Privacy Policy

How ECU-LAB processes account, order, payment and ECU-file data.

Version 3.5-N · In force since 2026-11-13

1. Controller and contact

The controller of the personal data described in this Policy is ECU-LAB, the operator of ecu-lab.online.

Privacy requests: contact@ecu-lab.online.

2. Scope

This Policy applies to ecu-lab.online, ECU-LAB Accounts, Plans, coin transactions, Automatic and Manual Processing, tickets and related communications.

ECU-LAB is primarily a B2B service, but personal data may relate to sole traders, employees, representatives, technicians, customers and vehicle owners.

3. What we process, why, and on what basis

• Account and business data — name, email, phone, company, billing address, VAT/tax details, language and account reference. Purpose: create and administer the Account. Basis: contract; legal obligation for invoice data.
• Authentication and security data — password hash, session/device identifiers, login history, IP address, browser/user-agent, abuse signals. Purpose: secure Accounts, enforce session/device limits, prevent fraud and account sharing. Basis: legitimate interests in security, fraud prevention and contract enforcement.
• Order and technical data — vehicle/ECU details, selected options, notes, DTC lists, order history, hashes and processing events. Purpose: identify files, process orders, deliver and document the Service. Basis: contract; legitimate interests in troubleshooting and audit.
• Uploaded ECU files — binary files, which may include a VIN or other vehicle identifiers. Purpose: perform Automatic or Manual Processing and secure delivery. Basis: contract.
• Coin and Plan records — Green/Red balances, ledger events, plan, limits, unlock confirmations. Purpose: charge only after confirmation, administer entitlements and resolve disputes. Basis: contract; legitimate interests in evidencing transactions.
• Payment and accounting data — amount, currency, provider, transaction status/reference, invoice details; not full card data. Purpose: take payment, issue invoices, reconcile and meet tax duties. Basis: contract; legal obligation.
• Support and communications — tickets, attachments, email content and service notifications. Purpose: support orders and communicate service information. Basis: contract; legitimate interests.
• Acceptance records — document/version accepted, date/time, Account, IP and user-agent. Purpose: prove contract and consent history. Basis: legitimate interests; legal obligation where applicable.
• Marketing data — email and consent/unsubscribe record. Purpose: send offers or news. Basis: consent.
• Analytics and cookie data — consent state and limited traffic data. Purpose: understand use and improve the Service. Basis: consent for non-essential analytics.

4. ECU files and confidentiality

An ECU file may contain a VIN or another identifier linked to a vehicle or individual. Files are treated as confidential, stored outside the public web root, made available through expiring signed links and restricted to the submitting Account and authorised personnel.

ECU-LAB does not sell files, publish them, use them for advertising, or use them to train or improve a general-purpose or competing model. Technical matching necessary to provide the requested Service is not a sale or unrelated reuse.

5. Sources of data

Most data comes directly from the Client, its authorised users, uploaded files and interactions with the Service. Payment providers send transaction confirmations. Security data is generated by systems and service providers.

If a Client submits data about another person or vehicle, the Client must have a lawful basis and provide the required notices.

6. Recipients and processors

ECU-LAB does not sell personal data. Data is disclosed only as necessary to authorised staff, professional advisers, competent authorities where legally required, and contracted service providers:

• Stripe Payments Europe, Ltd. (Ireland) — card payments
• PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) — payments
• Cloudflare, Inc. (USA / EU edge) — CDN, DDoS protection, tunnel to the processing engine
• ecu-lab (hosting provider) (ecu-lab) — hosting, backups
• ecu-lab (email delivery) (ecu-lab) — transactional email
• ecu-lab (self-hosted) (our own server) — traffic statistics, only with consent

Providers receive only the data necessary for their function and are bound by contract and data-protection obligations appropriate to their role.

7. International transfers

Where personal data is processed outside the European Economic Area, ECU-LAB relies on a lawful transfer mechanism, such as an adequacy decision or European Commission Standard Contractual Clauses, and applies supplementary safeguards where required.

Details of the mechanism for a specific provider are available on request.

8. Retention

• Prepared Output Files — deleted after successful download, with a short operational grace period.
• Prepared but unpaid files — deleted when the unlock window expires.
• Uploaded source files — retained only for processing, delivery, troubleshooting and the short operational window stated in the interface, then deleted unless a manual ticket or legal hold requires longer.
• Ticket attachments — normally deleted 30 days after the ticket is closed or resolved.
• Account, order, Plan and coin ledger records — for the Account lifetime and thereafter only as necessary for claims, fraud prevention and legal obligations.
• Invoices and accounting records — for the statutory period required by the applicable tax and accounting law.
• Acceptance and transaction evidence — for the applicable limitation period and any active dispute.
• Security logs — rotated periodically and kept longer only for a detected incident or legal requirement.
• Marketing consent — until withdrawal, plus a minimal suppression record to respect the opt-out.

When no fixed period is stated, ECU-LAB uses necessity, statutory duties, limitation periods, security risk and dispute status to determine retention. Data is deleted or irreversibly anonymised when no longer required.

9. Cookies and similar technologies

Strictly necessary cookies and local storage support login, security, language, order continuity and consent preferences and are used without optional consent where permitted. Non-essential analytics are activated only after consent.

ECU-LAB does not use advertising cookies. The Client can change optional choices through the cookie settings control. Every cookie is listed individually in the Cookie Policy.

10. Automated processing

The Service automatically matches technical file characteristics against its supported records, enforces limits and calculates coin cost.

These operations provide the requested service and do not make decisions about a person that produce legal or similarly significant effects within the meaning of GDPR Article 22. ECU-LAB does not profile individuals for advertising.

11. Security

Measures include encrypted transport, hashed passwords, access controls, expiring signed download links, storage outside the public web root, rate limiting, audit events, one-session controls, backups and incident procedures.

No system is risk-free. Where a personal-data breach triggers notification duties, ECU-LAB notifies the competent authority and affected individuals as required by law.

12. Your rights

Subject to the GDPR and applicable limits, individuals may request access, rectification, erasure, restriction, portability and objection, and may withdraw consent without affecting earlier lawful processing.

Where processing relies on legitimate interests, an objection will be assessed against compelling legitimate grounds. Requests may be sent to contact@ecu-lab.online. ECU-LAB may verify identity and normally responds within one month, subject to lawful extensions.

13. Marketing communications

Marketing is sent only with the required consent and includes an unsubscribe method.

Service communications — security alerts, order status, invoices and legal or operational notices — are necessary for the Account and are not marketing.

14. Account closure

Closing an Account stops ordinary service use and triggers deletion or restriction according to the retention schedule. ECU-LAB may keep invoice, payment, consent, security and dispute records where legally necessary.

The Client should download required Output Files before closure, because ECU-LAB is not a permanent archive.

15. Changes to this Policy

The current version and effective date are published with this Policy. Material changes are notified through the Account or by email where appropriate. A new consent is requested when the legal basis requires it.