Privacy policy

Who is responsible for your data

The controller of the processing described here, unless a section states otherwise, is Codelit 40 Production Management Informatikai Zártkörűen Működő Részvénytársaság (private company limited by shares; Codelit 40 Production Management Zrt.), registered seat: 1039 Budapest, Hadrianus utca 9. 4. em. 11., company registration number: 01-10-141719, tax number: 27719206-2-41. BATTOCAN is its brand.

Data protection contact: privacy@battocan.com · postal address: 1039 Budapest, Hadrianus utca 9. 4. em. 11.

Two roles: controller and processor

We never inspect our own vehicles: every inspection is carried out for a client. This does not make us a mere processor. We act in two distinct roles, and this policy keeps them apart.

Role 1 – controller of the inspection and reporting system

We decide the methodology, the scope of the diagnostic scan, what the report contains, what is public on the QR verification page and how long raw evidence is kept, and we sign the reports with our own key. These are decisions about the purposes and means of processing, so for this processing we are the controller, with the legal bases, retention periods and contact route stated below.

Role 2 – processor of personal data supplied by clients

Where a client (for example a dealer or a fleet operator) transmits personal data of its own customers to us – in vehicle lists, documents or notes – we process that data only on the client’s documented instructions, as its processor. A data processing agreement is required with each such client. Requests from data subjects concerning that data are handled by the client; if we receive one, we forward it to the client without delay. Cargent is a separate legal entity and is treated exactly like any other client.

• Data processing agreements with clients that supply personal data: not yet in place
• Data processing agreement with Cargent: not yet in place

Orders of listed services

The listed services are sold and invoiced by a partner sole trader (the seller of record). The seller is the controller of the contract and invoicing data of these orders. We host the order and invoice records on this platform on the seller’s behalf, as its processor. The inspection data itself (Role 1) remains ours as controller.

• Seller of record: Gulyás Adrián e.v. · registration no. 51798958 · tax no. 71462004-1-41 · seat 1039 Budapest, Hadrianus utca 9. 4. em. 11. ajtó
• Data processing agreement with the seller: not yet in place
• Where Codelit 40 Production Management Zrt. itself quotes and invoices (fleet orders), it is the controller of that order data too.

Is vehicle data personal data?

A vehicle identification number (VIN) and an odometer reading identify a vehicle, not a person. They are personal data when we, or someone we disclose them to, can link them to an identifiable natural person by means reasonably likely to be used. We do not collect licence plates.

In our workflow this depends on who commissions the report. When the client is a natural person – a private buyer or seller – the order links the VIN to that person, so in our hands the VIN, the odometer and the inspection results are personal data of that person.

When a company commissions a report on a vehicle and no natural person is linked to it in our records, the vehicle data alone is not personal data in our hands. We record for every inspection which of the two applies, and we treat an undetermined case as personal data.

Because a public page can be opened by anyone holding its link, we do not publish the full VIN there in either case (see “Public verification page”).

What we process, why, on what basis and for how long

This list is generated from the processing inventory kept with the application’s code, so it cannot drift from what the system does.

Public verification page

The QR code of a report leads to its public verification page, which anyone holding the link can open. It is designed to show what a prospective buyer needs to trust the document – results, methodology and scope, inspection date, report identifier, who issued and performed it, and the signature check – and no personal data of the vehicle owner or the client. The page is not indexed by search engines and is not listed in the sitemap.

The public page shows only the last six characters of the VIN. This is a deliberate choice: the last six characters let a buyer standing at the car compare the report with the VIN plate, while the full VIN – which can be linked to registration and service records – is not published. The original AVILOO certificate carries the full VIN, so it is offered in the full view only.

The inspection location is not shown on the public page.

The full view of a report (full VIN, inspection location, original certificate) is only available to signed-in operators and through a separate, random access link that we give to the client; it is not in the QR code.

The verification page stays available for 24 months. You can ask us to withdraw it earlier through the data protection contact. A withdrawn page shows only that it was withdrawn and when; the signed record itself is kept for the retention period of closed reports, because it is the evidence of what was issued.

Photos and evidence images

Our inspectors are instructed not to photograph bystanders, other licence plates or documents. If an image nevertheless shows something it should not, we redact it: the corrected image goes into a new revision of the report, the change is recorded in the audit log, and the original is kept access-restricted and can be erased on request. A closed, signed report is never edited silently.

While a redacted image belongs to the revision shown publicly, the public page withholds that revision’s documents until the corrected revision is closed.

Processors

Only the services the application actually uses are listed here.

• Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg – hosting, storage, backups and logs (EC2, EBS and snapshots, CloudWatch Logs, Route 53, SNS, ECR, Secrets Manager). Region: eu-central-1 (Frankfurt, Germany). Data processing addendum (AWS GDPR DPA): in place

Not processors: the TLS certificate authority (Let’s Encrypt) receives only our domain name and our own account e-mail; the country database used for the language default is downloaded to our server, and no visitor data is sent anywhere for it. We use no analytics, advertising or social media services, and no fonts or scripts are loaded from third parties.

Does data leave the EEA?

The data is stored in the AWS Frankfurt region (Germany). We do not transfer personal data outside the European Economic Area. AWS may access data from outside the EEA only as its data processing addendum allows, under the European Commission’s standard contractual clauses incorporated in it (GDPR Art. 46). Uptime alerts are routed through an AWS notification service outside the EEA; they contain no personal data of visitors or clients.

No profiling, tracking or advertising

We make no automated decisions with legal effect about anyone, do no profiling, and use no analytics or marketing cookies. The cookie notice lists the only storage the site uses.

Analytics or marketing tools planned: none.

Backups

A consistent copy of the database is made on the server every day and kept for 8 days; the data volume is also copied as daily snapshots (the last 14 kept) and weekly snapshots (the last 8 kept). Data deleted from the live system therefore disappears from the backups only when these copies expire.

Your rights

• Access: you can ask what data we hold about you and receive a copy.
• Rectification of inaccurate data. A closed report is corrected by a new revision, not by editing it.
• Erasure, where the data is no longer needed or you object and we have no overriding legitimate ground; accounting records must be kept for the statutory period.
• Restriction of processing while a request is being examined.
• Data portability for data you provided under a contract.
• Objection to processing based on our legitimate interest, including the public verification page.

Write to our data protection contact: privacy@battocan.com. We answer within one month (extendable by two months for complex requests, in which case we tell you why), and we may ask you to confirm your identity.

For data we process as a processor (orders on behalf of the seller of record, data supplied by clients), the seller or the client decides; we forward your request to them without delay and help them answer it.

You can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, 1055 Budapest, Falk Miksa utca 9–11; postal address: 1363 Budapest, Pf. 9; www.naih.hu) or turn to a court.

Security

Encrypted connections (HTTPS), access limited by role, passwords stored only as scrypt hashes, protection against form forgery and repeated attempts, signed and fingerprinted reports, daily backups, and an audit log of changes.

Versions of this policy

Every published version has an identifier and a date, and earlier versions remain retrievable. An order records the version shown at the time of ordering.