Privacy notice

1. Controller and contact

EVImport is a trading name of Driftly AS, organisation number 937 992 572, Solstrandvegen 20, 5200 Os, Norway. Driftly AS controls personal data used to operate EVImport. Contact support@evimport.no for privacy enquiries and rights requests; an active account is not required.

2. Data and sources

We process contact and company details, user roles, login and language/market preferences, correspondence, quotations, order lines, delivery details, vehicle/VIN information and documents needed for shipping, approval, warranty and invoicing. Documents may contain contact names and signatures. Do not upload identity documents or sensitive information unless specifically requested through an appropriate channel.

Payment records include amounts, currencies, order/transaction references, status and authorisation for recurring payments. Technical logs may contain IP addresses, times, browser information and security events. Sources include you, your company, parties fulfilling an order and payment-provider status notifications.

3. Purposes and legal bases

Our legitimate interests (GDPR Article 6(1)(f)) generally support business-contact administration, account access, service delivery to your company, security, abuse prevention and legal claims. We assess necessity and privacy impact; you may object. Where you personally are the contracting party, necessary contract processing relies on Article 6(1)(b). Accounting obligations rely on Article 6(1)(c).

Voluntary vehicle interest, approved lead sharing and any consent-based marketing rely on separate consent under Article 6(1)(a). Recurring-payment authorisation is not blanket privacy consent. Necessary contact and order details are required to supply the requested service; optional fields and consents remain voluntary. Registering vehicle interest does not subscribe you to a newsletter.

4. Vehicle interest

The free interest form records model, country, postcode/town and email. Confirmation links expire after 48 hours; confirmed interests remain active for 180 days. Expired records are removed during cleanup and must no longer be used for matching.

Contact details are shared only with a named dealer you expressly approve, never with exporters. That dealer is responsible for its subsequent contact. Anonymous dealer-recruitment summaries require at least five interests for a model and place and exclude email and postcode. Contact us to withdraw interest or sharing consent. Withdrawal does not invalidate prior lawful processing.

5. Recipients and payment providers

Staff access follows job responsibilities. Technical hosting, email, document and support providers may process necessary data on our behalf under appropriate processing agreements. Accountants, auditors and authorities receive information when required. Order-specific details may be shared with an exporter, carrier, approval body or subcontractor; recipients may have independent responsibilities.

You pay EVImport / Driftly AS for our products and services. Airwallex processes the payment and receives information such as email, amount, currency and payment reference. Card details are entered with the payment provider; EVImport does not collect card numbers or CVC in its payment forms. Airwallex may act independently for payment processing, security and statutory checks. Vehicle purchase money is paid directly between dealer and exporter.

Airwallex and participating card acquirers independently control transaction data used for payment processing, security and statutory checks. Their privacy notices are on their own websites; Airwallex is linked below. When you start checkout, Airwallex may also receive your IP address, browser/device information and information about checkout usage. For expressly authorised automatic renewal, the payment method is stored with Airwallex. EVImport stores payment references and mandate evidence, not card numbers or CVC.

6. Transfers outside the EEA

An order may involve an exporter or recipient outside the EEA, including China. Sharing must be limited to necessary data. Transfers covered by GDPR Chapter V require an appropriate transfer basis, assessment and any supplementary safeguards before taking place, for example an adequacy decision or EU standard contractual clauses. Ordering or accepting these pages does not replace those requirements. Contact us for recipients, countries and safeguards relevant to your case, including copies of applicable guarantees.

7. Retention

Account and contact data are kept for access and the customer relationship, then reviewed for deletion, anonymisation or justified retention. Rejected/closed enquiries without an order are reviewed within 24 months, sooner when their purpose ends. Primary accounting records are normally kept for five years after the financial year ends.

Order/vehicle documents may be needed longer for warranties, approvals or claims. The system review point for completed orders is ten years; this does not justify keeping every personal detail for ten years. Retention must be assessed by record and purpose. Technical logs are retained according to security and incident needs with restricted access. Privacy-export download links expire after seven days.

Backups may retain older data until overwritten under operating procedures. Restoring them must respect earlier deletion requests. Not every deletion process is automatic. Ask us for the retention period or deletion of records in your case.

8. Cookies

Cookies support login, access and language/market preferences. ev_access and ev_admin_access follow token validity; ev_refresh and ev_admin_refresh may last seven days. ev_locale and ev_market may last one year. Temporary support access has a short-lived cookie. Login cookies are HttpOnly and secure over HTTPS in production.

With your consent, we use Google Analytics for statistics on public pages. Google receives page views without URL parameters, a browser identifier and browser/device information; the IP address is involved in network communication. We do not send form, account, order or payment data. Ad personalisation and Google Signals are disabled. _ga and _ga_* may remain for up to 180 days. ev_analytics_consent stores your choice for 180 days. Processing is based on consent; refusal does not affect the service. Withdraw consent through the footer settings to stop measurement and remove Analytics cookies. Google may process data outside the EEA; see its privacy information and transfer safeguards at policies.google.com/privacy. Payment provider pages have their own cookies and notices.

9. Your rights

Subject to applicable conditions, you may request access, correction, deletion, restriction and portability, object to legitimate-interest processing and withdraw consent. Statutory retention and necessary claims can limit these rights; we explain refusals. Contact support@evimport.no. We may reasonably verify your identity without requesting passwords or card details.

We normally respond within one month and explain any lawful extension within that first month. You may complain to the Norwegian Data Protection Authority at datatilsynet.no.

10. Automation and updates

Tools may assist translation, document processing, notifications and payment status. They can make mistakes. Material contract and delivery decisions require checked records and agreement, rather than relying only on automatic translation or status. Contact us to challenge an incorrect record. Material changes to purposes require new information and, where necessary, fresh consent before processing begins.