Privacy policy for logistics services

Last updated: 9 October 2026.

What does this policy cover?

This policy covers personal data about our clients' customers and delivery recipients processed as part of our logistics services. Primepack is a brand operated by Shipify AB, Swedish company registration number 559426-4391. The company handling your order provides the data to us, for example through its e-commerce platform or another connected service.

Who is responsible for the processing?

The store or company handling your order is the data controller for the processing it instructs us to carry out. It determines the purposes of the processing and is responsible for informing you about the legal basis, retention periods and your rights in its own privacy policy.

Primepack acts as a data processor for this processing. We process the data on the client's behalf under its documented instructions and the data processing agreement governing the service. The data is used to provide the agreed logistics services.

What personal data do we process?

Depending on the order and the agreed service, the data may include:

• Name and delivery address.
• Email address and telephone number for contact and delivery notifications.
• Order number, items ordered and other details needed to handle the order.
• Delivery details, shipping service, tracking number and delivery status.
• Return details and instructions needed to handle a return.

The data we receive and process depends on the client's instructions. Processing must be limited to the data needed to provide the service.

Why is the data processed?

We process the data to administer orders, pick and pack goods, book transport, create shipping documents, enable delivery notifications, follow up deliveries, and handle returns and enquiries about these services on the client's behalf.

The data controller determines the legal basis. Processing necessary to handle and deliver an order is normally based on performance of the sales contract under Article 6(1)(b) of the General Data Protection Regulation (GDPR). For other purposes, such as statutory obligations, the controller needs to assess which legal basis applies.

Systems, sub-processors and carriers

To provide our logistics services, we use:

• Ongoing WMS for warehouse and order management.
• nShift for shipping administration.
• Hetzner for hosting and storing data in the database used for the logistics services.

These providers act as sub-processors to the extent that they process personal data on our client's behalf. The use of sub-processors is governed by the data processing agreement, including requirements for authorisation and information about changes. Sub-processors must be subject to equivalent data protection obligations for their processing.

Necessary contact, order and delivery details are also provided to the carrier making the delivery. The carrier's data protection role depends on its processing and the agreements for the service; a carrier may act as an independent controller for certain processing activities. The store can provide information about the carrier used and its privacy notice.

How long is the data stored?

Retention periods and deletion are determined by the client's documented instructions and the data processing agreement. Data must not be retained for longer than necessary for the agreed service, in accordance with the client's instructions. When the processing services end, personal data must be returned or deleted at the client's choice, and existing copies deleted, unless storage is required by EU or Member State law. Backup data is also subject to the agreement's retention and deletion requirements.

Contact the company handling your order for information about the retention periods that apply to your data.

Where is the data processed?

Processing locations and any transfers outside the EU/EEA depend on the services and providers used for the assignment. These must be handled under the client's documented instructions and the data processing agreement. Transfers to a country outside the EU/EEA, including access from that country, may take place only when GDPR requirements are met.

If such a transfer takes place, an applicable transfer mechanism is required, such as an adequacy decision or the European Commission's standard contractual clauses with supplementary safeguards where needed. Contact the controller for details of the countries involved and how to obtain information about the applicable safeguards.

How is the data protected?

Processing is subject to the GDPR's requirements for appropriate technical and organisational security measures. Measures must be adapted to the risks and protect the data against unauthorised access, loss and unlawful processing. Access must be limited to authorised people who need the data for their work and are bound by confidentiality. Security requirements and the handling of personal data breaches are governed by the data processing agreement.

Your rights and who to contact

Under the GDPR, where the relevant conditions are met, you may request access to your personal data, rectification, erasure, restriction of processing and data portability, and object to certain processing. Please contact the store or company handling your order first. As a processor, Primepack assists the client with these requests under its instructions. If we receive a request, we help direct it to the relevant client.

You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) or another competent data protection authority.

Contact and agreements

Questions about Primepack's processing in the logistics services can be sent to info@primepack.se or to Shipify AB, Orrekulla Industrigata 55B, 425 36 Hisings Kärra, Sweden.

This policy provides information about the processing. Primepack's assignment and permitted processing are governed by the agreement with the client, the data processing agreement forming part of the relationship and the client's documented instructions. Clients may contact us for information about agreements, sub-processors and processing locations.