Privacy Policy
Last updated: 2026-10-28
This Privacy Policy explains how ULC Engineering AB (“we”, “us” or “our”) processes personal data when you visit this website, contact us, place an order or use our customer services.
1. Who is responsible for your personal data?
The controller responsible for personal data processed through this website is:
ULC Engineering AB
Company registration number: 556996-6533
Bräckans väg 20
449 30 Nödinge
Sweden
Email: info@ulcengineering.se
Telephone: +46 (0)764 230 230
2. Personal data we process
The personal data we process depends on how you use the website.
Orders, payment and delivery
When you place an order, we process your name, billing and delivery address, email address, telephone number, order details, product configuration or personalization details, payment status, delivery information, correspondence about the order and any return, complaint or withdrawal information.
We use this information to accept and manage your order, take payment, manufacture or configure the product where applicable, arrange delivery, provide customer service, handle returns and complaints, prevent fraud, and meet legal obligations. The legal basis is performance of the contract with you and our legal obligations. Where necessary to prevent misuse or protect our business, the legal basis is our legitimate interest in maintaining a secure and reliable sales service.
Payments are handled through Stripe. We do not receive or store your full card number. The payment provider processes payment information under its own privacy information and terms.
Contact, support and withdrawal requests
When you contact us by email, form, telephone or another channel, we process the information you provide, such as your name, contact details, order number and message.
We use this information to respond to your request, provide support and handle withdrawals, returns or complaints. The legal basis is performance of the contract, compliance with legal obligations, and our legitimate interest in communicating with customers and protecting our legal interests.
Website operation and security
When you visit the website, our hosting and security systems may process technical information such as IP address, browser and device information, pages requested, date and time of access, referring page and security-related logs.
We use this information to deliver the website, maintain security, detect misuse and resolve technical problems. The legal basis is our legitimate interest in operating a secure and functional website.
Cookies and optional analytics
We use necessary cookies and similar technologies to make the website, basket, checkout and security features work. These are not used for advertising profiling.
If we use analytics, marketing or other non-essential cookies, we ask for consent before setting them.
You can manage or withdraw your consent below:
Our Cookie Policy provides current details of the cookies and services used.
3. Who receives your personal data?
We share personal data only where necessary for the purposes described above. Recipients may include:
- our website host, Inleed;
- service providers supporting our WordPress and WooCommerce website;
- Stripe, for payment processing;
- delivery and logistics providers selected for your order;
- our email provider and customer-support tools;
- professional advisers, insurers, banks, public authorities or other parties where required by law or necessary to establish, exercise or defend legal claims.
These providers act either as independent controllers or as processors acting on our instructions, depending on the service and the processing involved.
4. International transfers
Some service providers may process personal data outside the EU/EEA. Where this occurs, we use a lawful transfer mechanism, such as an adequacy decision, the European Commission’s Standard Contractual Clauses, or another safeguard permitted by data-protection law.
For further information about international transfers and applicable safeguards, please contact us.
5. How long we keep personal data
We keep personal data only for as long as needed for the relevant purpose, unless a longer period is required or permitted by law.
- Order, payment and accounting records are normally retained for at least seven years where required by Swedish accounting and tax rules.
- Customer-service correspondence, withdrawal requests, returns and complaint records are normally retained for up to three years after the matter is closed, unless a longer period is needed for an ongoing dispute, legal claim or legal obligation.
- Technical security logs, such as server access logs and logs of suspected security incidents, are retained only for as long as necessary to protect the website, troubleshoot issues and manage security incidents. In the event of a security incident, the data may need to be retained for longer.
- Information about your cookie consent choices is stored in your browser for up to 12 months. You can change or withdraw your consent at any time through the cookie settings.
When personal data is no longer needed, we delete it or anonymise it.
6. Your rights
Depending on the circumstances, you have the right to:
- request access to your personal data;
- request correction of inaccurate or incomplete data;
- request deletion of data where the law allows it;
- request restriction of processing;
- object to processing based on our legitimate interests;
- receive data you provided to us in a structured, commonly used and machine-readable format, where the right to data portability applies; and
- withdraw consent at any time where processing is based on consent. This does not affect processing carried out before consent was withdrawn.
To exercise a right, contact us using the details in section 1. We may need to verify your identity before responding.
You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), or with the data-protection authority in your country of habitual residence, work or the place of an alleged infringement. Information about IMY is available at https://www.imy.se.
7. Automated decisions
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
8. Children
This website is not directed at children. We do not knowingly collect personal data from children without an appropriate legal basis.
9. Changes to this Privacy Policy
We may update this Privacy Policy when our processing or legal requirements change. We will publish the updated version on this page and update the “Last updated” date. Material changes affecting existing customers will be communicated where required by law.