Privacy policy
This policy explains what personal data we process when you use the driverstune.com website and the dash.driverstune.com portal (together: “DriversTune”), why we do it, how long we keep it and what rights you have under the General Data Protection Regulation (GDPR). If anything is unclear, write to us.
1. Controller and contact
The controller is IntraBIT d.o.o. (IntraBIT društvo s ograničenom odgovornošću za računalno programiranje, savjetovanje i djelatnosti povezane s njima), Adalberta Oppitza 20, 43000 Bjelovar, Croatia, OIB (Croatian company ID) 51032084657. DriversTune is the name of our service.
For any question about personal data or to exercise your rights, email sales@intra-bit.com or write to the address above. We have not appointed a data protection officer; requests go straight to the company's management.
2. What data we process, why, and on which basis
We only process data needed to provide the service, take payment and keep the system secure:
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account: name, email address, password (stored only as a cryptographic hash), role on the portal | Opening and running your account, login, communication about your requests | Performance of a contract, Art. 6(1)(b) |
| Company details: name, address, OIB or VAT ID, result of the VIES check | Issuing invoices, charging VAT, checking eligibility for the reverse charge | Legal obligation (VAT and accounting law), Art. 6(1)(c) |
| ECU reads and vehicle data: uploaded files, make, model, engine, read tool; files may contain the vehicle identification number (VIN) | Building the modified file, delivery and revisions | Performance of a contract, Art. 6(1)(b) |
| Comments and request history | Communication with the mapper, tracking orders, handling complaints | Performance of a contract, Art. 6(1)(b) |
| Credits and payments: purchases, credit usage, Stripe payment references, invoices. You enter card details directly with Stripe; we never see or store them | Billing, keeping your credit balance, bookkeeping | Performance of a contract, Art. 6(1)(b), and legal obligation, Art. 6(1)(c) |
| Invoicing data when you buy credits directly from a mapper: name or company name, OIB or VAT ID, address, email address | Passing it to the mapper you bought the credits from, so they can invoice you | Performance of the purchase contract, Art. 6(1)(b), and the mapper's legal obligation to issue an invoice, Art. 6(1)(c) |
| Mobile number | Request status notifications via WhatsApp | Consent, Art. 6(1)(a); you can withdraw it at any time |
| IP address and country of access | Protection against abuse and attacks, rate limiting, restricting the service to Croatia, Slovenia, Bosnia and Herzegovina, Serbia, Montenegro and North Macedonia | Legitimate interest, Art. 6(1)(f): system security and operating only in the markets we serve |
| Online presence (whether you are currently signed in to the portal) | Showing whether users and mappers are available while a request is in progress | Legitimate interest, Art. 6(1)(f): faster communication about requests |
| Server logs: time, IP address, requested URL, browser type | Security, detecting attacks, fixing faults | Legitimate interest, Art. 6(1)(f): security and proper operation of the service |
Where we rely on legitimate interest, we process only the data needed for that purpose and have assessed that it does not override your interests and rights. You can object to this processing (see “Your rights”).
Account data and reads are required to enter into and perform the contract, and company details are required to invoice you when you buy as a company. Without them we cannot provide the service. Your mobile number is optional: without it, notifications arrive by email only.
We collect data directly from you. The exceptions are the VAT ID check in the European Commission's VIES system, from which we obtain confirmation that the number is valid and, where available, the company name and address, and the credit purchase details entered on your account by a mapper you bought credits from.
The driverstune.com website has no forms and no analytics; it only produces server logs.
3. Who receives your data
We do not sell your data or use it for advertising. Only the following have access:
- the mapper assigned to your request, limited to the read, vehicle data, comments and customer details needed to build the file;
- a mapper you buy credits from directly (outside the card checkout on the portal), limited to your invoicing data: name or company name, OIB or VAT ID, address and email address. For the invoices they issue, the mapper is an independent controller (see the note below the table);
- processors (Hetzner, Cloudflare and Meta), who process data on our instructions under a data processing agreement (Art. 28 GDPR);
- Stripe, which processes payment data as an independent controller (see the note below the table);
- public authorities (e.g. the Tax Administration or a court) where the law requires it.
| Provider | What for | Where |
|---|---|---|
| Hetzner Online GmbH | Server and database hosting | Germany (EU) |
| Cloudflare, Inc. | Content delivery (CDN), attack protection (WAF), sending email notifications | USA; global server network |
| Stripe (Stripe Payments Europe Ltd.) | Card payment processing | Ireland (EU); partly in the USA |
| Meta Platforms Ireland Ltd. (WhatsApp Business Platform) | Delivering WhatsApp notifications, only with your consent (processor) | Ireland (EU); partly in the USA |
| Modul42 d.o.o. (Pausalko) | Issuing invoices for credits bought directly from a mapper (the mapper's processor, not ours) | Croatia (EU) |
| COAX d.o.o. (Solo) | Issuing invoices for credits bought directly from a mapper (the mapper's processor, not ours) | Croatia (EU) |
Hetzner, Cloudflare and Meta (WhatsApp Business Platform) are our processors: Meta uses your mobile number and the notification content only to deliver the messages we send. Stripe processes card payments as an independent controller: it collects card and payment data directly from you and processes it to carry out the payment, prevent fraud and meet its own legal obligations, under its own privacy policy (stripe.com/privacy).
When you buy credits directly from a mapper, the mapper issues the invoice as the seller. For this we pass your invoicing data (name or company name, OIB or VAT ID, address and email address) to the mapper through the portal. The legal basis is performance of the purchase contract (Art. 6(1)(b)) and the mapper's legal obligation to issue and keep the invoice (Art. 6(1)(c)). The mapper is an independent controller for their invoices: they issue them through the invoicing service they choose (Pausalko by Modul42 d.o.o. or Solo by COAX d.o.o.), which acts as the mapper's processor, and keep them for as long as tax and accounting law requires. The mapper's details are on the invoice. You can exercise your rights regarding this data directly with the mapper or through us at sales@intra-bit.com; we will forward your request.
4. Transfers outside the EU
Cloudflare and Meta (and Stripe, for the processing it carries out as an independent controller) are US companies or part of US-based groups, so some data may be transferred to the USA. These transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework for companies certified under it, and otherwise on the standard contractual clauses adopted by the European Commission (Art. 46 GDPR).
You can request a copy of the safeguards in place at sales@intra-bit.com.
5. How long we keep data
- While your account is active we keep your account data, reads, modified files and request history, so we can make revisions and handle complaints. A delivered file is downloaded through a link that is valid for 7 days.
- When you ask for erasure or close your account, we anonymise the account: your name is replaced with data that does not identify you; your phone number, WhatsApp consent and company contact and address details are cleared; and your email address is kept only as a one-way cryptographic hash, so we can recognise repeat sign-ups and prevent abuse. You can no longer log in.
- Uploaded and modified files, request history, comments and credit transactions are not deleted. We keep them, detached from your name and contact details, for as long as they are needed to establish, exercise or defend legal claims (Art. 17(3)(e) GDPR; legitimate interest, Art. 6(1)(f)), for example if a dispute about a delivered file arises later, and for bookkeeping. Note that the files themselves may contain the vehicle's VIN. You can ask us what we still keep and why, and object to this processing (see “Your rights”).
- Invoices and payment records are kept for 11 years, as required by the Croatian Accounting Act. This applies even after your account is closed. Invoices for credits bought directly from a mapper are kept by the mapper who issued them.
- Your mobile number is deleted when you close your account; you can withdraw consent to WhatsApp notifications at any time, after which we no longer send you WhatsApp messages.
- Server and security logs are kept only as long as needed for security and troubleshooting, then deleted.
6. Your rights
At any time you can ask for:
- access to your data and a copy of it;
- rectification of inaccurate or incomplete data (you can change most of it yourself in your profile);
- erasure, subject to the exceptions described under retention;
- restriction of processing, e.g. while we verify the accuracy of your data;
- portability: data you gave us under the contract or with consent, in a structured, machine-readable format;
- objection to processing based on legitimate interest;
- withdrawal of consent to WhatsApp notifications, in your profile settings or by email. Withdrawal does not affect the lawfulness of processing before it.
Send your request to sales@intra-bit.com. We will reply without undue delay and within one month at the latest. To protect your data we may ask you to confirm your identity, e.g. by writing from the email address linked to your account.
If you believe we process your data unlawfully, you have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr. If you live in another EU member state, you can also complain to the supervisory authority there.
8. Automated decision-making
We make no decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you. The VAT ID check in VIES is only a lookup in a public register, and the country restriction applies equally to every visitor from a given country. If you think you have been blocked by mistake, contact us.
9. Changes to this policy
We update this policy when the service or the law changes. The current version is always published on this page with its version number. We notify registered users of material changes by email or on the portal before they take effect.
Version 2026-10-23.