This Privacy Policy explains how TUNING DATABASE SRL ("we", "us", "our"), the company operating the website www.tuning-database.co.uk, collects, uses, stores and protects your personal data. We are the data controller. We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679), the UK General Data Protection Regulation and the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR). Where this policy refers simply to "GDPR", it means whichever of those regimes applies to you.
1. Data Controller
The data controller responsible for your personal data is:
TUNING DATABASE SRL
CUI (fiscal code) 55425106 · Reg. Com. J2026049785007
Registered office: Jud. Argeș, România — full postal address on our Contact page
Website: www.tuning-database.co.uk
Email: contact@tuning-database.co.uk
"TUNING-DATABASE" and "Tuning Database" are trading names of TUNING DATABASE SRL. The same company is the controller for this website, for your customer account, for the file service, and for the software licences and hosted portals we operate. Operations and support are run from the United Kingdom.
We have not appointed a Data Protection Officer, because we are not required to. Data-protection enquiries go to the email address above and are handled by the company directly.
2. What Personal Data We Collect
Identity Data: Full name, username, email address, display name.
Contact Data: Email, phone/WhatsApp number, billing country, postcode.
Financial Data: Payment processed by Stripe/PayPal — we never store your full card number, CVV, or expiry date.
Transaction Data: Order history, amounts, products, downloads, credit balance, File Service history, payment status.
Technical Data: IP address, browser, OS, device type, HWID (for software licences), activation timestamps.
Communication Data: Support messages, File Service correspondence, contact form submissions.
Vehicle Data: Make, model, year, engine, ECU type, HW/SW numbers — provided by you for tuning services.
Consent Data: T&C acceptance records, cookie preferences, marketing opt-in status.
3. How We Collect Your Data
- Directly from you: Account creation, orders, File Service requests, contact forms, email/WhatsApp.
- Automatically: Cookies, server logs, software licence activation and verification.
- From payment providers: Stripe/PayPal transaction confirmations and limited billing details.
- From security services: Wordfence collects IP addresses, login attempts, and threat data.
4. Lawful Basis for Processing
We process your data under UK GDPR Article 6(1):
Contract Performance (Art. 6(1)(b)): Fulfilling orders, delivering products, managing your account, File Service, licence activation, customer support.
Legitimate Interests (Art. 6(1)(f)): Fraud prevention, chargeback defence, anti-piracy, security monitoring, service improvement.
Legal Obligation (Art. 6(1)(c)): Tax records (HMRC), financial reporting, law enforcement compliance.
Consent (Art. 6(1)(a)): Marketing emails and non-essential cookies — withdrawable at any time.
5. How We Use Your Data
Order Processing: Process purchases, deliver digital products, generate licence keys, manage credits, send confirmations.
File Service: Receive ECU uploads, produce custom files (typically delivered within 10 minutes to 3 hours), communicate about requests, manage payments.
Software Licensing: Generate and deliver keys, verify HWID activations, periodic licence verification, manage transfers, enforce single-device terms.
Security & Fraud Prevention: Monitor suspicious activity, detect fraud, defend chargebacks with evidence (IP, downloads, terms acceptance), enforce T&C, Wordfence WAF protection.
Customer Support: Respond to enquiries, troubleshoot issues, process licence transfers, resolve complaints.
Analytics: Understand site usage (anonymised where possible), improve performance and product catalogue.
Automated Analysis & AI Features: We process files, vehicle data (which may include a VIN) and data derived from them to operate and improve automated and AI-assisted features (file analysis, compatibility matching, tuning assistance and delivery), generate aggregated and de-identified insights, and maintain the capability and integrity of our service network. Lawful basis: legitimate interests (Art. 6(1)(f)), balanced against your rights. De-identified and derived data is not personal data and may be retained without restriction (see Section 8).
6. Cookies
Strictly Necessary: WooCommerce session, WordPress auth, Wordfence security, cookie consent. Cannot be disabled.
Analytics: Google Analytics — loaded only after you accept via our cookie consent banner. IP anonymisation enabled.
Payment: Set by Stripe/PayPal during checkout for secure processing and fraud prevention.
You can manage cookies through your browser settings. Disabling necessary cookies may prevent cart and login functionality.
7. Data Sharing
Stripe & PayPal: Payment processing and fraud prevention. PCI DSS Level 1 certified.
Card Networks (Visa, Mastercard, Amex): In chargeback disputes, we submit transaction records, delivery evidence, and terms acceptance.
Wordfence: Processes IP addresses and request data for website security.
WP Mail SMTP: Transactional email delivery.
Hosting Provider: Stores data on EEA servers.
Specialist technical service providers: A small number of vetted providers process data on our behalf to deliver parts of the service — file analysis and automated processing, and software delivery infrastructure. They act only on our written instructions, under contracts containing the data-protection terms required by Article 28 GDPR, and may not use the data for their own purposes.
Law Enforcement: Where required by law, or to establish, exercise or defend legal claims.
Business transfer: If the business, or the part of it operating this service, is ever sold, merged or reorganised, data may transfer to the acquirer, who will remain bound by this policy.
We do not sell, rent or trade your personal data to any third party for marketing purposes.
Portals we host for business customers. Where we operate a hosted portal for a tuning business, that business is the controller of its own customers' data and we act as its processor under a written agreement. If you are a customer of such a business, contact that business to exercise your rights — we will assist them, but we cannot act on their data without their instruction.
8. Data Retention
| Data Category | Retention | Reason |
|---|---|---|
| Account data | Account life + 2 years | Contract, legal compliance |
| Order & transaction records | 7 years | HMRC tax requirements |
| IP addresses & device IDs | 540 days minimum | Chargeback defence |
| Download & access logs | 540 days minimum | Proof of delivery |
| Terms acceptance records | 7 years | Legal compliance |
| Software licence records | Licence life + 2 years | Anti-piracy, disputes |
| File Service uploads & derived data | Retained as long as necessary | Service delivery, automated/AI features, fraud prevention & network integrity (legitimate interest) |
| Support communications | 3 years | Customer service |
| Cookie consent | 12 months | PECR/GDPR |
| Wordfence logs | 90 days | Security |
| Analytics | 26 months | Website improvement |
When data is no longer required, it is securely deleted or anonymised.
9. Data Security
- TLS/SSL Encryption: All data in transit is encrypted (HTTPS).
- PCI DSS Level 1: Payments handled by Stripe/PayPal — we never store card details.
- Access Control: Personal data restricted to authorised personnel only.
- Wordfence WAF: Real-time firewall monitoring and blocking.
- File Isolation: ECU uploads stored in per-user isolated directories.
- HWID Binding: Software licences secured with encrypted API communications.
- Password Security: Hashed with bcrypt (WordPress secure hashing).
In the event of a data breach posing high risk, we will notify you and the ICO within 72 hours as required by UK GDPR.
10. International Transfers
Your data is stored on servers in the European Economic Area. Some of our providers are based outside the EEA and the UK, and data may be transferred to them:
- Stripe (US) — Protected by Standard Contractual Clauses (SCCs) and, for UK transfers, the UK International Data Transfer Addendum.
- PayPal (US) — Protected by SCCs and Binding Corporate Rules.
- Google Analytics (US) — Protected by SCCs. IP anonymisation enabled. Loaded only if you accept analytics cookies.
All international transfers are protected by appropriate safeguards as required by Chapter V of the EU GDPR and of the UK GDPR, including an adequacy decision where one is in force, or Standard Contractual Clauses together with a transfer risk assessment where one is not. You may ask us for a copy of the safeguards in place.
11. Your Rights Under UK GDPR
Right of Access (Art. 15): Request a copy of your data. We respond within one month.
Right to Rectification (Art. 16): Correct inaccurate data. Update most info via your Account dashboard.
Right to Erasure (Art. 17): Request deletion — subject to legal retention obligations (e.g., HMRC tax records, chargeback defence).
Right to Restrict Processing (Art. 18): Request restriction while we verify accuracy or resolve an objection.
Right to Data Portability (Art. 20): Receive your data in CSV or JSON format.
Right to Object (Art. 21): Object to legitimate interest processing. Absolute right to object to direct marketing.
Automated Decisions (Art. 22): We do not make solely automated decisions with legal effects. Anti-fraud flags are reviewed by our team.
Withdraw Consent: Where processing is based on consent, withdraw at any time without affecting prior processing.
To exercise any right: contact@tuning-database.co.uk. We respond within one month. No fee unless requests are manifestly unfounded or excessive.
12. Children's Privacy
Our website and services are not intended for individuals under 18. We do not knowingly collect data from children. If we discover such data, we will delete it promptly. Contact us if you believe a child has provided us with personal data.
13. Changes to This Policy
We may update this Privacy Policy to reflect changes in practices, technology, or legal requirements. Updates are posted on this page with a revised "Last Updated" date. For significant changes, we may notify you via email or website notice.
14. Complaints
If you are unhappy with how we handle your data, you can lodge a complaint with a supervisory authority. You may complain to the authority in the country where you live, where you work, or where the issue occurred.
Our lead supervisory authority (EU) — ANSPDCP, Romania
Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal
Website: dataprotection.ro
B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, București, România
United Kingdom — Information Commissioner's Office (ICO)
Website: ico.org.uk
Telephone: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
We would appreciate the opportunity to address your concerns first — please contact us at contact@tuning-database.co.uk.
15. Contact Us
TUNING DATABASE SRL
CUI 55425106 · Reg. Com. J2026049785007
Jud. Argeș, România — full postal address on our Contact page
Email: contact@tuning-database.co.uk
Website: www.tuning-database.co.uk
Contact Page: www.tuning-database.co.uk/contact-us