Budbee

What Budbee is

Budbee is a Stockholm based last mile delivery and logistics provider founded in 2012 and now part of the Instabee group, which also operates Instabox. Budbee specialises in scheduled home delivery, evening delivery, returns and parcel locker drop offs in the Nordics, the Netherlands and Belgium. Retailers integrate Budbee by embedding a delivery widget on their checkout page and by exchanging order, address and tracking data through the Budbee API. The widget is widely used by fashion, beauty and electronics merchants targeting Nordic customers.

What data and cookies Budbee collects

When the Budbee widget is loaded on a checkout page it sets a small number of first party and third party cookies on the customer browser to remember the chosen delivery method, link checkout sessions across page reloads and, optionally, measure widget engagement. On the server side Budbee receives the order ID, recipient name, delivery address, phone number, email, time slot preference and any special instruction provided by the customer. After delivery the platform also processes proof of delivery photos and recipient confirmations.

GDPR and ePrivacy implications

The cookies that are strictly necessary to remember the delivery method during checkout fall under Article 5(3) of the ePrivacy Directive and do not require consent. Any analytics or marketing cookies set by the widget go beyond strictly necessary and trigger the consent requirement under the ePrivacy implementations in each EU member state. The sharing of name, address, phone and email with Budbee is necessary to perform the delivery contract and therefore relies on Article 6(1)(b) GDPR, but transparency obligations under Articles 13 and 14 GDPR still apply.

Consent requirements and legal basis

The lawful basis for processing the recipient personal data needed to deliver the parcel is contract performance under Article 6(1)(b) GDPR. Fraud prevention measures, such as failed delivery scoring or address normalisation across orders, are based on legitimate interest under Article 6(1)(f) GDPR. Marketing analytics and behavioural cookies set by the Budbee widget rely on consent under Article 6(1)(a) GDPR. A data processing agreement under Article 28 GDPR with Budbee AB is required because Budbee acts as a processor on behalf of the merchant for the delivery service.

Data transfers and hosting

Budbee operates from Sweden and processes most data on AWS infrastructure in EU regions, primarily Stockholm and Frankfurt. Limited transfers to the United States can occur through AWS sub processors and through optional integrations such as Google Maps APIs and SMS gateways used to notify recipients. These transfers should rely on Standard Contractual Clauses and on the EU US Data Privacy Framework where applicable, and should be documented in the privacy notice alongside the recipient categories and retention durations.

Practical compliance steps

Sign the Budbee data processing agreement, list Budbee AB as a sub processor in your privacy notice and document the EU hosting model. Classify the Budbee cookies between strictly necessary delivery cookies (always on) and optional analytics cookies (consent gated). Configure the widget to only collect the data fields strictly required for delivery, and clearly explain to the customer that their address, phone and email are shared with Budbee to fulfil the chosen delivery option.