Privacy Notice

1. Controller

Controller: Blaze Data Solution Korlátolt Felelősségű Társaság (Blaze Data Solution Kft.), registered office: Gadó utca 8. TT 7. ajtó, 7636 Pécs, Hungary, company reg. no.: 02-09-088407 (Registry Court of the Pécs Regional Court). Contact: support@blazedata.hu.

CarPulse is the controller for user account data. For customer data recorded by workshops (job sheets, photos, estimates) the workshop is the controller and CarPulse is its processor.

2. Data protection contact

For data protection questions contact us at support@blazedata.hu; we answer within 30 days at the latest.

We have assessed under Article 37 GDPR whether we must appoint a Data Protection Officer. We are not a public authority, our core activities do not consist of regular and systematic monitoring of data subjects on a large scale, and we do not process special categories of data or criminal-offence data on a large scale. We are therefore currently not required to appoint a DPO. We will repeat the assessment if the number of users or the nature of the processing changes significantly.

3. Data we process

Account data: name, e-mail address, phone number, language. Vehicle data: plate, make, model, year, VIN (if provided), odometer. Fault reports: description, markers on the vehicle diagram, photos, videos, audio. Repair data: job sheet, stages, estimates and approvals. Technical data: truncated IP address, device token for push notifications, logs.

4. Purposes and legal bases

Providing the service and managing accounts — performance of a contract (GDPR Art. 6(1)(b)). Logging approvals and preventing abuse — legitimate interest (Art. 6(1)(f)). Billing and accounting — legal obligation (Art. 6(1)(c)). Optional notifications — consent (Art. 6(1)(a)), which can be withdrawn at any time.

5. Processors and recipients

Data may be processed by: hosting and database Railway Corporation (EU region, Netherlands), file storage Railway (EU region, Netherlands), e-mail Resend, SMS SeeMe / Twilio, push Google Firebase, payments Stripe, RevenueCat, maps and geocoding OpenStreetMap / Nominatim. A workshop only sees data of its own jobs.

6. Transfers outside the EEA

Data is primarily stored in the European Union (the Netherlands). Some processors are based outside the European Economic Area (EEA) or provide support from outside it. In such cases the transfer is covered by a safeguard under Chapter V GDPR:

Railway Corporation (hosting, database, file storage; USA, data in the EU region): the European Commission's Standard Contractual Clauses (SCC).

Resend (e-mail delivery; USA): Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework.

Twilio Inc. (SMS, fallback provider; USA): EU–US Data Privacy Framework and Standard Contractual Clauses. SeeMe (Hungary) processes data within the EEA.

Google Firebase (push notifications; USA): EU–US Data Privacy Framework and Standard Contractual Clauses.

Stripe (card payments; contracting party Stripe Payments Europe Ltd., Ireland, which may also process data in the USA): EU–US Data Privacy Framework and Standard Contractual Clauses.

RevenueCat Inc. (app store subscriptions; USA): Standard Contractual Clauses.

OpenStreetMap Foundation / Nominatim (address search; United Kingdom): adequacy decision of the European Commission.

We review these safeguards annually and whenever a new processor is engaged. A copy of or information about the safeguards is available on request.

7. Retention

Account data is kept until the account is deleted. The approval log is kept within the civil-law limitation period 5 years; on account deletion personal data in the log is anonymised. Tracking links live at most 90 days, or 14 days after the job is closed.

8. Your rights

You have the right to access your data, to request rectification, erasure or restriction, to object to processing based on legitimate interest, and to data portability. You can download your data as JSON and PDF and delete your account in your profile. We answer requests within one month.

9. Withdrawing consent

You can withdraw consent-based processing (e.g. optional notifications) at any time in the settings or at support@blazedata.hu. Withdrawal does not affect the lawfulness of earlier processing.

10. Complaints to the supervisory authority

You may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, 1055 Budapest, Falk Miksa utca 9–11., www.naih.hu) or go to court.

11. Automated decision-making

We do not use automated decision-making or profiling that produces legal effects concerning you.

12. Cookies

The website and web app currently use only strictly necessary cookies and local storage: the login session and security token (until the end of the session, or at most 30 days), your chosen language and appearance (dark/light mode), and some view preferences (e.g. the board view). These do not require consent.

We currently use no advertising, marketing or tracking cookies and no analytics tools. If we introduce visitor statistics or any other non-essential cookie in the future, we will do so only with your prior, explicit consent (via a cookie banner), which you can withdraw at any time, and we will update this notice beforehand.

13. Security and personal data breaches

Data is transmitted over encrypted connections, passwords and tracking links are stored only as hashes, and access is limited by role. In case of a personal data breach we act according to GDPR Articles 33–34.

14. Changes to this notice

We update this notice as the service changes and notify you of material changes by e-mail or in the app.