Privacy Policy

Updated: September 26, 2025

Scope

This Privacy Policy applies to all websites operated by NETGO sp. z o.o. (“Vignette Express”), including but not limited to: vignetteexpress.com, vignetteoesterreich.eu, vignetteczech.eu, vignette-schweiz.com, vignettehungary.eu, vignetteromania.eu, vignetteslovenia.eu, bulgariavignette.eu, slovakiavignette.eu.

1. Who processes your data

The data controller is NETGO sp. z o.o., ul. Graniczna 29, 40-017 Katowice, Poland, NIP: 9542755521, KRS: 0000559238.

2. Data Protection Officer

Contact: support@vignetteexpress.com

3. What data we process

• Identity & contact: first name, last name, email; optionally billing address.
• Vehicle data: license plate number, country of registration, vehicle category.
• Order & billing: order number, selected product (vignette/route toll), amount to pay, payment status; payment tokens with providers (we do not store card numbers).
• Communications: messages you send us (support, complaints, requests).
• Technical data: IP address, cookie/device IDs, session data and event logs (not used for profiling).

4. Purposes & legal bases (GDPR)

Contract performance (Art. 6(1)(b) GDPR)
Processing orders, registering vignettes/route tolls on your behalf, order communications, issuing invoices/receipts.

Legal obligations (Art. 6(1)(c) GDPR)
Tax and accounting records, responses to public authorities.

Legitimate interests (Art. 6(1)(f) GDPR)
Service security, claim establishment/defence, service quality analytics, basic direct marketing of our services.

Consent (Art. 6(1)(a) GDPR)
Service review invitations (Trustpilot), marketing cookies / advanced analytics.

5. Cookies / analytics and advertising

We use strictly necessary cookies (for session management, language preferences, etc.). Upon your consent, we also use analytics and marketing cookies to improve our services and measure ad effectiveness.

Advertising and personalization
We collaborate with Microsoft Ireland Operations Ltd. (Microsoft Advertising) and Google Ireland Ltd. (Google Ads) to assess campaign performance, limit ad frequency, and deliver personalized advertising. These partners may place cookies or similar technologies to:

• display ads tailored to your interests;
• analyze conversions and user interactions after clicking on ads;
• measure the reach and effectiveness of our campaigns.

Data collected via these cookies or identifiers is technical in nature (e.g. device or cookie IDs), and does not include sensitive personal data such as your name, email, or vehicle information. All use of such data for advertising/personalization requires your consent.

6. Opt-out and consent management

You may withdraw your consent for analytics, marketing, or personalization cookies at any time:

• Adjust your cookie preferences on our website via the cookie settings interface.
• Use your browser settings to block or delete cookies.
• Opt out of personalized advertising from our partners by visiting:
  • https://account.microsoft.com/privacy/ad-settings
  • https://adssettings.google.com/
  • https://www.youronlinechoices.eu/

After opting out, you may still see ads, but they will not be personalized.

7. Data recipients

Public authorities and road toll operators; Payment providers: PayU, Stripe, PayPal, Klarna (independent controllers); IT/hosting providers, legal/accounting firms; Trustpilot A/S (review invitations).

Advertising partners: Google Ireland Ltd. (Google Ads), Microsoft Ireland Operations Ltd. (Microsoft Advertising).

8. Transfers outside the EEA

Where data is transferred to a third country (e.g., the USA), we rely on the European Commission’s Standard Contractual Clauses (SCCs) or other safeguards under Chapter V of the GDPR.

9. Data retention

• Order & billing records: up to 6 years (tax/accounting laws; claims).
• Communications: up to 3 years (claims).
• Technical data/logs: up to 12 months (security).
• Consent-based data: until consent is withdrawn.

10. Your rights

Access, rectification, erasure, restriction; portability (when lawful); objection; withdrawal of consent at any time; complaint to the supervisory authority (in Poland: President of the Personal Data Protection Office).

11. Security

We apply appropriate measures proportionate to risk, including TLS encryption, access controls, event logging, and regular security testing.

12. Changes to this Policy

We may update this document periodically. The latest version will be published on our website with its effective date.

13. Contact

For privacy matters, contact us at: support@vignetteexpress.com