Privacy policy

The data controller is:

1.1. For any questions regarding personal data protection, you can contact us at any time using the details above.

• Performance of a contract (Article 6(1)(b) GDPR) – providing the user account, managing service history, subscriptions and support.
• Legal obligation (Article 6(1)(c) GDPR) – issuing and storing invoices and tax reporting in accordance with Slovenian law.
• Legitimate interest (Article 6(1)(f) GDPR) – ensuring security, preventing abuse and improving the service.
• Consent (Article 6(1)(a) GDPR) – when we explicitly rely on it, for example to send newsletters. You can withdraw your consent at any time.

• We keep user account data for as long as the account is active or until it is deleted.
• We keep vehicle data and service records for 3 years from the last entry, after which they may be archived.
• We keep accounting and tax data for as long as applicable tax legislation requires.
• After the retention period expires, we permanently delete or anonymise the data.
• Images of vehicle documents uploaded for VIN recognition are retained for as long as they are needed to improve recognition, at most five years from upload, after which they are deleted. You may request earlier deletion of the images you uploaded at any time by contacting us; we will delete them within 30 days unless a legal obligation requires us to keep them.

5.1. We do not sell personal data. We share it only with trusted processors who help us operate the service, namely hosting and infrastructure providers, email sending, and the issuing and fiscalisation of invoices.

5.2. All processors are bound to protect data under a data processing agreement. We process data within the EU/EEA; in the event of any transfer to third countries, we ensure appropriate safeguards in accordance with the GDPR.

5.3. We may disclose data to the competent authorities when required by law.

Under the GDPR you have the following rights regarding your personal data:

• the right of access to the data and to a copy of the data;
• the right to rectification of inaccurate or incomplete data;
• the right to erasure (the "right to be forgotten");
• the right to restriction of processing and the right to object to processing;
• the right to data portability;
• the right to withdraw consent where processing is based on consent.

6.1. Registered users can export their data and delete their account directly in account settings, while other requests should be sent to info@evoca.app.

7.1. We implement appropriate technical and organisational measures to protect data against loss, misuse and unauthorised access, including encryption of transfers, access control and protection of service history with a PIN and QR code.

7.2. Users are responsible for the confidentiality of their access credentials, PIN and QR code.

8.1. The website uses essential cookies that are necessary for the operation of the service (e.g. login and security) and, with your consent, analytics cookies to improve the service.

8.2. You can adjust your cookie settings at any time in your browser.

9.1. We may update this privacy policy from time to time. In the event of significant changes we will notify users, and the version in force at any given time will be published on this page with the date of the last update.

10.1. To exercise your rights or for questions regarding the processing of personal data, contact us at info@evoca.app.

10.2. If you believe that the processing of your personal data violates regulations, you have the right to lodge a complaint with a supervisory authority – the Information Commissioner of the Republic of Slovenia, or the data protection authority of the EU member state where you live (in Croatia: AZOP) (www.ip-rs.si).