Saltar al contenido
vignette-now

Privacy Policy

DRAFT — NOT YET REVIEWED BY A LAWYER. This text is a template, not legal advice. It must be reviewed and approved by a lawyer admitted in Germany before this site goes live. Everything in square brackets is a placeholder and must be replaced with the real company details. In case of doubt the German version prevails.

Controller

[Company name], [address], email [datenschutz@domain.tld]. A data protection officer [has been appointed / has not been appointed, as the conditions of section 38 BDSG are not met].

What data we process

  • Order data: number plate, country of registration, vehicle type, product, period and start of validity.
  • Contact data: email address, chosen language, optionally name and phone number for support enquiries.
  • Payment data: payment method, amount, currency, transaction identifiers. Card and account details are processed only by the payment service provider and never reach us.
  • Usage data: IP address, time, page requested, browser and device type in the server log files.
  • Consents: your choice in the cookie notice and the express consent under section 356 (4) BGB during checkout, each with a timestamp.

Purposes and legal bases

  • Performing the contract, obtaining the vignette and sending the confirmation: Art. 6 (1) (b) GDPR.
  • Accounting and tax retention: Art. 6 (1) (c) GDPR in conjunction with section 147 AO and section 257 HGB.
  • Operating and securing the website and preventing abuse: Art. 6 (1) (f) GDPR.
  • Audience measurement and optional cookies: Art. 6 (1) (a) GDPR and section 25 (1) TDDDG. Consent can be withdrawn at any time with effect for the future.

Recipients and processors

We pass data on only where necessary to perform the contract. Processor agreements under Art. 28 GDPR are in place.

  • Issuing bodies of the destination countries — ASFINAG (Austria), SFDI (Czechia), Nemzeti Útdíjfizetési Szolgáltató (Hungary), NDS (Slovakia), DARS (Slovenia): plate, country of registration, vehicle type and period, so that the vignette can be registered there. These bodies are separate controllers.
  • Stripe Payments Europe, Limited (Ireland): payment processing and fraud prevention.
  • Resend (email delivery): sending order and fulfilment confirmations.
  • Vercel (website hosting) and Neon (database): technical operation.
  • Plausible Analytics: cookieless, aggregated audience measurement without personal reference.
  • [Tax advisers and, where necessary, legal advisers.]

Transfers to third countries

Where providers process data outside the European Economic Area, we base the transfer on an adequacy decision of the European Commission or on the standard contractual clauses under Art. 46 (2) (c) GDPR. [To be completed per provider after legal review.]

Retention periods

  • Order and invoice data: ten years after the end of the calendar year of the order (statutory tax retention).
  • Support correspondence: three years after the case is closed.
  • Server log files: seven days, then deleted automatically.
  • Records of consent: three years after withdrawal or expiry.

Your rights

  • Access to the data we hold about you (Art. 15 GDPR).
  • Rectification of inaccurate data (Art. 16 GDPR).
  • Erasure (Art. 17 GDPR), unless a retention obligation applies.
  • Restriction of processing (Art. 18 GDPR).
  • Data portability (Art. 20 GDPR).
  • Objection to processing based on legitimate interests (Art. 21 GDPR).
  • Withdrawal of consent with effect for the future (Art. 7 (3) GDPR).
  • Complaint to a supervisory authority (Art. 77 GDPR), for instance the authority competent for [federal state].

Please send requests to [datenschutz@domain.tld]. We reply within one month of receipt.

Cookies

Which cookies and storage techniques we use, and how to change your choice, is set out on the “Cookie settings” page.