Privacy Policy
Privacy Policy
This Privacy Policy explains how Winn Scandinavia AB collects, uses, stores, shares and protects personal data when you visit our websites, create a customer account, place an order, contact our customer service or use our products and services.
Winn Scandinavia AB operates websites and online stores under the BRL brand, including BRL Electronics.
We respect your privacy and are committed to protecting your personal data in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR).
This Privacy Policy also explains your rights regarding your personal data and how you can contact us if you have questions about how your information is handled.
1. Data Controller
The data controller responsible for the processing of personal data described in this Privacy Policy is:
Winn Scandinavia AB
Company registration number: 556792-9632
Idrottsvägen 37B
702 32 Örebro, Sweden
Privacy contact: dataskydd@brl.se
Winn Scandinavia AB is responsible for ensuring that personal data is processed lawfully, fairly, transparently and securely.
2. Scope of This Privacy Policy
This Privacy Policy applies to the processing of personal data by Winn Scandinavia AB in connection with our websites, online stores, customer accounts, orders, customer service, marketing activities and related services.
Our websites operate in several countries and regions. Certain aspects of personal data processing may differ depending on the country, applicable legislation, payment methods, service providers or local business practices.
Where applicable, additional information is provided in the privacy policies and other relevant notices available on our country-specific websites.
We recommend consulting the Privacy Policy applicable to your country or region for information about local requirements and processing practices.
Where a country-specific Privacy Policy contains more specific provisions concerning the processing of your personal data, those provisions take precedence over the corresponding general information in this Privacy Policy. Applicable data protection laws always take precedence.
3. What Personal Data Do We Collect?
The personal data we collect depends on how you interact with our websites and services.
We may process the following categories of personal data:
3.1 Personal and Contact Information
First and last name
Email address
Telephone number
Billing and delivery addresses
Company name and company identification details, where applicable
Customer number and other customer identifiers
3.2 Customer Account Information
Username and account identifiers
Passwords stored in a protected form
Saved addresses and account preferences
Order history and purchased products or services
Login activity and account-related information
3.3 Orders, Payments and Transactions
Products and services purchased
Order numbers and transaction information
Payment method and payment status
Delivery and shipping information
Invoices and accounting records
Returns, refunds and cancellations
Payment information may also be processed by independent payment providers in accordance with their own privacy policies.
3.4 Customer Service, Returns and Warranty Information
When you contact customer service or submit a return, complaint, warranty claim or service request, we may process:
Contact information
Order and product details
Messages and correspondence
Descriptions of technical problems or product defects
Photographs, videos or other supporting documentation
Information required to investigate and resolve your request
3.5 Technical and Website Usage Information
When you use our websites, certain technical information may be collected automatically, including:
IP address
Browser type and operating system
Device information and identifiers
Date and time of website visits
Pages visited and website interactions
Shopping cart activity
Login attempts and security-related events
Cookies and similar identifiers
Referral information and traffic sources
The collection and use of information through cookies and similar technologies depend on the type of technology, its purpose, your preferences and applicable legal requirements.
3.6 Marketing Information
Where applicable, we may process:
Newsletter subscriptions
Marketing preferences
Records of consent
Communication history
Information about interactions with marketing communications
3.7 Licensing and Cloud Services
If you purchase or use products, software licences or cloud services supplied by our manufacturers or partners, we may process personal data necessary for:
Licence activation and administration
Customer account management
Technical support
Billing and subscription administration
Communication with manufacturers or service providers
The manufacturer or service provider may also process personal data independently, subject to its own privacy policy.
4. How Do We Collect Personal Data?
We collect personal data through several sources.
4.1 Information You Provide Directly
We collect information when you:
Create a customer account
Place an order
Contact customer service
Submit a return, complaint or warranty request
Subscribe to a newsletter
Register for a service or software licence
Complete forms on our websites
Communicate with us through other available channels
4.2 Information Collected Automatically
Certain technical and usage information is collected automatically when you interact with our websites or services.
This may include website activity, technical logs, security information and data collected through cookies or similar technologies.
4.3 Information From Third Parties
We may receive personal data from third parties involved in providing our products or services.
These may include:
Payment and checkout providers
Shipping and logistics companies
Manufacturers and suppliers
Technical support and service partners
Cloud service and software providers
Marketing and analytics service providers
Other partners involved in processing orders, payments, returns or customer requests
We only process such information where there is an appropriate legal basis.
5. Why Do We Process Personal Data?
We process personal data for specific purposes and on appropriate legal grounds.
The applicable legal basis depends on the circumstances and the nature of the processing.
5.1 Orders and Contractual Obligations
We process personal data to:
Receive and manage orders
Process payments
Arrange deliveries
Issue invoices and order confirmations
Manage customer accounts
Provide purchased products or services
Administer licences and subscriptions
Communicate about orders and contractual matters
Legal basis: Performance of a contract or steps taken before entering into a contract. Where the contract is with a company or other organisation, processing of its representatives' personal data may instead be based on our legitimate interest in managing the business relationship.
5.2 Returns, Complaints, Repairs and Warranties
We process personal data to:
Manage returns and refunds
Investigate product complaints
Process warranty claims
Arrange repairs and technical service
Communicate with manufacturers, suppliers and service partners
Document and resolve customer cases
Legal basis: Performance of a contract, compliance with legal obligations or our legitimate interest in managing customer claims and protecting our legal rights, depending on the circumstances.
5.3 Legal and Accounting Obligations
We process personal data when necessary to:
Maintain accounting records
Issue and retain invoices
Fulfil tax obligations
Comply with consumer protection requirements
Respond to lawful requests from authorities
Meet other applicable legal obligations
Legal basis: Compliance with a legal obligation.
5.4 Customer Service and Communication
We process personal data to respond to questions, provide assistance, investigate problems and document customer communication.
Legal basis: Performance of a contract, steps taken before entering into a contract or our legitimate interest in providing customer support and managing customer relationships.
5.5 Website Security and Fraud Prevention
We process technical information and other relevant personal data to:
Protect customer accounts
Prevent unauthorised access
Detect fraudulent or suspicious activity
Maintain website and system security
Investigate technical errors
Prevent misuse of our services
Legal basis: Our legitimate interest in protecting our websites, customers, systems and business operations. Certain processing may also be required to comply with legal obligations.
5.6 Marketing and Customer Communication
We may process personal data to send newsletters, product information, promotions, offers and other marketing communications.
Marketing communications are sent where you have provided the required consent or where another legal basis permits such communication under applicable law.
You may unsubscribe from marketing communications at any time by using the unsubscribe function provided in our emails or by contacting us.
Legal basis: Consent or, where permitted by applicable law, our legitimate interest in marketing relevant products and services.
Country-specific rules concerning marketing communications and consent may apply.
5.7 Analytics and Service Improvements
We may process personal data to:
Understand how our websites are used
Improve website functionality
Develop our products and services
Analyse general customer behaviour
Evaluate marketing performance
Produce statistics
Improve customer experience
Legal basis: Our legitimate interest in improving our services or consent where required, particularly for certain analytics and tracking technologies.
5.8 Legal Claims and Protection of Rights
We may process personal data when necessary to establish, exercise or defend legal claims, resolve disputes or protect our rights and interests.
Legal basis: Our legitimate interest in protecting our legal rights or compliance with applicable legal obligations.
6. Cookies and Similar Technologies
Our websites use cookies and similar technologies to provide functionality, maintain security, remember preferences, analyse website performance and, where permitted, support marketing activities.
These technologies may include:
Essential cookies required for website functionality
Functional cookies used to remember preferences
Analytics cookies used to understand website usage
Marketing cookies used to measure advertising and support relevant marketing
Non-essential cookies and similar technologies are used only when permitted under applicable law, including obtaining consent where required.
You can manage your preferences through the cookie settings available on the relevant website.
Additional information about cookies, tracking technologies, their purposes, providers and retention periods is available in the Cookie Policy applicable to the website you are visiting.
7. Who Do We Share Personal Data With?
We may share personal data with third parties when necessary to provide our services, operate our business, fulfil contractual obligations or comply with legal requirements.
Recipients may include:
7.1 Payment and Checkout Providers
We may share contact, order, transaction and payment-related information with providers responsible for processing payments and managing checkout services.
Depending on the website and country, these services may be provided by different payment or checkout partners.
Some providers act as independent data controllers and process personal data under their own privacy policies.
7.2 Shipping and Logistics Partners
We may share necessary contact and delivery information with shipping companies, carriers, warehouses and logistics providers to fulfil orders and manage deliveries or returns.
7.3 Manufacturers, Suppliers and Service Partners
We may share relevant personal data with manufacturers, suppliers, distributors or authorised service providers when necessary to:
Process orders
Manage software licences
Activate products or services
Provide technical support
Handle warranty claims
Process repairs and complaints
7.4 IT and Technical Service Providers
We may use third-party providers for hosting, website infrastructure, system maintenance, data storage, customer service systems and other technical functions.
7.5 Marketing and Analytics Providers
Where permitted by applicable law and your preferences, we may share or make certain information available to service providers responsible for website analytics, marketing communication and advertising measurement.
7.6 Professional Advisers and Public Authorities
Personal data may be shared with accountants, auditors, legal advisers, insurers, public authorities or courts when necessary and legally justified.
7.7 Data Processors and Independent Controllers
Some third parties process personal data on our behalf and according to our documented instructions.
Other parties, such as certain payment providers, may act as independent data controllers for their own processing activities.
Where third parties act as independent controllers, their handling of personal data is governed by their applicable privacy policies.
We do not disclose personal data to third parties without an appropriate purpose and legal basis.
8. International Transfers of Personal Data
We primarily operate within the European market, but certain service providers, manufacturers or technical partners may process personal data outside the European Union (EU) or European Economic Area (EEA).
Such transfers may occur when using international IT infrastructure, cloud services, support systems, manufacturers or marketing technologies.
Where personal data is transferred outside the EU/EEA, we apply the safeguards required by applicable data protection law.
Depending on the destination and circumstances, these may include:
An adequacy decision issued by the European Commission
Standard Contractual Clauses approved by the European Commission
Other legally recognised transfer mechanisms and appropriate safeguards
We assess international data transfers and apply appropriate protective measures where required.
If you would like further information about international transfers or the safeguards used, you may contact us at dataskydd@brl.se.
9. How Long Do We Retain Personal Data?
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected or to comply with applicable legal obligations.
Retention periods depend on the category of information, the purpose of processing and the legal requirements applicable in the relevant country.
The following general principles apply:
Category |
General retention principles |
|---|---|
Customer account information |
Retained while the account is active and afterwards where necessary to fulfil legal obligations or manage legal claims. |
Orders and transactions |
Retained for the periods required by applicable accounting, tax and other legal obligations. |
Customer service correspondence |
Retained as necessary to manage requests, document cases and address legal claims or obligations. |
Returns, repairs and warranty claims |
Retained while the case is being processed and afterwards where necessary for warranty obligations, documentation or legal claims. |
Marketing information |
Retained while there is an applicable legal basis for the processing, subject to withdrawal of consent, objections and any necessary compliance records. |
Technical and security information |
Retained for periods appropriate to system security, error analysis and fraud prevention. |
Cookies and analytics information |
Retained according to the purposes and settings of the relevant technologies, as described in the applicable Cookie Policy. |
Where specific retention periods are required under national legislation, those periods apply.
When personal data is no longer necessary and no legal basis requires further retention, we delete or anonymise it using appropriate procedures.
10. How Do We Protect Personal Data?
We implement appropriate technical and organisational measures to protect personal data from unauthorised access, loss, misuse, alteration, disclosure or destruction.
Depending on the system and type of information, these measures may include:
Access controls and permission management
Secure storage and transmission
Encryption and other protective technologies
Protection of passwords and authentication information
System monitoring and security logging
Internal security procedures
Processes for identifying and managing security incidents
Access to personal data is restricted according to operational needs and applicable security requirements.
Although we take appropriate measures to protect personal data, no method of electronic transmission or storage can guarantee complete security.
We continuously work to maintain and improve the security of our systems and services.
11. Your Rights Regarding Personal Data
Where the GDPR applies, you have certain rights regarding the processing of your personal data.
These rights include:
11.1 Right of Access
You have the right to request confirmation of whether we process personal data about you and, where applicable, obtain access to that information.
11.2 Right to Rectification
You have the right to request correction of inaccurate personal data and completion of incomplete information.
11.3 Right to Erasure
Under certain circumstances, you have the right to request deletion of your personal data.
This right is subject to applicable legal requirements and exceptions, including situations where we must retain information for legal obligations or claims.
11.4 Right to Restrict Processing
Under certain conditions, you may request that we restrict the processing of your personal data.
11.5 Right to Object
You have the right to object to processing based on legitimate interests for reasons relating to your particular situation, subject to applicable legal exceptions.
You also have the right to object at any time to the processing of your personal data for direct marketing purposes.
If you object to direct marketing, we will stop processing your personal data for that purpose.
11.6 Right to Data Portability
Where the legal conditions are met, you have the right to receive personal data you have provided to us in a structured, commonly used and machine-readable format and to request its transfer to another data controller.
11.7 Right to Withdraw Consent
Where processing is based on your consent, you may withdraw that consent at any time.
Withdrawal does not affect the lawfulness of processing carried out before the consent was withdrawn.
11.8 Right to Lodge a Complaint
You have the right to lodge a complaint with a competent data protection supervisory authority if you believe your personal data is being processed unlawfully.
Within the EU/EEA, you may generally contact a supervisory authority in the country where you live, work or where an alleged infringement occurred.
As Winn Scandinavia AB is established in Sweden, the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) is also a relevant supervisory authority.
Additional country-specific information may be available in the applicable local Privacy Policy.
12. How to Exercise Your Rights
If you wish to exercise your data protection rights or request information about your personal data, please contact us at:
Please describe your request clearly so that we can identify the relevant information and respond appropriately.
In certain circumstances, we may need to verify your identity before fulfilling a request to prevent unauthorised access to personal data.
We will handle requests in accordance with applicable data protection legislation and relevant statutory deadlines.
You do not normally need to use a specific form to exercise your rights.
13. Marketing Preferences and Consent
You can manage certain preferences relating to marketing communications and data processing.
If you receive marketing emails from us, you can unsubscribe through the unsubscribe function included in the communication.
You may also contact us directly to withdraw consent or object to direct marketing.
Where cookie consent is required, you can review or change your preferences using the cookie settings on the relevant website.
Withdrawing consent does not affect processing carried out lawfully before withdrawal.
We may retain limited information necessary to record your preferences or ensure that you do not receive communications you have opted out of.
14. Information Required to Provide Our Services
Certain personal data is necessary to process orders, establish customer accounts, provide services and fulfil contractual or legal obligations.
For example, we may require your name, contact details, delivery address and relevant payment information to complete an order.
If you do not provide the necessary information, we may be unable to process your order or provide the requested service.
Other information may be optional and is provided at your discretion.
Where applicable, we will indicate which information is required and which information is optional.
15. Automated Decision-Making
Our general customer account, order management and customer service processes are not intended to involve decisions based solely on automated processing that produce legal or similarly significant effects on individuals.
However, payment providers and financial service partners may independently use automated systems for fraud prevention, identity verification, credit assessments or payment eligibility.
Such processing is governed by the relevant provider's own privacy information and applicable legal requirements.
Where we engage in automated decision-making subject to specific disclosure obligations under data protection law, we will provide the information and rights required by that law.
16. Third-Party Websites and Services
Our websites and services may include integrations with or references to services operated by third parties.
When you use a third-party service, its provider may collect and process personal data independently.
We recommend reviewing the relevant third party's Privacy Policy to understand how it processes personal data and what rights you may have in relation to that processing.
This Privacy Policy applies to the processing of personal data for which Winn Scandinavia AB is responsible.
17. Country-Specific Privacy Requirements
Winn Scandinavia AB operates websites and provides services in multiple countries.
Although our general approach to privacy and data protection is consistent across our operations, certain requirements may vary depending on local legislation and the services available in a particular market.
Country-specific information may include:
Applicable national privacy and consumer protection requirements
Local payment and checkout providers
Shipping, logistics and service partners
Marketing and communication requirements
Statutory data retention periods
Local supervisory authorities
Country-specific cookies and tracking practices
Additional legal rights or disclosures
Where relevant, this information is provided in the Privacy Policy, Cookie Policy or other applicable privacy notices on the country-specific website.
These local provisions supplement this general Privacy Policy and take precedence where they specifically address processing practices or legal requirements applicable to that country.
Nothing in this Privacy Policy limits rights granted to individuals under mandatory data protection legislation.
18. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, business operations, technical systems, third-party providers or applicable legislation.
The current version of this Privacy Policy will be made available on our website.
Where changes are significant or notification is required by applicable law, we will provide additional information through appropriate communication channels.
We encourage you to review this Privacy Policy periodically to remain informed about how we process personal data.
19. Contact Information
If you have questions about this Privacy Policy, how we process personal data or how to exercise your rights, please contact:
Winn Scandinavia AB
Company registration number: 556792-9632
Idrottsvägen 37B
702 32 Örebro, Sweden
Email: dataskydd@brl.se
We will review your request and respond in accordance with applicable data protection legislation.