This notice explains what personal data DashCAN processes, why and on what legal basis, who we share it with, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR).
We only process personal data where we have a lawful basis under Article 6 GDPR. The table below maps each processing purpose to the data involved and the legal basis we rely on.
(a) Account registration
Data: email address, password (stored only as a salted hash — never in plain text), display name.
Legal basis: performance of a contract — Art. 6(1)(b) GDPR (to create and operate your account).
(b) Orders, payment & shipping
Data: name, email, phone number, billing and shipping address.
Legal basis: performance of a contract — Art. 6(1)(b) — to process and deliver your order, and compliance with a legal obligation — Art. 6(1)(c) — for issuing and retaining invoices.
Payment: card payments are processed by Stripe. We do not receive or store your full card number or other card data.
(c) DashCAN Cloud telemetry (opt-in)
Data: the telemetry you choose to upload, including GPS position, lap times and ECU/sensor logs.
Legal basis: performance of the cloud-service contract — Art. 6(1)(b) — and, where the upload is an optional feature you switch on, your consent — Art. 6(1)(a). Telemetry is only sent to us if you explicitly enable the cloud feature; otherwise it stays on your device.
(d) Waitlist & notification emails
Data: email address and the product you asked to be notified about.
Legal basis: consent — Art. 6(1)(a). You can withdraw at any time via the unsubscribe link or by emailing us.
(e) Site analytics (Google Analytics)
Data: usage and device data collected through Google Analytics (e.g. pages viewed, approximate location, device/browser information).
Legal basis: consent — Art. 6(1)(a). Analytics runs only if you accept it in our cookie banner. If you do not accept, no analytics cookies are set and no analytics data is collected.
(f) Support email
Data: your email address and the contents of your message.
Legal basis: our legitimate interest in answering enquiries and providing support — Art. 6(1)(f) — or performance of a contract — Art. 6(1)(b) — where your message relates to an existing order or account.
We use a small number of carefully selected service providers who process personal data on our behalf (processors) or receive it to perform their own role (recipients). They act only on our instructions or as needed to deliver their service:
We do not sell your personal data; we share it only with the processors/recipients listed here to run the service. We may also disclose data where required by law or to establish, exercise or defend legal claims.
Most processing takes place within the European Union / European Economic Area (EU/EEA).
Some of our providers — in particular Google and Stripe — may process personal data in the United States. Where they do, the transfer is covered by the EU–US Data Privacy Framework, for which the European Commission has issued an adequacy decision confirming an adequate level of protection. Other processing of your data takes place in the EU/EEA.
Under the GDPR you have the following rights in respect of your personal data:
To exercise any of these rights, contact us at support@dashcan.eu. We will respond without undue delay and in any event within one month of receiving your request, as required by Art. 12(3) GDPR (this period may be extended by two further months for complex or numerous requests, in which case we will tell you).
You also have the right to lodge a complaint with a supervisory authority. In Hungary this is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) — the Hungarian National Authority for Data Protection and Freedom of Information — naih.hu.
We use a small number of strictly necessary cookies to run the site and keep you signed in: access_token and refresh_token (httpOnly, essential) and auth_session (a JavaScript-readable cookie holding your basic user identity, kept for 7 days). Your cart and your cookie-consent choice are stored in your browser's local storage, not in cookies.
Analytics cookies (Google Analytics) are only set if you accept them in the cookie banner. For full details of every cookie, its purpose and duration, see our separate Cookie Policy.
Our website, products and services are not directed to children under the age of 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact support@dashcan.eu and we will delete it.
We may update this Privacy Notice from time to time. When we do, we will post the revised version here with a new version number and date. Where a change requires it — for example a new processing purpose that relies on consent — we will seek your fresh consent before that processing begins. We encourage you to review this page periodically.