Skip to main content
    Cardim IT

    Privacy Policy

    Last updated 2026-10-01

    Who we are

    Cardim IT AB, org.nr 559278-1453, Gothenburg, Sweden, is the data controller for this website. Contact: assistant@cardim.se.

    What we collect

    Contact form: your name, email address and message.

    Providing your details is voluntary, but we need your name, email and message to reply.

    Analytics: usage data through Google Analytics — only if you accept analytics cookies.

    Why and legal basis

    Answering enquiries: our legitimate interest in answering business enquiries and following up on them (Art. 6(1)(f) GDPR), or steps taken at your request prior to entering into a contract (Art. 6(1)(b)).

    Analytics: your consent, which you can withdraw at any time via “Cookie settings” in the footer.

    Processors and recipients

    Lovable (website hosting).

    Supabase (contact form processing) — EU region.

    Google (Analytics, only after consent).

    Our email provider — Google Workspace.

    Hosting and security

    The site is hosted by Lovable and delivered through Cloudflare. To deliver and protect the site, they process technical data such as IP address, browser type and requested pages in server logs.

    Two strictly necessary cookies are set by the hosting: __cf_bm (Cloudflare bot protection, about 30 minutes) and __dpl (Lovable deployment routing, session). They do not require consent.

    Transfers outside the EU/EEA

    Some processors may process data outside the EU/EEA. Such transfers rely on the EU–US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses.

    Retention

    Enquiries: up to 24 months unless a contract follows.

    Analytics data: 14 months.

    Your rights

    You have the right to access, rectification, erasure, restriction of processing, objection and data portability, and to withdraw consent at any time. Email assistant@cardim.se.

    We do not use automated decision-making or profiling.

    Complaints

    You can lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten), imy.se.

    Cookies

    • _ga — Google Analytics, distinguishes visitors. Set only after you accept. Expires after 2 years.
    • _ga_<ID> — Google Analytics, keeps session state. Set only after you accept. Expires after 2 years.
    • cookie-consent (local storage) — remembers your choice. No expiry until you clear it.
    • __cf_bm — Cloudflare, bot protection. Strictly necessary. About 30 minutes.
    • __dpl — Lovable, deployment routing. Strictly necessary. Session.