Privacy policy

1. The data controller and contact details

The data controller is Artinet Ltd., the operator of ServiceHistoryByVIN. Its registered office is at: 6500 Baja, Kígyó utca 9., Magyarország; company registration number: 0309135079; tax number: HU29300464.

A written request can also be submitted by post to the headquarters of Artinet Ltd.: 6500 Baja, Kígyó utca 9., Magyarország.

2. Source and scope of the processed data

We receive the VIN from you, email address, ownership, buyer, or dealer role, chosen language, and accepted offer. For service requests requiring authorization, we also process the necessary certifications and approval data. Please do not provide documents or other persons' data not required for the request.

The vehicle's technical and equipment data, available battery estimations, and authorized service information come from the manufacturer's or contracted service provider's response. The VIN may be personal data if linked to a natural person. The request does not grant access to all previous owners' data of the vehicle.

The system records order identifiers, payment and refund status, acceptance time, report version, and sharing settings. We do not store credit card numbers or security codes; these are entered on the payment provider's interface.

3. Purposes and legal bases

Sharing the report is a separate service action initiated by you. Sharing is not a condition of the order. Language and security cookies are necessary for requested operation; analytic consent is optional.

4. Who can receive data?

Only authorized employees of the operator, technical contributors of infrastructure and mail, the manufacturer serving the query, and the Stripe during payment participate in order fulfillment to the extent necessary for their tasks. The Tesla request forwards the VIN and required technical authentication; authorized service data requires approved access.

Cloudflare service may participate in website delivery and protection. Technical data of the HTTP connection, such as IP address and request headers, are available during the connection to server and network protection. These do not enter our analytics table. The requested email notification is forwarded by the configured mail infrastructure.

We use the OpenAI service to translate the interface texts and the textual names of vehicle data. For translation, we do not send the VIN, your email address, the order ID, or the login link. The completed translations are stored for later display.

The roles of data processors and independent controllers are determined by the respective service and contract. Data is provided upon official request only with proper legal basis. We do not sell personal data nor use it for advertising profiling.

5. International data transfer

International technical service providers may involve data processing outside the European Economic Area. Personal data can only be transferred under applicable adequacy decisions or appropriate contractual guarantees. Information about the applicable guarantees and the current list of collaborators can be requested from the data controller. Translation input is produced without personal data.

6. Retention periods

Report access is by default 365 days and the sharing link 30 days; the accepted value in the order prevails. Expired report versions are deleted by background process. The access link is single-use and valid for 30 minutes. Service access tokens are deleted at task end or expiration; raw source data of closed service requests are kept in the active source table for up to 30 days.

Order and financial evidence are not governed by the same retention rules as the report. Only data necessary for fulfillment, complaints or legal claims can be retained; general statute of limitations for civil claims and applicable accounting retention obligations apply. Accounting documents must usually be retained for 8 years. Only authorized operators have access to the technical source archive; deletion must be performed when service and evidentiary purposes cease.

Cookie selection and aggregated analytics are stored for up to 180 days. Aggregated measurement includes daily page-, language- and device-group counters; it contains no visitor ID, IP, VIN, email or secret URL. Security logs and backups are retained according to debugging, abuse protection and recovery needs; they are not used for marketing.

7. Private report and sharing

The report is private by default and tied to verified email access. You can create a separate sharing link; the link holder can view the shared version. The VIN is masked by default, full VIN disclosure requires explicit selection. Email address and authentication data are not included in the shared document.

The link can be revoked and expires, but we cannot technically retract previously downloaded PDF or screenshot copies. Share only data you have the right to publish.

8. Cookies and analytics

The proprietary analytics and Google Analytics 4 are disabled by default. They only track public page views after explicit permission; private orders, reports, and sharing tokens are not tracked. Google processes analytic identifiers as well as technical browser, device, and session data, and the IP address is accessible to it during the network connection. Query parameters and URL fragments are omitted from the transmitted page URL; VIN, email, and order data are not sent. The retention of Google measurement data is regulated by the analytic account settings.

If the browser signals Do Not Track or Global Privacy Control, the measurement does not start. Consent can be revoked at any time via the Cookie settings link in the footer; in such cases, we stop the measurement and delete the available Google Analytics cookies. We do not allow advertising personalization or Google Signals measurement.

9. Rights of the data subject

You may request access, copy, correction, deletion or restriction; depending on legal basis, also data portability. You can object to legitimate interest-based processing. Consent can be withdrawn anytime without affecting prior lawful processing. Documents under mandatory retention cannot be deleted despite legal request.

Requests must be submitted in writing to the data controller. Identification data is only requested to verify request legitimacy. Generally, we respond within one month; for justified extensions, we notify within the first month.

10. Complaints and remedies

You can file a complaint with the National Data Protection and Freedom of Information Authority: office location 1055 Budapest, Falk Miksa utca 9–11., mailing address 1363 Budapest, Pf. 9.. You may also seek judicial remedy and contact relevant other European supervisory authorities.

11. Automation and changes

The system automatically checks format, authorization, payment status and request status. It does not make profile-based decisions with legal effect. AI translates text; vehicle data and business decisions are not altered. New versions are published upon significant changes; prior order terms remain recorded.