EcuPrime

Privacy Policy

1. Scope

This policy explains the data collected, the cookies and the analytics tools used when you use the EcuPrime site, the customer panel and Studio. Details on the processing of personal data are in the Personal Data Notice.

2. Data we collect

Account details: email address, full name or company name, phone number, the vehicle types you work with and your language preference. Your password is not stored in plain text; only its hash (PBKDF2) is kept.
Profile details (optional): fields you enter yourself on the profile page, such as country, city, address, company name and tax details.
ECU files: the file you upload and the output file produced from it are stored on the server. An ECU file may contain the vehicle identification number (VIN).
Session and security records: IP address, browser information and an audit log of account actions.
Consent records: which text and which version you accepted and when, together with IP address and browser information.
Marketing permission: the box for email announcements is unticked by default; it is recorded only if you tick it.
Registration declarations: records that you have read the privacy notice, accepted the terms of use and made the declaration of responsibility, together with the text version, time, language, IP address and browser information. Giving and withdrawing the marketing permission are also kept as separate entries.
Support requests: the messages you write on the support screen.
Order and credit records: your purchase records and credit movements.

3. Cookies and browser storage

Cookie	What it is for
`sid`	Login session. Not readable by browser scripts (HttpOnly).
`csrf`	Security: verifies that form requests come from your session.
`lang`	Language preference. Lifetime: 1 year.
`prm-riza`	Your cookie choice (accept or decline). Shared across the primechiptuning.com domains. Lifetime: 1 year.
`ep-kanal`	A label showing which channel brought you to the site; it contains no address or IP. It is written only if you accept cookies and is deleted if you decline. Lifetime: 30 days.

Browser storage (not cookies): ep-theme (theme), ecuprime_lang (language), prm-riza (backup of the cookie choice).

4. Analytics and advertising

Google Tag Manager is loaded on public pages (container: GTM-5SWF76N).
Google's analytics and advertising storage is off by default; it is turned on only if you choose “Accept” in the cookie banner.
No analytics tag is loaded on the login, panel and Studio pages.

5. Third parties

Google (Tag Manager, Analytics, Ads): the analytics and advertising tags on public pages.
Google Drive: database backups are stored there.
Payment providers: when you start a card payment, the order number, amount, your email address, name, phone number and IP address are sent to PayTR; for a PayPal payment, the order number and amount are sent to PayPal. You enter your card details on the payment provider's page.

Because database backups are stored on Google Drive and Google tags are used on public pages, your personal data may be transferred to servers outside your country.

Your personal data may be transferred, strictly limited to the purposes above, to the suppliers from whom we obtain server hosting, backup and email services in order to provide the service, to payment institutions for payment transactions, and, in the event of a legal obligation or request, to authorised public institutions and organisations and judicial authorities.

Transfers abroad are made on the basis of one of the conditions set out in KVKK Article 9. Analytics and advertising tags on public pages rely solely on the explicit consent you give in the cookie banner.

6. Retention period

Automatic deletion is off by default: the files you upload and their outputs stay on the server until an administrator deletes them.

Your account and job records are kept for the duration of the contractual relationship and for ten years after it ends, which is the general limitation period.

Order, payment and invoice records are kept for the period required by commercial and tax legislation (ten years); records of consent to marketing communications for three years after the consent is withdrawn; and session and traffic records for the period required by the relevant legislation.

If you ask for your files or your account to be deleted, your request is carried out, except for records that must be kept by law.

Data whose retention period has expired is deleted, destroyed or anonymised.

7. Data security

To protect your data against unauthorised access, loss and alteration, technical and administrative measures are applied, such as access authorisation, storing passwords as hashes, session and form security, audit logging and regular backups.

8. Age limit

The service is not intended for persons under 18; accounts of persons found to be under 18 are closed.

9. Your rights and how to apply

You can withdraw your marketing permission at any time under My Profile › Notification Consents.
Password, order, delivery and support messages do not depend on the marketing permission; withdrawing it does not affect them.
You can change your cookie choice with the button below.

You have the right to access your personal data, to have it rectified or erased, to restrict or object to its processing, to data portability, and to withdraw a consent at any time without affecting the lawfulness of processing carried out before the withdrawal (Arts. 15–21 and 7(3) GDPR; Art. 11 KVKK).

Send your request to the controller's contact details above; requests are answered within one month at the latest. You also have the right to lodge a complaint with a data protection supervisory authority: in the EU, the authority of your place of residence; in Türkiye, the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

10. Changes to this text

This text may be updated. The version in force is shown at the end of the page; the version you read at registration is kept together with your declaration record.