Privacy notice.

The controller is the operator. The identifying details are in the imprint. Contact: hello@vinkodex.com

Imprint

We have not appointed a data protection officer. If we appoint one, we will publish the name and contact on this page.

There is no registration and no sign-in. We send no newsletter, and we do not sell data. We do not ask for a phone number or a postal address. If you use the contact form, we process your name, your email address and your message.

VIN decoding runs in your own browser. We do not send the 17 characters anywhere, we do not log them, and we do not put them in the address. When you continue to the model, only the make, the model year and the type code go into the address bar. Together those three still do not identify a car: one model year runs to hundreds of thousands of units.

Saved models and checklist ticks live in your browser's local storage. That is not a cookie, and it never reaches us: the server does not see it. It does not exist on another device or in another browser. Clearing your browser data removes it.

The log contains the time of the request, the address requested, the response code, the browser identifier and the IP address.

The purpose is operation, blocking abuse and fixing faults. We do not build a profile from it, and we do not tie it to an account, because there is no account.

The legal basis is Article 6(1)(f) GDPR, legitimate interest. The interest is that the site runs and that we can see an attack. The IP address is technically necessary for that (Section 13/A(3) of Act CVIII of 2001).

We keep the log for 30 days, then delete it. If a security investigation is open, the entry stays until it ends, and for one year at most.

From the form we process your name, your email address, the topic and the message. We send a confirmation to the address you gave. A direct email is the same data.

The purpose is the reply and the correction. The legal basis is legitimate interest: we answer what you asked (Article 6(1)(f) GDPR). If you exercise a data-subject right, the basis is a legal obligation (Article 6(1)(c)).

We keep an ordinary message for 1 year from the last email. We keep a message about a data-subject right for 5 years. That is the general limitation period under Section 6:22 of the Civil Code, and for that long we can show what we answered.

We do not set our own cookies. The site still opens if you reject the cookies that are not necessary.

In the European Economic Area, the United Kingdom and Switzerland, storage is denied until you answer. Google's consent message asks the question. You can change your answer at any time through “Cookie settings” in the footer.

Withdrawal applies to later processing. It does not undo processing that has already happened.

After consent, Google may set a cookie for ads and for measurement. Examples are IDE, DSID, __gads and _ga. In the EEA an advertising identifier typically lasts 13 months at most. _ga lasts 2 years at most.

Google stores your answer in a cookie so it does not ask again on the next page.

If you reject measurement, no analytics cookie is placed on your device. Google may still receive a cookieless signal. It builds aggregated, modelled data from that. The signal can still involve an IP address.

Ad personalisation happens only with consent. After a rejection, an ad, if one appears, is not tailored to your profile.

Without consent, an ad click identifier may stay in the address, instead of a cookie. It is there to measure the ad.

The legal basis for the cookie and for personalisation is your consent (Article 6(1)(a) GDPR, and Section 13/A(4) of Act CVIII of 2001). For the cookieless aggregated signal, Google acts under its own policy.

We measure traffic with Google Analytics 4. We want to know which models people look up, and where we lose the reader. Not who you are.

The measurement records the page opened, the referring site, the approximate location (country, region), the browser and device type, and the time spent on the page. Not your name, email or VIN.

GA4 does not store the IP address. It uses it to work out the approximate location, then drops it.

Event data is retained for 2 months in the Google Analytics property. After that Google deletes it.

The legal basis is your consent (GDPR Article 6(1)(a)). For measurement Google acts as a processor, on our instructions.

If you decline, no analytics cookie is placed on your device. Google also offers a browser add-on that stops GA measurement on every site. tools.google.com/dlpage/gaoptout

The hosting provider processes the log to run the server, as a processor, on our instructions. The imprint names the provider.

Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is a processor for measurement. For its own advertising and modelling it is an independent controller. For AdSense it is one too. Its policy and cookie guide are linked below.

policies.google.com/privacy · policies.google.com/technologies/cookies · adssettings.google.com

Google may transfer part of the data to the United States. The safeguard is the EU-US Data Privacy Framework, which rests on an adequacy decision. Where that does not cover a transfer, Google uses standard contractual clauses.

We make no automated decision about you, and we build no profile. Your visit has no legal effect. Ad personalisation, if you consent, is Google's processing.

You may ask for access, rectification, erasure and restriction. You may object to processing based on legitimate interest. You may withdraw consent at any time.

Portability applies where the basis is consent or a contract, and the processing is automated. A contact message does not qualify: its basis is legitimate interest. We keep no user database.

You can also send a privacy request on the contact form. Choose the privacy topic. Contact: write to us

You receive the first answer within one month. For a complex request the deadline can be extended by two months. We tell you beforehand. The request is free. Write to the email address above.

There is no account. You delete the saves stored in your browser. If you wrote to us, we can find the message by the email address.

You may complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH).

naih.hu · 1055 Budapest, Falk Miksa utca 9-11. · Postal address: 1363 Budapest, Pf. 9. · +36 1 391 1400 · ugyfelszolgalat@naih.hu

You may also go to court. You can file the claim at the court of your domicile or your residence.

We print the date of the change at the top of this page. Processing that has already happened stays under the earlier text.