Last updated: 23 August 2026
1. Introduction
This Privacy Policy explains how Offertbox app (Blixtgo Agency AB), Swedish organisation number 559069-9038, operating the OffertBox platform (“OffertBox”, “we”, “us”, or “our”), collects, uses, stores, protects, and shares personal data.
Company: Offertbox Blixtgo Agency AB
Organisation number: 559069-9038
Address: Drottninggatan 6A, 212 11 Malmö, Sweden
Email: info@offertbox.se
OffertBox is a Software-as-a-Service (“SaaS”) platform designed for businesses in the service sector.
The platform provides tools that may include customer management, leads, quotations, bookings, scheduling, communication, internal administration, subscriptions, reporting, and integrations with third-party services.
We are committed to protecting personal data and processing it in accordance with applicable privacy and data protection legislation, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”).
2. Scope of this Privacy Policy
This Privacy Policy applies to personal data processed in connection with:
- Visitors to the OffertBox website
- Businesses registered with OffertBox
- Administrators and employees using OffertBox
- Individuals whose information is processed by an OffertBox customer
- Users connecting third-party services or integrations to OffertBox
- Users connecting a Google Account to OffertBox
OffertBox is primarily intended for business use and is not designed as a consumer service for private individuals.
3. Our Role Under Data Protection Law
Depending on the type of information being processed, Blixtgo Agency AB may act either as a data controller or a data processor.
3.1 When We Are the Data Controller
We normally act as data controller for personal data relating to:
- Account registration
- User administration
- Subscription management
- Billing
- Customer support
- Security
- Website usage
- Service communications
- Platform administration
3.2 When We Are the Data Processor
When a customer uses OffertBox to process information relating to its own customers, prospects, employees, bookings, leads, quotations, or other business contacts, the OffertBox customer is generally the data controller and Blixtgo Agency AB acts as a data processor on the customer’s behalf.
Such data is processed only for the purpose of providing the OffertBox services and in accordance with the customer’s instructions and applicable data protection requirements.
4. Personal Data We Collect
Depending on how OffertBox is used, we may process the following categories of information.
4.1 Account and User Information
This may include:
- Name
- Email address
- Telephone number
- Company name
- Business address
- User role
- Account status
- Authentication information
- User preferences
4.2 Company Information
This may include:
- Company name
- Organisation number
- Address
- Email address
- Telephone number
- Billing information
- Company settings
- Subscription information
4.3 Customer and Contact Information
Information entered into OffertBox by our customers may include:
- Customer name
- Email address
- Telephone number
- Address
- Company information
- Notes
- Customer communication
- Service-related information
4.4 Business and Platform Data
Depending on the features used, information may include:
- Leads and enquiries
- Quotations
- Pricing information
- Bookings
- Appointments
- Scheduling information
- Customer communications
- Internal comments
- Tasks
- Activities
- Feedback
- Ratings
- Documents
- Files
- Support tickets
4.5 Payment and Subscription Data
We may process information relating to:
- Subscription plan
- Billing status
- Payment status
- Invoice information
- Transaction references
Payment card details may be processed directly by our payment service providers rather than being stored by OffertBox.
4.6 Technical and Security Information
We may automatically collect technical information such as:
- IP address
- Browser type
- Device information
- Operating system
- Login activity
- Date and time of access
- Security logs
- Error logs
- Session information
- Platform usage information
This information is used for security, troubleshooting, fraud prevention, service operation, and improvement.
5. How We Use Personal Data
We may process personal data for the following purposes:
- Providing and operating OffertBox
- Creating and managing accounts
- Authenticating users
- Managing user permissions
- Providing customer management functionality
- Creating and managing quotations
- Managing bookings and scheduling
- Sending user-requested communications
- Managing subscriptions and payments
- Providing customer support
- Troubleshooting technical problems
- Preventing fraud, abuse, and unauthorised access
- Maintaining platform security
- Improving platform functionality and usability
- Monitoring service availability and performance
- Complying with legal obligations
We do not use personal data for purposes that are incompatible with the purposes described in this Privacy Policy.
6. Legal Basis for Processing
Where GDPR applies, we rely on one or more of the following legal bases.
6.1 Performance of a Contract
Processing may be necessary to:
- Create and maintain an OffertBox account
- Provide the platform
- Deliver requested functionality
- Administer subscriptions
- Provide support
6.2 Legitimate Interests
We may process data where necessary for legitimate business interests such as:
- Platform security
- Fraud prevention
- Service improvement
- Technical troubleshooting
- Business administration
We consider the rights and interests of affected individuals before relying on legitimate interests.
6.3 Legal Obligations
We may process or retain information where required by applicable laws, including accounting, taxation, regulatory, or legal obligations.
6.4 Consent
Where required, we rely on consent for specific activities, including certain:
- Cookies
- Analytics
- Marketing activities
- Third-party integrations
- Access to third-party account data
Consent may be withdrawn where applicable.
7. Google Account and Google API Integration
OffertBox may allow users to connect their Google Account to OffertBox using Google OAuth 2.0.
Connecting a Google Account is voluntary unless a specific OffertBox feature selected by the user requires that integration.
Before OffertBox receives access to Google user data, Google displays a consent screen describing the permissions requested by OffertBox.
OffertBox only requests access to Google data that is necessary to provide functionality requested or enabled by the user.
We do not request access to Google user data merely for possible future use.
8. Google User Data We May Access
The specific Google user data that OffertBox can access is determined by the Google OAuth permissions that the user explicitly authorises.
Depending on the Google integration enabled by the user, this may include basic Google Account information required to identify and connect the user’s Google Account, such as:
- Name
- Email address
- Google account identifier
- Profile information made available through the authorised Google OAuth scope
Where additional Google services are connected, OffertBox will only access the specific information covered by the Google OAuth permissions presented to and authorised by the user.
OffertBox cannot access Google Account information outside the permissions authorised by the user.
9. How OffertBox Uses Google User Data
Google user data obtained through Google APIs is used only to provide or improve user-facing functionality that the user has requested or enabled within OffertBox.
Google user data may be used to:
- Authenticate or identify the connected Google Account
- Maintain the connection between OffertBox and the user’s Google Account
- Provide the Google-connected feature requested by the user
- Synchronise information where the user has specifically enabled a synchronisation feature
- Perform actions explicitly requested by the user through OffertBox
- Maintain security and prevent misuse of the Google integration
- Troubleshoot problems affecting the connected Google functionality
OffertBox does not use Google user data for unrelated purposes.
10. Google API Limited Use Compliance
OffertBox’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular:
- Google user data is used only for providing or improving user-facing features requested by the user.
- Google user data is not sold.
- Google user data is not transferred to data brokers.
- Google user data is not used for advertising.
- Google user data is not used for personalised, interest-based, or retargeting advertising.
- Google user data is not used to determine creditworthiness or for lending purposes.
- Google user data is not transferred to advertising platforms for advertising purposes.
- Google user data is not used to create, train, or improve general-purpose or foundation artificial intelligence or machine-learning models.
Any use of Google user data remains limited to the functionality disclosed to the user and authorised through Google’s consent process.
11. Human Access to Google User Data
OffertBox does not permit employees, contractors, or other persons to manually access Google user data except where such access is strictly necessary and permitted, including:
- When the user has provided affirmative permission for support relating to specific information
- Where access is required to investigate fraud, abuse, security incidents, or technical problems
- Where access is required by applicable law
- Where data has been appropriately aggregated or anonymised for legitimate internal operations
Access to systems containing user information is restricted to authorised personnel according to their responsibilities.
12. Storage of Google User Data
Where required to provide a Google-connected feature, OffertBox may securely store:
- Google account identifiers
- Connection information
- OAuth access credentials or tokens
- Data necessary to provide the authorised integration
Such information is stored only for as long as necessary to maintain the functionality authorised by the user or as otherwise required for security or legal purposes.
Access credentials and tokens are treated as confidential information and protected through appropriate technical and organisational security measures.
13. Sharing and Transfer of Google User Data
OffertBox does not sell Google user data.
Google user data is not shared with third parties except where necessary to:
- Provide a feature explicitly requested by the user
- Operate technical infrastructure necessary to provide OffertBox
- Protect against fraud, abuse, or security threats
- Comply with applicable legal obligations
- Process data through service providers acting on our behalf and subject to appropriate confidentiality and data protection obligations
Google user data obtained through Google APIs is not provided to advertising networks, data brokers, or information resellers.
Analytics and advertising technologies used on the public OffertBox website are not permitted to use Google API user data obtained through an authenticated Google integration for advertising purposes.
14. Disconnecting Google and Revoking Access
Users may disconnect their Google Account from OffertBox where the applicable integration provides this functionality.
Users may also revoke OffertBox’s access through the security or third-party connection settings of their Google Account.
After access is revoked, OffertBox will no longer be able to obtain new Google user data through that authorisation.
Where Google-derived information is no longer necessary to provide the requested service, it will be deleted or anonymised in accordance with our data retention procedures, unless continued retention is required by law or necessary for legitimate security purposes.
Users may also contact us at:
to request assistance with disconnection or deletion.
15. Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected.
Retention periods depend on the type of information and the purpose for processing.
Examples include:
- Account information may be retained while an account remains active.
- Operational platform information may be retained while necessary to provide the service.
- Billing and accounting information may be retained for the period required by applicable law.
- Customer data processed on behalf of an OffertBox customer is retained according to the customer’s instructions and applicable contractual arrangements.
- Security records may be retained where necessary to investigate or prevent abuse.
- OAuth credentials are retained only while necessary to maintain an authorised third-party connection.
When information is no longer required, it is deleted, anonymised, or otherwise securely removed in accordance with our retention procedures.
Information contained in encrypted backups may remain for a limited period until those backups are automatically replaced or deleted.
16. Third-Party Service Providers
OffertBox may use third-party service providers to operate and support the platform.
These may include services relating to:
- Cloud infrastructure
- Authentication
- Payment processing
- Email delivery
- SMS delivery
- Analytics
- Security
- Monitoring
Providers used by OffertBox may include:
- Google Cloud
- Firebase
- Stripe
- Mailgun
- Twilio
- Google Analytics
- Meta Pixel
These providers may process information only according to their role, applicable contractual arrangements, and applicable data protection requirements.
The presence of analytics or marketing technologies on our public website does not mean that Google API user data obtained through an authenticated Google integration is shared with those services for advertising purposes.
We may update our service providers as our platform evolves.
17. International Data Transfers
Some service providers may process personal data outside Sweden or outside the European Economic Area (“EEA”).
Where personal data is transferred internationally, we use appropriate safeguards as required by applicable data protection legislation.
Depending on the circumstances, these safeguards may include:
- European Commission adequacy decisions
- Standard Contractual Clauses
- Data processing agreements
- Additional technical and organisational safeguards
18. Security
We use reasonable and appropriate technical and organisational security measures designed to protect personal data against:
- Unauthorised access
- Accidental loss
- Unlawful disclosure
- Alteration
- Destruction
- Misuse
Security measures may include:
- Encrypted communications
- Access controls
- Authentication
- Role-based permissions
- Infrastructure security controls
- Monitoring
- Logging
- Backup procedures
- Restricted administrative access
No online service can guarantee absolute security. We continuously work to maintain safeguards appropriate to the nature of the data being processed.
19. Data Breaches
Where a personal data breach occurs, we will investigate the incident and take appropriate measures.
Where required by applicable data protection law, we will notify the relevant supervisory authority and affected individuals within the legally required timeframes.
20. Your Data Protection Rights
Where GDPR applies, individuals may have the right to:
- Request access to personal data
- Request correction of inaccurate information
- Request deletion of personal data
- Request restriction of processing
- Object to certain processing
- Request data portability
- Withdraw consent where processing is based on consent
- Lodge a complaint with a competent supervisory authority
The applicability of a particular right depends on the circumstances and legal basis for processing.
Requests may be sent to:
Where OffertBox processes information solely on behalf of one of our customers, we may refer the request to the relevant customer as data controller.
21. Account and Data Deletion Requests
Users may request deletion of their OffertBox account and associated personal data by contacting:
Before completing a deletion request, we may need to verify the identity and authority of the person making the request.
Certain information may be retained where required by law, necessary for the establishment or defence of legal claims, or required for security and fraud-prevention purposes.
Google Account connections associated with the deleted account will be removed or revoked where applicable.
22. Cookies and Similar Technologies
The OffertBox website and platform may use cookies and similar technologies for purposes including:
- Essential website functionality
- Authentication
- Security
- User preferences
- Analytics
- Performance measurement
- Marketing, where permitted
Where required by law, non-essential cookies are used only after appropriate consent has been obtained.
More information may be provided in our separate Cookie Policy.
23. Marketing
Where permitted by applicable law, we may use contact information to communicate with customers regarding OffertBox services.
Users may unsubscribe from marketing communications at any time.
Google user data obtained through Google APIs is not used for advertising, retargeting, or marketing profiling.
24. Children’s Privacy
OffertBox is a business-oriented service intended for persons who are at least 18 years old or otherwise legally authorised to act on behalf of a business.
OffertBox is not intentionally directed at children.
25. Automated Decision-Making
OffertBox does not use Google user data to make decisions that produce legal or similarly significant effects on individuals based solely on automated processing.
Google user data is not used to determine creditworthiness, eligibility for loans, insurance decisions, employment decisions, or similar high-impact decisions.
26. Changes to this Privacy Policy
We may update this Privacy Policy where:
- Our services change
- New features or integrations are introduced
- Legal requirements change
- Our data processing practices change
The current version will always display the date of the latest update.
If we materially change how Google user data or other personal data is used, we will provide appropriate notice and obtain consent where required.
27. Supervisory Authority
Individuals in Sweden may have the right to submit a complaint to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten – IMY) if they believe their personal data has been processed unlawfully.
We encourage users to contact us first so that we have an opportunity to address any concerns.
28. Contact Information
For privacy questions, data protection requests, Google data questions, or account deletion requests, contact:
Blixtgo Agency AB
Organisation number: 559069-9038
Drottninggatan 6A
212 11 Malmö
Sweden
Email: info@offertbox.se
Service: OffertBox