Legal information
Last updated:
This policy explains how TAILOR MADE DIGITAL SLU processes your personal data when you use vignette-pass.com. As a company established in Andorra, we are subject to Andorran Qualified Law 29/2021 on the protection of personal data. Since our services are offered to individuals in the European Union, Regulation (EU) 2016/679 (GDPR) also applies (Article 3(2)).
TAILOR MADE DIGITAL SLU, Carrer de l'aigueta, 19, 1R pis, 3A porta, Andorra 16. For any question about your data: contact@vignette-pass.com.
Representative in the European Union (Article 27 GDPR): [EU_REPRESENTATIVE_NAME_AND_ADDRESS].
We do not collect any sensitive data and do not carry out any automated decision-making that produces legal effects concerning you.
| Purpose | Legal basis |
|---|---|
| Processing the order, registering the permit with the authority, sending proof of registration | Performance of a contract (Art. 6(1)(b) GDPR) |
| Collecting payment and handling refunds | Performance of a contract (Art. 6(1)(b) GDPR) |
| Creating your customer account after your first order, authenticating you (password, sign-in link) and attaching your orders and invoices to it | Performance of a contract (Art. 6(1)(b) GDPR) |
| Answering support requests and handling complaints | Performance of a contract and legitimate interests (Art. 6(1)(b) and (f)) |
| Preventing fraud and securing the website | Legitimate interests (Art. 6(1)(f)) |
| Keeping accounts and meeting legal obligations | Legal obligation (Art. 6(1)(c)) |
| Establishing, exercising or defending legal claims | Legitimate interests (Art. 6(1)(f)) |
The equivalent legal bases provided for by Andorran Qualified Law 29/2021 also apply. We never send marketing communications without your prior consent and never sell your data.
Your data is accessible only to authorised members of our team and, strictly to the extent necessary, to the following recipients:
Our processors are bound by a contract that complies with Article 28 of the GDPR.
Your data is processed in Andorra, a country recognised by the European Commission as providing an adequate level of protection. It is sent to the authorities of the European Union countries concerned and, for Switzerland, to the Swiss authority; Switzerland also benefits from an adequacy decision.
Some providers (in particular Vercel Inc.) may process data in the United States. These transfers are governed by the EU–US Data Privacy Framework where the provider is certified under it, or otherwise by standard contractual clauses.
| Data | Period |
|---|---|
| Order and vehicle data | Validity period of the permit, then until the applicable statutory limitation period expires |
| Accounting records (invoices, transactions) | Period required by the applicable accounting and tax obligations |
| Bank card data | Not kept by us; kept by the payment service provider in accordance with its own obligations |
| Customer account (profile, vehicles, saved addresses and cards) | Until the account is deleted, which you can do at any time from the account settings; orders and invoices are then kept, detached from the account, for the period required by accounting obligations |
| Sign-in session (cookie) | At most 30 days after your last visit; deleted when you sign out |
| Sign-in and password reset links | Single use; 15 minutes (sign-in link), 1 hour (reset), 24 hours (link in the account-creation e-mail) |
| Communications with support | 3 years from the last exchange |
| Connection logs | 1 year |
You have the right of access, rectification, erasure, restriction of processing, data portability and objection to processing based on our legitimate interests.
To exercise these rights, write to contact@vignette-pass.com stating your request; we may ask for proof of identity if we have reasonable doubts. We respond within one month, which may be extended by two months depending on the complexity of the request.
A permit already registered with an authority is kept by that authority in accordance with its own rules; we cannot obtain its erasure.
If you believe your rights have not been respected, you may lodge a complaint with the Andorran Data Protection Agency (APDA, www.apda.ad) or with the supervisory authority of the European Union Member State in which you live or work or in which the alleged infringement took place, for example the CNIL in France (www.cnil.fr).
The website is accessible over HTTPS only. Payments are processed by a PCI-DSS-certified provider and secured by 3-D Secure. Access to data is restricted to those who need it.
The use of cookies and other trackers is described in our cookie policy.
This policy may change. The date of the last update is shown at the top of the page.