Privacy Policy

Data controller

Incrane, Gothenburg, Sweden is the data controller for the processing described in this policy.

Contact for privacy matters: info@incrane.se.

What data we collect

We collect the following data:

• Contact form: name, email address, phone number (optional), company (optional), selected service, and your message.
• Newsletter: email address and first name (optional) — see the Newsletter section below.
• Client portal: name, email address, and account details when you are invited to or sign up for our client portal, plus project-related information and messages.
• Email communication: the contents of emails you send us.
• Contacts at companies and associations that we approach ourselves: name, role, work email or another contact route the organisation has published, and our correspondence with them. We take the details from the organisation's own website and other public sources.
• Technical information: anonymised visitor statistics (see the cookie section below).

Why we process the data (legal basis)

• Responding to enquiries and quote requests — legitimate interest and pre-contractual steps (Art. 6(1)(b) and (f) GDPR).
• Contacting and following up companies and associations that we think could benefit from our services, using contact details the organisation has published itself — legitimate interest (Art. 6(1)(f)). You can object to this at any time (see Your rights).
• Delivering services and operating the client portal — performance of a contract (Art. 6(1)(b)).
• Sending confirmation and notification emails related to your enquiry or account — legitimate interest (Art. 6(1)(f)).
• Sending our newsletter — consent (Art. 6(1)(a)). You can withdraw your consent at any time.
• Accounting and invoicing — legal obligation (Art. 6(1)(c)).

How long we keep the data

Contact form enquiries are kept while the dialogue is ongoing and deleted no later than 12 months after the last contact, unless a client relationship has begun. The same applies to contact details and correspondence with organisations we approached ourselves that have not replied or become clients. Data tied to client agreements is kept for the duration of the agreement and thereafter as required by the Swedish Bookkeeping Act (normally 7 years for accounting records).

Newsletter

If you sign up for our newsletter we collect your email address and, if you choose to fill it in, your first name. We also store the language you signed up in and the time you gave your consent.

The legal basis is your consent (Art. 6(1)(a) GDPR). We use the data for one purpose only: sending the newsletter, roughly once a month. We do not use it for any other marketing, and we do not share it with anyone beyond the processor named below.

Sign-up is double opt-in. After you submit the form you get an email with a confirmation link, and you are added to the list only once you click it. If you do not confirm, you never become a subscriber.

The sending is handled by Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France) as our data processor. The data is stored inside the EU. Brevo also records whether you open or click in the email, so that we can see how the newsletter is received.

Every newsletter has an unsubscribe link at the bottom. Clicking it ends the subscription immediately — you do not need to give a reason. You can also email info@incrane.se and ask us to remove you.

We keep the data for as long as you are a subscriber. If you unsubscribe you are removed from the list at Brevo immediately, and we delete our sign-up record within three months. A sign-up that is never confirmed is deleted after twelve months. Withdrawing consent does not affect newsletters already sent.

Who has access to the data

We never sell your data. Data is shared only with the providers (data processors) required to run the website and our services:

• Convex (database and backend) — storage of enquiries, accounts, and project data.
• Clerk (sign-in and account management for the client portal).
• Vercel (hosting and anonymised visitor statistics).
• Resend (transactional email, e.g. confirmations).
• Brevo / Sendinblue SAS, France (newsletter delivery) — data stored inside the EU.

Transfers outside the EU/EEA

Some of our providers process data in the United States. Transfers rely on the European Commission's Standard Contractual Clauses (SCCs) and/or the EU–U.S. Data Privacy Framework.

Your rights

Under the GDPR you have the right to:

• Request access to the data we hold about you.
• Have inaccurate data corrected.
• Have your data erased (“the right to be forgotten”).
• Request restriction of, or object to, the processing.
• Receive your data in a machine-readable format (data portability).
• Lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se.

Cookies

incrane.se uses strictly necessary cookies only. No marketing or tracking cookies are set, which is why no cookie banner is shown.

• Sign-in (Clerk): necessary session cookies required for the client portal and sign-in to work. Set only in connection with signing in.
• Statistics (Vercel Analytics): cookie-free, anonymised visitor statistics — nothing identifying is stored in your browser.

Changes to this policy

We may update this policy when needed, for example when changing providers or launching new features. The latest version is always available on this page. We notify active clients by email of material changes.