Privacy policy
Brobox AB (reg. no 559375-1026) is the data controller for trollkam.com. This page says what we store, why, and for how long.
Orders
When you buy we store your name, address, e-mail, phone and order details to deliver, handle withdrawals and complaints, and meet the Swedish Bookkeeping Act (7 years). Payment is handled by Stripe – we never see your card details. Delivery details go to our warehouse and the carrier.
Order confirmation, shipping notice and one request for a review are sent to your e-mail. Newsletters and offers only if you ticked the box, and you unsubscribe with one click in every mail.
The support chat
Conversations with our chat are stored anonymously for 90 days so we can improve the answers. We store no IP address, e-mail or customer id with the chat – please don't type personal data into it.
Cookies
Essential cookies for the cart, language and country are always active. A cookie of our own called bx_attr also stores, for up to 180 days, how you reached us, for example through an ad or a newsletter, so we can see which marketing leads to purchases. The campaign names in the link are always stored. The ad click's id is stored only if you have accepted cookies, and is removed if you say no. Cookies from Google and Meta are set only once you have chosen Accept all in the cookie banner. To change your choice, clear the site's data in your browser and the banner is shown again.
Measurement and ads
We measure visits and purchases with Google (Analytics and Ads) and ads with Meta (Facebook and Instagram). We measure both in your browser and from our server, and the cookie banner only governs the first. Meta's pixel is not loaded until you have accepted. Google's measurement script loads straight away, but with consent set to denied: no cookies are set, and Google receives only your IP address, your browser and which page you are looking at. If you accept cookies, Google and Meta also measure what you look at, add to the cart and buy.
What our server sends
If you have accepted cookies, our server reports to Meta when you have looked at a product, added something to the cart, started a checkout or entered payment details. Your IP address, your browser and Meta's cookie id go along in clear text, and your contact details in hashed form if you have already filled them in. We report every paid purchase to Meta and Google whatever you answered in the cookie banner. To Meta we send the order number, amount, currency, items, the page's address, your IP address and your browser, plus your name, e-mail, phone, city, postcode and country in hashed form, and a customer number in hashed form if you have an account with us. Meta's cookie id and the ad click's id go along only if you have accepted cookies. To Google we send the order number, amount, currency, time and items, and on a refund the order number, amount and currency. If Google's analytics cookie exists, its id goes along, otherwise a technical id we derive from the order. If you have accepted cookies, your browser also hands your e-mail and phone number to Google in hashed form at the purchase. Refunds are never sent to Meta. A hash is one-way, so the data is never sent in clear text. But it is stable, so the recipient can match it against its own records and recognise you.
Legal basis and transfers
Cookies and pixels in your browser rest on your consent. Google's measurement without cookies and the purchase reporting from our server rest on our legitimate interest in knowing which marketing leads to sales. You can object to that, see Your rights. Google and Meta may process data in the USA. The transfer is covered by the EU–US Data Privacy Framework and the European Commission's standard contractual clauses.
Your rights
You can request a copy, correction or deletion of your data, or object to the measurement, by e-mailing hello@trollkam.com. You can also complain to the Swedish Authority for Privacy Protection (IMY).