Privacy Policy

We care about your privacy. This policy describes which personal data we process, why we do it, how long we keep it, and what rights you have.

1. Data controller

Bildiagnos i Utby AB (corporate ID 559082-4800) is the data controller for the data processed when you use our website or book our services.

2. What data we collect

We collect data you provide yourself and technical information generated when you use the site:

• Contact details — name, email, phone number provided in our contact or booking forms.
• Booking details — registration number, vehicle make and model, mileage, problem description, preferred time.
• Account details — if you create a customer account, login details and history are stored via Clerk.
• Technical information — IP address, browser type, and language settings are collected in server logs for security and debugging.
• Analytics data — anonymized statistics about visits and behavior, only if you've given consent.

3. How we use your data

Your data is only used for the following purposes:

• Respond to questions and inquiries via the contact form.
• Book and confirm appointments for service, repair, or diagnostics.
• Manage your customer account and show your booking history.
• Improve site content and performance based on anonymized statistics.
• Meet legal obligations — for example accounting and warranties.

4. Legal basis for processing

We process your data on the basis of the following lawful grounds:

• Contract: Processing required to perform the service you ordered — booking, repair, invoicing.
• Consent: Analytics cookies and any marketing only happen after your active consent and can be withdrawn at any time.
• Legitimate interest: Security logging and service improvement are based on our legitimate interest, balanced against your privacy.
• Legal obligation: Some data we must retain under the Bookkeeping Act and other mandatory legislation.

5. Sub-processors

We use established providers who help us run the site and our services. All have signed data processing agreements with us:

• Convex — database and server logic (data stored in an EU region).
• Clerk — sign-in and account management.
• Vercel — hosting and content delivery for the site.
• Resend — transactional email — confirmations and notifications.
• Google (Calendar, Analytics, Maps) — calendar sync for bookings, optional analytics, maps on the contact page.

Some of these services may transfer data to countries outside the EU/EEA. Such transfers always rely on the European Commission's standard contractual clauses or equivalent safeguards.

6. How long we keep your data

We don't keep your data longer than necessary:

• Inquiries via contact form — for 12 months unless they lead to a booking.
• Bookings and service history — 7 years per the Swedish Bookkeeping Act.
• Customer account — as long as the account is active, then 90 days after you delete it.
• Analytics data — for 14 months, then anonymized or deleted.
• Invoicing records — 7 years per the Bookkeeping Act.

7. Your rights under GDPR

You have the following rights regarding your personal data:

• Right of access: You can request a copy of the data we process about you.
• Right to rectification: Incorrect or incomplete data can be corrected on your request.
• Right to erasure: You can request that your data be deleted, unless we are required by law to retain it.
• Right to restriction: You can ask us to temporarily stop using certain data while we investigate an objection.
• Right to data portability: You can receive your data in a structured, machine-readable format to transfer to another provider.
• Right to object: You can object to processing based on legitimate interest.
• Right to withdraw consent: Consent (e.g. for analytics cookies) can be withdrawn at any time via the cookie settings or by contacting us.

If you believe we are processing your data incorrectly, you have the right to file a complaint with the Swedish Authority for Privacy Protection (IMY).

8. Cookies

We use cookies to make the site work and to understand how it's used. Details about which cookies we use and how to control them are in our cookie policy.

9. Security

We protect your data with technical and organizational measures — encrypted connection (HTTPS), strict access control, security updates, and logging. Only authorized staff have access to data needed to do their work.

10. Changes to this policy

We may update this policy when services, regulations, or providers change. Major changes are announced on the site. The date at the top shows when the policy was last updated.