CARVIAN – Privacy Policy

Effective date: 27.10.2026

1. General

1.1

This Privacy Policy ("Privacy Policy") describes how the entity operating the Carvian service ("Company", "we", "us") processes personal data in connection with the Carvian platform available at carvian.com and its related domains, subdomains and applications ("Platform").

1.2

The Company is the controller of the personal data described in this Privacy Policy within the meaning of Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR").

Questions regarding data protection may be sent to support@carvian.com.

1.3

This Privacy Policy covers two categories of data subjects:

  • Customers and visitors of the Platform (Part I)
  • Natural persons who own or possess a vehicle for which the Platform provides vehicle history or register information (Part II)

Cookies and similar technologies are described separately in the Carvian Cookie Policy.

Part I – Customers and Visitors

2. What Data We Collect About Customers

2.1

The Platform operates without user accounts.

When you purchase and use a vehicle history report or a Traficom search, we process the following information, all of which is necessary for providing the service.

2.1.1 Query Data

  • the VIN or registration number you enter
  • the vehicle summary retrieved for that identifier from our data sources (for example, vehicle register data)
  • the odometer reading displayed in the report.

2.1.2 Order and Delivery Data

  • your email address
  • your selected language
  • the package you purchased or the tier of the Traficom search
  • your remaining report or search balance
  • timestamps relating to your order and report generation.

2.1.3 Payment Data

  • the Stripe Checkout Session identifier
  • the payment amount
  • the payment currency
  • the report identifier linked to the payment session
  • the related timestamp.

Payment card details are entered directly into Stripe's payment interface and are never received, processed or stored by the Company.

2.2

You may also voluntarily subscribe to our newsletter by providing your email address.

Subscribing to the newsletter is entirely optional and is not required to purchase or use vehicle history reports.

2.3

You may browse the Platform without providing any personal data.

Information collected through cookies and similar technologies is described in the Carvian Cookie Policy. Analytics and advertising technologies are used only with your consent.

3. Purposes and Legal Bases

3.1

We process customer data for the following purposes and on the following legal bases.

3.1.1 Providing the Service

Generating the report or Traficom search for the identifier you provide, delivering the report to your email address in your selected language, and maintaining your report or search balance.

Legal basis: performance of a contract (Article 6(1)(b) GDPR).

3.1.2 Payment Processing and Fraud Prevention

Linking the Stripe Checkout Session, payment amount and currency to the delivered report.

Legal bases:

  • performance of a contract (Article 6(1)(b) GDPR)
  • legitimate interest in preventing fraud and misuse (Article 6(1)(f) GDPR).

3.1.3 Accounting and Legal Obligations

Retaining transaction records as required by the Finnish Accounting Act (1336/1997) and applicable tax legislation.

Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR).

3.1.4 Customer Support

Providing customer support and handling complaints, withdrawal requests and legal disputes.

Legal bases:

  • performance of a contract
  • legitimate interest in resolving disputes and establishing, exercising or defending legal claims.

3.1.5 Newsletter

Sending newsletters, updates and promotional offers to subscribers.

Legal basis: consent (Article 6(1)(a) GDPR).

You may withdraw your consent at any time using the unsubscribe link included in every newsletter.

4. Recipients of Customer Data

4.1

We disclose or make customer data available to the following categories of recipients only where necessary.

4.1.1 Stripe

Stripe, our payment service provider, processes payment transactions.

For payment processing, Stripe acts partly as an independent data controller. Its processing activities are described in the Stripe Privacy Policy.

4.1.2 IT Service Providers

Service providers that:

  • host the Platform
  • deliver transactional emails
  • provide our newsletter service.

These providers act as data processors under appropriate data processing agreements.

4.1.3 Google, Meta, TikTok and OpenAI

Google, Meta, TikTok and OpenAI, in connection with analytics and advertising technologies used with your consent, as described in the Carvian Cookie Policy.

Where you have consented to advertising cookies, OpenAI's measurement technology may additionally collect an email address you enter on the Platform in hashed form (SHA-256) and use it to match conversions to advertisements shown in OpenAI's services (automatic advanced matching). The hashing takes place in your browser; the email address itself is not disclosed to OpenAI.

4.1.4 Authorities

Authorities, courts and dispute resolution bodies where disclosure is required by law or necessary for the establishment, exercise or defence of legal claims.

4.1.5 Group Companies

Companies belonging to the same corporate group as the Company, as well as parties involved in a merger, acquisition or business transfer, subject to appropriate confidentiality safeguards.

4.2

We primarily process personal data within the European Union and the European Economic Area (EU/EEA).

Where a service provider processes personal data outside the EU/EEA, the transfer is based on an adequacy decision issued by the European Commission or on the European Commission's Standard Contractual Clauses together with any necessary supplementary safeguards.

5. Retention of Customer Data

5.1

Order, payment and invoicing data is retained for six (6) years following the end of the financial year during which the transaction took place, as required by the Finnish Accounting Act.

5.2

A generated report remains accessible through its delivery link for thirty (30) calendar days, after which the link expires. The result of a Traficom search remains accessible for twenty-four (24) hours from the time the search is made.

The stored content of a Carvian report is deleted from our database after 30 days and the result of a Traficom search within about 25 hours; see Section 6.8.

Unused report and search credits and the associated order information are retained for the validity period of the credits and for as long as necessary to handle potential legal claims.

5.3

Newsletter subscription data is retained until you unsubscribe.

Following unsubscription, your email address is removed from the mailing list without undue delay.

5.4

Customer support correspondence is retained only for as long as necessary to resolve the matter and any related legal claims, after which it is deleted.

Part II – Vehicle Data

6. Processing of Vehicle Data

6.1

Vehicle data is organised by vehicle (VIN or registration number), not by individual. Searches are always made by registration number or VIN, and the Platform does not offer a search by a person's name.

General vehicle information, such as technical data, inspection and odometer records, service history and reference prices, does not identify an owner or keeper.

As an exception, the result of a Traficom search contains personal data about the owner and keeper of the vehicle, which is listed precisely in Section 6.5. A Carvian report may also contain register data about the owners and keepers of the vehicle (Section 5.11 of the Terms of Service). The processing of this data is described in Sections 6.5–6.9, and the data subject's rights are the same for both.

6.2

We process vehicle information, including:

  • identification and technical information
  • odometer readings
  • inspection records
  • service history
  • registration events
  • reference pricing information.

This processing enables us to increase transparency in the used vehicle market and help protect buyers against fraud.

Legal basis: legitimate interests of the Company, report purchasers and other road users (Article 6(1)(f) GDPR).

6.3

Vehicle information is obtained from a variety of sources, including:

  • official vehicle registers
  • vehicle inspection stations
  • service and repair providers
  • vehicle dealerships
  • insurance and claims data providers
  • publicly available online sources.

6.4

Vehicle information that does not identify a person is retained for as long as it remains relevant to the vehicle's history, corresponding to the vehicle's normal lifespan. This does not apply to the personal data described in Section 6.8.

6.5 Traficom Search: Personal Data from the Vehicle Register

In a Traficom search we retrieve vehicle data for the registration number or VIN you enter from the transport register (liikenneasioiden rekisteri) maintained by the Finnish Transport and Communications Agency Traficom. The identifier you enter is passed on to a query to Traficom's register.

The result of a search may contain and show the following data about the owner or keeper of the vehicle (current and previous, depending on the tier of the search):

  • first and last name (the company name, for a company)
  • postal town
  • whether the person is an owner or a keeper, and the date on which the ownership or possession began
  • the vehicle's registration number, previous registration number and VIN, which may indirectly identify the owner or keeper.

We also store the postal code of the owner or keeper, but we do not display it. It is used only to tell owners with the same name apart when counting the number of owners.

Other personal data in Traficom's response, such as the owner's street address and the name of the policyholder, is neither stored nor displayed. It is removed from the response before it is stored.

6.6 Purpose and Legal Basis

We process this data so that a buyer of a vehicle can verify the vehicle's details and ownership in a consumer transaction, for example that the seller owns the vehicle being sold, and protect themselves against fraud. We use the data only to produce and present the result of the search.

Legal basis: legitimate interests (Article 6(1)(f) GDPR): the interest of the Company, the buyer and others involved in vehicle transactions in a reliable vehicle trade and the prevention of fraud. Traficom's permission granted to the Company covers the disclosure of the data to consumers through the Company's service, and the data is processed in accordance with Traficom's conditions (see Sections 5.12 and 5.13 of the Terms of Service).

6.7 Recipients

The result of a search is opened by the buyer through a link, and anyone who has the link can open it during its validity period (Section 3.5 of the Terms of Service). The result of a Traficom search is, however, intended for the buyer's own use and must not be shared or published (Section 5.16 of the Terms of Service). Owner and keeper data is not disclosed to anyone other than IT service providers acting as processors (Section 4.1.2) and, where necessary, authorities (Section 4.1.4).

6.8 Retention

The result of a Traficom search, including the owner and keeper data and the postal code it contains, remains accessible for 24 hours from the time the search is made and is deleted automatically from our database by an hourly purge, that is, within about 25 hours of the search. The stored content of a Carvian report is deleted 30 calendar days after the report is generated. After deletion the result or report can no longer be opened.

We retain only a search history permanently: the time of the search, the registration number and VIN entered and found, a summary of the vehicle (for example make and model), the outcome of the search (found, not found or error, including searches in which no vehicle was found), the product or tier purchased, the order and the code used, and which sources answered. This history contains no owner or keeper data and no email address, but it can be linked to an order, and a registration number or VIN may indirectly identify a person. We keep it for as long as necessary for customer support and bookkeeping.

6.9 Data Subject Rights and Information

If you are the owner or keeper of a vehicle and your name appears in the result of a Traficom search or in a Carvian report, you have the rights described in Section 7, including the right of access and the right to object to processing based on legitimate interests. The result of a Traficom search is deleted automatically within about 25 hours; on request we can delete the stored content of a Carvian report before the 30-day period expires.

We cannot change the source data in the register (Section 5.1 of the Terms of Service), so requests to correct inaccurate register entries must be made to Traficom.

In accordance with Article 14(5) GDPR, we inform data subjects through this publicly available Privacy Policy rather than individually, because we hold no contact details for them and individual notification would not be possible without disproportionate effort.

You may ask for a stored Report or the result of a Traficom search to be deleted before its retention period ends by writing to support@carvian.com. We then delete the stored result, after which its link no longer works. The result of a Traficom search is in any case deleted automatically within about a day.

Part III – General Provisions

7. Your Rights

7.1

Subject to the GDPR, you have the right to:

  • access your personal data
  • request correction of inaccurate data
  • request erasure of your personal data
  • request restriction of processing
  • receive your personal data in a portable format where processing is based on contract or consent
  • object to processing based on legitimate interests
  • withdraw any consent you have previously provided at any time.

7.2

Requests may be sent to support@carvian.com.

For requests relating to vehicle information, we may ask you to demonstrate your connection to the vehicle (for example by providing the vehicle registration certificate). For requests relating to personal data that appears in the result of a Traficom search or in a Carvian report, we also ask you to state the vehicle's registration number or VIN so that we can find the stored result, if it is still stored, and we will verify your identity.

We respond to requests within one month.

Where a request is particularly complex, this period may be extended by up to two additional months. If an extension is necessary, we will notify you within the initial one-month period.

8. Changes and Contact

8.1

All enquiries regarding privacy or personal data may be sent to support@carvian.com.

8.2

We may update this Privacy Policy from time to time, for example when our services, service providers or applicable legislation change.

The latest version will always be published on the Platform.

Where changes are material, we will also provide a notice on the Platform.