Privacy Policy

Last updated: March 2026

Article 1 - Identity of the data controller

The controller of the personal data collected via the vin-doc.com website (hereinafter "the Site") is:

• Company name: SRS MEDIA LTD, a company incorporated under Bulgarian law, registration number 207787318
• Registered office: Barzaritsa Street, 4A, ap.16, 1618 Sofia, Bulgaria
• Contact: contact form available on the Site

For any question relating to the processing of personal data or the exercise of the rights described in this policy, the User may contact the data controller via the contact form.

Article 2 - Personal data collected

Personal data means any information relating to an identified or identifiable natural person, within the meaning of article 4 of the General Data Protection Regulation (GDPR - EU Regulation 2016/679).

The Site collects the following personal data, depending on the User's interactions:

2.1 Contact form

Surname, first name, email address.

2.2 Account creation and subscription

Surname, first name, email address, telephone number, postal address, billing address.

2.3 Browsing data

IP address, connection data, behavioural data (pages visited, clicks, visit duration), cookie identifiers.

Article 3 - Purposes and legal bases of processing

Personal data is collected and processed for the following purposes:

• Management of contact requests: processing the User's contact requests.

Legal basis: consent of the User (article 6.1.a of the GDPR).

• Account management and provision of the Services: creating and managing the User's account, providing the Services related to the subscription, ensuring maintenance and support.

Legal basis: performance of the contract between the Customer and SRS MEDIA LTD (article 6.1.b of the GDPR).

• Payment management: validating orders, managing debits and processing refunds.

Legal basis: performance of the contract (article 6.1.b of the GDPR).

• Statistical analysis: analysing the Site's traffic and improving the user experience.

Legal basis: consent of the User for analytical cookies (article 6.1.a of the GDPR).

• Targeted advertising: displaying targeted advertisements and measuring their performance.

Legal basis: consent of the User (article 6.1.a of the GDPR).

• Security and fraud prevention: preventing and combating computer fraud.

Legal basis: legitimate interest of the data controller (article 6.1.f of the GDPR).

The data controller undertakes not to process the data for purposes other than those mentioned above. In the event of new processing, the User's consent will be obtained beforehand.

Article 4 - Minors' data

In accordance with article 8 of the GDPR, the Services of the Site are intended for persons aged 15 or over. Minors under 15 must obtain the consent of their legal representative to use the Site.

Article 5 - Data retention period

Personal data is retained for the period strictly necessary for the purposes for which it was collected:

• Users' data (contact form): 3 years from the last contact.
• Customers' data (account and subscription): 5 years from the last subscription.
• Billing data: 10 years in accordance with legal and tax obligations.
• Connection data and cookies: 13 months maximum.

Upon expiry of these periods, the data is deleted or anonymised. The data controller may retain certain data beyond these periods to fulfil its legal or regulatory obligations.

Article 6 - Recipients of the data

6.1 Host

The Site is hosted by Amazon Web Services, Inc. (AWS) on servers located in the European Union. The host has limited access to the data as part of its hosting services.

6.2 Subcontractors

The Site uses the following subcontractors:

Each subcontractor is contractually required to process the data in accordance with the GDPR.

6.3 Transfers outside the European Union

Some subcontractors are located outside the European Union (notably in the United States). These transfers are governed by standard contractual clauses adopted by the European Commission, guaranteeing an adequate level of protection of personal data.

6.4 Legal obligations

The data may be communicated to the competent authorities in response to legal, judicial or regulatory obligations.

The data controller does not sell, rent or transfer any personal data to third parties.

Article 7 - Data security

The data controller implements the appropriate technical and organisational measures to ensure the security and confidentiality of personal data, in accordance with article 32 of the GDPR.

However, no method of transmission over the Internet or method of electronic storage can guarantee absolute security. In the event of a personal data breach likely to result in a high risk to the rights and freedoms of the data subjects, the data controller will inform the Users concerned and the competent supervisory authority within the timeframes provided for by the GDPR.

Article 8 - Users' rights

In accordance with the GDPR (articles 15 to 22), the User has the following rights over their personal data:

• Right of access: to know the data collected and obtain a copy (article 15).
• Right of rectification: to correct inaccurate or incomplete data (article 16).
• Right to erasure: to request the deletion of data under the conditions provided for by article 17.
• Right to restriction: to request the restriction of processing (article 18).
• Right to portability: to receive their data in a structured format and transmit it to another data controller (article 20).
• Right to object: to object to the processing of their data, in particular when the processing is based on legitimate interest (article 21).
• Right to withdraw consent: to withdraw their consent at any time, without affecting the lawfulness of the processing carried out before the withdrawal (article 7.3).
• Right relating to automated decisions: not to be subject to a decision based solely on automated processing producing legal effects (article 22).

Article 9 - Exercise of rights

The User may exercise their rights by the following means:

• via the contact form available on the Site;
• by post to the address: SRS MEDIA LTD, Barzaritsa Street, 4A, ap.16, 1618 Sofia, Bulgaria.

The request must indicate the surname, first name and email address of the User, and be accompanied by proof of identity. Requests are processed within one (1) month from their receipt. This period may be extended by two (2) months in the event of complexity or a high number of requests, in accordance with article 12.3 of the GDPR.

In the event of difficulty in exercising their rights, the User may lodge a complaint with the competent supervisory authority (for France: CNIL - www.cnil.fr; for Bulgaria: CPDP - www.cpdp.bg).

Article 10 - Cookie policy

10.1 What is a cookie?

A cookie is a small text file placed on the User's device (computer, tablet, phone) when consulting the Site. It allows certain information relating to the User's browsing to be stored.

10.2 Categories of cookies used

The Site uses the following categories of cookies:

• Strictly necessary cookies: cookies necessary for the operation of the Site and for consent management (Cookiebot). These cookies do not require the User's consent.
• Analytical cookies: cookies allowing the analysis of traffic and User behaviour on the Site (Google Analytics). Subject to prior consent.
• Advertising cookies: cookies allowing the display of targeted advertisements and the measurement of their performance (Google Ads, Meta, Snapchat, TikTok, Taboola, Outbrain). Subject to prior consent.

10.3 List of cookies

10.4 Consent

In accordance with the CNIL guidelines and Directive 2002/58/EC (ePrivacy), the placing of analytical and advertising cookies is subject to the prior consent of the User, obtained via the cookie management banner (Cookiebot) displayed on the first visit. This consent is valid for 13 months.

The absence of action by the User (simply continuing to browse) does not constitute valid consent. No non-essential cookie is placed before consent is obtained.

10.5 Management and objection

The User may at any time modify their cookie preferences:

• via the cookie management widget accessible on the Site;
• via their browser settings (Edge, Safari, Chrome, Firefox, Opera).

Refusing analytical and advertising cookies does not prevent access to the Site, but may limit certain features.

Article 11 - Modification of this policy

The data controller reserves the right to modify this policy in order to comply with legislative developments or to adapt its practices. Any modification will be published on the Site. In the event of a substantial modification affecting Users' rights, new consent will be obtained.

Article 12 - Applicable law

This policy is governed by the General Data Protection Regulation (GDPR - EU Regulation 2016/679), Directive 2002/58/EC (ePrivacy) and, on a subsidiary basis, by Bulgarian data protection legislation.

In the event of a dispute, the User may refer the matter to the supervisory authority of their place of habitual residence, their place of work or the place where the breach was allegedly committed, in accordance with article 77 of the GDPR.

SRS MEDIA LTD - Barzaritsa Street, 4A, ap.16, 1618 Sofia, Bulgaria - No. 207787318