Privacy Policy
– Wall-it

PEG Solutions AB / Wall-it
Company reg. no.: 559218-3163
Hammarliden 10
412 65 Göteborg
Sweden
Email: pfp@wall-it.nu
Phone: +46 72 244 33 60

PEG Solutions AB is the data controller for the processing where we determine why and how personal data is processed.

Wall-it uses, among others, the following systems and services:

• Lovable – the website's frontend
• Shopify – products, cart, checkout, orders and ecommerce functions
• Shopify Messaging – newsletters and messages related to, among other things, the cart and checkout
• Judge.me – product reviews and review requests
• STOQ / Artos Software – back-in-stock alerts and preorders
• Packrooster – shipping and order handling
• PostNord and Instabox/Instabee – delivery and delivery notifications
• Airtable – internal sales statistics, order follow-up, reporting and marketing attribution
• n8n Cloud – automation and transfer of information between Wall-it's systems
• external payment providers
• analytics and advertising platforms described below.

When you make a purchase, we may process, for example:

• name,
• email address,
• phone number,
• delivery address,
• billing address,
• postal code,
• city,
• country,
• customer ID,
• order number,
• Shopify order ID,
• order date,
• order status,
• products ordered and quantity,
• order value,
• currency,
• discounts,
• shipping cost,
• tax,
• payment status,
• selected payment method,
• selected delivery method,
• refunds,
• delivery and tracking information.

Wall-it does not itself handle or store full card numbers, CVV codes or card expiry dates.
Such information is handled by Shopify and the relevant payment provider.

When you contact us, we may process:

• name,
• email address,
• phone number,
• order details,
• the content of the communication,
• other information you provide yourself.

When you use our returns or complaints function, we may process:

• name and contact details,
• order number,
• delivery details,
• the product concerned,
• the selected case type,
• information about the return or complaint,
• images or other documentation,
• return shipping,
• refund information.

When exercising the statutory right of withdrawal, you do not need to state why you are withdrawing from the purchase.

Judge.me may process, for example:

• name or display name,
• email address,
• rating,
• review title,
• review text,
• product information.

Judge.me may also be used to send product review requests after a completed purchase.

When you request a back-in-stock alert, STOQ may process, for example:

• email address,
• where applicable, phone number,
• product,
• variant.

The data is used to provide the back-in-stock alert you have requested.
STOQ is also used for Wall-it's preorder functions.

We use your contact details for messages needed to complete and administer your purchase.
These may include, for example:

• order confirmation,
• payment information,
• order status,
• information that the order has been shipped,
• tracking information,
• delivery notification,
• information about problems or changes in the delivery.

Wall-it may itself send information that the order is on its way.
PostNord and Instabox/Instabee may also send SMS or email needed to complete the delivery.

Legal basis: performance of a contract.

Wall-it may use Shopify Messaging for newsletters, campaigns and other direct marketing.
Where consent is required, such communication is only sent after the customer has given valid consent.
You can unsubscribe from marketing messages at any time using the unsubscribe function in the message or by contacting us.

Shopify's messaging functions may be used for messages related to a cart or checkout that has not been completed.
Such processing and communication take place in accordance with applicable rules and the customer's relevant choices.

Wall-it uses Airtable for internal:

• sales statistics,
• order follow-up,
• financial reporting,
• business analysis,
• sales channel analysis,
• marketing attribution,
• follow-up of returns, refunds and cancellations.

Data that may be transferred to and processed in Airtable includes, for example:

Order data

• order number,
• Shopify order ID,
• order date,
• order status,
• number of products,
• products ordered,
• cancellation date and cancellation reason,
• date the order was last updated in Shopify.

Financial data

• currency,
• gross sales,
• discounts,
• shipping charged,
• tax,
• refund amount,
• net sales,
• total sales,
• refunds,
• refunded shipping,
• refunded tax,
• other refunded amounts,
• sales adjustments.

Customer data

• customer name,
• email address,
• Shopify customer ID,
• country,
• city.

Marketing and attribution data

We may also process information about how a visit or purchase has been attributed to a marketing channel, for example:

• first touch source,
• first touch medium,
• first touch campaign,
• first touch content,
• first touch term,
• last touch source,
• last touch medium,
• last touch campaign,
• referrer,
• landing page,
• UTM ID and other relevant UTM parameters,
• GCLID,
• FBCLID,
• TTCLID.

Such information is used to understand which campaigns and sales channels contribute to visits and purchases, and for internal business analysis.

When these identifiers or other information are first collected through cookies, pixels or similar marketing technology, such collection only takes place after relevant consent where consent is required.

The subsequent internal analysis of order and sales data may, when the conditions are met, be based on Wall-it's legitimate interest in analysing sales, marketing and operations.

We strive not to process more identifying data than is necessary for the purpose and may restrict, aggregate or anonymise information when individual identification is no longer needed.

Wall-it uses n8n Cloud to automate information transfers between our systems.
n8n may, for example, be used to automatically transfer relevant information from Shopify to Airtable or between other services used by Wall-it.
n8n may therefore process the same types of personal data that exist in the workflow being automated.
This may include, for example:

• order information,
• customer information,
• sales data,
• marketing and attribution information.

n8n is used as a technical automation platform and does not itself determine Wall-it's purposes for the processing.

When relevant consent has been given, we and our analytics providers may process information such as:

• IP address,
• browser,
• device,
• session and client identifiers,
• pages visited,
• product views,
• clicks,
• scrolling,
• mouse movements,
• cart events,
• checkout started,
• purchase and conversion events,
• campaign and ad identifiers.

Google Analytics 4 is used to understand how the website is used.
This may include, for example:

• traffic measurement,
• page views,
• product views,
• cart events,
• checkout started,
• ecommerce events.

Analytics is only activated when relevant consent has been given.

Microsoft Clarity is used to analyse the user experience.
Clarity may be used, for example, for:

• heatmaps,
• session recordings,
• click analysis,
• scrolling,
• mouse movements,
• device and browser analysis.

Clarity is classified as analytics and is only activated after relevant consent.

With relevant consent, Wall-it may use:

• Google Ads,
• Meta/Facebook Pixel,
• TikTok Pixel

for purposes including:

• conversion measurement,
• campaign attribution,
• ad optimisation,
• retargeting,
• audience analysis,
• measuring the effectiveness of ads.

Wall-it processes personal data on different legal bases depending on the purpose of the processing.

Performance of a contract
For example:

• order administration,
• payment,
• delivery,
• necessary order communication,
• returns handling.

Legal obligation
For example:

• bookkeeping,
• tax requirements,
• certain consumer law obligations.

Legitimate interest
May be used, for example, for:

• certain internal sales statistics,
• business analysis,
• relevant marketing attribution after lawful collection,
• customer service,
• IT and information security,
• prevention of misuse,
• handling and defence of legal claims.

When we base processing on legitimate interest, we assess our interest against the rights and interests of the data subject.

Consent
Consent is used where required, for example for:

• certain cookies,
• analytics tools,
• marketing tracking,
• certain direct marketing.

Consent that has been given can be withdrawn.

To complete the delivery, we may transfer, for example:

• name,
• delivery address,
• postal code,
• country,
• phone number,
• email address,
• order information,
• parcel information

to Packrooster and the relevant carrier.

Where necessary, personal data may be processed by or disclosed to, among others:

• Shopify,
• Lovable and relevant hosting providers,
• Airtable,
• n8n,
• Judge.me,
• STOQ / Artos Software,
• Packrooster,
• PostNord,
• Instabox/Instabee,
• Google,
• Meta,
• TikTok,
• Microsoft,
• Klarna,
• PayPal,
• card and payment providers,
• accounting and administrative providers,
• authorities when required by law.

The role a particular provider has under data protection legislation may vary depending on the service and processing.

Some of Wall-it's providers are international companies or use subcontractors and infrastructure in several countries.
Personal data may therefore in some cases be processed or made available outside the EU/EEA.

Airtable's standard infrastructure may involve processing and storage in the USA depending on Wall-it's subscription and data region.

When an international transfer is covered by the GDPR, the transfer must be based on a permitted transfer mechanism and, where required, appropriate safeguards.
This may include, for example:

• an adequacy decision,
• the European Commission's standard contractual clauses,
• another permitted mechanism under data protection legislation.

n8n Cloud is used by Wall-it as a cloud service. n8n currently states that its Cloud platform and platform data are hosted within the EU, but certain subcontractors or specific features may involve other processing depending on which features are used.

Wall-it does not keep personal data longer than necessary for the purpose for which it is processed or as required by law.
Examples:

• bookkeeping and transaction records are kept for as long as applicable bookkeeping and tax legislation requires,
• customer service, return and complaint data are kept for as long as they are needed for the case and any legal claims,
• marketing data is processed until the customer unsubscribes, consent is withdrawn or the processing is otherwise no longer justified,
• back-in-stock alert data is kept for as long as it is needed to provide the service,
• identifiable customer, order and attribution data in Airtable is stored for a maximum of 24 months from the order date. Thereafter, data that no longer needs to be linked to an identifiable customer is deleted or anonymized. Anonymized statistics, such as sales, product, channel and campaign data, may be retained for longer periods for historical analysis and business reporting. Data that must be retained for longer by law is handled separately in accordance with applicable statutory retention periods.
• data processed through n8n is handled according to the workflows, settings and retention periods that apply to the processing in question,
• cookie and tracking data is kept according to the current cookie settings and each service's retention period.

Depending on the circumstances, you may have the right to:

• receive information about how your personal data is processed,
• request access to your data,
• request rectification of inaccurate data,
• request erasure,
• request restriction of processing,
• object to processing based on legitimate interest,
• request data portability for certain data,
• withdraw consent.

Withdrawing consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

To exercise your rights: pfp@wall-it.nu

We may need to verify your identity before a request is carried out.

If you believe that Wall-it is processing your personal data incorrectly, you can contact us.
You also have the right to lodge a complaint with the competent data protection authority.
In Sweden, the supervisory authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).

Wall-it does not currently use automated decision-making that alone makes decisions about a customer with legal or similarly significant effects.
The use of n8n to automate information transfers does not in itself constitute such automated decision-making.

We use appropriate technical and organisational security measures to protect personal data against, for example:

• unauthorised access,
• loss,
• alteration,
• unauthorised disclosure,
• other unauthorised processing.

This privacy policy may be updated when our business, our systems, our providers or applicable rules change.
The latest version is always available on the website.

PEG Solutions AB / Wall-it
Company reg. no.: 559218-3163
Hammarliden 10
412 65 Göteborg
Sweden
Email: pfp@wall-it.nu
Phone: +46 72 244 33 60