Legal
BRDiagnostics collects personal data necessary to provide our services and operate our platform. The types of data we collect include:
Account information: name, email address, phone number, company name, VAT number, and billing address provided during registration or added later in your account. If you place a guest order, we store the email address you provide; for physical product orders we store the shipping name, address, and phone number you provide.
Vehicle data: VIN numbers, ECU file contents, diagnostic fault codes, and vehicle configuration data submitted through our platform for processing, together with the files generated for your orders.
Remote diagnostics data: when you use our remote diagnostic service, we process connection identifiers and certificates for your diagnostic device, the device name you choose, connection status, and the chat messages and attachments exchanged during a session. Session reports may include the session chat transcript and screenshots selected by the operator.
Support and contact data: messages you send us through the contact form or support channels, including your name, email address, and the content of your message. Our staff may record internal notes about your support requests and sessions.
Optional contact identifiers: if you choose to link Telegram for notifications, we store your Telegram username and chat ID.
Consent records: when you accept our Terms or Privacy Policy or confirm an order, we record the time, the language you used, and your browser's user-agent string, so we can evidence your consent.
Usage data: IP addresses and server logs collected automatically to keep the service secure and reliable, plus aggregated, cookieless analytics (see “Cookies”).
Payment data: card and bank details are processed by our payment service provider and are not stored on our servers. We only retain transaction records and payment confirmation references.
We process collected data for the following purposes, each under an appropriate GDPR legal basis:
Service delivery (performance of a contract): processing ECU files, performing diagnostics, managing your account, and fulfilling purchases.
Platform improvement (legitimate interest): analysing aggregated, anonymised usage to improve performance and fix bugs.
Communication: sending order confirmations, service updates, and security alerts (contractual / legitimate interest); promotional messages only with your consent.
Legal compliance: maintaining accounting and tax records as required by applicable Netherlands and EU law, and to prevent fraud or respond to lawful requests.
We do not sell your personal data. Data sharing is limited to the recipients listed below, under data processing agreements where applicable.
Under the GDPR you have the right of access, rectification, erasure, restriction of processing, data portability, and to object to processing (including direct marketing). You may withdraw consent at any time.
You can update most account information directly through your dashboard. To delete your account, contact [email protected]: your personal data is permanently deleted or irreversibly anonymised within 30 days, except for records we are legally required to keep — invoices, credit notes, and the related transaction records are retained for 7 years under Dutch tax law, in a form no longer linked to an active account.
To exercise any right, contact [email protected]. We respond to verified requests within 30 days. You also have the right to lodge a complaint with the competent data protection authority.
We keep personal data only as long as needed for the purposes above:
Account and profile data: for as long as your account exists, then deleted or anonymised as described under “Your Rights”.
Uploaded files, generated result files, and session reports: available for download for the period shown in your dashboard, after which stored copies are removed on a scheduled basis.
Invoices and credit notes: 7 years (statutory retention under Dutch tax law).
Application and email logs: automatically deleted after 14 to 90 days depending on the log type.
Analytics: aggregated and cookieless only — no personal data is retained.
We keep cookies and similar browser storage to the minimum required to run the site:
Strictly necessary: authentication and session state (a secure cookie plus your browser's local storage), and your saved language and theme preferences. These cannot be disabled and are exempt from consent.
Analytics: when enabled, we use privacy-friendly analytics that is cookieless and stores no personal data — no tracking cookies, no advertising pixels, and no data shared with third parties.
Because we set no non-essential cookies, no cookie consent banner is required. See our Cookie Policy for details.
We do not sell your personal data. To run the service we rely on a small number of vetted providers, each bound by a data processing agreement where applicable and acting only on our instructions. By category, these are:
a payment service provider — to take payments; when you set up a subscription or saved payment mandate, it also receives your name and email address;
cloud hosting and storage providers, located in the EU — to run the platform;
a content-delivery and security provider — to deliver and protect the site;
an email provider — to send transactional email;
a bookkeeping software provider — invoice details required for statutory accounting;
a messaging provider — if you choose to link Telegram, the notifications you enable are delivered through Telegram's API, which may process data outside the EEA.
In addition, where an order requires files to be generated or signed by the vehicle manufacturer, we transmit the vehicle identification number (VIN) and the vehicle configuration data needed to fulfil that order to the manufacturer's online systems. Where you provide an EU VAT number for business invoicing, we validate it against the European Commission's VIES service.
Where a provider may process personal data outside the European Economic Area, the transfer is covered by appropriate safeguards such as the EU Standard Contractual Clauses. We can provide the identity of a specific provider on request. Our website analytics is cookieless and shares no data with any third party.
For any question or request regarding this Privacy Policy or our data practices:
Controller: BRDiagnostics
Email: [email protected]
We aim to respond to all privacy-related inquiries within 5 business days, and to formal data subject requests within 30 calendar days as required by the GDPR.