Privacy

1. Controller and contact

Previously: ECU-Tuningfiles public information website.

The controller for ecu-mappack.com is ECU-Tuningfiles, Robertstraße 81, 44809 Bochum, Germany. Contact: info@ecu-tuningfiles.com, +49 176 55255829.

2. Website hosting

Previously: Netlify hosting for information pages without its own purchase flow.

The web interface is hosted by Netlify, Inc. Requests involve technical connection data such as IP address, time, URL, browser and operating system. This supports delivery, reliability and security under Article 6(1)(f) GDPR.

A private server in Germany is proposed for analysis and file storage. The final provider, subprocessors, log scope and retention settings must be specified before launch. Appropriate processor agreements will be concluded. Netlify processing is not automatically limited to the EU. Any third-country transfers, recipients and safeguards under Articles 44 onward GDPR will be specified after provider contracts are selected.

3. Upload, analysis and manual review

Previously: Files exchanged through an external registered customer portal.

Original files can be uploaded without an account. Processing includes file content, filename, size, checksum, ECU/software identifiers, analysis status and an order identifier. Files may contain vehicle or other identifiers. Submit only files you are entitled to use and avoid unnecessary personal information.

The purpose is the analysis, preview and potential purchased output you request, under Article 6(1)(b) GDPR. A manual enquiry includes your email, optional notes and a private file reference. Files and the library are not made public. Preview data is limited to map labels, groups, sizes, axis labels, counts and the match indicator.

Uploads and generated outputs are automatically deleted no later than 14 days after upload, including order-specific temporary files and relevant caches. Expired links no longer work. Customer-file backups should not outlast this period; deletion, versioning and backup settings must be checked before launch. Order files and long-term accounting records are kept separately.

If you request a notification for a longer analysis, the supplied email address, order reference and chosen language are processed for the requested status message under Article 6(1)(b) GDPR. This does not subscribe you to marketing or a newsletter. The personal local test can only record the address with the order; it does not yet send email. Without a purchase or another necessary purpose, this analysis-notification address is deleted with the analysis record within 14 days. Legally required purchase and invoice evidence is retained separately.

4. Purchases, delivery and invoicing

Previously: Bisheriger Entwurf: Angebot auch an Privatkunden, Verbraucher-Widerruf und externe Rechnungsanbindung. Ersetzt gemäß B2B-Entscheidung vom 06.11.2026. Update 06.11.2026: Brevo für Transaktionsmails gewählt; Testversand ausschließlich an freigegebene Testadresse.

Business checkout requires company, contact name, email, billing address and country, plus VAT ID where relevant. Product, price, verified tax treatment, payment references and checkout confirmations are recorded under Article 6(1)(b) and (c) GDPR.

We generate invoices ourselves; this portal does not use sevDesk. Invoice copies and accounting evidence are stored separately from uploaded files, generally for eight years subject to applicable requirements. The 14-day file deletion policy does not remove accounting records.

Download links last 3 days for up to 3 downloads. Transactional email is sent through Brevo using encrypted SMTP. The private test only sends to the expressly authorised test address and does not sell actual CSV files.

5. Payment providers

Previously: Bisheriger Entwurf: Angebot auch an Privatkunden, Verbraucher-Widerruf und externe Rechnungsanbindung. Ersetzt gemäß B2B-Entscheidung vom 06.11.2026.

Payments are processed by Mollie B.V., Netherlands. PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, may be selected in Mollie Checkout. Required order, amount and currency information is transmitted; additional billing details may be necessary for particular methods. Payment providers process payment information under their own privacy notices. We receive references and payment status and do not store full payment card or online banking credentials. Customer files and private DAMOS sources are not sent to payment providers. The legal basis is Article 6(1)(b) GDPR.

6. Optional program improvement

Previously: No consent process for uploaded-file learning.

Only if you actively select the separate, initially empty checkbox may we additionally analyse your file for program improvement and quality checks during its 14-day retention. This uses consent under Article 6(1)(a) GDPR. Consent is not required for analysis or purchase and does not extend file retention.

Derived technical findings may be retained longer only when reliably anonymised and no longer attributable to a person or vehicle. Otherwise they are deleted too. You may withdraw consent for the future by email with your order identifier. Prior lawful processing remains unaffected. Expanded purposes or longer retention require new information and an appropriate legal basis.

7. Security and abuse prevention

Previously: General hosting and HTTPS information.

Short-lived upload permissions, size limits and rate limits protect the service. Truncated or pseudonymised IP features, timestamps and security events may be processed under Article 6(1)(f) GDPR. The final bot protection service and recipients will be named before launch. Customer-file contents are not put into general security logs.

Administrator access is separately authenticated and restricted. Transfers use HTTPS, files remain private, and downloads have time and count limits. General security logs are proposed to be retained for no more than 7 days, with longer retention only where necessary to investigate a documented incident. These settings must be verified before launch.

8. Language, local storage and external links

Previously: “lang” storage, calculator, optional AI assistant and social links.

Your manually selected language is stored locally under “ecu-mappack-language” and takes priority over browser language. You can reset it by clearing site data. Fonts are hosted locally. No advertising or analytics services are embedded.

The proposed functional language storage and necessary security functions do not use a general tracking-cookie banner. The final assessment depends on the services actually used. Any optional services requiring consent will remain disabled until consent is obtained.

WhatsApp is a normal external link and connects only when opened. A prefilled message may include ECU, software version and order number. You can use email instead. No AI chat or embedded social widgets are included.

10. Required information and automated processing

Previously: No automatic MapPack analysis described.

Necessary file and order information is required to provide the requested service. Optional consent is separate. Identification and purchase availability are determined automatically. This is not intended as a legally significant profiling decision under Article 22 GDPR; unclear cases permit manual enquiry. The information will be updated if the purpose or effect of automation changes.

11. VAT identification verification

Previously: Previously: official VAT checks were only planned. Update 6 November 2026: VIES connected in the private test.

For cross-border EU business orders we use the official VIES service operated by the European Commission with national tax administrations. Seller and customer VAT IDs, legal company name, street, postcode and city are submitted for validity and attribution checks. Customer BIN/ORI files, CSV files, payment details and email addresses are not sent to VIES.

Check time, result, available identity-match indicators and reference are kept with the tax-related order evidence separately from customer files, under Article 6(1)(b) and (c) GDPR. A valid number without confirmed business identity, or an unavailable check, requires manual review and does not automatically permit reverse charge. Details: VIES.

12. Transactional email through Brevo

Previously: Added 6 November 2026: chosen mail service and test restrictions.

Brevo sends order-related messages: requested analysis notifications, analysis problem notices and, after verified payment, invoices and protected download links. Required recipient address, language, order reference, ECU/software information, message content and, where relevant, invoice and time-limited link are transmitted under Article 6(1)(b) and, for invoices, (c) GDPR. Original BIN files and the private DAMOS library are not emailed.

Messages use HTML with an embedded logo and a plain-text alternative. Our template contains no opening pixels or marketing trackers. No newsletter is sent. Delivery states and errors are processed for reliability; SMTP acceptance is not proof of inbox delivery. Before public launch, the data-processing agreement, contractual Brevo entity, subprocessors, retention and any international processing must be finalised. Brevo privacy information.