Privacy Policy

Last updated: 16 June 2026

This Privacy Policy explains how CIURENIS IT LTD, operating the VignPass service at vignpass.eu, collects, uses, shares and protects your personal data, and what rights you have. We process personal data in accordance with the EU General Data Protection Regulation (GDPR), the UK GDPR and the UK Data Protection Act 2018.

1. Who We Are (Data Controller)

The controller responsible for your personal data is:

CIURENIS IT LTD Company No. 16763272 (England and Wales) 4 Wye Close, Aylesbury, HP21 9NH, United Kingdom Email for privacy matters: privacy@vignpass.eu

For most processing relating to your purchases, VignPass acts as the data controller. Our service providers (such as the payment provider) act either as separate controllers or as our processors, depending on their role, as described in Section 4.

2. What Data We Collect and Why

We collect only the data needed to provide our service, comply with the law and operate our Website. The table below sets out each category, the purpose, and the legal basis under GDPR Article 6.

Data category	Purpose	Legal basis (GDPR Art. 6)
Name	Identifying you, issuing confirmations, customer support	Art. 6(1)(b) — performance of contract
Email address	Sending order confirmations, activation notices, support replies	Art. 6(1)(b) — contract; Art. 6(1)(f) — legitimate interest for service messages
Telephone number	Contacting you about your order where needed; courier delivery (Toll Box)	Art. 6(1)(b) — contract
Vehicle registration (number plate)	Registering the e-vignette against your vehicle with the relevant authority	Art. 6(1)(b) — contract
Vehicle data (country of registration, category, emission class)	Determining the correct product and price; correct registration	Art. 6(1)(b) — contract
Delivery address (Toll Box only)	Shipping the physical device to you	Art. 6(1)(b) — contract
Payment-related data (handled by our payment provider; we receive only confirmation and limited transaction references)	Taking payment, fraud prevention, refunds	Art. 6(1)(b) — contract; Art. 6(1)(c) — legal obligation (accounting); Art. 6(1)(f) — fraud prevention
IP address and device/technical data	Security, fraud prevention, correct site functioning	Art. 6(1)(f) — legitimate interest
Cookies and similar identifiers (analytics, marketing)	Measuring and improving the Website; advertising	Art. 6(1)(a) — consent (for non-essential cookies)
Transaction and order history	Record-keeping, support, legal/tax compliance	Art. 6(1)(c) — legal obligation; Art. 6(1)(f) — legitimate interest

We do not knowingly collect special categories of data, and we do not collect data from children.

3. Where the Data Comes From

Most data is provided directly by you when you place an order or contact us. Technical data (IP address, cookies) is collected automatically when you use the Website, subject to your cookie choices. Payment confirmation data is provided to us by our payment service provider.

We share personal data only with the categories of recipient below, only to the extent necessary, and under appropriate contractual safeguards. We do not sell your personal data.

PCI-DSS certified payment service provider — processes your payment securely. Full card details are handled by the provider under PCI-DSS standards and are not stored by us. This provider acts as an independent controller and/or processor for payment and fraud-prevention purposes.
Road / vignette authority or toll operator — for e-vignettes, the vehicle registration and product data are transmitted so that the official authority can register and validate the vignette. This is essential to delivering the product you purchased.
Analytics and advertising provider (Google) — where you consent, we use Google Analytics and Google Ads to understand Website usage and measure advertising. This is governed by your cookie consent (see our Cookie Policy).
Email / communications provider — sends transactional and support emails on our behalf as a processor.
Courier / postal service (Toll Box only) — receives your name, address and phone number solely to deliver the device.
Hosting and IT infrastructure provider — stores and serves the Website and our records as a processor under our instructions.
Professional advisers and authorities — accountants, auditors, or regulators/courts where required by law.

We describe these recipients by role rather than naming each one here; details of specific processors can be requested via the contact in Section 8.

5. International Data Transfers (UK ↔ EU and Beyond)

VignPass is established in the United Kingdom and serves customers across the EU, so personal data may be transferred between the UK and the EEA, and to other countries where our service providers operate.

EEA → UK: The European Commission has adopted an adequacy decision for the United Kingdom, which provides a lawful basis for transfers of personal data from the EEA to the UK.
UK → EEA: Transfers from the UK to the EEA are covered by UK adequacy regulations recognising the EEA.
Other transfers: Where data is transferred to a country without an adequacy decision, we rely on Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), together with supplementary measures as needed.

You can request information about the safeguards used by contacting us.

6. How Long We Keep Your Data (Retention)

We keep personal data only as long as necessary for the purposes described, then delete or anonymise it.

Order and transaction records (including name, contact details, vehicle and product data): retained for the period required by accounting and tax law (generally up to 6 years under UK law) from the end of the relevant financial year.
Vehicle registration data tied to a vignette: retained for the validity period of the product plus the record-keeping period above.
Delivery address (Toll Box): retained for the duration of fulfilment and the record-keeping period above.
Customer support correspondence: typically up to 24 months after the matter is resolved.
Marketing/analytics data and cookie-based identifiers: retained for the period stated in our Cookie Policy or until you withdraw consent, whichever is sooner.
IP and security logs: retained for a short period for security purposes, typically up to 12 months.

Subject to the conditions in the GDPR/UK GDPR, you have the right to:

Access (Art. 15) — obtain confirmation of and a copy of your data;
Rectification (Art. 16) — correct inaccurate or incomplete data;
Erasure (Art. 17) — have your data deleted in certain circumstances;
Restriction (Art. 18) — limit how we use your data in certain circumstances;
Data portability (Art. 20) — receive certain data in a structured, machine-readable format;
Object (Art. 21) — object to processing based on legitimate interests, and to direct marketing at any time;
Avoid solely automated decisions (Art. 22) — we do not make decisions producing legal or similarly significant effects based solely on automated processing.

Where processing is based on consent (e.g. non-essential cookies), you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

You also have the right to lodge a complaint with a supervisory authority — in the UK, the Information Commissioner’s Office (ICO), or the data protection authority of your EU country of residence.

8. How to Exercise Your Rights / Contact

To exercise any right or ask a privacy question, email privacy@vignpass.eu or write to the registered address in Section 1. We will respond within the statutory time limit (generally one month). We may need to verify your identity before acting on a request.

9. Cookies

Our Website uses cookies and similar technologies. For full details of the cookies we use, their purposes, durations and how to manage them, please see our separate Cookie Policy.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date above reflects the latest version. Material changes will be communicated where appropriate.