Privacy Policy

Last updated: 18 September 2026

Kruvion AB ("we", "our", "us") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our Website at www.kruvion.com (the "Website") in accordance with data protection laws (which includes the European General Data Protection Regulation (GDPR), as amended and/or incorporated into the laws of the United Kingdom of Great Britain and Northern Ireland (UK), if applicable and other applicable EU, Member State and UK laws). Please read this Privacy Policy carefully. By accessing our Website or doing business with us, you confirm you have read and understand our Privacy Policy. For any data protection inquiries or queries related to this Privacy Policy, please use the contact details provided in this policy.

Personal Data We Collect and Process

"Personal data" means any information relating to an identified or identifiable natural person ('data subject'). We collect and process various types of personal data depending on our interactions with you. This may include:

• Data collected directly from you

  We may collect the following information when you contact us, submit an enquiry, book a service or otherwise work with Kruvion:

  • Contact information: Your name, email address, telephone number and, where required, postal or billing address.

  • Billing and payment information: Information needed to issue invoices and confirm payment. Card and other electronic payment details are processed by our payment providers and are not stored directly by Kruvion.

  • Booking and service information: Details about the service requested, preferred timing, vehicle location and other practical arrangements.

  • Vehicle information: Information such as the vehicle identification number (VIN), registration number, listing details, specification, history, documentation and seller or dealer information.

  • Communications: Emails, enquiry-form submissions, telephone notes and other communications relating to your enquiry or engagement.

  • Assessment materials: Photographs, diagnostic information, notes, findings and reports produced or obtained while providing the service.

  • Other information: Any additional information or documents you voluntarily provide to us.

  
  

• Automated data collection through our Website: When you visit our Website or use our services, we may automatically collect data such as IP addresses, cookie identifiers, other online identifiers, and location data. This may also include information about your device, browser type, and interactions with our Website (e.g., pages viewed, clicks). These technologies may create profiles of natural persons.

• Third-Party Services: We may collect and process your data with trusted third-party service providers who assist us in operating our Website, conducting our business, or providing our services to our users, so long as those parties agree to keep this information confidential. Our Website is hosted by a third-party service provider called Squarespace. Learn more about Squarespace below.

• Invoicing
  
  We use branded invoices to collect payments. We may collect information like your:

  • Email address

  • Invoice details (for example, line items)

  • Name

  • Payment history

  
  

• Taxes
  
  We use automated taxes to confirm applicable tax rates and we may collect information like your:

  • Billing and shipping address

  • Details relating to your purchase (for example, Product Tax Codes for the items purchased)

  • Name

  
  

• Form Blocks
  
  When you submit information to this Website via webform, we collect the data requested in the webform in order to track and respond to your submissions. We provide this information to Squarespace, our third-party Website service provider, so that they can provide website services to us and help us manage our relationship with you. We also provide this information to google.com for storage and with Zapier for data porting.

Special Categories of Personal Data: We generally prohibit the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation. We will only process such special categories of personal data if one of the specific exceptions under Article 9(2) of the GDPR applies, for example:

• You have given explicit consent for one or more specified purposes.

• It is necessary for reasons of substantial public interest, based on Union or Member State law, with suitable and specific measures to safeguard your rights and interests.

• It is necessary for the purposes of preventive or occupational medicine, medical diagnosis, health or social care, or the management of health/social care systems and services, processed by a professional subject to professional secrecy obligations.

• The data has been manifestly made public by you.

How We Use Your Personal Data

Depending on how you engage with our Website and services, we use the information we collect for the following purposes:

• To operate and maintain our Website.

• To provide you with the services, fulfil your orders and arrange shipping.

• To tailor your experience and remember your preferences.

• To improve our Website and services.

• To communicate with you about your transactions, service-related announcements and assist with customer support

• To process your payments from you for services requested.

• To perform marketing activities about our products, services and promotions messages.

• To foster the safety, security and integrity of our Website and services, including fraud and risk monitoring related to payments. investigate or take action regarding possible fraudulent, illegal or malicious activity, and to secure our Website and services

• To analyze Website traffic and usage trends (e.g., via Google Analytics).

• To manage third-party service relationships.

• To comply with applicable legal requirements, such as tax and other government regulations and industry standards, contracts or law enforcement requests.

Legal Basis To Process Your Personal Data

We process your personal data for specified, explicit, and legitimate purposes. The legal bases for our processing activities are as follows:

• Your Consent: We will process your personal data when you have given us clear, affirmative consent for one or more specific purposes. For example, for sending you marketing communications, or for certain types of cookies. You have the right to withdraw your consent at any time. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.

• Performance of a Contract: Processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract. For example, to provide you with the services or goods you have requested.

• Compliance with a Legal Obligation: Processing is necessary for compliance with a legal obligation to which we are subject.

• Protection of Vital Interests: Processing is necessary in order to protect your vital interests or those of another natural person. This applies in emergency situations, such as to protect your life or physical integrity.

• Performance of a Task Carried Out in the Public Interest or Exercise of Official Authority: Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us. The purpose of such processing will be determined by Union or Member State law.

• Legitimate Interests: Processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms, especially if you are a child. Our legitimate interests include:

  • Improving our services and products: To understand how our services are used and to enhance their functionality and user experience.

  • Marketing our products and services: To inform you about our offerings that may be of interest to you.

  • Preventing fraud and ensuring network security: To protect against unauthorized access, malicious code distribution, and other cyber threats.

  • Internal administrative purposes: For processing client or employee data within our group of undertakings.

  • Processing by public authorities in the performance of their tasks is not based on legitimate interests.

How We Disclose Your Information

As part of the services we provide, we may disclose information about you to third parties, on your behalf to provide the services request, for legitimate purposes, legal obligation and by your consent in accordance with this Privacy Policy. We only share your information with service providers to help run our business. This may include:

• Squarespace and other vendors. Squarespace and other vendors assist us in providing the services (e.g. website hosting, scheduling, order processing, invoicing, transacting, payment processing, shipping, customer accounts or subscriptions, form blocks). Please see below for more information about our platform provider, Squarespace.

• Payment Processing. We transmit your payment information via an encrypted connection to our payment processors, to enable us to operate and provide the payments services.

• Customer support vendors. These vendors assist us in hosting our support offerings.

• Safety and security vendors. These vendors enable us to keep our services safe and secure.

• Sales and marketing vendors. These vendors assist us in sending marketing and other communications.

• Third party plugins and social networks. We may disclose information about you to other parties that operate website plugins, social media platforms or similar third party services to improve your experience, at your direction, or when you intentionally interact with the plug-in.

• Your Consent. When you provide us with a direction or request to provide certain information to a third party.

• Following the law or protecting rights and interests. We disclose your information if we determine that such disclosure is reasonably necessary to comply with the law or law enforcement, protect our or others' rights, prevent fraud and abuse, or prevent other criminal or illegal activity.

• Corporate group. With affiliates to within our company group.

Data Retention and Security

We retain personal data for no longer than is necessary for the purposes for which it was collected or otherwise processed. In some cases, personal data may be stored for longer periods if processed solely for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, provided appropriate safeguards are in place for individuals' rights and freedoms.

We implement appropriate technical and organizational measures to ensure the appropriate level of security and confidentiality for the personal data we process. This includes protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage. Our measures include, but are not limited to:

• Using SSL certificates (HTTPS) to encrypt data shared between our Website and servers.

• Implementing strong password policies for administrative accounts.

• Minimising the collection of personal data to only what is necessary for our stated purposes.

While we strive to protect your personal data, no method of transmission over the Internet or method of electronic storage is 100% secure. Therefore, we cannot guarantee its absolute security.

Your Data Protection Rights

Under data protection laws in the European Economic Area and the UK, you have several important rights regarding your personal data. We are committed to facilitating the exercise of these rights. These rights include:

• Right to be Informed: You have the right to receive clear, transparent, and easily understandable information about how we use your personal data and your rights. This Privacy Policy aims to provide you with this information.

• Right of Access: You have the right to obtain confirmation as to whether or not personal data concerning you is being processed, and, where that is the case, access to the personal data and certain information about the processing, free of charge.

• Right to Rectification: You have the right to have inaccurate personal data concerning you rectified without undue delay. You also have the right to have incomplete personal data completed, including by means of providing a supplementary statement. If we have shared incorrect data, we will inform recipients of the change where possible.

• Right to Erasure: In certain circumstances, you have the right to ask us to erase your personal data without undue delay, for example, if the data is no longer necessary for the purposes for which it was collected or if you withdraw consent and there is no other legal ground for processing. We are not obliged to erase data if processing is necessary for exercising the right of freedom of expression and information, compliance with a legal obligation, reasons of public interest (e.g., public health, scientific/historical research), or for the establishment, exercise, or defense of legal claims.

• Right to Restriction of Processing: You have the right to request the restriction of the processing of your personal data in certain situations (e.g., if you contest the accuracy of the data, or the processing is unlawful but you oppose erasure).

• Right to Data Portability: Where processing is based on consent or a contract, and is carried out by automated means, you have the right to receive the personal data concerning you in a structured, commonly used, and machine-readable format and have the right to transmit those data to another controller without hindrance from us. This includes data you provided and data observed from your behavior.

• Right to Object: You have the right to object, at any time, to the processing of your personal data for direct marketing purposes, or when processing is based on our legitimate interests or for a task in the public interest, unless we demonstrate compelling legitimate grounds for the processing that override your interests. In the case of direct marketing, we are always obliged to stop processing your personal data if requested.

• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. The process for withdrawing consent should be as easy as giving it.

• Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority, particularly in the EEA Member State or the UK of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the data protection laws in the EU or the UK.

To exercise any of these rights, please contact us using the contact details provided in this Privacy Policy. In accordance with applicable laws, we may be required to verify your identity or request additional information prior to processing your request.

Squarespace Platform

Our Website and certain services we provide are hosted by Squarespace. Squarespace, as our processor collects and processes personal data for the purpose of providing the services to us and to improve the services to you. Squarespace may also act as an independent controller for some personal data relating to your use of the services and is responsible for processing such personal data in compliance with applicable laws. Please see Squarespace Privacy Policy for details relating to your end user site usage information, for which they act as an independent controller. We share personal data and other information with Squarespace as part of the services they provide to us.

Data Transfers

As our Website is hosted by Squarespace, a U.S.-based company, certain personal data may be transferred outside the European Economic Area (EEA) or the United Kingdom (UK) (a "third country") or to an international organisation and transferred to and stored in the United States. In accordance with applicable data protection laws in the EEA and UK, Squarespace relies upon a number of means to transfer personal data. These include:

• Adequacy decision. In accordance with Article 45 of the GDPR, a country that European Commission, UK or Swiss data protection supervisory authority(ies) have confirmed, by decision, offers an adequate level of data protection (adequacy decision).

• Data Privacy Frameworks. Transfer of personal data to Squarespace, Inc. in the US from, as applicable, the EEA, Switzerland and the UK pursuant to the Data Privacy Frameworks. An adequacy decision was adopted for the EU-U.S. Data Privacy Framework, Swiss-US Data Privacy Framework and the UK Extension to the EU-US Data Privacy Framework (each individually and jointly, the Data Privacy Frameworks).

• Standard data protection clauses ("SCCs") and other transfer methods. For countries without an adequacy decision, in accordance with Article 46 of the GDPR, recipients may enter the approved form of transfer contract (SCCs) for the transfer of personal data outside the EEA or UK.

Children's Privacy

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you are a parent or guardian and you are aware that your child has provided us with personal data, you may contact us. If we become aware that we have collected personal data from children without verification of parental consent, we take steps to remove that information from our servers.

Cookies & Analytics

Some information is collected automatically using cookies and similar technologies. [You can read more about our use of cookies in our Cookie Policy].

This Website uses cookies and similar technologies, which are small files or pieces of text that download to a device when a visitor accesses a website or app. For specific information about the cookies dropped on your device by our third-party website hosting service provider, Squarespace, visit The cookies Squarespace uses.

• These functional and required cookies are always used, which allow Squarespace, our hosting platform, to securely serve this Website to you.

• These analytics and performance cookies are used on this Website, as described below, only when you acknowledge our cookie banner. This Website uses analytics and performance cookies to view Website traffic, activity, and other data.

This Website may collect personal data to power our Website analytics, including:

• Information about your browser, network, and device

• Web pages you visited prior to coming to this Website

• Your IP address

This information may also include details about your use of this Website, including:

• Clicks

• Internal links

• Pages visited

• Scrolling

• Searches

• Timestamps

We use this information to learn about Website traffic and activity.

Third-Party Services and External Links

Our Website may contain links to third-party Websites or services, or integrate with third-party services. These third-party services may have their own privacy policies governing the collection and use of your information. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal data through their platforms. If your Website uses third-party services through connected accounts or code-based integrations, check with those platforms to review how they manage visitor data, as our privacy policy only addresses our own practices and our hosting platform's core functions.

Fonts

This Website serves font files from and renders fonts using Google Fonts and Adobe Fonts. To properly display this site to you, these third parties may receive personal information about you, including:

• Information about your browser, network, or device

• Information about this site and the page you're viewing on it

• Your IP address

Changes to This Privacy Policy

We may update this privacy policy from time to time to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will notify you of any changes by posting the new Privacy Policy on this page and updating the 'Last updated' date. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

Contact Us

If you have any questions about this Privacy Policy or any data protection inquiries, please contact us at: Website: www.kruvion.com, Email: info@kruvion.com, Address: Umeågatan 25, Ängelholm 26265