Privacy policy
What data we collect, why, how long we keep it and what you can do about it.
Who is responsible for your data
The data controller is Tullify AB, company registration number 559196-3029, Stureplatsen 3, 411 39 Göteborg. If you have a question about your data, or want to exercise any of the rights listed below, email info@tullify.se.
We do not have a data protection officer. The company is not of a type or size that requires one, so questions go directly to the address above.
What we collect and why
We collect as little as possible, and only for the purposes listed here. The table shows each purpose, the data involved, the legal basis and how long the data is kept.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Handling your enquiry | Name, email, phone if you provide it, company name, whether you are declaring as an individual or a business, whether the enquiry concerns import, export or something else, your description of the enquiry if you write one, the number of attached files, language and the page the form was filled in on. | Contract, or steps taken before entering one | For the duration of the engagement. If no engagement follows, the data is deleted after 24 months. Records that constitute accounting information are kept for seven years under the Swedish Accounting Act. |
| Power of attorney | Name, email, company name and company registration number if you sign on behalf of a business, language, the page you came from, a document ID and two checksums. The power of attorney itself is not stored, nor is your personal identity number: the checksums are only receipts proving that exact document was signed. | Contract, and legal obligation towards the Swedish Customs authority | For as long as the power of attorney is valid, and seven years thereafter. |
| Incomplete submissions | Name, email and company name, saved after the first step of the form even if you do not submit it. | Legitimate interest in being able to follow up an enquiry that was started. We send one automatic email, see below. | 90 days. |
| Limiting abuse of the form | A one-way hashed version of your IP address. We do not store any readable IP address. | Legitimate interest in protecting the service | No more than 24 hours. |
| Measuring how the website is used | Cookies and events about the pages you visit, the steps you fill in and what you click. None of it loads before you have said yes. | Consent | See the generated list below. Each cookie has its own lifetime there. |
Incomplete submissions, and the email you get
This deserves its own heading, because it is not obvious. The form has four steps, and as soon as you have entered your name, email and company in the first step, those details are saved. That applies even if you close the tab and never submit.
This is also what happens next, and it is worth being straight about: roughly ten minutes after you stop filling in the form, we send ONE automatic email asking whether you want us to take the matter further. One email, no reminder sequence, no tracking of whether you open it. If you do not reply, you hear nothing more from us.
If you would rather not, email info@tullify.se and tell us which address it concerns. We will delete the details, and you do not need to give a reason. You can also object to the processing, since it rests on a legitimate interest and not on your consent.
The deletion happens automatically. A job in the database goes through the data every night and removes anything past the periods in the table above, so it does not depend on someone here remembering to do it.
Your attachments
The files you upload are forwarded to us as email attachments. They are not stored in our database. We accept PDFs, images and common Office files, up to 3 MB in total, and other file types are rejected before they leave your browser.
Do not send information about health, trade union membership or similar sensitive categories through the form. We do not need it for a customs matter.
Who we share your data with
We do not sell any data and do not pass it on for anyone else to market to you. The suppliers that process data on our behalf do so on our instructions and under contract.
| Supplier | What they do |
|---|---|
| Vercel | Hosts the website |
| Supabase | The database where enquiries and powers of attorney are stored |
| Microsoft | Sends and receives the email, including your attachments |
| Analytics, Ads and Tag Manager. Only after consent | |
| Microsoft Clarity | Recordings and heatmaps of how the pages are used. Only after consent to statistics |
| Cookiebot | The consent banner and the list of cookies |
| OpenFreeMap | The map images on the contact page |
| The Swedish Customs authority | Declarations and applications in your case |
Beyond that, we disclose data to public authorities where the law requires it, and to our advisers if we ever need to pursue a legal claim.
Transfers outside the EU and EEA
We try to keep data inside the EU and the EEA. Some of the suppliers listed above are US companies, in which case data may be processed in the United States. This takes place on the basis of the European Commission’s standard contractual clauses, and for suppliers certified under the EU-US Data Privacy Framework, on that basis as well.
Cookies and consent
The first time you visit the website you choose which cookies you accept. Necessary cookies are always used. They store your choice and make the page work. Everything else is switched off until you say yes.
Statistics means that we measure how the pages are used with Google Analytics, and record how visitors move around the page with Microsoft Clarity. The recording shows clicks, scrolling and movement. What you type into the form fields is masked and is not stored in the recording. Marketing means that we can see which advert or search in Google Ads brought you here, and that Microsoft may set its advertising cookies.
If you say no, no such cookies are set. Google’s tags then only send anonymous signals without cookies, for example that a page was viewed. They cannot be linked to you or to an earlier visit. The website works exactly as usual, the form can be submitted and your enquiry is handled in the same way.
You can change your mind at any time. The button below the list reopens the same dialogue, where you can both change and withdraw your consent.
Cookies on this website
The list below is generated automatically and shows every cookie the website sets, who is behind it, what it does and how long it remains.
Your rights
You have the following rights when we process your data. Email info@tullify.se to exercise any of them. We reply within one month and do not charge.
- Find out what data we hold about you, and get a copy of it.
- Have incorrect data corrected.
- Have data deleted, unless we are required to keep it.
- Restrict processing while a question is being examined.
- Object to processing based on a legitimate interest.
- Receive data you have provided in a machine readable format, and move it.
- Withdraw consent. This does not affect processing that has already taken place.
If you are not satisfied with how we handle your data, you can complain to the Swedish Authority for Privacy Protection, the supervisory authority in Sweden. You do not need to contact us first, though it is often quicker.
Security
Traffic to and from the website is encrypted. The database is closed to the outside and reached only by the service itself. Only those of us who need the data to handle your enquiry have access to it, and they are bound by confidentiality.
Changes to this policy
If we change how we process data, we update this page. The date below shows when the text was last changed in substance.
Last updated 18 September 2026.
