1. About this policy
This privacy policy explains how Brandtown AB collects and uses personal data in connection with our website, enquiries, orders, business relationships and job applications.
Personal data is information that identifies you or can be linked to you, such as your name, business email address or IP address.
Brandtown AB is the data controller for the processing described in this policy, except where we process personal data solely on a customer’s behalf as explained in section 11.
Brandtown AB, company registration number 559422-4619, Druveforsvägen 32, 504 33 Borås, Sweden. Email: [email protected].
This policy provides information about our processing. Visiting our website or accepting our sales terms does not, in itself, constitute consent to personal data processing.
2. Personal data we process
Depending on your relationship with us and the services you use, we may process:
- Contact and business information: your name, employer or organisation, role, business address, email address and telephone number.
- Enquiry and communication information: messages, quotation requests, correspondence and information you provide when contacting us.
- Order and delivery information: products, quantities, order history, delivery details, recipients, approvals and information needed to fulfil an order.
- Billing and payment information: invoice details, payment status, transaction references and information needed for accounting.
- Production information: names, initials, numbers, sizes or other personalisation details supplied for garment decoration, labelling or packing.
- Application information: contact details, CV, cover letter and other information you send when applying for a job with us.
- Technical information: IP address, browser and device information, timestamps, error information and security logs generated when the website is delivered.
- Choices and objections: your marketing choices and records of consent or objections.
Please do not send sensitive personal data, such as health information, unless we have specifically agreed on a lawful and secure way to handle it.
3. Where the information comes from
We receive personal data when you contact us, request a quotation, place an order, apply for a job or otherwise communicate with us.
We may also receive information from your employer, a club or organisation you represent, or a customer who provides delivery or personalisation details relating to you.
Technical information is generated when our website and systems are used. The website does not use optional cookies, analytics or advertising technologies.
If we obtain personal data from another source, we provide the information required by applicable data protection law.
4. Why we use personal data
We use different legal bases for different purposes.
- Purpose
- Respond to enquiries and prepare quotations
- Personal data involved
- Contact details, correspondence and quotation information
- Legal basis
- Our legitimate interest in responding to requests and developing business relationships. Where you personally are the contracting party: taking steps at your request before entering into a contract.
- Purpose
- Manage business relationships, orders and deliveries
- Personal data involved
- Business contact details, order information, approvals and delivery information
- Legal basis
- Our legitimate interest in fulfilling agreements with the organisation you represent. Where you personally are the contracting party: performance of that contract.
- Purpose
- Provide support and handle complaints
- Personal data involved
- Contact details, correspondence and relevant order information
- Legal basis
- Our legitimate interest in resolving issues and maintaining customer relationships, and legal obligations where applicable.
- Purpose
- Handle job applications and recruitment
- Personal data involved
- Contact details, CV, cover letter and other information in the application
- Legal basis
- Taking steps at your request before entering into an employment contract, and our legitimate interest in assessing applications and being able to show how a recruitment was carried out.
- Purpose
- Maintain website and system security
- Personal data involved
- Technical information, access records and security logs
- Legal basis
- Our legitimate interest in protecting our systems, preventing misuse and investigating incidents.
- Purpose
- Meet accounting and other statutory requirements
- Personal data involved
- Invoice details, transaction information and supporting records
- Legal basis
- Compliance with legal obligations.
- Purpose
- Send relevant business communications and marketing
- Personal data involved
- Business contact details, choices and relevant customer history
- Legal basis
- Consent where required, or our legitimate interest in communicating relevant information to business contacts where permitted by law.
- Purpose
- Establish, exercise or defend legal claims
- Personal data involved
- Relevant agreements, correspondence and transaction records
- Legal basis
- Our legitimate interest in protecting our legal rights.
Where we rely on legitimate interests, we assess whether the processing is necessary and whether your interests and rights override ours. You can contact us for more information about that assessment.
We do not use consent as a substitute for a legal basis that more accurately reflects the processing.
5. Marketing and your choices
We may send information about our products, services and business where permitted by applicable data protection and marketing rules.
Where prior consent is required for email marketing, we obtain it before sending marketing messages. Where a statutory exception applies, we comply with its conditions.
You can unsubscribe using the option included in our marketing emails or by contacting [email protected].
You have the right to object to direct marketing at any time. If you object, we stop using your personal data for that purpose, including any related profiling.
We may retain limited information on a suppression list so that we can respect your choice. Unsubscribing from marketing does not prevent us from sending necessary messages about an order or delivery.
6. Cookies and similar technologies
The website does not use cookies for analytics, marketing or advertising and does not store any information in your browser.
The website is delivered through our hosting provider’s network, which is operated by Cloudflare. Cloudflare sets one strictly necessary cookie, __cf_bm, which distinguishes visitors from automated traffic and protects the website against misuse. It expires after 30 minutes. As it is needed to deliver the website securely, it does not require consent.
The fonts on the website are served from our own server, so no information is sent to a font service.
The links to Google Maps, Facebook and Instagram are ordinary links. No content is loaded from these services until you click a link. After that, the service’s own privacy policy applies.
If we start using optional cookies or analytics in the future, we will update this policy and ask for your consent before they are used.
7. How long we keep personal data
We retain personal data only for as long as it is needed for the relevant purpose, including any applicable legal retention requirements.
Different records may have different retention periods, even where they relate to the same customer.
- Information
- Enquiries and quotations that do not lead to an order
- Retention period
- 12 months from the most recent contact.
- Information
- Contact information in a business relationship
- Retention period
- While the business relationship remains relevant and the details are needed, and no longer than 24 months after the relationship has ended.
- Information
- Accounting records
- Retention period
- Until the end of the seventh year following the calendar year in which the relevant financial year ended, unless a longer period is legally required. This applies to records that constitute accounting information, not automatically to all customer data.
- Information
- Order, approval and complaint records
- Retention period
- For as long as needed to fulfil the order and during the complaint period under our sales terms. Records that constitute accounting information are kept in line with accounting rules.
- Information
- Personalisation and production files
- Retention period
- For the agreed production purpose and any agreed repeat-order period. Where we act as a processor, retention follows the customer’s documented instructions and the data processing agreement.
- Information
- Job applications
- Retention period
- 24 months after the recruitment has been completed. Open applications are kept for 24 months from when we received them.
- Information
- Technical logs
- Retention period
- The logs are handled by our hosting provider and kept for the limited period the provider applies. Relevant extracts may be retained longer where necessary to investigate an incident or handle a legal claim.
- Information
- Marketing information
- Retention period
- Until you withdraw consent or object, or the information is no longer needed. Contacts that have been inactive for 24 months are removed.
- Information
- The __cf_bm cookie
- Retention period
- 30 minutes.
Where information is needed for an ongoing dispute or a specific legal obligation, we may retain the necessary records for longer. Access is limited accordingly.
8. Who receives personal data
We share personal data only where needed for the purposes described in this policy.
Depending on the service, recipients may include:
- Providers of hosting for the website: DigitalOcean and its network provider Cloudflare.
- Provider of email and office software: Microsoft.
- Provider of email from the website's forms: Twilio SendGrid. The contact form, orders in the Lotus shop and job applications are sent to us as email via SendGrid. For an order, a confirmation is also sent to the email address you have given. The forms do not store any data on the website.
- Providers of business and accounting systems, IT operations and technical support.
- Production and fulfilment partners that need information to complete an order.
- Shipping and logistics providers.
- Accounting, payment and professional advisory service providers.
- Providers of mailing services, where we send marketing through such a service.
- Public authorities where disclosure is legally required.
We limit the information shared to what is needed for the recipient’s task.
Where a provider processes personal data on our behalf, the relationship must be governed by a data processing agreement. Other recipients may act as independent controllers and are responsible for their own processing.
We do not sell personal data.
9. Transfers outside the EU/EEA
DigitalOcean, Cloudflare, Microsoft and Twilio (SendGrid) are US companies. Using their services can involve personal data being processed in the United States or accessed by support staff located in another country.
Such transfers are based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework, for providers certified under it, or on the European Commission’s Standard Contractual Clauses, together with supplementary measures where required. The same requirements apply if any other provider processes personal data outside the EU/EEA.
You can contact us for information about the safeguards used and how to obtain a copy, subject to necessary redactions.
10. Security
We are responsible for implementing technical and organisational measures appropriate to the risks associated with our processing.
These measures are to cover matters such as authorised access, confidentiality, system protection, secure handling and deletion of information, and the management of personal data incidents. The website uses an encrypted connection (HTTPS).
No online service can guarantee absolute security. If a personal data breach occurs, we assess and meet any applicable obligations to notify the supervisory authority and affected individuals.
11. Personal data processed on a customer’s behalf
Some assignments may involve personal data supplied by a club, company or other customer, for example names and sizes used for personalised garments or packing.
Our role depends on the actual arrangement.
Where we process this information solely on the customer’s behalf and according to its documented instructions, the customer is the controller and Brandtown acts as a processor. The processing is then governed by a separate data processing agreement.
This privacy policy does not replace that agreement or the customer’s obligation to inform the individuals concerned.
If your request concerns information for which our customer is the controller, we will assist that customer as required and direct your request appropriately.
12. Your rights
Subject to the conditions in the GDPR, you may:
- Request access to your personal data and information about its use.
- Ask us to correct inaccurate or incomplete information.
- Request deletion where there is no lawful reason to retain the information.
- Request restriction of processing in certain circumstances.
- Object to processing based on legitimate interests.
- Object to direct marketing at any time.
- Receive personal data you have provided in a structured, commonly used and machine-readable format where processing is automated and based on consent or a contract.
- Withdraw consent without affecting the lawfulness of processing carried out before withdrawal.
These rights are not absolute. For example, accounting obligations may prevent us from deleting certain records.
Contact [email protected] to make a request. We may ask for information necessary to verify your identity.
We normally respond within one month. Where the GDPR permits an extension because of the complexity or number of requests, we inform you within that first month and explain why.
13. Information you need to provide
Some information is necessary to respond to a request, fulfil an order, handle an application or meet legal obligations. We explain what is required when collecting it.
If you do not provide necessary information, we may be unable to provide the requested service.
Consent to marketing is voluntary and is not required to place an order.
14. Automated decision-making
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
15. Complaints
Please contact us if you have questions or concerns about how we handle personal data.
You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), or another competent supervisory authority, particularly in the EU/EEA country where you live, work or believe an infringement has occurred.
Information about submitting a complaint is available at imy.se.
16. Changes to this policy
We review this policy when our processing or applicable requirements change.
The current version is published on this page, with the date of the latest update. Where required, we provide additional information about material changes before the new processing begins and obtain consent where necessary.
Creativity Together
As a customer, partner or new colleague. We build this together.