Last updated: 12 November 2026

This policy explains what personal data EVC RESEARCH & DEVELOPMENT d.o.o. za usluge collects when you use ev.clinic, buy from us or use our software, why, for how long, who else sees it, and what your rights are. It is written to meet the General Data Protection Regulation (GDPR) and the Croatian Act on the Implementation of the GDPR.

1. Controller

EVC RESEARCH & DEVELOPMENT d.o.o. za usluge, Ljubljanska ulica 7, 10431 Sveta Nedelja, Croatia, OIB 32246144302. E-mail: info@ev.clinic, phone: +385 91 946 6409. We have not appointed a data protection officer; write to the e-mail address above for anything concerning your data.

2. What we process, why and on what basis

Visiting the website

Our hosting provider logs the IP address, time, requested page, browser and referrer of every request for security and to keep the site running (Article 6(1)(f) GDPR, legitimate interest). Logs are kept for up to 30 days. We do not run advertising or analytics trackers; see section 6 on cookies.

Account and orders

When you register or order we process your name, company, address, e-mail, phone, VAT ID, order history and the licences on your account, to conclude and perform the contract (Article 6(1)(b)) and to issue invoices and keep accounts as the law requires (Article 6(1)(c); the Croatian Accounting Act and the VAT Act). Invoices and the data on them are kept for eleven years after the end of the financial year; the account itself for as long as it exists plus the limitation period for claims.

Payment

Card payments are handled by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland. Your card number, expiry and security code are entered on Stripe’s form and go directly to Stripe; we receive only a token, the last four digits, the card brand and the result. Stripe processes this data as an independent controller for the payment, for fraud prevention and to meet its own legal obligations, and may transfer it to Stripe, Inc. in the United States under the EU–US Data Privacy Framework and the standard contractual clauses. Stripe’s privacy policy: stripe.com/privacy. Bank transfers show us the payer’s name, account and reference, which we keep with the invoice.

Using the software

EVC TBX PRO and the EVC Explorer PRO web application process, on our servers, the data needed to run: your account and licence, the identity of the device you connect, the vehicle identification number and the vehicle data, fault codes, logs and reports you read or generate, and — when you request remote access to a Tesla vehicle — the e-mail address of the vehicle owner, which is sent to Tesla so that the owner can approve or refuse. We process this to perform the contract (Article 6(1)(b)) and, for usage and error logs that let us keep the software working and secure, on our legitimate interest (Article 6(1)(f)). Reports and vehicle data stay on your account for as long as it exists, so that you can reopen them; you can delete them yourself or ask us to. Error logs are kept for 90 days.

When you connect through Tesla’s API you do so with your own Tesla Toolbox Online account; Tesla, Inc. processes that connection under its own terms and privacy policy. Where you are a workshop processing a customer’s vehicle data in our software, you are the controller of that data and we act on your instructions as a processor under the data processing terms available on request.

E-mail and support

Messages you send us, and our replies, are kept for as long as needed to deal with the matter and then for the limitation period for claims, on the basis of the contract or our legitimate interest in answering you. Transactional e-mails — order confirmation, licence activation, the reminder seven days before a licence expires — are part of the contract. We send marketing e-mail only with your consent (Article 6(1)(a)), which you can withdraw with the link in every message.

3. Who else sees the data

• Stripe Payments Europe, Ltd. (card payments, fraud prevention) — see above.
• Our hosting and e-mail providers in the European Union, acting as processors under Article 28 contracts.
• The carrier (GLS, DPD, DHL or UPS) for a hardware delivery: name, address, phone and e-mail for delivery notices.
• Tesla, Inc., when you request remote access to a vehicle: the vehicle owner’s e-mail and the VIN, through Tesla’s authorisation flow.
• Our accountant and, where the law requires, the tax authority, courts or regulators.

We do not sell or rent personal data and we do not share it with advertisers.

4. Transfers outside the EU/EEA

Our servers are in the European Union. Stripe and Tesla may transfer data to the United States; both rely on the EU–US Data Privacy Framework and on the European Commission’s standard contractual clauses. A hardware delivery outside the EU necessarily sends the recipient’s details to the destination country (Article 49(1)(b) GDPR).

5. Your rights

You can ask us at any time for access to your data, for its correction or deletion, for restriction of processing, for a copy in a portable format, and you can object to processing based on legitimate interest. Consent can be withdrawn at any time without affecting what was done before. Write to info@ev.clinic; we answer within one month. You also have the right to complain to the supervisory authority: Agencija za zaštitu osobnih podataka (AZOP), Selska cesta 136, 10000 Zagreb, Croatia, azop@azop.hr, or to the authority of the country where you live.

6. Cookies

This website sets only cookies that are needed for it to work; none of them is used for advertising or for tracking you across other sites, so no consent banner is shown (čl. 43. st. 4. Zakona o elektroničkim komunikacijama). They are:

• wordpress_*, wordpress_logged_in_*, wp-settings-* — set by WordPress when you log in, to keep you logged in and remember your editor preferences; session or up to one year.
• woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_* — set by WooCommerce to keep your cart between pages; session or two days.
• __stripe_mid, __stripe_sid — set by Stripe on the checkout page for fraud prevention and to tell a card-testing attack from a customer; one year and 30 minutes.

If we add analytics or embedded media that set further cookies, this section will list them and a consent request will be shown first. You can delete cookies at any time in your browser; the cart and the login then start over.

7. Security

The website is served over HTTPS throughout, access to the server is restricted and logged, backups are encrypted, and card data never touches our systems. No measure is perfect; if a breach ever affects your data we will tell you and the authority as the GDPR requires.

8. Children

Our products are professional tools and the website is not directed at children. We do not knowingly process data of anyone under 16.

9. Changes

We update this policy when what we do changes. The date at the top shows the last change; material changes are announced on the website or by e-mail to account holders.