This policy covers brobox.se and the internal tools Brobox AB operates. If you have shopped in one of our stores, that store's own policy applies – the links are further down.

Who is responsible

The data controller is:

Brobox AB, reg. no. 559375-1026
Köpmanbergsvägen 1b, 824 55 Hudiksvall, Sweden
hello@brobox.se

If you have questions about how we process your data, or want to exercise any of the rights listed at the end, email us at the address above. We reply as soon as we can and within one month at the latest.

What this website collects

brobox.se is an information site with a contact form. It has no accounts and no shopping cart.

We set no cookies. The site uses neither advertising pixels nor cross-site tracking. That is why there is no cookie banner here – there is nothing to consent to.
The contact form. If you submit the form we process what you enter – name, email address, optionally a phone number, and your message – in order to reply. The message is delivered to our inbox through the email service Mailjet (Sinch), which processes the data within the EU and keeps a delivery log for up to 90 days. Legal basis: our legitimate interest in answering whoever contacts us, or steps prior to a contract if the matter concerns an assignment (art. 6(1)(b) and (f) GDPR).
Cookie-free visitor statistics. We measure how many people visit the site and which pages are read. The measurement sets no cookies, stores no identifiers in your browser and cannot follow you across websites. The statistics are aggregated and cannot be linked to an individual.
Web server logs. Like every web server, ours receives your IP address, the time, the page you requested and the browser you use. This is technically necessary to deliver the page to you and to detect outages and attacks. Legal basis: our legitimate interest in a working and secure website (art. 6(1)(f) GDPR).
Fonts. The site's fonts are served from our own domain. No requests go to any third party when the page loads.

The website is hosted on Vercel. We do not read the logs to profile individual visitors and do not link them to any person.

If you email us

If you email one of the addresses on the site we process what you write – name, email address and the content of the message – in order to reply. The legal basis is our legitimate interest in answering whoever contacts us, or performance of a contract if the matter concerns an order.

We keep the correspondence for as long as the matter is open and thereafter for as long as needed to follow up, normally no more than 24 months. If the email concerns an order or an invoice, the seven-year retention period of the Swedish Bookkeeping Act applies.

Have you shopped with us?

Brobox AB is behind five stores. Data about orders, deliveries, returns and mailings is handled per store, and each store has its own, more detailed policy:

If you are unsure which one applies: check your order confirmation, it comes from the store you shopped in.

Brobox Commerce – our own platform

Orders, customer details and mailings for Shaktimattan, Znake Grips and KickrSports are handled in Brobox Commerce, a system we have built and operate ourselves instead of renting a platform. This means the data stays with us as the controller, rather than being spread across more suppliers than necessary. The system runs on servers within the EU/EEA. Runcoaching and Run Slow run on other platforms for now; the suppliers used there are listed in each store's own policy.

Our Google Ads integration

This section describes an integration used only by Brobox AB staff. It does not process your data as a visitor to brobox.se.

We run our own connection to the Google Ads API to report our own sales to our own advertising accounts, so that we can see which advertising actually leads to purchases – and to withdraw the figure again when a customer returns an item.

What it accesses	Only the Google Ads account of the staff member who signs in, via the `auth/adwords` scope. No other Google account and no other Google service.
What it sends	Details of our own completed purchases: order number, amount, currency, time and Google's own click ID. Plus adjustments when an order is refunded.
What it stores	An access token that lets the connection work without anyone signing in again. It is stored encrypted with our hosting provider and can be revoked at any time.
What it does not do	It does not read email, contacts, calendar, files or other Google services.

We do not share data obtained through the Google Ads API with any third party, we never sell it, we do not use it for advertising to individuals and we do not use it to train AI models. The data is used solely to measure the results of our own advertising.

Brobox AB's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Where the data is processed

We keep processing within the EU/EEA where possible. Contact form email is handled by Mailjet within the EU. The website is hosted on Vercel, and any transfer to the United States that follows from this relies on the EU–US Data Privacy Framework and the European Commission's standard contractual clauses.

How long we keep data

Web server logs: No more than 90 days.
Form messages and email correspondence: For as long as the matter is open, normally no more than 24 months.
Records that count as bookkeeping: Seven years, under the Swedish Bookkeeping Act.

Your rights

You have the right to know what data we hold about you, to have it corrected or erased, to object to processing based on legitimate interest, to request restriction, and to receive your data in a machine-readable format. Where processing is based on your consent, you can withdraw it at any time without affecting what has already been done.

Contact hello@brobox.se. If you are not satisfied with how we handled the matter, you can complain to the Swedish Authority for Privacy Protection (IMY), the supervisory authority in Sweden.

Changes

If we change anything material we update the date at the top and rewrite this page. We never change the policy retroactively to justify something we have already done.

Privacy Policy