How we handle personal data

What we use, why, and on what legal basis

• Producing and delivering your report. Stripe passes us your email address, what you typed for the report (an address, PIN, folio, CCN, NPI, license number or coordinates), the product, the amount, the tax and the date. We use them to produce the report, email it to you, and handle a correction or refund. Legal basis: performing our contract with you (GDPR Art. 6(1)(b)). You have to give your email address and what the report is about to buy; without them we can’t produce or deliver it.
• Bookkeeping. We keep records of each sale for our accounts. Legal basis: our legal obligation under the Swedish Bookkeeping Act (Art. 6(1)(c)).
• Answering you and correcting reports. When you email us, including an enquiry composed by the form on Condo Assessment Risk, we use your name, email address and what you tell us to answer you, give you a quote, and check and correct what we publish. Legal basis: taking steps you ask for before a contract (Art. 6(1)(b)) where you ask for a quote, and otherwise our legitimate interest in answering questions and keeping our reports accurate (Art. 6(1)(f)). The enquiry form sends nothing by itself: it opens an email in your own mail program, and you decide whether to send it.
• Running the site securely. Our host receives your IP address and the pages you request. Legal basis: our legitimate interest in delivering the site and protecting it from abuse (Art. 6(1)(f)).
• Counting visits, only if you allow it. On civicdelta.com we ask whether we may use Google Analytics. If you choose “Allow analytics”, it records the pages you view, the site you came from, your device and browser type, and your approximate location, so we can see which pages help people. Addresses, PINs and order codes are removed from page addresses before anything is sent. Legal basis: your consent (Art. 6(1)(a)). If you choose “No thanks”, Google Analytics isn’t loaded and nothing is sent to Google. You can change your answer at any time with “Analytics choice” at the foot of every page.

No decision about you is made solely by automated means with legal or similarly significant effects. When an order can’t be matched automatically, a person looks at it.

What your browser sends while you use the site

The site is static. The free lookups run in your browser against files the site publishes, and what you type into them isn’t sent to us. Our fonts are served from this site, not from a third party. Apart from Google Analytics, which runs only if you allow it (see Cookies), these two exceptions send data directly from your browser to another organisation, and only when you use the tool concerned:

• Environmental Snapshot. When you run it, your browser sends the matched parcel’s map coordinates, not your address, to the US Environmental Protection Agency’s public ECHO service, which also receives your IP address. Legal basis: our legitimate interest in providing the lookup you asked for (Art. 6(1)(f)). This goes to a US public authority that the EU-US Data Privacy Framework does not cover, and it happens only when you run that tool.
• Condo Assessment Risk unit search. When you search, your browser sends the address or folio you typed, and your IP address, to the Miami-Dade County Property Appraiser’s public map service, hosted on Esri’s ArcGIS Online. Legal basis: as above. Esri, Inc. is certified under the EU-US Data Privacy Framework; the county, a US public authority, is not covered by it. It happens only when you search.

Cookies and local storage

We set no cookies unless you allow analytics. If you do, Google Analytics sets two cookies, _ga and _ga_EVM6BWM1M2, which tell one visit from the next and last up to two years. They aren’t needed to use the site, so under the Swedish Electronic Communications Act (2022:482), chapter 9, section 28, we ask before setting them. Your answer is stored on your device under the name cd-analytics so we don’t ask on every page; it is used for nothing else, and we ask again after a year. If you later choose “No thanks”, the two cookies are deleted.

If you switch between light and dark mode, your browser stores that choice on your device under the name cd-theme, so the site remembers it. It is stored only when you ask for it, is used only to provide that setting, and never leaves your device. Storage strictly necessary to provide a service the user has expressly asked for doesn’t require consent under the Swedish Electronic Communications Act (2022:482), chapter 9, section 28, so we don’t ask for it. You can clear it in your browser settings.

Who receives personal data

• Link and Stripe run checkout. Link is the merchant of record for your purchase, and Link and Stripe collect your payment details, billing details and email address as independent controllers under their own privacy policies. We never see your card details. Stripe, LLC is certified under the EU-US Data Privacy Framework.
• Cloudflare hosts the site and its domain, sends our emails from reports@civicdelta.com (Cloudflare Email Service), and receives mail sent to support@civicdelta.com and reports@civicdelta.com and forwards it to our mailbox (Cloudflare Email Routing). Cloudflare processes this data for us. Transfers to Cloudflare, Inc. in the US rely on its certification under the EU-US Data Privacy Framework, with EU Standard Contractual Clauses in its data processing addendum as a fallback.
• Google provides the Gmail mailbox where we read and answer your emails and, if you allow analytics, Google Analytics, which processes that data for us. We have turned off Google signals and ad personalisation for it, and Google keeps the analytics data for 2 months. Transfers to Google LLC in the US rely on its certification under the EU-US Data Privacy Framework and, where needed, EU Standard Contractual Clauses.

We don’t sell or rent personal data, and we don’t give it to anyone else unless the law requires us to.

How long we keep it

• Your order details (email address, what you typed, the report file and anything we fetched for your order): deleted 24 months after you pay, or sooner if you ask.
• Bookkeeping records (Stripe’s payout statements, and a record of each sale showing the product, amount, tax, date, payment status and Stripe’s payment reference, without your email address, what you typed or your report): kept until the end of the seventh year after the end of the calendar year of the sale, as the Swedish Bookkeeping Act (1999:1078), chapter 7, section 2, requires.
• Backups of our order records: overwritten within 8 weeks.
• Emails you send us: kept in the mailbox while we need them to answer you or deal with your order, and deleted when you ask.
• Email logs at Cloudflare (sender, recipient and subject of each email sent or forwarded): kept for 31 days. A copy of each email we send, including the attached report, is kept for about 7 days.
• Analytics data at Google, if you allowed it: 2 months.
• Payment data at Link and Stripe: kept under their own policies.

People named in the public records we publish

Our lookups and reports republish official US records that name people: payments to clinicians in CMS Open Payments, clinician names in the NPPES provider registry, owners of nursing homes listed in CMS ownership filings, and contractor licences in the California Contractors State License Board (CSLB) files. US law makes these records public so people can see them. We republish them because of our legitimate interest in making official records easier to find and read (GDPR Art. 6(1)(f)).

• You can ask to be removed. If you are named in one of these records, we remove you from our lookups and from the reports we produce, within one month. You don’t have to give a reason.
• How to ask. Email support@civicdelta.com with your NPI, your licence number, or the nursing home and the owner name as listed.
• What stays. Your record stays on the government’s own site, and we can’t change what the government publishes. Anonymous totals and medians may still include your figures, because they identify no one.

Your rights

You have the right to ask for access to your personal data, to have it corrected or erased, to restrict how we use it, to receive the data you gave us in a portable format, and to object to use based on our legitimate interests. Email support@civicdelta.com from the address you used, or say which order it was. We may ask you to confirm it is you. We answer within one month. Some data we have to keep, such as bookkeeping records, can’t be erased before the law allows. For payment data held by Link and Stripe, contact Link support.

If you think we have handled your data wrongly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), www.imy.se, or to the data protection authority where you live.

Children

Reports are for adults making property, care and hiring decisions. We don’t knowingly collect personal data from children. If you think a child has sent us personal data, tell us and we delete it.

Changes

If we change what we collect, why, or who receives it, we update this page and the date at the top.

Public-record data in CivicDelta reports is covered by our method: we don’t collect owner, buyer, seller or appellant names from property datasets.