your data. You can also object to processing or request data portability. Contact contact@znakegrips.com.

We retain your data only as long as necessary for the purpose, and at least the time required by Swedish accounting law (7 years).

We may update this policy. Material changes are communicated via email or on the website.