Vignette Go
← Back to home

Privacy Policy

Last updated: November 2026

1. Introduction

Protecting your personal data is important to us. This Privacy Policy informs you about how Michael Lukas (hereinafter "we" or "us") processes your data in connection with the use of our website and vignette intermediary service.

We process personal data in accordance with the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG), and other applicable data protection regulations.

2. Data controller

Michael Lukas
Flöcking 136
8200 Flöcking
(Gemeinde Ludersdorf-Wilfersdorf)
Österreich
Email: michael.lukas.at@gmail.com
Phone: +43 660 4834005

3. Data we collect

We collect various categories of personal data:

Order data

When you order a vignette, we collect:

  • Your vehicle's licence plate
  • Country of vehicle registration
  • Email address for order confirmation
  • Desired vignette start date
  • Selected vignettes (country, duration)
  • Your consent to immediate performance (timestamp, IP address, browser information)

Technical data

When using our website, the following is automatically collected:

  • IP address (anonymized)
  • Browser type and version
  • Operating system
  • Date and time of access

4. Purposes of data processing

We process your data for the following purposes:

  • Processing and fulfilling your vignette order
  • Registering the vignette at the official state portal
  • Communicating with you regarding your order
  • Compliance with legal retention obligations
  • Improving our website and services
  • Proof of your consent to immediate performance and the associated waiver of the right of withdrawal (IP address, user agent, timestamp)
  • Fraud prevention

5. Legal basis

The processing of your data is based on the following legal grounds:

  • Art. 6(1)(b) GDPR: Contract performance — for processing your order
  • Art. 6(1)(c) GDPR: Legal obligation — for tax retention requirements and proof of withdrawal waiver (§ 18 FAGG)
  • Art. 6(1)(f) GDPR: Legitimate interests — for website analysis, improvement, and fraud prevention (including storage of IP address and user agent when consent is given)

6. Data recipients and processors

We use the following service providers to deliver our services:

Payment processing

Mollie B.V.
Keizersgracht 126, 1015 CW Amsterdam, Netherlands
Purpose: Processing online payments
Privacy Policy: https://www.mollie.com/privacy

When paying, your payment data is transmitted directly to Mollie. We do not store complete credit card data.

Hosting

Vercel Inc.
340 S Lemon Ave #4133, Walnut, CA 91789, USA
Purpose: Providing our website
Privacy Policy: https://vercel.com/legal/privacy-policy

Vercel hosts our website on servers worldwide to ensure fast loading times. Data transfer to the USA is based on Standard Contractual Clauses.

Database

Neon Inc.
548 Market St #38200, San Francisco, CA 94104, USA
Purpose: Storing order data
Privacy Policy: https://neon.tech/privacy

Analytics

Vercel Inc. (Vercel Analytics)
340 S Lemon Ave #4133, Walnut, CA 91789, USA
Purpose: Website analytics and performance monitoring
Privacy Policy: https://vercel.com/legal/privacy-policy

We use Vercel Analytics to analyze website usage. Anonymous data is collected that does not allow conclusions about individual persons.

7. Data transfer to third countries

Some of our service providers are located outside the EU/EEA (particularly in the USA).

Data transfer is based on EU Standard Contractual Clauses or other appropriate safeguards under Art. 46 GDPR.

8. Retention period

We store your personal data only as long as necessary for the purposes or as required by legal retention obligations.

Order data is stored for the duration of the legal retention period (7 years under Austrian tax law).

Consent proof data (IP address, user agent, timestamp) is retained together with order data for the same period in order to demonstrate proper collection of consent to waiver of withdrawal right pursuant to § 18 FAGG. (Note: The exact retention period for this proof data should be reviewed by legal counsel.)

9. Your rights

You have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR): Right to confirmation and information about processed data
  • Right to rectification (Art. 16 GDPR): Right to correct inaccurate data
  • Right to erasure (Art. 17 GDPR): Right to deletion under certain conditions
  • Right to restriction (Art. 18 GDPR): Right to restrict processing
  • Right to data portability (Art. 20 GDPR): Right to receive your data in a transferable format
  • Right to object (Art. 21 GDPR): Right to object to processing
  • Right to withdraw consent: Where processing is based on consent, you can withdraw it at any time

To exercise your rights, contact us at: michael.lukas.at@gmail.com

10. Cookies

Our website uses technically necessary cookies that are required for the operation of the website.

These cookies are set without your consent because they are essential for providing our service:

  • Session cookies: For website functionality during your visit
  • Language settings: To save your preferred language

11. Data security

We implement technical and organizational security measures to protect your data against accidental or intentional manipulation, loss, destruction, or access by unauthorized persons. Our website uses SSL/TLS encryption for all data transfers.

12. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority.

The supervisory authority responsible for us is:
Österreichische Datenschutzbehörde
Barichgasse 40-42, 1030 Wien

13. Changes to this Privacy Policy

We reserve the right to update this Privacy Policy to adapt to changes in the law or changes to our services. The current version is always available on this page.