1. Who we are
Attachment Warehouse is the data controller for personal data processed through attachmentwarehouse.eu. We operate from Saltsjö-Boo, Stockholm, Sweden.
For all data-protection matters, contact support@attachmentwarehouse.eu.
2. What data we collect
We collect only data necessary to operate the Site and fulfil orders:
- Order data: name, billing and delivery address, phone, email, company name, VAT number where applicable.
- Payment data: handled by our payment providers (Klarna, our card processor). We never see or store full card numbers.
- Account data: if you create an account, your saved machine preference and order history.
- Browsing data: IP address, device type, browser, pages visited, referrer URL, time on page. Stored as analytics events with consent.
- Communications: support emails, chat transcripts, call notes when you contact us.
- Cookies and similar technologies: see our Cookies Policy for the full list.
3. Why we collect it
- Process and deliver your order, including handling returns and warranty claims.
- Provide customer service and technical support.
- Comply with legal obligations (tax, accounting, consumer protection).
- Detect and prevent fraud, abuse, and unauthorised access.
- Improve the Site, product range, and customer experience through analytics.
- Send marketing communications, where you have given consent or where we have a legitimate interest in retaining existing customers.
4. Legal basis for processing
Under GDPR Article 6, we rely on:
- Contract performance — to fulfil orders, accounts, and warranty obligations.
- Legitimate interest — for fraud prevention, retention of existing customers, and Site improvement, balanced against your rights.
- Consent — for marketing cookies, third-party analytics, and direct marketing emails. You can withdraw consent at any time.
- Legal obligation — to retain accounting records (Swedish Bokföringslagen requires 7 years), VAT records, and to respond to lawful requests.
Phone numbers you give in the deals area
In the deals area you can choose to leave your phone number. It is optional and never required to see or buy the deals. We collect the number so we can contact you by phone about the deals area, the discount, and the stock you showed interest in.
The legal basis is legitimate interest (GDPR Article 6(1)(f)). Our interest is to follow up with you after you have shown a concrete buying interest in the deals area, balanced against your right to privacy. We keep the number for up to 12 months from the day you gave it, or until you ask us to remove it, whichever comes first.
You can object to the calls and ask us to delete the number at any time. Email support@attachmentwarehouse.eu and we will stop contacting you by phone and remove the number.
Competitions and promotions
When you enter a prize draw or promotion, for example the pick-a-card pre-order game, we collect the contact details you give us (such as email, phone and postal address) and your entry. We use them to run the promotion, contact winners, and send any prize. The legal basis is our and your legitimate interest in administering the promotion (GDPR Article 6(1)(f)), and consent for any marketing emails you opted into. Entry data we no longer need is deleted within three months of the draw, except where you also opted into our emails. The full rules for a given draw are published on its terms page, for example attachmentwarehouse.eu/tavlingsvillkor.
What you type in forms, the chat and calls
When you fill in a form on the site (contact and quote forms, popups, the machine finder and the checkout), we save what you type while you type it, even before you press send. This includes details your browser fills in for you automatically (autofill), such as your name, email address or phone number. We do this to answer your enquiry and to help you if a question about your machine or a product was left unfinished. If the form holds your name, email address or phone number, our sales team may contact you about it by phone or email, even if you did not press send. We never save passwords or card details this way, and we do not store a VAT or company registration number from unfinished typing. If the form holds no name, email address or phone number, the entry has no contact details, is linked only to your visit and is deleted after 90 days. If you give contact details during the same visit, the earlier entries are added to your enquiry and kept as support communications. Saving what you type never puts you on a newsletter or marketing list: that only happens if you tick the box for it and send the form. You can object to this at any time, and we will delete the entry. Legal basis: steps before a contract at your request and our legitimate interest in answering enquiries (GDPR Article 6(1)(b) and (f)).
Our chat assistant answers product questions with an AI model from xAI. Your contact details are never sent to the model. If you leave contact details in the chat, a copy of the conversation is saved with your enquiry so we can follow up. Legal basis: steps before a contract and legitimate interest (Article 6(1)(b) and (f)).
If you call us and we miss the call, our telephony provider Twilio sends one text message to the number you called from, and we save the missed call with your number so we can call you back. Legal basis: legitimate interest in answering your call (Article 6(1)(f)).
Early access to the contractor workspace
If you request early access to the contractor workspace, we collect your name, company, phone number, email address and country and use them to answer your request and contact you about your access (GDPR Article 6(1)(b): steps at your request before an agreement). Until you tick a marketing box we contact you only about your access. If you leave the form unfinished we may contact you about it, as described under "What you type in forms, the chat and calls". We keep the details until the access invitation has been sent and 90 days after, or for as long as a marketing consent you gave lasts.
Cookie choices, server logs and company lookups
When you accept or decline cookies, we save the choice itself: which categories, the banner version, the site language, the type of page, the device type (mobile, tablet or desktop) and the time. We save no identifier and no IP address with it. We use it to prove how consent was collected (GDPR Article 7(1)) and to count how many visitors accept. Legal basis: legal obligation (Article 6(1)(c)) and legitimate interest.
Our web server logs every request, including the IP address, the approximate country our CDN (Cloudflare) supplies, the page, the referring page and the browser type, for security and operations. We keep these logs for 14 days. Once a day we turn them into anonymous daily totals: visits, product views, carts, checkouts, orders and enquiries, split by traffic source, language, device type and type of landing page. To count a visit, the daily run holds the pages of one visit together in memory under a random key that is discarded when the run ends. The address is used only to leave out bots and our own devices. The totals we keep contain no IP address, no visitor identifier and no sequence of pages. For the current day, our staff also see a short list of the visits that got furthest (time, type of traffic source, landing page, device type, country and how far the visit got: product, cart, checkout, order). The list holds no IP address and no identifier, and it is deleted when the day ends. When someone starts a cart or opens the checkout, the browser also sends a count signal with only the type of traffic source, the page type and the language, without any identifier. No cookie or device storage is used for this. Legal basis: legitimate interest (Article 6(1)(f)).
When you enter a company registration number or VAT number, we fetch the registered name and address from public company registers (Bolagsverket, Brønnøysundregistrene, CVR, PRH, GUS, EU VIES). We save the result with your enquiry, cart, order and customer record. For a sole trader this can be personal data. Legal basis: steps before a contract or the contract (Article 6(1)(b)) and our legitimate interest in correct customer and invoice data.
Saved cart with a locked price. If you save your cart for 7 days, we store your email address, what is in the cart, the locked prices and when you saved it. We email you the cart straight away and remind you the day before the lock ends; once you order, we stop. Legal basis: the service you asked for (Art. 6(1)(b) GDPR). The email address and the cart are also kept as an enquiry, as described under enquiries.
Measuring our advertising on our server
We measure our advertising on our own server (server-side tagging that we run on Hetzner in the EU). What the server passes on depends on your choice in the cookie banner.
Before you choose, and also after "Only necessary": our server passes on page views, product views, carts, checkouts, purchases and enquiries to Google (Analytics and Ads) and to Meta (Facebook and Instagram) through Meta's Conversions API. Google receives them marked as without consent. No Google cookie is set, and under Google's rules such events are used only in aggregated, modelled form, not to link them to you or to an ad click. Meta receives them with your IP address and browser details and, if you arrived by clicking a Meta ad, that ad's click ID. If you send us an enquiry, including a request for early access, or place an order, Meta also receives the email address, phone number, name and address (city, postal code, country) you entered, in hashed form (SHA-256, not readable as text), so the enquiry or purchase can be matched to an ad; Google receives these details only with your consent. Without your consent the Meta pixel does not run in your browser and no Meta cookie is set. Meta uses this to measure and improve our ads.
If you choose "Only necessary": the Meta pixel does not run and no analytics or marketing cookies are set in your browser. The server measurement described above continues to Meta, Google Ads and Google Analytics, without cookies. Google receives your choice exactly as you made it (without consent), and we never report it to Google or Meta as consent.
If you choose "Accept all": analytics and marketing cookies, the Meta pixel and Google Ads work as described in the rest of this policy and in our Cookies Policy.
Purpose: measuring and improving our advertising. Legal basis: our legitimate interest (Article 6(1)(f) GDPR). Questions or objections: support@attachmentwarehouse.eu.
Emails about our products (only if you tick the box)
In our contact forms and some pop-ups you can tick a box to get emails from us about offers and reminders about your cart, tailored to your interest. The box is never ticked for you, and you can buy or ask without it. If you tick it, we use what you looked at and put in your cart on our site, and the machine you told us about, to choose what we write to you. Our emails contain no open-tracking pixel.
In Germany, and in any country where we are not sure that one tick is enough, we first send you one confirmation email. Nothing else is sent until you press its button. The link is valid for 7 days. If you do not confirm, we delete the request after 30 days.
As proof of your consent we store your email address, the time, the wording you saw and its version, the page, the internet address (IP) you ticked from and, where it applies, the time and IP address of your confirmation. Legal basis: your consent (GDPR Article 6(1)(a)) and, for the proof, our obligation to be able to show it (Article 7(1)).
Every email has a one-click unsubscribe link. If you unsubscribe, we stop at once, remove your email address from the consent record and keep only a pseudonymised proof (a hash of the address, the times and the wording) until 3 years after the end of that year. Your address stays on our block list so that you are never emailed again by mistake.
If you buy from us, we may email you about similar products as an existing customer, where the law allows it. The checkout says so in one line. You can say no there ("No thanks") or with the link in any such email, free of charge. We store that the line was shown (time and wording version) or that you said no.
5. Sharing your data
We share data with the following categories of recipients, only as needed:
- Payment processors: Klarna and Stripe (card payments). We never see or store full card numbers.
- Carriers: PostNord, DHL, Schenker, and freight forwarders for larger items.
- Warehouse and logistics partners involved in pick, pack, and dispatch.
- Transactional email: Resend, for order confirmations and account messages.
- Chat: xAI, which runs the AI model behind the chat assistant (no contact details are sent).
- Telephony, SMS and WhatsApp: Twilio, for calls, the missed-call text message, and the WhatsApp message that tells our salesperson about a new enquiry (name, phone number, machine and the product asked about). WhatsApp messages are carried by Meta (WhatsApp).
- Email and SMS marketing: Klaviyo (with consent).
- Analytics: Google Analytics 4 (with consent) and Microsoft Clarity, which records anonymised page interactions on every visit. Without your consent, Clarity sets no cookies.
- Marketing: Meta (Facebook/Instagram) Pixel and Google Ads remarketing (with consent). Our server also sends measurement events to Meta and Google without cookies, before you make a cookie choice and also after "Only necessary"; Google Analytics receives them too, marked as without consent. See "Measuring our advertising on our server".
- Google Customer Reviews: after an order, if you have accepted marketing cookies, a box from Google may ask whether you want a short survey email from Google about your purchase. To show that box, your email address, order number, delivery country, expected delivery date and, where a product has one, its barcode number (GTIN) are passed to Google. Google only emails you if you say yes in its box, and it handles the survey under its own privacy policy. With marketing cookies accepted, our pages (not the checkout) also show Google's badge with our store rating. It is loaded from Google, which receives your IP address and the address of the page. Legal basis: your consent (Art. 6(1)(a) GDPR).
- Hosting and infrastructure: our cloud hosting provider, located within the EEA.
- Business systems and accounting: ERPNext (order and invoice data) and Fortnox (bookkeeping and invoicing).
- Professional advisors: accountants, auditors, lawyers, when bound by confidentiality.
- Authorities: tax, customs, and law enforcement when required by law.
We do not sell your personal data.
6. Retention
- Order and accounting data: 7 years from end of fiscal year (Swedish Bokföringslagen).
- Account data: until you delete the account, then anonymised.
- Marketing data: until you withdraw consent or 3 years of inactivity.
- Browsing analytics: 26 months in Google Analytics 4 by default.
- Support communications: 3 years from last contact.
- Form entries without contact details: 90 days.
- Enquiries with contact details (forms, chat, calls): as support communications, 3 years from last contact.
- Server logs: 14 days.
7. Your rights
Under GDPR you have the right to:
- Access — get a copy of the data we hold about you.
- Rectification — correct inaccurate or incomplete data.
- Erasure — request deletion, subject to our legal retention obligations.
- Restriction — limit processing in specific circumstances.
- Portability — receive your data in a machine-readable format.
- Objection — object to processing based on legitimate interest, including direct marketing.
- Withdraw consent — at any time, without affecting prior lawful processing.
- Complaint — lodge a complaint with the Swedish Authority for Privacy Protection (IMY, imy.se) or your local supervisory authority.
To exercise any of these rights, email support@attachmentwarehouse.eu. We respond within 30 days.
8. International transfers
Most of our processing happens within the European Economic Area (EEA). Where data is transferred outside the EEA (for example, when using Google or Meta services), the transfer is protected by Standard Contractual Clauses approved by the European Commission, supplementary safeguards, or an adequacy decision.
9. Security
We protect your data with TLS encryption in transit, role-based access controls, regular backups, and limited data retention. We do not store full card numbers. Where we discover a personal-data breach with risk to your rights, we notify IMY within 72 hours and inform affected users without undue delay.
10. Changes to this policy
We update this policy when our processing changes or when law requires it. The "Last updated" date at the top reflects the latest revision. Material changes are notified by Site banner and, where appropriate, by email.
11. Contact
Privacy contact: support@attachmentwarehouse.eu
General contact: ove@attachmentwarehouse.eu
Phone: +46 10 520 04 68
Saltsjö-Boo, Stockholm, Sweden