CARVIAN – Privacy Policy
Effective date: 14.07.2026
1. General
1.1
This Privacy Policy ("Privacy Policy") describes how the entity operating the Carvian service ("Company", "we", "us") processes personal data in connection with the Carvian platform available at carvian.com and its related domains, subdomains and applications ("Platform").
1.2
The Company is the controller of the personal data described in this Privacy Policy within the meaning of Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR").
Questions regarding data protection may be sent to support@carvian.com.
1.3
This Privacy Policy covers two categories of data subjects:
- Customers and visitors of the Platform (Part I)
- Natural persons who own or possess a vehicle for which the Platform provides vehicle history information (Part II)
Cookies and similar technologies are described separately in the Carvian Cookie Policy.
Part I – Customers and Visitors
2. What Data We Collect About Customers
2.1
The Platform operates without user accounts.
When you purchase and use a vehicle history report, we process the following information, all of which is necessary for providing the service.
2.1.1 Query Data
- the VIN or registration number you enter
- the vehicle summary retrieved for that identifier from our data sources (for example, vehicle register data)
- the odometer reading displayed in the report.
2.1.2 Order and Delivery Data
- your email address
- your selected language
- the package you purchased
- your remaining report balance
- timestamps relating to your order and report generation.
2.1.3 Payment Data
- the Stripe Checkout Session identifier
- the payment amount
- the payment currency
- the report identifier linked to the payment session
- the related timestamp.
Payment card details are entered directly into Stripe's payment interface and are never received, processed or stored by the Company.
2.2
You may also voluntarily subscribe to our newsletter by providing your email address.
Subscribing to the newsletter is entirely optional and is not required to purchase or use vehicle history reports.
2.3
You may browse the Platform without providing any personal data.
Information collected through cookies and similar technologies is described in the Carvian Cookie Policy. Analytics and advertising technologies are used only with your consent.
3. Purposes and Legal Bases
3.1
We process customer data for the following purposes and on the following legal bases.
3.1.1 Providing the Service
Generating the report for the identifier you provide, delivering it to your email address in your selected language, and maintaining your report balance.
Legal basis: performance of a contract (Article 6(1)(b) GDPR).
3.1.2 Payment Processing and Fraud Prevention
Linking the Stripe Checkout Session, payment amount and currency to the delivered report.
Legal bases:
- performance of a contract (Article 6(1)(b) GDPR)
- legitimate interest in preventing fraud and misuse (Article 6(1)(f) GDPR).
3.1.3 Accounting and Legal Obligations
Retaining transaction records as required by the Finnish Accounting Act (1336/1997) and applicable tax legislation.
Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR).
3.1.4 Customer Support
Providing customer support and handling complaints, withdrawal requests and legal disputes.
Legal bases:
- performance of a contract
- legitimate interest in resolving disputes and establishing, exercising or defending legal claims.
3.1.5 Newsletter
Sending newsletters, updates and promotional offers to subscribers.
Legal basis: consent (Article 6(1)(a) GDPR).
You may withdraw your consent at any time using the unsubscribe link included in every newsletter.
4. Recipients of Customer Data
4.1
We disclose or make customer data available to the following categories of recipients only where necessary.
4.1.1 Stripe
Stripe, our payment service provider, processes payment transactions.
For payment processing, Stripe acts partly as an independent data controller. Its processing activities are described in the Stripe Privacy Policy.
4.1.2 IT Service Providers
Service providers that:
- host the Platform
- deliver transactional emails
- provide our newsletter service.
These providers act as data processors under appropriate data processing agreements.
4.1.3 Google
Google, in connection with analytics and advertising technologies used with your consent, as described in the Carvian Cookie Policy.
4.1.4 Authorities
Authorities, courts and dispute resolution bodies where disclosure is required by law or necessary for the establishment, exercise or defence of legal claims.
4.1.5 Group Companies
Companies belonging to the same corporate group as the Company, as well as parties involved in a merger, acquisition or business transfer, subject to appropriate confidentiality safeguards.
4.2
We primarily process personal data within the European Union and the European Economic Area (EU/EEA).
Where a service provider processes personal data outside the EU/EEA, the transfer is based on an adequacy decision issued by the European Commission or on the European Commission's Standard Contractual Clauses together with any necessary supplementary safeguards.
5. Retention of Customer Data
5.1
Order, payment and invoicing data is retained for six (6) years following the end of the financial year during which the transaction took place, as required by the Finnish Accounting Act.
5.2
A generated report remains accessible through its delivery link for thirty (30) calendar days, after which the link expires.
Unused report credits and the associated order information are retained for the validity period of the credits and for as long as necessary to handle potential legal claims.
5.3
Newsletter subscription data is retained until you unsubscribe.
Following unsubscription, your email address is removed from the mailing list without undue delay.
5.4
Customer support correspondence is retained only for as long as necessary to resolve the matter and any related legal claims, after which it is deleted.
Part II – Vehicle Data
6. Processing of Vehicle Data
6.1
Vehicle data is organised by vehicle (VIN or registration number), not by individual.
We do not collect information that directly identifies a vehicle owner or keeper, and our reports do not identify any individual.
In accordance with Article 11 GDPR, we inform data subjects through this publicly available Privacy Policy rather than individually.
6.2
We process vehicle information, including:
- identification and technical information
- odometer readings
- inspection records
- service history
- registration events
- reference pricing information.
This processing enables us to increase transparency in the used vehicle market and help protect buyers against fraud.
Legal basis: legitimate interests of the Company, report purchasers and other road users (Article 6(1)(f) GDPR).
6.3
Vehicle information is obtained from a variety of sources, including:
- official vehicle registers
- vehicle inspection stations
- service and repair providers
- vehicle dealerships
- insurance and claims data providers
- publicly available online sources.
6.4
Vehicle information is retained for as long as it remains relevant to the vehicle's history, corresponding to the vehicle's normal lifespan.
Part III – General Provisions
7. Your Rights
7.1
Subject to the GDPR, you have the right to:
- access your personal data
- request correction of inaccurate data
- request erasure of your personal data
- request restriction of processing
- receive your personal data in a portable format where processing is based on contract or consent
- object to processing based on legitimate interests
- withdraw any consent you have previously provided at any time.
7.2
Requests may be sent to support@carvian.com.
For requests relating to vehicle information, we may ask you to demonstrate your connection to the vehicle (for example by providing the vehicle registration certificate), as we do not possess information that directly identifies a vehicle owner or keeper.
We respond to requests within one month.
Where a request is particularly complex, this period may be extended by up to two additional months. If an extension is necessary, we will notify you within the initial one-month period.
8. Changes and Contact
8.1
All enquiries regarding privacy or personal data may be sent to support@carvian.com.
8.2
We may update this Privacy Policy from time to time, for example when our services, service providers or applicable legislation change.
The latest version will always be published on the Platform.
Where changes are material, we will also provide a notice on the Platform.