Legal
Privacy notice
What vehiq.app does with personal data, part by part: what it handles, what for and on what legal basis, who receives it and how long it is kept.
01
Who is behind the site
vehiq.app is a public vehicle-information site run by the company named below, which is responsible (the controller under the GDPR, the EU data protection regulation) for the personal data described here. To ask about your personal data, to have it corrected or deleted, to object to a use of it or to withdraw a consent you gave, write to the contact address below. The company's details are also in the Imprint.
- Company
- SIAX Technology AB
- Legal form
- Aktiebolag
- Registered address
- Kringvägen 31, 622 66 Gotlands Tofta, Sweden
- Organisation number
- 559552-6194
- Contact address
- privacy@vehiq.app
02
What each part of the site does with your data
Looking at the site, searching for a vehicle and comparing vehicles need no account. This list covers everything the site's code does with personal data or with data that can be linked to you. For each part it states the legal basis. "Legitimate interests" means Article 6(1)(f) of the GDPR: our interest in running a safe and useful vehicle-information service, weighed against your interests and rights.
Opening a page
- What is handled
- What your browser sends with every request: the page address, your language and browser type, and the network address the request comes from.
- What for
- To send you the page, and to limit how many requests one visitor can make to lookups, searches and forms so that the service stays available and safe. Legal basis: legitimate interests (Article 6(1)(f)).
- Who receives it
- Our servers. Cloudflare sees the traffic on its way there (see Who receives data, and transfers).
- How long it is kept
- The request counter is kept only for the length of the limit window, which is measured in minutes. When you open an ordinary page the site sets no cookie and stores nothing about the visit.
Searching for a vehicle and looking up a plate
- What is handled
- What you type (a registration number, a VIN, or words such as a make and model) and the market you choose. The address of a vehicle page contains an identifier for the vehicle.
- What for
- To find the vehicle and show its page. Legal basis: legitimate interests (Article 6(1)(f)), in giving you the result you asked for.
- Who receives it
- Our servers pass the request to VehIQ's vehicle data service, together with your network address and, if you have one, your guest identifier, so that the service can apply its own limit. The service answers from the data VehIQ holds.
- How long it is kept
- The site stores nothing about the search on our servers. The list of your latest searches in the search box lives only in your browser. Your first lookup, search, sell request or sign-in start gives your browser a guest identifier in a cookie, which the request limit uses and which lasts 1 day. What the vehicle data service itself keeps of a request is outside this site's code.
Data about vehicles, including registration numbers
- What is handled
- Data about vehicles that VehIQ collects from public registers (such as the Dutch vehicle register, RDW) and from public vehicle advertisements that VehIQ observes on marketplaces, and shows on vehicle pages: registration number or VIN, make, model, year, technical data, inspection and recall information where available, an advertisement's asking price, marketplace, place and date last seen, and aggregate figures such as how many times ownership has changed. Someone who has other information can link a registration number to a person, so we treat it as personal data. We do not publish the name, address, telephone number or any other identity of an owner or a seller, and ownership history is shown only as aggregate figures about the vehicle.
- What for
- To give buyers, sellers and the public information about a vehicle, with its source and an indicative price range. Legal basis: legitimate interests (Article 6(1)(f)), in public vehicle information that helps people judge a vehicle, limited to data about the vehicle. You can object at any time (see Your choices); we then remove or suppress the data in question unless we have compelling grounds not to.
- Who receives it
- Anyone who opens a vehicle page: the pages are public. The data is held on our own servers, in VehIQ's vehicle data service.
- How long it is kept
- There is no fixed end date, because the pages show a vehicle's history. Vehicle data is kept for as long as it is current and useful for that purpose, and is removed sooner if you object or ask for erasure and the request is justified.
Page performance measurements
- What is handled
- How fast a page loaded and responded (a timing and its rating), the type of page (not its address), your language and a random id for that one measurement. No name, account or guest identifier.
- What for
- To find slow pages. Legal basis: legitimate interests (Article 6(1)(f)), in keeping the site fast.
- Who receives it
- Our own server only. Nothing is sent to a third party.
- How long it is kept
- Kept for a rolling window of some weeks and then discarded.
Saving, following and comparing vehicles without an account
- What is handled
- The vehicles you choose to save, follow or compare, kept under the random guest identifier that is stored in a cookie in your browser.
- What for
- To show your saved, followed and compared vehicles when you come back in the same browser. Legal basis: providing the function you asked for (Article 6(1)(b)).
- Who receives it
- Our servers, in the site's session store.
- How long it is kept
- 60 days after your last change. If you delete the cookie in your browser, the list can no longer be reached from that browser.
Recently viewed (off until you switch it on)
- What is handled
- Only after you switch it on in My garage: the vehicles you open, up to 10 vehicles, in your guest record.
- What for
- To show the Recently viewed list in My garage. Legal basis: your consent (Article 6(1)(a)), given by switching it on; you withdraw it by switching it off.
- Who receives it
- Our servers, in the same session store.
- How long it is kept
- 60 days after your last change, or until you switch it off, which deletes the list at once. Signing in clears it too: the list and the choice are not carried into your account. Until you switch it on, opening a vehicle page records nothing and sets no cookie.
The contact form
- What is handled
- What you type: your e-mail address and, if you give them, your name, company and message, and the reason you chose. The form also records which page it was sent from.
- What for
- To receive your message and answer it. Legal basis: legitimate interests (Article 6(1)(f)), in answering the people who write to us.
- Who receives it
- The site's own database, which we read to reply. A record of the submission (its outcome, and one-way hashes of your e-mail address and your network address, never the plain values) goes to the server log and to an audit service.
- How long it is kept
- As long as needed to answer you and follow up, and then deleted; sooner if you ask. The site's code sets no automatic deletion period for messages. Write to the contact address to have yours deleted.
The sell-your-car request
- What is handled
- Your name, your e-mail address, an optional phone number, the vehicle you chose and your tick in the consent box.
- What for
- To pass your request on: with your consent, the valuation and your contact details are shared with dealers so they can make you a purchase offer. VehIQ takes no other action on your behalf. Legal basis: your consent (Article 6(1)(a)), given by ticking the box, which you can withdraw; handling the request is the service you asked for (Article 6(1)(b)).
- Who receives it
- Our servers pass it to VehIQ's vehicle data service, which stores the request, and, as the consent text says, to dealers. The request is refused unless the box is ticked.
- How long it is kept
- As long as needed to pass on and follow up the request, and then deleted; sooner if you ask. The site's code sets no automatic deletion period for sell requests. Write to the contact address to have yours deleted.
Signing in and your account
- What is handled
- At the sign-in service you enter your credentials; the site never sees them. The site receives an account identifier and, if the service provides it, your e-mail address, and keeps them with the sign-in tokens in an encrypted cookie while you are signed in. While you are signed in, the vehicles you save or follow are stored under your account identifier. While an alert ("Email me if this changes") is on for a followed vehicle, VehIQ's backend also stores the e-mail address the alert goes to, a snapshot of the vehicle details it last compared, and when it last checked the vehicle and last e-mailed you.
- What for
- To keep you signed in and to keep your saved and followed vehicles across devices. If you switch on "Email me if this changes" for a followed vehicle, your account e-mail address is used to send you that alert. Legal basis: providing the function you asked for (Article 6(1)(b)).
- Who receives it
- The sign-in service (SIAX ID) and VehIQ's own services behind the site, where your saved and followed vehicles are stored.
- How long it is kept
- The sign-in cookie lasts as long as the cookies page says and ends when you sign out. Saved and followed vehicles are kept until you remove them or delete your data from the account page. That deletion covers what the site stores, not your sign-in identity: deleting that is not self-service yet, so write to the contact address. Alert data is used after you sign out too: VehIQ's backend checks followed vehicles in the background and e-mails the stored address when something changes. The address is deleted when you switch the alert off; all alert data is deleted when you stop following the vehicle or delete your data from the account page. An address that has not been confirmed by a visit to your garage for 180 days is no longer e-mailed.
03
Who receives data, and transfers
The site runs on dedicated servers that SIAX Technology AB rents from Hetzner, in Germany and Finland. Traffic to the site passes through Cloudflare on its way to those servers, so Cloudflare sees it in transit. Mail sent to our addresses is handled by Proton, the mail host of vehiq.app. These providers handle data on our behalf (they are processors).
Signing in is handled by SIAX ID, the sign-in service of SIAX Technology AB. You enter your credentials there, not on vehiq.app. The vehicle data service and the alert mailer behind the site are operated by the same company.
The site loads no third-party analytics, advertising or tracking scripts and sets no analytics or advertising cookies.
Our servers are in the EU. Cloudflare is a US company: where it handles traffic outside the EEA, the transfer rests on the EU-US Data Privacy Framework and on the standard contractual clauses in Cloudflare's own terms. Proton is in Switzerland, which has an adequacy decision from the European Commission. The site sends personal data to no other country. The Trust and data page says what we can and cannot show about where data is processed.
04
Your choices
The Recently viewed list is off until you switch it on in My garage, and switching it off deletes it. Your language, your colour theme and your latest searches are stored in your browser only; you can delete them in the browser's settings. When you are signed in, the account page lets you download what the site stores about you and delete it. That covers what this site stores, not your sign-in identity: to have that deleted, write to the contact address.
Your rights: you can ask us for access to your personal data and a copy of it, for correction, for erasure, for restriction of processing and for data portability. You can object at any time to processing that rests on legitimate interests, and where processing rests on your consent you can withdraw it at any time, which does not affect what was done before. Write to the contact address; we answer within one month.
You can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY, imy.se), which supervises us, or to the data protection authority of the country where you live or work. Giving us data through the forms is voluntary, but we cannot answer a message or pass on a request without it. We take no decision about you by automated means that has legal or similarly significant effects.
05
Cookies and local storage
The cookies and browser storage the site uses are listed, with their purpose and lifetime, on the cookies page. The list is generated from the site's code. None of the items needs a consent banner; that page says why.
06