This policy describes how we gather and use your personal data, your rights, and how you can contact us

Scope

This policy applies to anyone who:

• is an Instabox customer;

• is a recipient of packages transported and conveyed by us to you;

• visits our digital channels, such as our websites, apps, and social media;

• takes part in customer surveys, or;

• comes into contact with us in any other way, e.g. via our customer service facility.

Who we are

Instabox Sweden AB is the company who is responsible for the processing of your personal data (i.e. the Personal Data Controller).

If you have any questions about how we process your personal data, or would like to assert your rights in this context, please contact us by emailing us at info@instabox.se or by writing to us at:

Instabox Sweden AB
Medborgarplatsen 3
SE-118 72 Stockholm
Sweden

How do we gather your personal data?

The majority of our personal data gathering occurs in conjunction with the ordering of transport services. We start processing personal data when the online retailer sends us an order confirmation for transportation of a package. That confirmation usually includes your given name, surname, postal address, telephone number, email address, and IP address. If we need any additional information, such as the door code and floor, in conjunction with home deliveries, or when the recipient orders a return, we will also gather personal data directly from the package recipient. Secure identification of the package recipient is sometimes also required, in which case we will gather personal data via BankID or by scanning or taking a copy of the package recipient’s driving licence.

When you enter into a customer agreement with us, contact us via our contact form or customer service facility, via text message, apps or other digital channels, or interact with us physically during our marketing activities, we will also gather the personal data that you choose to share. We can also gather personal data from other services, such as official bodies, public databases, and marketing partners, when they share data with us

What use do we make of your personal data?

Corporate customers’ personal data

We process personal data in order to conduct the day-to-day management and administration of our relationship with our corporate customer. This may, for example, involve managing the customer agreement, administration of the customer’s setup in our IT systems, communication with the customer’s contact person in order to respond to queries, ticket resolution, providing news and information about our services, or questionnaires and market surveys, etc. The lawful basis for this processing is our legitimate interest, which derives from the contractual undertakings of the agreement into which we have entered with the corporate customer.

We process the following personal data for this purpose: name, work contact details for the customer’s contact persons, and log-in details to our customer portal.

Package recipients’ personal data

We process personal data in order to send packages to the right recipients, to process returns and customer service tickets, to send out surveys and marketing material, to create anonymised statistics, to maintain, develop, and test our products and services, and to maintain our websites, apps, and social media.

The lawful basis for this processing is our legitimate interest (which derives from the contractual undertakings of the agreement to transport packages), or your consent.

We process the following personal data for this purpose: given name, surname, postal address, telephone number, email address, and personal ID number in connection with identification.

Personal data of visitors to our websites, apps, and other digital channels

We process personal data in order to communicate with you via our digital channels, and to provide you with information about our products and services.

The lawful basis for this processing is the fulfilment of an agreement we have with you, or your consent.

We process the following personal data for this purpose: name, email address, IP address, and the other data that you have chosen to share.

Other purposes

We process personal data in order to conduct and administer our day-to-day operations, e.g. in conjunction with recruitment, in data analyses, and the development of new services and IT systems. We also process personal data in order to comply with legal obligations and industry recommendations. This may, for example, include obligations in connection with legal proceedings, requests by official bodies, the need to protect our operations, to protect both your and our rights, interests and security, and in order to limit any damage we may incur.

The lawful basis for this processing is legitimate interest or legal obligation.

We process the following personal data for this purpose: name, contact details, and the data you choose to share.

With whom do we share your personal data?

We may, for the purposes listed above, share your personal data with companies in the Instabox corporate group, service providers such as IT providers, courier companies, consultants, and client companies.

We share your personal data with official bodies (such as the police) and other third parties when required or appropriate, e.g. in order to fulfil a legal obligation or when we have a legitimate interest in doing so. We have a legitimate interest in sharing your personal data with a third party, such as a potential purchaser and their advisors, in conjunction with corporate reorganisations, commercial transactions, mergers, sales, bankruptcies, etc.

Children’s personal data

Our services are not intended for use by children and we do not, therefore, deliberately gather children’s personal data.

Security and storage

We endeavour to maintain a high level of security for your personal data and take reasonable technical and organisational measures to protect personal data within our organisation. Transfer or storage of data can never, however, be completely secure. If you have grounds to suspect that your data is no longer secure (e.g. if you suspect that your log-in details have fallen into the wrong hands), we would ask you to notify us immediately of your concerns.

We process your personal data for as long as necessary to fulfil the objectives of the processing and to comply with our legal obligations. Our organisation and our services are global, and your personal data may, therefore, be stored and/or processed in countries other than Sweden.

Your rights

Contact us if you would like to review, correct, update, keep secret, restrict, or delete your personal data that is processed by us, object to the processing or request an electronic copy of the personal data in order to transfer them to another company. We will handle your request in accordance with applicable legislation.

Amendments to this policy

We amend this integrity policy on a rolling basis and the most recent version can be found on our website