Privacy policy
What data we collect, why, how long we keep it and what you can do about it.
Who is responsible for your data
The data controller is Tullify AB, company registration number 559196-3029, Stureplatsen 3, 411 39 Göteborg. If you have a question about your data, or want to exercise any of the rights listed below, email info@tullify.se.
We do not have a data protection officer. The company is not of a type or size that requires one, so questions go directly to the address above.
What we collect and why
We collect as little as possible, and only for the purposes listed here. The table shows each purpose, the data involved, the legal basis and how long the data is kept.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Handling your enquiry | Name, email, phone if you provide it, company name, whether you are declaring as an individual or a business, whether the enquiry concerns import, export or something else, your description of the enquiry if you write one, the number of attached files, language and the page the form was filled in on. | Contract, or steps taken before entering one, while we handle your enquiry. If no engagement follows, or once the customer relationship has ended, we keep the data on the basis of our legitimate interest in being able to see earlier cases and defend ourselves against legal claims. | We keep your enquiry until you ask us to delete it, even if no engagement follows. Customs needs often recur, and we want to be able to see your earlier question if you get in touch again. If you become a customer, we keep the data during the customer relationship and afterwards. Records that constitute accounting information are kept for at least seven years under the Swedish Accounting Act. You can object at any time, or ask us to delete data we are not required to keep. |
| Ordering a Certificate of Origin | Name, email, your message if you write one, and the documents you upload, for example the invoice and a packing list. The documents often contain the names and addresses of the exporter and the consignee, and details of the goods. | Contract, or steps taken before entering one, for you as the person ordering. For other people named in the documents, for example a contact person at the consignee, our legitimate interest in being able to carry out the assignment. | The case and the documents are kept in our case system until you ask us to delete them, like other cases. Records that constitute accounting information are kept for at least seven years under the Swedish Accounting Act. |
| Power of attorney | Name, email, company name and company registration number if you sign on behalf of a business, language, the page you came from, a document ID and two checksums. The power of attorney itself is not stored, nor is your personal identity number: the checksums are only receipts proving that exact document was signed. | Contract, and legal obligation towards the Swedish Customs authority | For as long as the power of attorney is valid, and ten years thereafter, the limitation period for a claim. |
| Incomplete submissions | Name, email and company name, saved after the first step of the form even if you do not submit it. | Legitimate interest in being able to follow up an enquiry that was started. We send one automatic email, see below. | Until you ask us to delete them. |
| Seeing where your enquiry came from | If you arrived through an advert or a link: the advert’s click ID from Google Ads, campaign tags in the address, the page you landed on, the website that linked here and, if you opened the link in an app such as LinkedIn or Instagram, the name of the app. The data is read when you arrive on the website, is not stored on your device and is only sent if you fill in the form. With the click ID we can see in our Google Ads account which campaign and keyword the advert belonged to. | Legitimate interest in knowing which adverts and channels lead to enquiries, so that we do not pay for adverts that do not work. You can object to the processing. | For as long as the enquiry it belongs to. |
| Limiting abuse of the form | A one-way hashed version of your IP address. We do not store any readable IP address. | Legitimate interest in protecting the service | No more than 24 hours. |
| Measuring how the website is used | Cookies and events about the pages you visit, the steps you fill in and what you click. None of it loads before you have said yes. | Consent | See the generated list below. Each cookie has its own lifetime there. |
| Measuring adverts on Facebook and Instagram | Only if you have said yes to marketing. Meta’s pixel in your browser sends the pages you visit and whether you click our phone number or email address. When you submit an enquiry, our server also sends an event about it to Meta, with your email, your phone number if you provided it and your first and last name in hashed form, which Meta compares with its own accounts. Your IP address, details of your browser, Meta’s cookies _fbp and _fbc, the page address, the type of enquiry and the language are included. | Consent | We store nothing extra for this. How long Meta keeps the data is set out in Meta’s Privacy Policy. |
Incomplete submissions, and the email you get
This deserves its own heading, because it is not obvious. Our forms have several steps, and as soon as you have entered your name, email and company in the first step, those details are saved. That applies even if you close the tab and never submit.
This is also what happens next, and it is worth being straight about: roughly ten minutes after you stop filling in the form, we send ONE automatic email asking whether you want us to take the matter further. One email, no reminder sequence, no tracking of whether you open it. If you do not reply, you hear nothing more from us.
If you would rather not, email info@tullify.se and tell us which address it concerns. We will delete the details, and you do not need to give a reason. You can also object to the processing, since it rests on a legitimate interest and not on your consent.
The data is not deleted automatically. It remains until you ask us to remove it, and then we delete it.
Your attachments
The files you upload through the contact form are forwarded to us as email attachments. They are not stored in our database. We accept PDFs, images and common Office files, up to 3 MB in total, and other file types are rejected before they leave your browser.
On the Certificate of Origin page the files instead go directly to the case in our case system, where they are stored with the case. There we accept up to ten files, no more than 25 MB each. Only if the case system does not respond are they sent by email, and then the limit above applies. To fill in the application, we may let Anthropic’s AI model Claude read the documents. We start that ourselves in the case, and we check the details before anything is submitted to the Chamber of Commerce.
Your enquiry and your attachments therefore reach us as email, and our reply remains there. The email is not deleted automatically, any more than the data in the database. If you want us to remove it, email info@tullify.se.
Do not send information about health, trade union membership or similar sensitive categories through the form. We do not need it for a customs matter.
Who we share your data with
We do not sell any data. Most of the suppliers below process data on our behalf, on our instructions and under contract. Google and Meta for advertising measurement, and Microsoft for Clarity, also decide for themselves how the data is used, and for the collection on our website we are then joint controllers with them. None of them is used until you have given your consent.
| Supplier | What they do | Role | Where the data is processed |
|---|---|---|---|
| Vercel | Hosts the website, our case system and their functions | Processor | Sweden. US company, data may be processed in the United States |
| Supabase | The databases where enquiries, powers of attorney and the documents for a Certificate of Origin are stored | Processor | Sweden. US company, data may be processed in the United States |
| Microsoft 365 | Sends and receives the email, including your attachments | Processor | EU |
| Google Analytics och Tag Manager | Measure how the website is used. Only after consent | Processor | EU and the United States |
| Google Ads | Measures whether an advert led to an enquiry. Only after consent | Joint controller for the collection | EU and the United States |
| Meta Platforms Ireland | Measures whether an advert on Facebook or Instagram led to a visit or an enquiry, with Meta’s pixel and from our server. Only after consent to marketing | Joint controller for the collection | EU and the United States |
| Microsoft Clarity | Recordings and heatmaps of how the pages are used. Only after consent to statistics | Joint controller for the collection | United States |
| Anthropic | Suggests commodity codes in the HS code finder based on the description you type, or on the text of an invoice you upload. Email addresses, phone numbers, account numbers and company numbers are removed from the invoice text first, and the file itself is neither sent nor stored. Also reads the documents for a Certificate of Origin order when we fill in the application. The files are then sent as they are | Processor | United States |
| Cookiebot | The consent banner and the list of cookies | Processor | EU (Ireland), with a subcontractor in the United States |
| Google Maps | The map on the contact page. It loads only when you click View map | Separate controller | EU and the United States |
| West Sweden Chamber of Commerce | Issues the Certificate of Origin. We submit the application and the documents in the Chamber’s system | Separate controller | Sweden |
| The Swedish Customs authority | Declarations and applications in your case | Separate controller | Sweden |
For Meta, we and Meta Platforms Ireland have an agreement on the joint responsibility. It covers the collection on our website and the transfer to Meta, and under the agreement it is up to us to inform you, which we do here. What Meta then does with the data is Meta’s own responsibility. If you want to access, correct or delete what Meta has stored, contact Meta directly. How Meta processes the data, on what legal basis and how to reach Meta is set out in Meta’s Privacy Policy.
Beyond that, we disclose data to public authorities where the law requires it, and to our advisers if we ever need to pursue a legal claim.
Transfers outside the EU and EEA
We try to keep data inside the EU and the EEA, and the databases and the functions of the website and our case system run in Sweden. Several suppliers are nevertheless US companies or use subcontractors in the United States, in which case data may be processed there. This applies to Vercel, Supabase, Microsoft, Google, Meta, Anthropic and Cookiebot’s subcontractor.
For companies certified under the EU-US Data Privacy Framework, the European Commission has decided that the level of protection is adequate (Article 45 of the GDPR). Vercel, Microsoft, Google and Meta are certified. Regardless of that, our transfers take place under the European Commission’s standard contractual clauses (Article 46), and for Supabase, Cookiebot and Anthropic they are the only basis. We provide data to Meta in Ireland, and Meta transfers it on to the United States as part of its own processing, as described in Meta’s Privacy Policy. If you want a copy of the safeguards, email info@tullify.se.
Cookies and consent
The first time you visit the website you choose which cookies you accept. Necessary cookies are always used. They store your choice and make the page work. Everything else is switched off until you say yes.
Statistics means that we measure how the pages are used with Google Analytics, and record how visitors move around the page with Microsoft Clarity. The recording shows clicks, scrolling and movement. What you type into the form fields is masked and is not stored in the recording. Marketing means that Google Ads may use cookies to measure whether an advert led to an enquiry, that Microsoft may set its advertising cookies and that Meta’s pixel is loaded. The pixel tells Meta which pages you visit and whether you click our phone number or email address, but does not read what you type into the form. If you submit an enquiry, our server also sends an event about it to Meta, with your email, your phone number and your name in hashed form. Which advert or link you came from is, however, stored with your enquiry whatever you choose, if you submit it. That sets no cookie, see the table above.
If you say no, no such cookies are set, and nothing is sent to Meta, either from your browser or from our server. Google’s tags then only send anonymous signals without cookies, for example that a page was viewed. They cannot be linked to you or to an earlier visit. The website works exactly as usual, the form can be submitted and your enquiry is handled in the same way.
You can change your mind at any time. The button below the list reopens the same dialogue, where you can both change and withdraw your consent.
Cookies on this website
The list below is generated automatically and shows every cookie the website sets, who is behind it, what it does and how long it remains.
Your rights
You have the following rights when we process your data. Email info@tullify.se to exercise any of them. We reply within one month and do not charge.
- Find out what data we hold about you, and get a copy of it.
- Have incorrect data corrected.
- Have data deleted, unless we are required to keep it.
- Restrict processing while a question is being examined.
- Object to processing based on a legitimate interest.
- Receive data you have provided in a machine readable format, and move it.
- Withdraw consent. This does not affect processing that has already taken place.
If you are not satisfied with how we handle your data, you can complain to the Swedish Authority for Privacy Protection, the supervisory authority in Sweden. You do not need to contact us first, though it is often quicker.
Publishing on social media
We publish our own posts on Facebook, Instagram, LinkedIn and YouTube from an internal tool. To do so we connect our own accounts through the Meta, LinkedIn and YouTube APIs, for YouTube that is YouTube API Services. The tool is used only by our employees and does not process data about visitors or customers.
When an account is connected we store the account ID and name, who at our company connected it, and an access token, stored encrypted, so that posts can be published at the scheduled time. We also store the link to each post we publish. The account details and the token are deleted when the account is disconnected in the tool.
Use of YouTube is subject to the YouTube Terms of Service and the Google Privacy Policy. Access for a Google account can be revoked at any time on the Google security settings page. LinkedIn and Meta have equivalent settings.
Security
Traffic to and from the website is encrypted. The database is closed to the outside and reached only by the service itself. Only those of us who need the data to handle your enquiry have access to it, and they are bound by confidentiality.
Changes to this policy
If we change how we process data, we update this page. The date below shows when the text was last changed in substance.
Last updated 12 October 2026.
