Privacy Policy

1. Introduction

Carl-Gustaf Consulting AB, doing business as Thinkertags ("Thinkertags", "we", "us", "our"), is committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website at https://thinkertags.com and our services.

Please read this Privacy Policy carefully. By using our Services, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this Privacy Policy, please do not access our Services.

Data Controller:
Carl-Gustaf Consulting AB
Kivra: 559309-2868, 106 31 Stockholm, Sweden
Organization Number: 559309-2868
Email: support@thinkertags.com

2. Information We Collect

We collect information that you provide directly to us, information we collect automatically, and information from third-party sources.

2.1 Information You Provide to Us

• Account Information: Name, email address, password, and customer ID when you create an account
• Order Information: Full name, billing address, shipping address, email address, phone number, payment card information (processed by Stripe), company name, VAT number (if applicable)
• Asset Information: Asset names, descriptions, images, documents, custom notes, and any other information you choose to associate with your tags
• Communication Data: Information in emails, support requests, or other communications with us
• User Content: Photos, documents, and other files you upload to our Services

2.2 Information We Collect Automatically

• Location Data: When a tag is scanned, we collect the approximate location (country, city, and coordinates) of the scan
• Usage Data: Information about how you use our Services, including access times, pages viewed, and actions taken
• Device Information: IP address, browser type, operating system, and device identifiers
• Cookie Data: As described in our Cookie Policy, including session cookies and authentication tokens

2.3 Information from Third Parties

• Payment Information: Transaction details from Stripe (we do not store full payment card numbers)
• Authentication Data: Limited profile information from AWS Cognito for user authentication
• Map Data: Location services from Google Maps API for tag tracking visualization

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 To Provide and Maintain Our Services

• Process your orders and deliver tags
• Create and manage your account
• Enable tag functionality and asset tracking
• Provide customer support
• Send transactional emails (order confirmations, receipts)

3.2 To Improve Our Services

• Analyze usage patterns to improve functionality
• Develop new features and services
• Troubleshoot technical issues
• Conduct research and analysis

3.3 For Legal and Security Purposes

• Comply with legal obligations
• Detect and prevent fraud or unauthorized tag duplication
• Enforce our Terms of Service
• Protect our rights and property

3.4 For Marketing (With Your Consent)

• Send promotional emails about new products or features (only if you have explicitly opted in)
• Provide updates about Thinkertags
• We will only send marketing communications if you have explicitly opted in

4. Legal Basis for Processing (GDPR)

We process your personal data under the following legal bases:

• Contract Performance: To fulfill our contract with you (processing orders, providing services, managing your account)
• Legitimate Interests: For business operations, fraud prevention, security, and improving our services
• Legal Obligations: To comply with laws, regulations, and legal processes
• Consent: For marketing communications and optional features (you can withdraw consent at any time)
• Vital Interests: In rare cases where processing is necessary to protect someone's life

5. How We Share Your Information

We do not sell, trade, or rent your personal information. We share information only in the following circumstances:

5.1 Service Providers

We share data with third-party service providers who assist us in operating our Services:

• Amazon Web Services (AWS): Cloud hosting, authentication, and data storage
• Stripe: Payment processing (PCI compliant)
• Email Service Providers: For sending transactional and marketing emails
• Google Maps: For location services and map visualization

5.2 Legal Requirements

We may disclose information if required by law or in response to:

• Court orders or legal processes
• Government or regulatory requests
• To protect our rights, privacy, safety, or property
• To enforce our Terms of Service

5.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

5.4 Public Information

Information you choose to make public through storefront features or public asset pages may be visible to anyone with the link.

6. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

• Encryption in transit (HTTPS/TLS)
• Encryption at rest for sensitive data
• Secure authentication through AWS Cognito
• Regular security assessments
• Access controls and authentication for our systems
• PCI compliant payment processing through Stripe

While we strive to protect your information, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

In the event of a data breach that poses risk to your rights and freedoms, we will notify affected users within 72 hours as required by GDPR.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy:

• Account Data: Retained while your account is active and for 5 years after account deletion for legal and business purposes
• Order Data: Retained for 7 years for tax and accounting purposes
• Tag Scan Data: Retained for the lifetime of the tag to provide service functionality
• Communication Data: Retained for 3 years or as required by law
• Marketing Data: Retained until you unsubscribe or withdraw consent

8. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights:

8.1 Your Rights Include:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your data (subject to legal obligations)
• Right to Restrict Processing: Request limited processing of your data
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time
• Right to Lodge a Complaint: File a complaint with supervisory authorities

8.2 How to Exercise Your Rights

To exercise any of these rights, please contact us at support@thinkertags.com. We will respond to your request within 30 days. We may need to verify your identity before processing your request.

9. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. Our primary data processing occurs in the European Union (Sweden and Germany through AWS).

When we transfer data outside the EEA, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions for countries with equivalent data protection laws
• Other legally approved transfer mechanisms

11. Children's Privacy

Our Services are not intended for children under the age of 16. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe we have collected information about your child, please contact us immediately at support@thinkertags.com.

12. Third-Party Links

Our Services may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Updating the "Last Updated" date
• Sending an email notification (for material changes)
• Posting a notice on our website

We encourage you to review this Privacy Policy periodically. Your continued use of our Services after changes constitutes acceptance of the updated policy.

14. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Swedish Data Protection Authority:
If you are not satisfied with our response, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY):
Website: https://www.imy.se/en/