Privacy Policy

1. Legal basis for data processing

We process your personal data in accordance with:

• the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 applicable in the United Kingdom,
• Regulation (EU) 2016/679 (EU GDPR) — where applicable to customers in the European Economic Area.

The primary legal basis is Article 6(1)(b) UK GDPR / EU GDPR (performance of a contract — purchase and registration of the vignette in the name and on behalf of the user). We also process data under Article 6(1)(c) (legal obligation — taxes, accounting), Article 6(1)(f) (legitimate interest — defence of claims, service quality) and Article 6(1)(a) (consent — direct marketing). Due to the digital nature of the service, you expressly request immediate performance and lose the right of withdrawal once the vignette is registered, under Regulation 36(2) of the Consumer Contracts Regulations 2013 and corresponding EU consumer law.

2. Scope of processed data and purposes

3. Recipients of personal data

Personal data may be transferred to the following categories of recipients:

• the official toll system (edalnice.gov.cz) — only the registration number and vehicle data needed to register the e-vignette,
• PayU S.A. (Poznań, Poland) — data needed to process a BLIK payment (email address, phone number, amount),
• Stripe Payments Europe Ltd — data needed to process the payment,
• IT and hosting providers — only to the extent needed to provide the service,
• public authorities — only on the basis of applicable law.

Where data is transferred outside the United Kingdom or the EEA (e.g. to Stripe Inc. in the United States), we apply appropriate safeguards including the UK International Data Transfer Agreement (IDTA) or EU Standard Contractual Clauses (SCC).

4. Data retention period

• transaction data and accounting records: 6 years from the date of the transaction (HMRC and UK Companies Act 2006 requirements),
• order data: 3 years from fulfilment (legitimate interest — handling claims),
• marketing data: until consent is withdrawn.

5. Your rights

Under UK GDPR and EU GDPR you have the following rights:

• right of access (Article 15),
• right to rectification (Article 16),
• right to erasure (Article 17),
• right to restriction of processing (Article 18),
• right to data portability (Article 20),
• right to object (Article 21),
• right to withdraw consent at any time — without affecting the lawfulness of earlier processing.

To exercise these rights, contact us at info@e-dalnice.org.

6. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with the competent supervisory authority:

• United Kingdom: the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow SK9 5AF, ico.org.uk,
• European Union: your local data protection authority — list available at edpb.europa.eu.

7. Data security

We apply appropriate technical and organisational measures to protect your data:

• TLS/SSL encryption of all connections,
• card data is never stored on our servers,
• access to data is restricted to authorised personnel only,
• regular security audits of the systems.

8. Cookies

The website uses cookies — small text files on your device. We use:

• essential cookies — necessary for the site to function (session, order form). No consent needed.
• functional cookies — store user choices (e.g. selected country). Consent required.
• analytics cookies (e.g. Google Analytics) — traffic analysis and quality improvement. Consent required.
• marketing cookies (e.g. Google Ads) — personalised advertising. Consent required.

You can manage cookies via the consent tool (cookie banner) or your browser settings. Details in the Cookie Policy.

9. Profiling

Data may be used for marketing profiling (e.g. personalisation of advertising) without producing legal effects on you. Profiling is carried out on the basis of your consent (Article 6(1)(a) UK GDPR / EU GDPR).

You can opt out of direct marketing at any time by contacting info@e-dalnice.org.

10. Changes to this privacy policy

We reserve the right to amend this privacy policy at any time. Changes take effect upon publication on the website.

In the case of material changes, users who have provided an email address may be notified electronically. Continued use of the website after changes constitutes acceptance of them.

11. Transferring data between our websites

We operate several e-vignette websites: e-dalnice.org (Czech Republic), e-znamka.org (Slovakia), e-matrica.org (Hungary), e-vinjeta.org (Slovenia), bg-vineta.org (Bulgaria) and e-rovinieta.org (Romania). The data controller for all of them is the same entity, identified at the top of this policy. If, after your purchase, you decide to buy a vignette for another country and click a button taking you to another of our websites, we pass your contact and vehicle details between them so that you do not have to type them again. This covers both data sent from this website and data it receives from the others. It happens only at your request — merely visiting a website transfers nothing.

• Data transferred: e-mail address, phone number, registration number, country of vehicle registration, VIN (if provided) and the vignette start date.
• Legal basis: Article 6(1)(b) GDPR — processing necessary for the performance of a contract you enter into yourself. No consent is required and this is unrelated to any marketing consent.
• Method: only a random, single-use identifier is placed in the address of the destination website. Your data never appears in the URL.
• Retention: the identifier expires after 60 minutes or after a single use, whichever comes first. The data linked to it is then deleted.
• The vehicle category is not transferred automatically where the destination country classifies vehicles differently from the country of purchase. In that case we ask you to select the category yourself.

Transferred data is used solely to pre-fill the order form. You may change or clear it at any time before placing your order.