BG TollBG™Vignette · Bulgaria
Buy a vignette

Data Processing Statement

Privacy Notice

1.1 Preamble

This Privacy Notice applies to every domain from which this system is officially accessible, and it also extends to the legal relationships of the applications and networks connected to it. The Document is placed in the footer of the Website, is available in several languages, is effective from the date indicated and remains in force until revoked.

This notice provides information on the processing of personal data; it is not a contractual term and does not require a declaration of acceptance. The contractual terms are set out in the General Terms and Conditions, which you accept separately and expressly during the ordering process.

The Operator may amend the content of the Document. Any amendment shall not have retroactive effect, and we will provide information about material changes on the Website.

1.2 Data controller, operator

Enternova Kft.
2161 Csomád, Szent István utca 48., Hungary
Tax number: HU24892955
Data protection contact: privacy@evignet24.eu, or via the contact form found in the footer of the website by selecting the "Data protection question" topic. The form is accessible to anyone, without registration or purchase.
Application development: NOVA26

1.3 Data processors and data transfer partners

Partner Activity Registered office Safeguards
Stripe, Inc. Payment processing USA / Ireland EU-US Data Privacy Framework
ClickSend (Synph Pty Ltd) Transactional SMS sending Australia SCC contractual safeguards
Cloudflare, Inc. CDN and web security USA EU-US Data Privacy Framework
KBOSS.hu Kft. (Számlázz.hu) Invoice issuance Hungary (EU) Data transfer within the EU
Google LLC (Google Ads) Conversion measurement (from the URL parameter of the click, without any storage on the visitor's device – no cookies, no localStorage; exclusively via a server-side API, after the order has been fulfilled) USA / Ireland EU-US Data Privacy Framework
Tárhely.Eu Szolgáltató Kft. Hosting services, server operation Hungary (EU) Data processing within the EU, contract pursuant to Article 28 GDPR
NOVA26 Application and system development, technical support Hungary (EU) Data processing within the EU, contract pursuant to Article 28 GDPR
National toll operators and their official registration partners E-vignette registration in accordance with the regulations of the given country EU / destination countries In accordance with the laws of the given country

Data transfers to the USA take place on the basis of the EU-US Data Privacy Framework. Data transfers to Australia are based on Standard Contractual Clauses (SCC) contractual safeguards. We have concluded data processing agreements pursuant to Article 28 GDPR with our data processors.

With regard to the data transferred to them, the national toll operators qualify as independent data controllers: their data processing is governed by their own national laws. There is no joint controllership (Article 26 GDPR).

1.4 Definitions

1.5 Principles of data processing

1.6 Automatically recorded data

When visiting the Website, the following logging parameters are automatically recorded: time of entry and exit, time spent and activity on the website, browser type, resolution and language, operating system and device type, as well as the IP address. The legal basis is legitimate interest pursuant to Article 6(1)(f) of the GDPR (secure operation of the system and prevention of misuse).

1.7 Data provided by the User

The scope of the data processed: personal name, e-mail address, telephone number, billing name, billing address, tax number, vehicle registration number, country of origin (country code), vehicle category, the validity period of the road use entitlement. The toll systems of certain countries may require the provision of further data as well: vehicle identification number (VIN), name of the vehicle's owner or operator, passport or identity document number. These additional data requirements are not based on the Operator's decision, but on the rules of the given country's official toll system; the data are transmitted exclusively to the relevant toll administrator for the purpose of completing the registration.

The purpose of the data processing: use of the Website, the conclusion and performance of the contract of purchase, the invoicing of fees, and the enforcement of claims arising therefrom.

Nature of the data provision: the provision of the above data is a precondition for the conclusion of the contract; in the absence thereof we are unable to fulfil the order. The provision of billing data is based on a statutory obligation.

1.8 Data categories, purposes, legal bases and retention periods

Data category Purpose Legal basis Retention period
Identification data (name, e-mail, phone) Conclusion and performance of the contract GDPR Art. 6(1)(b) – performance of a contract 5 years (limitation period under the Hungarian Civil Code); data forming part of accounting documents: 8 years
Billing data (name, address, amount) Issuing invoices, tax compliance GDPR Art. 6(1)(c) – legal obligation 8 years (Section 169 of Act C of 2000)
Vehicle data (licence plate number, country code) Registration of the e-vignette, performance of the contract GDPR Art. 6(1)(b) – performance of a contract 5 years
Country-specific additional data (chassis number/VIN, name of the owner or keeper, passport/document number) Completing the registration required by the toll system of the given country GDPR Art. 6(1)(b) – performance of a contract 5 years
Payment data (card reference, transaction ID) Processing of the payment GDPR Art. 6(1)(b) – performance of a contract 8 years (accounting document)
IP address, browser, session data Security, abuse prevention GDPR Art. 6(1)(f) – legitimate interest 1 year
Google Ads click identifier (gclid) Conversion measurement, business analysis GDPR Art. 6(1)(f) – legitimate interest 2 years
SMS data Confirmation of the transaction GDPR Art. 6(1)(b) – performance of a contract 3 years
Customer service communication Customer service, complaint handling GDPR Art. 6(1)(b) and (f) 3 years
Stripe risk assessment Fraud prevention (by the payment processor) GDPR Art. 6(1)(f) – legitimate interest In accordance with the payment processor's own privacy policy, for as long as the fraud prevention purpose exists, but no longer than 8 years from the transaction (data related to accounting documents)

Balancing of interests: for data processing based on legitimate interest (security logging, conversion measurement, fraud prevention) we have carried out a legitimate interest assessment (balancing test), a summary of which is available upon request. According to the outcome of the balancing test, these processing activities do not entail a disproportionate restriction on the rights of the data subjects.

1.9 Erasure of data

We fulfil the data subject's erasure request within one month at the latest (Article 12(3) GDPR); where the request is complex, this deadline may be extended by a further two months, of which we will provide information. In practice, we carry out the erasure within a considerably shorter period. Accounting documents constitute an exception, as we are required to retain them for 8 years pursuant to Act C of 2000 on Accounting.

Requests may be submitted at the e-mail address privacy@evignet24.eu or via the contact form found in the footer of the website. If it is not clear that the request has been submitted by the person entitled to do so, we may request additional identification data.

2.0 Cookies

Detailed information on the website's cookie management is provided in the separate Cookie Policy. The website currently uses only cookies strictly necessary for its operation (technical cookies); no analytical or marketing cookies, nor embedded external tracking codes, are in operation on it. Should we use any such tools, this would take place exclusively with your prior, explicit consent.

2.1 Consent management

The website uses exclusively cookies that are strictly necessary for its operation (technical cookies), for which — pursuant to Article 5(3) of Directive 2002/58/EC (ePrivacy), which exempts storage that is strictly necessary solely for the transmission of an electronic communication or for the provision of a service explicitly requested by the data subject — your consent is not required. In all other respects, Section 155 of Act C of 2003 on Electronic Communications governs the storage of, and access to, data on terminal equipment. Should we use analytics or marketing cookies in the future, we would do so exclusively with your prior, explicit consent. Refusing consent would be just as easy as giving it, and consent may be withdrawn at any time, just as easily; withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal (Article 7(3) GDPR).

2.2 Automated data processing

The processing of orders, the registration of the e-vignette and the sending of confirmations take place largely in an automated manner. However, no solely automated decision-making or profiling within the meaning of Article 22 GDPR takes place that would produce legal effects concerning you or similarly significantly affect you. In disputed or irregular cases, one of our staff members intervenes in the processing.

Stripe, as the payment processor, applies its own risk assessment system (Stripe Radar) for fraud prevention purposes. This is Stripe's own system; Enternova Kft. does not take automated decisions on the basis of this assessment.

2.3 Data transfers to third countries

Data transfers to the United States of America (Stripe, Cloudflare, Google) take place on the basis of the EU-US Data Privacy Framework. The data transfer to Australia (ClickSend) is based on the contractual safeguards of the Standard Contractual Clauses (SCC). A copy of these safeguards is made available upon request.

2.4 Data Protection Officer (DPO)

Enternova Kft. is not obliged under Article 37 GDPR to designate a data protection officer, as it is not a public authority, its core activities do not require regular and systematic monitoring of data subjects on a large scale, and it does not process special categories of data on a large scale. Data protection enquiries may be submitted at the e-mail address privacy@evignet24.eu or via the contact form found in the footer of the website.

3.1 Your rights

3.2 Right to object

You may object at any time, on grounds relating to your particular situation, to processing based on legitimate interests (Article 6(1)(f) GDPR) — including security logging and conversion measurement. In the event of your objection, we will cease the processing unless there are compelling legitimate grounds which override your interests, or which relate to the establishment, exercise or defence of legal claims. In the event of an objection to processing for direct marketing purposes, we will erase the data for this purpose immediately and unconditionally.

3.3 Remedies

If you consider that unlawful data processing has taken place, you may lodge a complaint with the supervisory authority of the Member State of your habitual residence, place of work or the place of the alleged infringement, or with the Hungarian supervisory authority below (Article 77 GDPR):

Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
1055 Budapest, Falk Miksa utca 9-11., Hungary
Postal address: 1363 Budapest, P.O. Box 9., Hungary
www.naih.hu

In addition, you may seek a judicial remedy (Article 79 GDPR), and if you have suffered damage as a result of the processing, you may claim compensation (Article 82 GDPR).

3.4 Data security

Data transmission takes place via an encrypted connection (SSL/TLS). Only authorised staff members may access the system, accesses are logged, and regular backups are made of the data. We have concluded contracts with our data processors in accordance with Article 28 GDPR. In the event of a personal data breach, we act in accordance with Articles 33-34 GDPR.

3.5 Final provisions

If you discover any error or omission in this notice, please notify us immediately at the e-mail address privacy@evignet24.eu or via the contact form in the footer of the website.

Legislation underlying the data processing:

Effective from: 12 August 2026