Last updated: June 2026

This Privacy Policy applies when you use or place an order on www.sandqvist.com. The data controller is Sandqvist Bags and Items AB, Mosebacke torg 18, 116 20 Stockholm, Sweden (VAT: SE556783080601). For privacy enquiries, contact us at service@sandqvist.com.

We collect and process the following personal data when you interact with our website or place an order:

• Name, email address, telephone number
• Delivery and billing address
• IP address and device identifiers
• Order information and purchase history
• Payment information (processed via our payment partners)
• Browsing behaviour and activity on our website
• First-party data collected through interactions on our website, such as pages visited, items viewed, and conversion events (e.g. purchases, add-to-cart actions)

This data is collected directly from you (e.g. when placing an order or signing up to our newsletter) and automatically through cookies and similar tracking technologies when you browse our site.

We process your personal data for the following purposes:

Order Management
To process, fulfil and deliver your orders, manage returns and handle quality claims. Legal ground: Performance of a contract.

Customer Service
To handle your enquiries via chat, email or phone and to investigate complaints. Legal ground: Legitimate interest.

Newsletter & Marketing Communication
When you subscribe to our newsletter, you consent to receiving updates about new products, events and exclusive offers. You may unsubscribe at any time via the link at the bottom of our emails. Legal ground: Consent.

Website Optimisation & Digital Marketing
We collect first-party data about your activity on our website (pages visited, products viewed, purchases made) to personalise your experience, analyse traffic and improve the effectiveness of our advertising. This includes the use of Enhanced Conversions technology. Legal ground: Consent.

We use Google Enhanced Conversions to improve the accuracy of our conversion measurement. When you complete an action on our website — such as making a purchase — and have given your consent, we collect first-party data (such as your email address, name or phone number) and share it with Google for advertising and analytics purposes.

How your data is protected before sharing: Before any personal data is transmitted to Google, it is hashed using the SHA-256 algorithm. Hashing is a one-way cryptographic process that converts your personal data into an anonymised string that cannot be reversed to reveal your original information.

The hashed data is matched against Google's records solely to attribute conversions to ad interactions. Google does not use this data to identify you or build individual profiles beyond what you have consented to as a Google account user.

For more information on how Google handles data received through Enhanced Conversions, please visit: https://business.safety.google/privacy/.

We share your data with the following categories of third parties, only to the extent necessary and always in accordance with applicable data protection law:

• Google LLC — Analytics (Google Analytics), advertising (Google Ads, Enhanced Conversions, Google Signals). Data may include hashed first-party identifiers. See Google's Privacy Policy.
• Meta Platforms Inc. — Advertising and retargeting via Meta Pixel. See Meta's Privacy Policy.
• Klarna Bank AB — Payment processing. See Klarna's Privacy Policy.
• PayPal (Europe) S.à r.l. — Payment processing. See PayPal's Privacy Policy.
• Swish  — Payment processing.  See Swish Privacy policy
• Mollie   — Payment processing.  See Mollie Privacy Policy

Your personal data is primarily stored within the European Economic Area (EEA). Where data is transferred outside the EEA, we ensure appropriate safeguards are in place (e.g. Standard Contractual Clauses) in accordance with GDPR Chapter V.

We use cookies and similar technologies on our website. Cookies are small text files placed on your device. You can control and manage cookies through our cookie consent banner and through your browser settings.

We use the following categories of cookies:

• Strictly Necessary — Essential for the website to function (e.g. shopping cart, checkout). These are placed without your consent.
• Analytics & Performance — Used to understand how visitors interact with our website (e.g. Google Analytics, Algolia). Placed only with your consent.
• Marketing & Advertising — Used to deliver personalised advertisements and to measure the effectiveness of our campaigns (e.g. Google Ads, Meta Pixel, Enhanced Conversions). Placed only with your consent.
• Functional — Enable enhanced functionality such as personalised recommendations. Placed only with your consent.

If you have given your consent, analytics and advertising cookies are stored for a maximum of 24 months. You can withdraw your consent at any time by clicking the cookie settings link in the footer of our website or by adjusting your browser settings. Please note that withdrawing consent may affect your experience on our site.

For details on Google Signals — a feature that combines site visit data with data from Google accounts — please refer to Section 6 below.

We use Google Signals, a feature of Google Analytics that associates your visit data with data from your Google account (if you are signed in and have ad personalisation enabled). This allows us to generate aggregated, anonymised cross-device insights. Information that may be included in Google Signals includes location, search history, YouTube history and data from websites that partner with Google.

Under GDPR (and UK GDPR), you have the following rights regarding your personal data:

• Right of access — request a copy of the data we hold about you
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure — request deletion of your data (subject to legal obligations)
• Right to restrict processing — request that we limit how we use your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interest
• Right to withdraw consent — withdraw consent at any time without affecting the lawfulness of prior processing

To exercise any of these rights, please contact us at service@sandqvist.com. We will respond within 30 days. Note that certain legal obligations (e.g. the Swedish Bookkeeping Act, tax regulations) may prevent us from deleting specific data.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including for legal, accounting or reporting requirements. Order-related data is typically retained for 7 years in accordance with Swedish bookkeeping legislation. Marketing data is retained until you withdraw consent.

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or disclosure. Personal data shared with third-party advertising and analytics platforms (such as Google) is hashed using SHA-256 before transmission, ensuring that raw personal data is never sent in plain text.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes by posting a notice on our website. The date at the top of this page indicates when the policy was last revised.