Privacy policy - Meksta Butik

This policy describes how Meksta AB processes personal data when you use Meksta Butik, for example when you search by your registration number, place an order or contact us. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and supplementary Swedish legislation.

1. Data controller

Meksta Butik is part of Meksta AB. We have not appointed a data protection officer, since our operations do not require one.

2. What data we process, why, and on what legal basis

2.1 Searching by registration number and VIN

When you search by a registration number or chassis number (VIN) in the shop, we process that number to identify the vehicle and show which engines fit it, with pricing.

• What happens technically: the number is sent to an external vehicle data provider, which returns data about the vehicle, for example make, model, model year and engine code. Registration numbers and VINs are personal data when they can be linked to an identifiable individual.
• What we do not do: we do not retrieve data about the vehicle's owner (such as name or address) at the search step, and we do not store any owner data. Vehicle data is only linked to a person in our systems if you place an order.
• Legal basis: steps taken at your request before a contract is entered into (Article 6(1)(b) GDPR), and our legitimate interest in being able to show the right product for your vehicle (Article 6(1)(f) GDPR).
• Retention: searches that do not lead to an order are kept for no longer than 30 days in technical logs and are not used for any other purpose.

2.2 Ordering and order handling

When you place an order, we process the data needed to fulfil the purchase:

• Name, address, email address and phone number.
• The vehicle's registration number and chassis number (VIN), which we use to verify the exact engine version before the build starts.
• Order data: product, price, deposit, delivery choice, order number and order history.
• Payment references from the payment service provider. We never receive or store full card details, these are handled by the payment service provider.
• Delivery and return data, including data relating to the core return and deposit refund.

Legal basis: performance of the contract with you (Article 6(1)(b) GDPR). For accounting: legal obligation under bokföringslagen (the Swedish Accounting Act) (Article 6(1)(c) GDPR). For documentation of VIN verification, warranty certificates and case history: performance of a contract and our legitimate interest in being able to manage and defend legal claims (Article 6(1)(f) GDPR).

2.3 Warranty, complaint and support cases

For a warranty or complaint case, we process case data: order number, vehicle details, description of the fault, fault codes, details of the installing workshop, and photos or video of the engine and vehicle that you or your workshop submit.

Legal basis: performance of a contract (Article 6(1)(b) GDPR), legal obligation under consumer legislation (Article 6(1)(c) GDPR), and our legitimate interest in being able to investigate, assert and defend legal claims (Article 6(1)(f) GDPR).

2.4 Email and other communication

When you email, call or use a form on the website (for example a quote request) we process the contact details and content you provide so that we can respond to and handle your enquiry.

Legal basis: steps taken before entering into a contract and performance of a contract (Article 6(1)(b) GDPR), and our legitimate interest in handling customer contacts (Article 6(1)(f) GDPR).

2.5 Cookies and analytics

The website uses cookies and similar technologies. Non-necessary cookies, for example for analytics and marketing, are only used with your consent, which you give via the cookie banner on your first visit and can change or withdraw at any time via Cookie settings in the footer. Details of which cookies are used, their lifetimes and any third parties are set out in the cookie information in the same interface.

Legal basis: consent (Article 6(1)(a) GDPR and lagen (2022:482) om elektronisk kommunikation, the Swedish Electronic Communications Act). Necessary cookies required for the website and the cart to function are used on the basis of our legitimate interest in providing the service.

3. Who we share data with

We never sell personal data. We share data with the following categories of recipients, only to the extent necessary:

• Freight companies and carriers: name, delivery address and phone number, for delivery of the engine and delivery notifications. You arrange the return transport of your old engine (the core) yourself, directly with a carrier of your choice.
• Payment service providers (for example card and invoice services such as Klarna): the data required to carry out the payment, refunds and credit checks. The payment service provider is independently responsible for its own processing, for example the credit check, and has its own privacy policy.
• Vehicle data provider: registration number and VIN, for looking up vehicle data under point 2.1.
• Our remanufacturing partner within the EU: vehicle data such as VIN, registration number and engine data, to the extent needed to verify and build the correct engine version and to handle warranty cases. Name, address and contact details are not shared with the remanufacturing partner, delivery and customer contact take place through us in Tyresö.
• IT and system providers: the e-commerce platform, customer systems, email and hosting, which process data on our behalf as data processors under a data processing agreement.
• Authorities: when we are required to by law, for example Skatteverket (the Swedish Tax Agency).

4. Transfer to countries outside the EU/EEA

Our remanufacturing partner and our shipping flows for the engines are within the EU. However, certain IT providers, for example the e-commerce platform and its subcontractors, may process data in countries outside the EU/EEA. When this happens, we use a valid transfer mechanism under the GDPR, for example an adequacy decision or the European Commission's standard contractual clauses, with supplementary safeguards where needed.

5. How long we keep data

Data is deleted or anonymised once the retention period has expired, unless we are required by law to keep it for longer.

6. Your rights

You have the right to:

• Access the personal data we process about you (a register extract).
• Have inaccurate data corrected.
• Have data deleted, when it is no longer needed for its purpose and we are not required to keep it, for example under bokföringslagen (the Swedish Accounting Act).
• Have the processing restricted in certain cases.
• Object to processing that is based on legitimate interest.
• Data portability: receive the data you have given us in a machine readable format, when the processing is based on contract or consent.
• Withdraw consent at any time, for example for cookies, without affecting the lawfulness of processing carried out before the withdrawal.

Contact us at info@meksta.se to exercise your rights. We respond without undue delay and no later than within one month. We may need to verify your identity before we disclose any data.

We do not make any decisions about you based solely on automated processing that have legal or similarly significant effects. The payment service provider's credit check is the provider's own processing, for which it is independently responsible.

7. Complaints

If you believe we are processing your personal data incorrectly, we would like you to contact us first, so we can put right what went wrong. You always have the right to lodge a complaint with the supervisory authority: Integritetsskyddsmyndigheten (IMY), Sweden's data protection authority, Box 8114, 104 20 Stockholm, Sweden, www.imy.se.

8. Changes to this policy

We may update this policy, for example when the service or the legislation changes. The current version is always available on this page, marked with the version date. In the event of material changes, we will inform you if you have an order in progress.