Privacy Policy
This policy explains what personal data Kinetics Motorsport LTD collects, why we collect it, how long we keep it, and what rights you have. We are the data controller for the data described here, under the EU General Data Protection Regulation (GDPR) and Bulgarian data protection law.
Tsar Simeon St. 34, 4000 Plovdiv, Bulgaria
Email: admin@kinetics-tuning.com
Phone: +359 899 722 017
1. What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Name, email, phone, company name and VAT number | To create your account, communicate with you, and issue invoices | Contract |
| Password (stored hashed, never in readable form) | To secure your account | Contract |
| Vehicle details, VIN, ECU type, hardware and software numbers | To identify the vehicle and produce a correct calibration | Contract |
| Uploaded ECU files and the modified files we return | To deliver the service, support revisions, and allow recovery of your original | Contract |
| Orders, credits, payments and invoices | To operate your account and meet accounting obligations | Contract / legal obligation |
| Messages and support tickets | To answer you and keep a record of what was agreed | Contract |
| IP address, approximate country, pages viewed | Basic visitor statistics and site security | Legitimate interest |
| Login attempts and session data | To protect accounts against unauthorised access | Legitimate interest |
A note about your ECU files. Original files read from your vehicle are sensitive: they are what is needed to restore a vehicle if something goes wrong. We store them outside the public web root, under randomised filenames, in a directory that cannot be reached from the internet. They are accessible only through your authenticated portal account and to our technicians.
2. How long we keep it
- Account details — for as long as your account is open, and up to 12 months afterwards.
- ECU files (original and modified) — for as long as your account is open, so that your original remains recoverable and revisions remain possible. You can ask us to delete specific files sooner.
- Invoices and payment records — retained as required by Bulgarian accounting law, currently 10 years. This is a legal obligation and applies even if you close your account.
- Support messages — up to 3 years.
- Visitor statistics — up to 24 months, in aggregated form.
- Backups — our backups roll over on a schedule, so deleted data may persist in a backup for up to one month before being overwritten.
3. Who we share it with
We do not sell your data and we do not share it for advertising. We share only what is necessary with:
- PayPal — to process card and PayPal payments. We never see or store your full card details.
- EVC / EVC-numbers — where you buy EVC credits, your EVC customer number and the credit amount are sent to book the credits to your WinOLS account.
- Our hosting provider — which stores the site and database on our behalf.
- Our email provider — to deliver account and order emails.
- Our accountant and the tax authorities — for invoices, as required by law.
- Google Fonts and Google Maps — loaded on our public website; these receive your IP address as a technical necessity of serving the content.
- ip-api.com — used to determine the approximate country of a visitor for statistics.
Some of these providers may process data outside the European Economic Area. Where that happens, transfers are covered by the European Commission's standard contractual clauses or an adequacy decision.
4. Cookies
We use a small number of cookies, and none of them are for advertising:
- Session cookie — keeps you logged in to the client portal. Strictly necessary.
- Security token cookie — protects forms against cross-site request forgery. Strictly necessary.
Our visitor statistics are deliberately cookie-free: we count unique visits using a daily rotating hash rather than by tracking individuals across time.
5. Your rights
Under the GDPR you have the right to:
- Ask what data we hold about you and receive a copy.
- Have inaccurate data corrected — most account details you can edit yourself in the portal.
- Ask us to delete your data, subject to records we must keep by law (invoices in particular).
- Ask us to restrict processing, or object to processing based on legitimate interest.
- Receive your data in a portable, machine-readable format.
- Withdraw consent at any time, where processing is based on consent.
To exercise any of these, email admin@kinetics-tuning.com. We will respond within one month.
6. Complaints
If you believe we have handled your data improperly, please contact us first so we can put it right. You also have the right to complain to the Bulgarian supervisory authority, the Commission for Personal Data Protection (Комисия за защита на личните данни), at cpdp.bg.
7. Security
We protect your data with encrypted connections (HTTPS), hashed passwords, optional two-factor authentication on accounts, protection against brute-force login attempts, and file storage that is unreachable from the public web. No system is perfectly secure, but we take these measures seriously and review them.
8. Children
Our services are intended for adults and for businesses. We do not knowingly collect data from anyone under 18.
9. Changes
If we change this policy we will update the date at the top of this page. Significant changes affecting how we use your data will be communicated to account holders by email.