Privacy Policy

1. Legal Basis for Data Processing

We process your personal data in accordance with:

• UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 applicable in the United Kingdom,
• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (EU GDPR) — where applicable to customers in the European Economic Area.

The primary legal basis for processing is Article 6(1)(b) UK GDPR / EU GDPR — processing necessary for the performance of a contract (purchase and registration of the e-vignette in the name and on behalf of the User). We also process data on the basis of:

• Article 6(1)(c) UK GDPR / EU GDPR — compliance with a legal obligation (taxes, accounting records),
• Article 6(1)(f) UK GDPR / EU GDPR — legitimate interest (defence against claims, improving service quality),
• Article 6(1)(a) UK GDPR / EU GDPR — user consent (direct marketing).

Where the e-vignette is registered within 14 days of purchase, the Customer expressly requests immediate commencement of performance and acknowledges that they lose the right of withdrawal from the contract upon registration of the e-vignette in the operator's system, in accordance with Regulation 36(2) of the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 (UK) and Article 16(a) of Directive 2011/83/EU. Where the e-vignette is registered later than 14 days after purchase, the Customer retains the full 14-day right of withdrawal. Details are set out in Section 7 of the Terms and Conditions.

2. Scope of Processed Data and Purposes

We collect and process data exclusively for clearly defined and legitimate purposes:

3. Recipients of Personal Data

User personal data may be transferred to the following categories of recipients:

• official toll systems — the registration number and vehicle data, and for a Hungary vignette (Magyar Közút Nonprofit Zrt., formerly NÚSZ) also the purchaser's address details, solely in order to register the vignette in their name,
• Stripe Payments Europe Ltd — data necessary to process the payment transaction,
• IT and hosting service providers — only to the extent necessary to provide the services,
• Public authorities — only on the basis of applicable law.

Where personal data is transferred outside the United Kingdom or the European Economic Area (e.g. to Stripe Inc. in the United States), the Company applies appropriate safeguards including UK International Data Transfer Agreement (IDTA) or EU Standard Contractual Clauses (SCC) approved by the European Commission.

4. Data Retention Period

• Transactional data and accounting documents: 6 years from the date of the transaction (HMRC and UK Companies Act 2006 requirements),
• Order data: 3 years from the date of fulfilment (legitimate interest — handling claims),
• Marketing data: until consent is withdrawn by the user.

5. Your Rights

Under UK GDPR and EU GDPR you have the following rights:

• Right of access (Article 15) — you can request a copy of the data being processed,
• Right to rectification (Article 16) — you can request correction of inaccurate data,
• Right to erasure (Article 17) — the "right to be forgotten", subject to the Company's legal obligations,
• Right to restriction of processing (Article 18) — you can request temporary suspension of processing,
• Right to data portability (Article 20) — you can receive your data in a structured format,
• Right to object (Article 21) — you can object to processing based on legitimate interest,
• Right to withdraw consent at any time — without affecting the lawfulness of processing carried out previously.

To exercise the above rights, please contact us at: info@europe-vignettes.com

6. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with the competent supervisory authority:

• United Kingdom: Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow SK9 5AF, ico.org.uk,
• European Union: your local Data Protection Authority — list available at edpb.europa.eu (e.g. CNIL in France, BfDI in Germany, Garante in Italy, AEPD in Spain, UODO in Poland).

7. Data Security

We implement appropriate technical and organisational measures to protect data against unauthorised access, loss or destruction:

• TLS/SSL encryption of all connections,
• Payment card data is never stored on the Company's servers,
• Access to data is restricted to authorised personnel only.

8. Cookies

The website uses cookies — small text files stored on the user's device. We use the following types of cookies:

• Essential — necessary for the site to function (basket, saved cookie decision, protection of the order form against bots). Do not require consent.
• Analytical (e.g. Google Analytics) — enable traffic analysis and quality improvement. Require consent.
• Marketing (e.g. Google Ads) — enable personalised advertising. Require consent.

Users manage their consents with the consent management tool built into the site: the banner shown on the first visit and the “Cookie settings” panel opened by the “Manage cookies” link in the site footer. Consent can be changed or withdrawn at any time; cookies can also be controlled in the browser settings. Blocking essential cookies in the browser may prevent certain site features from working properly. Details are set out in the Cookie Policy.

9. Profiling

User data may be used for marketing profiling (e.g. personalisation of advertising) without producing legal effects on the user. Profiling is carried out on the basis of the user's consent (Article 6(1)(a) UK GDPR / EU GDPR).

Users can withdraw their consent to marketing cookies at any time (“Manage cookies” in the site footer) and opt out of direct marketing by contacting the Company at: info@europe-vignettes.com