Last updated: 11 November 2026
This policy explains how Toplift processes your personal data when you visit toplift.se, shop with us or contact us. We only process the data we need, and we never sell your personal data.
Data controller
Toplift AB (company reg. no. 556993-7245)
Änghagen 421, SE-472 91 Stillingsön, Sweden
Email: info@toplift.se
You can also reach us via our contact form.
What data we process and why
When you place an order
We process your name, delivery and billing address, email address, phone number, ordered products, order number, chosen payment and shipping method and, for business customers, company name and registration number. If you order a product with a logo or print, we also process the files and details you send us. We use this data to receive and deliver your order, send order confirmations and tracking numbers, and handle withdrawals, complaints and warranty claims.
Legal basis: contract (Article 6(1)(b) of the General Data Protection Regulation, GDPR).
Accounting
Order details and invoices are kept as accounting records under the Swedish Bookkeeping Act. We do our own bookkeeping, and our accounting software records amounts and vouchers but not your contact details.
Legal basis: legal obligation (Article 6(1)(c)).
Payment
Payments are handled by the payment provider you choose. We never see your card details. We are informed that the payment has been completed and which payment method you used.
Legal basis: contract (Article 6(1)(b)).
Customer service
When you contact us via the contact form, email or chat, we process your name, email address and what you write to us, in order to answer and follow up your enquiry.
Legal basis: contract when the enquiry concerns an order, otherwise our legitimate interest in answering questions (Article 6(1)(b) and (f)).
Customer reviews
If you submit a review, it may be published on toplift.se together with the name you provide.
Legal basis: consent (Article 6(1)(a)). You can ask us to remove your review at any time.
Newsletter
We occasionally send newsletters with news and offers. We then process your email address, your name and whether you open the emails or click links in them. As a customer, you may receive newsletters about products similar to those you have bought, as permitted by Swedish marketing law. If you have not bought from us, we only send newsletters if you have signed up. You can unsubscribe at any time via the link in every email or by contacting us.
Legal basis: our legitimate interest in marketing to existing customers (Article 6(1)(f)), otherwise consent (Article 6(1)(a)).
Statistics, ad measurement and embedded videos
With your consent in the cookie banner, we use Google Analytics and Google Ads to understand how the website is used and to measure the effect of our ads, and we show embedded videos from YouTube. Without your consent, these services are not loaded. You can change your choice at any time. See our cookie policy for more information.
Legal basis: consent (Article 6(1)(a)).
Security and operation
To protect the website and prevent fraud and intrusion, we process technical data such as IP address, browser information and logs.
Legal basis: our legitimate interest in a secure and working online store (Article 6(1)(f)).
Who we share data with
The following providers process personal data on our behalf (data processors) and may only use it according to our instructions:
- Binero – website hosting (Sweden)
- Websupport – emails sent from the online store, such as order confirmations (EU)
- Our newsletter service, currently Paloma (Sweden)
- Zendesk – customer service chat (USA)
- Google – Google Analytics and Google Ads, only with your consent (USA)
The following recipients process the data as independent controllers, under their own privacy policies:
- Payment providers, depending on the payment method you choose: Nexi (Nets Easy, card payment and Klarna), Klarna, PayPal (including the local payment methods offered through PayPal), Swish and banks.
- Carriers: within Sweden mainly DSV (formerly DB Schenker), abroad usually UPS, DHL or FedEx. They receive your name, address, phone number and email address for delivery and notifications.
- Public authorities, such as the Swedish Tax Agency and Swedish Customs, when required by law. For deliveries outside the EU, data is provided to customs in the destination country.
Transfers outside the EU/EEA
Google, Zendesk, PayPal, UPS, DHL and FedEx may process data in countries outside the EU/EEA, such as the USA. Such transfers are based on European Commission adequacy decisions (including the EU–US Data Privacy Framework for certified companies) or the European Commission’s standard contractual clauses. When we deliver to a recipient outside the EU/EEA, the transfer is necessary for us to fulfil the purchase.
How long we keep the data
- Order and accounting records: seven years after the end of the calendar year in which the financial year ended, as required by the Swedish Bookkeeping Act. After that, the personal data in the order is deleted or anonymised.
- Customer service enquiries: up to 24 months after the enquiry was closed, or longer if it concerns a complaint or warranty that can still be claimed.
- Newsletter: until you unsubscribe.
- Customer reviews: until you ask us to remove the review.
- Statistics in Google Analytics: 14 months. After that, data linked to individual visitors is deleted.
- Cookies: see our cookie policy.
Your rights
You have the right to:
- know what data we hold about you and receive a copy of it
- have incorrect data corrected
- have data erased when it is no longer needed or we have no legal basis for keeping it
- request that processing be restricted
- object to processing based on legitimate interest. You can always object to direct marketing.
- receive data you have provided to us in a machine-readable format (data portability)
- withdraw your consent at any time, without affecting processing carried out before the withdrawal
Contact us at info@toplift.se or via our contact form. We will reply within one month.
Complaints
If you believe we are processing your personal data incorrectly, we would appreciate it if you contacted us first. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), Box 8114, SE-104 20 Stockholm, Sweden, www.imy.se, or with the data protection authority in your country of residence.
How we protect your data
The website uses an encrypted connection (HTTPS). Administration is protected by several login steps, including two-factor authentication, and only those who need the data in their work have access to it.
Changes
We may update this policy, for example if we change providers. The latest version is always available on this page, and the date at the top shows when it was last changed.