Privacy policy
What data we collect on tullify.no, why, who we share it with and what rights you have.
Who is responsible for your data
The data controller is Tullify AB, company registration number 559196-3029, Stureplatsen 3, 411 39 Göteborg, Sverige. The website is operated through the Norwegian branch Tullify AB NUF, organisation number 934283724, postal address Jernbanegata 11, 1706 Sarpsborg. If you have a question about your data, or want to exercise any of the rights listed below, email info@tullify.se.
We do not have a data protection officer. The company is not of a type or size that requires one, so questions go directly to the address above.
What we collect and why
We collect as little as possible, and only for the purposes listed here. The table shows each purpose, the data involved, the legal basis and how long the data is kept.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Handling your enquiry | Name, email, phone if you provide it, company name if you are a business, whether you are declaring as an individual or a business, what the enquiry concerns (import, export, digitoll, post-clearance declaration or something else, and if so the topic), your description if you write one, the number of attachments, language and the page the form was filled in on. | Contract, or steps taken before entering one, while we handle your enquiry. If no engagement follows, or once the customer relationship has ended, we keep the data on the basis of our legitimate interest in being able to see earlier cases and defend ourselves against legal claims. | Until you ask us to delete it. If you become a customer, we keep it during the customer relationship and afterwards, and accounting records for as long as bookkeeping rules require. |
| Digital application for Digitoll | In addition to the contact details: the carrier and the carrier's organisation number, the registration numbers of the vehicle and trailer, the driver's name and phone, consignor, consignee, goods description, waybill number, weight, packages, declaration ID and a comment. The details about the carrier, vehicle and driver reach us only by email. The database stores the contact details, goods description, weight and packages. | Contract with you as the client, and legal obligation when we submit a notification to Norwegian Customs. We process the driver's details because Norwegian Customs requires them in the transport notification. | Until you ask us to delete it. If you become a customer, we keep it during the customer relationship and afterwards, and accounting records for as long as bookkeeping rules require. |
| Incomplete submissions | Name and email, saved after the first step of the form even if you do not submit it, and what the enquiry concerns if the page you were on already says so. | Legitimate interest in being able to follow up an enquiry that was started. We send one automatic email, see below. | Until you ask us to delete them. |
| Knowing which adverts and channels lead to enquiries | The Google Ads click ID and the campaign tags in the address you arrived on, the page you landed on, the website that linked here and the time. See the separate heading below. | Legitimate interest in knowing which marketing actually brings customers, and in no longer paying for marketing that does not. | Together with the enquiry. |
| Limiting abuse of the form | A keyed hash of your IP address. We do not store any readable IP address. | Legitimate interest in protecting the service | No more than 24 hours. |
| Counting page views | Vercel Web Analytics records which pages are viewed, without cookies and without storing your IP address. It cannot be linked to you. | Legitimate interest in knowing that the website works | Only as aggregate figures. |
| Measuring how the website is used | Cookies and events about the pages you visit, the steps you fill in and what you click, and recordings of how the page is used. See the heading on cookies. | Consent | See the generated list below. Each cookie has its own lifetime there. |
Incomplete submissions, and the email you get
This deserves its own heading, because it is not obvious. As soon as you have entered your name and email in the first step of the form, they are saved. That applies even if you close the tab and never submit.
Roughly 20 minutes after you stop filling in the form, we send ONE automatic email asking whether you want us to take the matter further. One email, no reminder sequence, no tracking of whether you open it. If you do not reply, you hear nothing more from us.
If you would rather not, email info@tullify.se and tell us which address it concerns. We will delete the details, and you do not need to give a reason. You can also object to the processing, since it rests on a legitimate interest and not on your consent.
Where you came from
When you arrive on the website, we read where you came from: the click ID Google Ads adds to the address when you click an advert, any campaign tags (utm), the page you landed on and the name of the website that linked here. It is kept only in the browser's memory while you are on the site. We do not store it in cookies or on your device, and it disappears when you close the tab.
If you submit the form, or complete its first step, this is saved together with the enquiry. We can then look up in Google Ads which campaign and keyword the click came from. You can object to this in the same way as to the rest of the processing.
Your attachments
The files you upload are forwarded to us as email attachments. They are not stored in our database. We accept PDF, JPG, PNG, Word and Excel, up to 3 MB in total.
Your enquiry and attachments therefore reach us as email, and our reply remains there. The email is not deleted automatically. If you want us to remove it, email info@tullify.se.
Do not send information about health, trade union membership or similar sensitive categories through the form. We do not need it for a customs matter.
Who we share your data with
We do not sell any data. Most of the suppliers below process data on our behalf, on our instructions and under contract. Google for advertising measurement and Microsoft for Clarity also decide for themselves how the data is used, and for the collection on our website we are then joint controllers with them. Both load only after your consent.
| Supplier | What they do | Role | Where the data is processed |
|---|---|---|---|
| Vercel | Hosts the website and its functions, and counts page views | Processor | United States |
| Supabase | The database where enquiries are stored | Processor | Sweden. US company, data may be processed in the United States |
| Microsoft 365 | Sends and receives the email, including your attachments | Processor | EU |
| Google Analytics og Tag Manager | Measure how the website is used. Only after consent | Processor | EU and the United States |
| Google Ads | Measures whether an advert led to an enquiry. Only after consent | Joint controller for the collection | EU and the United States |
| Microsoft Clarity | Recordings and heatmaps of how the pages are used. Only after consent to statistics | Joint controller for the collection | United States |
| Cookiebot | The consent banner and the list of cookies | Processor | EU (Ireland), with a subcontractor in the United States |
| CARTO | The map images on the front page. Your browser fetches them directly, and CARTO then sees your IP address | Separate controller | EU and the United States |
| Tolletaten, Tullverket | Declarations and notifications in your case | Separate controller | Norway, Sweden |
Beyond that, we disclose data to public authorities where the law requires it, and to our advisers if we ever need to pursue a legal claim.
Transfers outside the EU and EEA
The database is in Sweden and the email in the EU. Several suppliers are nevertheless US companies or use subcontractors in the United States, in which case data may be processed there. This applies to Vercel, where the website's functions currently run in the United States, and to Supabase, Microsoft, Google, CARTO and Cookiebot's subcontractor.
For companies certified under the EU-US Data Privacy Framework, the European Commission has decided that the level of protection is adequate (Article 45 of the GDPR). Vercel, Microsoft and Google are certified. Otherwise the transfers take place under the European Commission's standard contractual clauses (Article 46). If you want a copy of the safeguards, email info@tullify.se.
Cookies and consent
The first time you visit the website you choose which cookies you accept. Necessary cookies are always used. They store your choice and make the page work. Everything else is switched off until you say yes.
Statistics means that we measure how the pages are used with Google Analytics, and record how visitors move around the page with Microsoft Clarity. The recording shows clicks, scrolling and movement, and Clarity masks what you type into the form fields. Marketing means that we can see which advert or search in Google Ads brought you here, and that Microsoft may set its advertising cookies.
If you say no, no such cookies are set. Google's tags then only send anonymous signals without cookies, for example that a page was viewed. They cannot be linked to you or to an earlier visit. The website works exactly as usual, and your enquiry is handled in the same way.
You can change your mind at any time. The button below the list reopens the same dialogue, where you can both change and withdraw your consent.
Cookies on this website
The list below is generated automatically and shows every cookie the website sets, who is behind it, what it does and how long it remains.
Your rights
You have the following rights when we process your data. Email info@tullify.se to exercise any of them. We reply within one month and do not charge.
- Find out what data we hold about you, and get a copy of it.
- Have incorrect data corrected.
- Have data deleted, unless we are required to keep it.
- Restrict processing while a question is being examined.
- Object to processing based on a legitimate interest.
- Receive data you have provided in a machine readable format, and move it.
- Withdraw consent. This does not affect processing that has already taken place.
If you are not satisfied with how we handle your data, you can complain to Datatilsynet, the Norwegian Data Protection Authority. Since our main establishment is in Sweden, you can also complain to the Swedish Authority for Privacy Protection (IMY). You do not need to contact us first, though it is often quicker.
Security
Traffic to and from the website is encrypted. The database is closed to the outside and reached only by the service itself. Only those of us who need the data to handle your enquiry have access to it, and they are bound by confidentiality.
Changes to this policy
If we change how we process data, we update this page. The date below shows when the text was last changed in substance.
Last updated 29 September 2026.