Privacy policy
1. Who we are
Swish & Click OÜ is a business-to-business distributor of branded merchandise and promotional products, registered in Estonia and operating across Europe. We are the controller of the personal data described in this notice.
- Swish & Click OÜ, registration number 17301303
- Lõõtsa tn 5, 11415 Tallinn, Estonia
- EU VAT (VIES) EE102889941 · EORI EE17301303
- Email info@swishandclick.eu · Telephone and WhatsApp +39 353 202 5915
We also operate a United Kingdom subsidiary, Swish and Click Ltd, company number NI737465, registered in Belfast. Where that company invoices you or arranges your delivery, it acts as controller of your data for that transaction and this notice applies to it in the same terms.
We have not appointed a Data Protection Officer, as we are not required to do so. Privacy questions are handled by the company's management and reach a person, not a queue.
2. What this notice covers, and who it is about
We sell to organisations rather than to consumers. In practice that means almost all the personal data we hold is business contact data: the name, work email address, job title and work telephone number of somebody acting for their employer. We treat that data with the same care as any other personal data, because the law makes no exception for it and neither do we.
This notice covers four groups of people:
- People at our client organisations, including the person who requests a quote, approves artwork, or receives a delivery.
- People at organisations we approach, whose business contact details we have obtained from a public source. Section 4 is written specifically for you, and it explains exactly where we found you and how to make us stop.
- Visitors to swishandclick.eu, whether or not you contact us.
- People at our suppliers and our own contractors.
3. The personal data we process
| Category | What it includes |
|---|---|
| Contact details | Name, job title, employer, work email address, work telephone number, billing address, delivery address. |
| Business and tax details | Company registration number, VAT number and its VIES validation result, EORI number, purchase order references. These identify a company rather than a person, but we list them because they often appear alongside your name. |
| Order and quotation details | Products quoted and ordered, quantities, branding specifications, artwork files you send us, delivery destinations and dates, venue and stand details, the name and telephone number of the person receiving a delivery. |
| Payment details | Payment method, transaction references, bank remittance details, payment confirmations. We do not store full card numbers; card payments are handled by our payment providers. |
| Correspondence | Emails, WhatsApp messages, call notes and support enquiries, including anything you choose to include in them. |
| Prospecting records | For people described in section 4 only: name, job title, employer, work email address, the event or public source your details came from, the exact web address we took them from, the date we did so, and a record of any contact we have made and any objection you have raised. |
| Website and device data | IP address, browser and device type, pages viewed, referring site, and cookie identifiers. See section 7. |
We do not seek and do not want any special category data as defined in Article 9 of the GDPR, and we do not carry out profiling or automated decision-making that has legal or similarly significant effects on anyone.
4. Business contacts we approach, and where we found you
If you have received an unexpected message from us, this section is the explanation, and we would rather give it plainly than bury it.
We sometimes contact people at organisations we believe have a near-term need for branded merchandise, most often because their employer is exhibiting at a trade fair. We obtain their business contact details from public sources: trade fair and exhibition exhibitor directories, professional networking profiles, and organisations' own websites. We do not buy contact lists, and we do not use scraping tools to collect every name available at an event.
What we hold, and what we do with it
Only your name, job title, employer, work email address, the event or source concerned, and the source's web address and the date we visited it. Nothing is inferred, enriched, purchased or scored beyond what we need to route the approach to the right person and the right country. We use it to make a single approach about merchandise for that event, followed by at most one further message. If you do not reply, we do not contact you again.
Our legal basis, and how we reached it
We rely on our legitimate interests under Article 6(1)(f) of the GDPR, namely offering our products to organisations likely to need them. We have carried out and documented a balancing assessment weighing that interest against your rights, and we will send you a copy on request. In reaching it we took account of the following, which we also apply as operating rules:
- We write to you about your own professional responsibilities, in your professional capacity, at a work address. If a person's published role does not cover marketing, brand, communications or events, we do not write to them.
- We tell you the specific source of your details in the first message itself, not on request.
- We contact one person per organisation, once, with at most one follow-up.
- We do not use tracking pixels or link tracking in prospecting or business correspondence, so we generate no behavioural data about you at all. We do not know whether you opened this notice or anything we have sent you.
- Where the national law of your country requires prior consent for electronic marketing, we do not send you email at all.
How to make it stop
You have an absolute right to object, and we will act on it. Reply to any message you have received from us with a single word, or write to support@swishandclick.eu. You do not need to give a reason and there is no cost. We act within one working day and the effect is permanent and applies across our whole team, not only to the person who wrote to you.
When you object we delete your contact record and keep only the minimum needed to make sure we never contact you again, which is your email address or your employer's domain and the date of your objection. We keep that indefinitely, because destroying it is the one thing that would allow us to contact you by mistake in future. If you would prefer us to erase even that, tell us and we will, and we will explain the consequence.
5. Where your data comes from
- From you, when you request a quote, place an order, send artwork, email, call or message us, or use our website.
- Automatically, through cookies and similar technologies when you visit swishandclick.eu.
- From your colleagues, where someone at your organisation gives us your details as the recipient of a delivery, the approver of artwork, or the contact for payment.
- From public sources, as described in section 4.
- From our service providers, including Shopify, our payment providers and our couriers, where they process data on our behalf or return delivery information to us.
6. Why we process your data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Preparing quotations, processing orders, arranging production and branding, and coordinating delivery | Performance of a contract, or steps taken at your request before entering one, Article 6(1)(b). Where you act for a company rather than in your own name, our legitimate interest in administering that contract, Article 6(1)(f). |
| Issuing invoices, credit notes and pro forma invoices, and keeping accounting records | Legal obligation, Article 6(1)(c), including the Estonian Accounting Act and applicable VAT law. |
| Applying the correct VAT treatment, including validating VAT numbers through VIES and reporting under the One Stop Shop | Legal obligation, Article 6(1)(c). |
| Producing export and customs documentation for deliveries outside the EU customs territory | Legal obligation, Article 6(1)(c). |
| Answering your enquiries and providing support | Performance of a contract, Article 6(1)(b), or our legitimate interest in being responsive to people who contact us, Article 6(1)(f). |
| Contacting business contacts obtained from public sources, as described in section 4 | Legitimate interests, Article 6(1)(f). |
| Sending marketing to people who have asked to receive it | Consent, Article 6(1)(a), which you may withdraw at any time. |
| Cookies and similar technologies that are not strictly necessary | Consent, Article 6(1)(a), given through our cookie banner. |
| Preventing fraud, securing our systems, and assessing credit risk before offering payment terms | Legitimate interests, Article 6(1)(f), and legal obligation where applicable. |
| Establishing, exercising or defending legal claims | Legitimate interests, Article 6(1)(f), and legal obligation, Article 6(1)(c). |
7. Cookies, analytics and email tracking
Our website uses cookies that are strictly necessary for it to work, including for your basket, your session and security. It also uses cookies for analytics and advertising, which are set only where you have consented through our cookie banner. You can change or withdraw your cookie choices at any time through the banner or your browser settings.
We honour the Global Privacy Control signal. If your browser sends it, we treat that as an instruction to opt out on that browser and device.
On email tracking, our position is deliberate. We do not place tracking pixels in prospecting emails or in ordinary business correspondence, and we do not use link tracking in them. Data protection authorities in France and Italy have concluded that an email tracking pixel requires the same consent as a website cookie, and we agree with the principle. Where we send a marketing email to somebody who has consented to receive it, any tracking is covered by that consent and described at the point you give it. If you would like to know whether a particular message from us contained a tracker, ask and we will tell you.
8. Who we share your data with
We do not sell personal data. We share it only where there is a reason to, and the reasons are these:
| Recipient | Why |
|---|---|
| Suppliers and production partners | We are an asset-light distributor and do not manufacture or warehouse. To fulfil an order we pass the delivery address, the recipient's name and telephone number, the delivery date and your artwork to the supplier producing and dispatching your goods. This is necessary to deliver what you have ordered. |
| Couriers and freight forwarders | Delivery address, recipient name and telephone number, and any venue or stand instructions. A local telephone number for the recipient is often the difference between a successful delivery and a failed one. |
| Customs authorities and customs agents | For deliveries outside the EU customs territory, including the United Kingdom and Switzerland, export and import documentation naming the consignee. |
| Shopify | Our website and store platform. See section 9. |
| Payment providers and banks | To take and reconcile payment. |
| Our accountants, auditors and legal advisers | To meet our accounting and tax obligations and to take professional advice. |
| Our own contractors | Members of our team are self-employed and handle client data on our behalf under written instructions and written data protection obligations. They may not copy or retain data outside our systems. |
| Software providers | Email, document storage, and customer relationship management, acting on our instructions. |
| Our group companies | Swish and Click Ltd in the United Kingdom, and any future group entity, where they are involved in your order. |
| Acquirers, authorities and courts | In connection with a sale or reorganisation of our business, to comply with the law, or to establish or defend legal claims. |
9. Our relationship with Shopify
Our website and store are hosted by Shopify, which collects and processes personal data about your use of the site in order to provide and improve that service. Information you submit through the site is transmitted to Shopify and may be shared with third parties located outside your country. We also use certain Shopify features that draw on data about interactions with our store and with other merchants. For those features Shopify is responsible for the processing, including for responding to requests about it. Shopify's own Consumer Privacy Policy explains how it uses personal data, and depending on where you live you may exercise rights directly through the Shopify Privacy Portal.
10. Transfers outside the European Economic Area
Most of our processing happens inside the EEA. Some does not, because some of our service providers, and some of our clients, suppliers and delivery destinations, are elsewhere. Where we transfer personal data outside the EEA we rely on an adequacy decision by the European Commission where one covers the destination, and otherwise on the Commission's Standard Contractual Clauses together with an assessment of the safeguards in place. For transfers from the United Kingdom we rely on the equivalent United Kingdom mechanisms. You may ask us which mechanism applies to a particular transfer and we will tell you.
11. How long we keep your data
| Record | Retention period |
|---|---|
| Invoices, credit notes and accounting records | Seven years from the end of the financial year to which they relate, as required by Estonian accounting law |
| Order files, artwork and delivery records | Seven years, so that they can support the accounting record and any warranty or claim |
| Quotations that did not become orders | Twenty-four months from the date of the quotation |
| Customer service correspondence | Three years from the last contact |
| Prospecting records where you have not engaged with us | Twelve months from the date we obtained your details |
| Objection and suppression records | Indefinitely, and limited to the minimum needed to honour your objection, as explained in section 4 |
| Marketing consent records | Until you withdraw consent, and reviewed at least every three years |
| Supplier and contractor records | Seven years from the end of the relationship |
| Website and cookie data | For the lifetime of the relevant cookie, as set out in our cookie banner |
Where we are required to keep a record for a legal reason we keep it for that reason only and do not continue to use it for anything else.
12. Security
We apply technical and organisational measures appropriate to the data we hold, including access controls, encryption in transit, multi-factor authentication on our core systems, and a rule that client and prospect data lives only in company-controlled systems and never in a personal account, device or spreadsheet. Everyone who handles data on our behalf is bound in writing to those measures and to telling us about any breach within twenty-four hours.
No security measure is perfect and information sent to us over the internet is not entirely secure in transit. Please do not use email to send us confidential or sensitive information; ask us and we will suggest a better route.
13. Your rights
Subject to the conditions and exceptions in the law, you have the right to:
- Be informed about how we use your data, which is what this notice is for.
- Access a copy of the personal data we hold about you.
- Rectification of data that is inaccurate or incomplete.
- Erasure of your data, where we have no overriding reason to keep it.
- Restriction of our processing in certain circumstances.
- Data portability, where we process your data by automated means on the basis of consent or a contract.
- Object to processing based on our legitimate interests. Where the processing is for direct marketing or prospecting, this right is absolute and we will always stop.
- Withdraw consent at any time where we rely on it. Withdrawing consent does not affect processing that was lawful before you withdrew it.
To exercise any of these, write to info@swishandclick.eu or support@swishandclick.eu or use any other contact detail you have for us. We respond within one month and will tell you if we need longer, which the law permits in limited cases. We may need to confirm your identity first, and we will ask for no more than we need to do so. Exercising your rights costs nothing and we will never treat you less favourably for doing it.
If you want an authorised agent to make a request for you, they should include evidence of your authorisation, and we may also verify it with you directly.
14. Marketing preferences
Every marketing email we send carries an unsubscribe link, and every prospecting email carries a plain instruction for making us stop. Both work immediately and permanently. If you unsubscribe we may still contact you about an order you have placed or a quotation you have asked for, because those are not marketing.
15. Children
We sell to organisations and our services are not directed at children. We do not knowingly collect personal data about anyone under the age of majority in their jurisdiction, and we do not sell or share the data of anyone under sixteen. If you believe a child has given us their data, contact us and we will delete it.
16. Links to other websites
Our website links to sites we do not control, including suppliers, trade fair organisers and review platforms. Their privacy practices are their own, and a link from us is not an endorsement. Please read their notices before giving them your data.
17. Changes to this notice
We update this notice when our practices change or when the law requires it. We post the current version here and change the date at the top. Where a change materially affects how we use your data we will tell you directly if we hold a contact detail for you.
18. Contact and complaints
If you have any question about this notice or about how we handle your data, contact us first. We would rather fix something than have you escalate it.
- Email info@swishandclick.eu / support@swishandclick.eu
- Telephone or WhatsApp +39 353 202 5915
- Post: Swish & Click OÜ, Lõõtsa tn 5, 11415 Tallinn, Estonia
You also have the right to complain to a data protection authority. Our lead authority is the Estonian Data Protection Inspectorate, Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, Estonia, www.aki.ee/en. You may instead complain to the supervisory authority in the country where you live or work, or where you believe the problem occurred. If you are in the United Kingdom, that is the Information Commissioner's Office, ico.org.uk/make-a-complaint.
For the purposes of applicable data protection law, Swish & Click OÜ is the controller of the personal data described in this notice.