Privacy Policy

This Policy explains what personal data the Evimarko service (evimarko.com) processes, why, on what legal bases, to whom it is disclosed, how long it is kept, and what rights the people whose data is processed have. This Policy has been drawn up in accordance with the Law of Ukraine “On Personal Data Protection” (hereinafter, the Law) and Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter, the GDPR).

1. Who processes the data

1. The controller of the data of website visitors, users of the Service (studios and their employees) and Market shops is [details to be provided], individual tax number (RNOKPP) / EDRPOU code [details to be provided], address: [details to be provided], email: [email protected] (hereinafter, “Evimarko”, “we”).
2. With respect to the data of studios’ clients (people who book with a studio or whose data the studio enters into the CRM), the controller is the relevant studio, and Evimarko is the processor, which processes the data only on the studio’s instructions under the Data Processing Agreement. Please address questions about such data to the studio first; we will help the studio fulfil your request.

2. What data we process and why

2.1. Website visitors

• Technical data: IP address, browser and device type, page address, time of request — in server logs, for operating the website and protecting against attacks and abuse. Legal basis: legitimate interest (Article 11 of the Law; Article 6(1)(f) GDPR).
• Visit statistics — if enabled, cookieless analytics (Plausible or Umami) is used, which counts visits in aggregated form and does not identify any specific person. Legal basis: legitimate interest.
• Form data: support requests, catalog reviews (name, telephone number for verification — not published, text, rating, IP), owner requests to change or remove a catalog listing (contact, reason). Legal basis: your consent and our legitimate interest in moderation and protection against fakes.

2.2. Users of the Service (studios and their employees)

• Account: name, email, telephone number, password (stored only in hashed form), role, language, time zone, settings, two-factor authentication data.
• Studio data: name, address, contacts, business details, logo, plan and payment history (amount, date, status; we do not receive payment card data — it is processed by the payment service).
• Logs: logins (IP address, time), CRM activity log, log of consents to documents (who, when, IP, document version).
• Support: correspondence and screenshots you send.

Purpose: conclusion and performance of the contract (provision of the Service, payment, support), account security, compliance with legal requirements (accounting and tax records), evidence of acceptance of the terms. Legal bases: contract (Article 11 of the Law; Article 6(1)(b) GDPR), legal obligation (Article 6(1)(c)), legitimate interest (Article 6(1)(f)).

2.3. Studios’ clients (Evimarko as processor)

• Name, telephone number, email, language; vehicle (make, model, year, registration plate number, VIN, mileage); call-out address; booking and order history, estimates, amounts and payments; photos of the vehicle and damage, check-in reports with signature; warranties; correspondence in messengers and on online booking pages; call data where telephony is integrated; the studio’s notes.
• The purpose and legal bases are determined by the studio as controller (typically performance of a contract with the client, the client’s consent, or the studio’s legitimate interest). Evimarko processes this data solely to provide the Service to the studio.
• During online booking, we record the time, IP address and the version of this Policy that was presented to the client.

2.4. Market shops

Name and contacts of the representative, business name, details (EDRPOU code / individual tax number (RNOKPP)), verification documents, goods, orders, commission invoices, reviews. Legal bases: contract (Market Offer), legal obligation, legitimate interest in verifying sellers. Market data is stored in a separate database.

2.5. Studio catalog

Public information about studios (name, address, public telephone number, website, social media, opening hours) obtained from the studios themselves or from open sources. If a studio is a sole proprietor (FOP), this information may constitute personal data. Legal basis: legitimate interest in informing about services (Article 6(1)(f) GDPR); the owner has the right to require changes or removal — see the Catalog Rules.

3. To whom we disclose data

We do not sell personal data or disclose it for advertising. Data may be received only by:

• the hosting provider — servers are located in the European Union (Poland); the provider stores encrypted backups;
• the email delivery service — for service emails (password recovery, notifications);
• payment services — monobank (JSC “Universal Bank”), LiqPay (JSC CB “PrivatBank”), Heleket — for payment of plans; they act as independent controllers under their own policies;
• messengers and social networks — Telegram, Viber, Meta (WhatsApp, Instagram, Facebook) — only if the studio has connected the relevant channel; messages pass through their servers under their rules;
• services that the studio connects itself: fiscalisation (Checkbox), SMS gateways, telephony, delivery services (Nova Poshta — for the Market), webhooks and API;
• fonts and maps: studio websites may load Google Fonts (Google receives the visitor’s IP address); links to Google Maps / Waze open only after you click them;
• public authorities — only upon a lawful request;
• a successor — in the event of the Service being transferred to another person, with notice to users.

Some of these services may process data outside the European Economic Area (EEA) and Ukraine (for example, in the USA). In such cases, the transfer is made on the basis of an adequacy decision (in particular, the EU-U.S. Data Privacy Framework), EU standard contractual clauses, or because it is necessary for the performance of a contract or is made at your request (Article 29 of the Law; Chapter V GDPR).

4. How long data is kept

• Account data and Studio data — for the term of the contract and 30 days after its termination (for export), after which it is deleted; backups — up to a further 30 days.
• Studios’ clients’ data — for as long as the studio keeps it; after termination of the contract with the studio — as stated above.
• Payment and accounting documents — for the period set by tax legislation (no less than 1095 days).
• Consent log and correspondence concerning claims — for the term of the contract and 3 years thereafter (the limitation period).
• Server logs — no longer than 90 days, unless they are needed to investigate an incident.
• Catalog reviews — for as long as they are published; the author’s telephone number — until moderation is completed, but no longer than 1 year.

5. Cookies and local storage

We use only strictly necessary cookies, without which the website cannot function, so no consent banner is required:

• session cookie — to keep you signed in (deleted when the session ends / on sign-out);
• XSRF-TOKEN — protection of forms against request forgery;
• remember_web_… — only if you have selected “Remember me”.

We do not set advertising or analytics cookies. The browser’s local storage (localStorage) may hold minor interface settings (for example, that you have dismissed the app installation tip); these are not transmitted to us.

6. Security

• the connection is protected by encryption (HTTPS/TLS);
• sensitive fields (clients’ telephone numbers and emails, notes, addresses, access codes, IP addresses in logs) are stored in the database in encrypted form;
• passwords are stored only in hashed form; two-factor authentication is available;
• each studio’s data is isolated from other studios; Market data is kept in a separate database;
• studio employees’ access is restricted by roles; an activity log is maintained;
• regular backups.

We notify the competent supervisory authority of a personal data breach that poses a risk to people within 72 hours and, where necessary, the people themselves (Articles 33–34 GDPR), as well as the studio — with respect to its clients’ data.

7. Your rights

In accordance with Article 8 of the Law and Articles 15–22 GDPR, you have the right to: know who processes your data and why; access it and obtain a copy; require the rectification of inaccurate data; require erasure (the “right to be forgotten”) or restriction of processing; object to processing based on legitimate interest; receive your data in a machine-readable format (portability); withdraw consent at any time (this does not affect the lawfulness of processing before withdrawal); lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights or with an EU supervisory authority (in Poland — Prezes Urzędu Ochrony Danych Osobowych).

Please send requests to [email protected]. We respond within 30 days (in complex cases this period may be extended, and we will inform you of this). We may ask you to verify your identity. If you are a studio’s client, the quickest way is to contact the studio itself.

8. Other

• We do not take decisions that produce legal effects for you based solely on automated processing.
• The Service is not intended for persons under 16; we do not knowingly collect their data.
• We may update this Policy; the new version is published on this page with its date. We notify users of the Service of material changes in the CRM.

9. Contacts

[details to be provided]
Individual tax number (RNOKPP) / EDRPOU code: [details to be provided]
Address: [details to be provided]
Email for personal data matters: [email protected]
Phone: [details to be provided]