Privacy policy

Brobox AB (org. no. 559438-3975), Köpmanbergsvägen 1b, 824 55 Hudiksvall, Sweden, is the data controller for the processing of your personal data. Contact us at hello@shaktimattan.com.

When you make a purchase, we collect: name, email address, phone number, delivery address and payment details. Payment card information is handled by Stripe and is never stored by us.

• Process your order and delivery
• Send order confirmation and shipping information
• Handle returns and complaints
• Improve our website and service
• Send newsletters (with your consent)

We process your personal data based on: contract fulfilment (purchase), legitimate interest (customer service, web analytics, marketing to you as a customer of ours) and consent (newsletters if you have not purchased from us, cookies).

If you have purchased from us, we send offers and tips about our own similar products. This is done under the exemption for existing customer relationships in the EU rules on electronic direct marketing. You can decline already at checkout, and every email we send contains an unsubscribe link.

If you have not purchased from us, we only send email if you have signed up for our newsletter yourself, and then only after you have confirmed your email address.

We use essential cookies for website functionality (e.g. shopping basket, language selection). Analytics and marketing cookies (Google Analytics, Meta Pixel) are set only with your consent. The measurement scripts themselves, however, load differently — see the section “Measurement and ad tracking”.

• Stripe — payment processing
• Klarna — invoice and instalment payments
• Brobox Commerce — our own e-commerce platform, operated by Brobox AB (the data controller) — order handling
• Bring/UPS — delivery and collection points
• Vercel — web hosting
• Google (Google Analytics and Google Ads) — web analytics and ad measurement
• Meta (Facebook and Instagram) — ad measurement
• Shelfless/Dreamlogistics — warehousing and delivery
• Mailjet — sending order and customer e-mails

Google and Meta may process data in the United States; transfers rely on the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses. Stripe and Vercel process data within the EU/EEA or under equivalent safeguards.

We measure both in your browser and from our server. The cookie banner governs only the first.

Meta’s pixel does not load until you have consented. Google’s measurement script loads immediately but with consent set to denied — no cookies, just your IP address, your browser and which page you are viewing. If you accept cookies, Google also measures what you view, add to the basket and buy.

If you have accepted cookies, our server reports to Meta when you have viewed a product, added something to the basket, started a checkout or entered payment details — with your IP address, your browser and Meta’s cookie id in plain text, plus your contact details in hashed form if you have filled them in by then. On a purchase we send the order number, amount, currency, items, the same hashed contact details and a customer number with us — that one regardless of what you answered in the cookie banner. Refunds are never sent to Meta.

To Google we send, on a purchase, the order number, amount, currency, time and items, regardless of what you answered in the cookie banner; on a refund, the order number, amount and currency. If Google’s analytics cookie is there, its id goes along, otherwise a technical id we derive from the order. Your browser also passes your e-mail address and telephone number in hashed form on a purchase, and the click id from the ad if you have accepted cookies.

A hash is one-way — the data is never sent in plain text. But it is stable, so the recipient can match it against its own register and recognise you.

The legal basis is our legitimate interest in knowing which marketing leads to sales. You can object to that — see the section on your rights.

You have the right to request access to, correction or deletion of your data, to request restriction of processing, to object to processing and to request data portability. A consent you have given (e.g. for the newsletter or cookies) can be withdrawn at any time; this does not affect processing carried out before. Contact hello@shaktimattan.com. If you are unhappy with how we handle your data, you can lodge a complaint with the Swedish Authority for Privacy Protection (IMY, imy.se) or the data protection authority in your own country.

Order data that forms part of our accounting records is kept for 7 years under the Swedish Bookkeeping Act. Customer-service matters are kept for as long as the matter requires and deleted afterwards. Newsletter addresses are kept until you unsubscribe. Visit statistics are kept for at most 14 months.

Conversations with our chat assistant are not stored by us and disappear when you close the page. If you choose to send a conversation to customer service (checkbox + button), the transcript and your email address are processed as a customer service case, in the same way as a message via the contact form.

We may update this policy. Material changes will be notified via email or on the website.