Privacy policy
PostEkspress Nordic AB is the controller for the personal data we receive when you use the parcel pickup point in Strömstad.
What we collect
When you create an account we store your name, email address, phone number, a hash of the password, a customer ID and the time the account was created. You can also save a home address.
For parcels we store the parcel ID, the description as registered, status, date and price. A tracking number you enter is used only to ask the carrier and is not stored by us.
Technical logs may contain a time and a short error message. They must not contain passwords, API keys or full email addresses. Login attempts are counted with a hash of the IP address, not the address in clear text.
Why and the legal basis
Account, customer ID and parcel details are processed to perform the parcel pickup contract. The basis is GDPR article 6(1)(b).
Information needed as an accounting record may be kept because the law requires it, article 6(1)(c).
Error logs and the login limit are used to protect the service. The basis is legitimate interest, article 6(1)(f). The logs are short and contain no passwords.
How long we keep it
Account data and parcel history are kept while the account is active. When you delete the account we delete the account and the parcels linked to it.
What must remain under bookkeeping rules, such as a payment record, may be kept for the period those rules require. The data is then limited to what the record needs.
The error log and the login counter do not contain customer data in clear text and are used only for operations and security.
Your rights
You can request access, correction, erasure, restriction and portability, and you can object to processing based on legitimate interest.
On My account you can correct your details, download a copy without the password hash, and delete the account. If you cannot sign in, email the address at the bottom of this page. We may ask you to confirm that you are the person concerned.
You can complain to the Swedish Authority for Privacy Protection (IMY), because the company is Swedish, and to Datatilsynet in Norway.
Recipients and subprocessors
The site runs on a server at Hetzner and is reached through Cloudflare. They process technical connection data in order to deliver the site.
Email is sent only when email is turned on, through Postmark or SendGrid. SMS is sent only when SMS is turned on, through 46elks or Twilio. Card payment through Stripe is prepared in test mode and is not used until it is turned on. The amount and a reference would be sent, not the whole profile, and never the card number to us.
Tracking with PostNord and Bring is used only when the API keys are set, and only with the tracking number you enter. The map on the tracking page loads tiles from OpenStreetMap. The OpenStreetMap Foundation then sees your IP address. None of these parties receive data while the feature is off.
Security and backups
Passwords are stored with password_hash. New passwords use Argon2id when the server supports it. Older bcrypt hashes still work.
Backups of account data should be taken regularly and must not sit in a folder that can be opened from the web. Access to the copies should be limited, and they should be deleted when they are no longer needed.