Portal privacy policy
Updated 25 September 2026 · Version 2026-10-01-eur-v1
Privacy statement
We are committed to protecting customers’ personal data by collecting only the essential basic information needed to fulfil our obligations. We inform customers how collected information is used and regularly give them a choice about its use, including whether they want their name removed from lists used for marketing campaigns. The portal does not send marketing messages or disclose data to third parties for their marketing without separate consent. All user information is strictly safeguarded and available only to employees who need it to perform their work. All our employees and business partners are responsible for following privacy protection principles.
Who is responsible for your data
This policy covers accounts, file processing orders, credit purchases and invoices on files.atf-chiptuning.com. The data controller is Trgovina, zanatstvo i usluge „CHIPTUNING“ Mladen Mitrović s.p. Banja Luka, JIB 4510823620007, PDV / VAT 510823620007, Vasilija Ostroškog 7, 78000 Banja Luka, Bosnia and Herzegovina. For privacy enquiries and rights requests, email info@atf-chiptuning.com or call +387 65 517 111. The main ATF website has its own policy; this notice covers the portal.
Data we process and its sources
You provide your name, email, phone, company and contact person details, address, city, postcode, country and tax details where supplied. We also process account details, uploaded files, vehicle and service request details, support messages, purchases, credit balances and usage, invoices and complaints. Passwords are stored as one-way hashes rather than readable text. The system records operational and security events; server logs may contain IP addresses, access times and technical request details. Monri supplies transaction outcomes and identifiers. Do not submit information about other people or content unnecessary for the requested service.
Purposes and legal bases
We use account and order information to register and approve access, perform our contract, process files, collect payment, allocate credits, deliver services and provide support. For business customers, processing contact details also serves our legitimate interest in communicating with an authorised company representative. Invoices and mandatory business records are processed to meet legal obligations. Account protection, abuse prevention, technical support and dispute handling serve our legitimate interest in secure operations, taking your rights into account. Where an additional purpose requires consent, it is requested separately and can be withdrawn. Without mandatory information, we cannot open an account or complete the relevant purchase and delivery.
Monri and card payments
When you start a card payment, Monri WebPay receives your name, email, phone, billing address, city, postcode and country, the purchase reference and description, amount, currency and form language. You enter card details directly into Monri’s payment form; the portal does not store full card numbers or CVV codes. Monri and banks process card and necessary technical information to execute the transaction, authenticate customers and prevent fraud. The portal retains the amount, currency, status, references and payment time, plus the terms version and acceptance time. These records support credit allocation, invoicing, complaints and payment reconciliation. Further information about Monri’s processing is linked below.
Invoices and service emails
After confirmed payment for purchased credits, we email a PDF invoice to the account email recorded for that delivery. The invoice includes seller and buyer details, document number and date, credits purchased, amounts, currency and applicable tax items. Our email delivery provider and your email provider process the recipient address, message and attachment to deliver it. The portal records the recipient, delivery status, time and attempts to check delivery and retry failed sending. You can also view the invoice in your portal account. Registration, email verification, password recovery, job notifications, invoices and support replies are service messages. Buying or accepting terms is not consent to marketing or disclosure for third-party advertising. Contact us to object to direct marketing; this does not prevent necessary service messages.
Recipients and service providers
Authorised personnel access information as needed to administer accounts, process requests, provide support or keep accounting records. Hosting, maintenance, storage and email providers process necessary information, as do Monri, banks and card payment participants. We disclose information to authorities when legally required. We do not sell customer data for advertising. Service providers may process data outside Bosnia and Herzegovina, depending on their infrastructure and payment participants; we do not claim all data remains in the country. You may request information about recipients and the applicable conditions of cross-border processing in your case. Monri and banks also provide their own notices for processing they independently determine.
Retention
Retention depends on the data category and purpose. Account information and credit balances are needed while the account and our obligations to the customer continue; credits do not expire. Requests, files and communications are kept as needed for performance, support and complaints. Invoices, payments and accounting records are retained for periods required by applicable tax and accounting laws. Security and technical logs and email delivery records support operation, protection and evidence of delivery; retention needs depend on incidents, complaints or disputes. Closing an account does not automatically erase records we must retain. On request, we assess what can be deleted or anonymised and explain the basis and retention criteria for remaining data. Deletion also takes backups and evidence preservation obligations into account.
Browser storage
The portal uses local browser storage for sign-in, language and appearance, and session storage to associate checkout attempts and prevent repeat submissions. Signing out removes local sign-in credentials; other settings can be removed by clearing site data in your browser. Blocking storage may prevent sign-in or disrupt checkout. Monri may use technologies required for payment and security on its own form under its policy.
Data security
The portal uses HTTPS, sign-in checks and authorisation to control access to account data, invoices and files. Payment confirmation is verified before credits are allocated. Protect your credentials, use a strong password and sign out on shared devices. Do not send support card details, passwords or security codes. Report suspected unauthorised access or a misdirected invoice to our contact promptly. No transmission or storage system provides an absolute security guarantee.
Your rights and complaints
Subject to applicable legal conditions, you may request access and a copy, correction, erasure, restriction and portability, and object to processing, especially legitimate-interest processing and direct marketing. Consent may be withdrawn for future processing without affecting the lawfulness of earlier processing. Email info@atf-chiptuning.com from your account address; we may require proportionate identity verification to protect your data. We respond without undue delay within the legal deadline, generally no later than 30 days after receiving your request; if a permitted extension is needed, we explain the reason and timeframe within that period. You may complain to the Personal Data Protection Agency in Bosnia and Herzegovina through azlp.ba.
Automation and policy updates
Payment confirmation automatically triggers credit allocation and preparation of the invoice email. Banks or Monri may perform their own payment security checks. Contact support for a review if you believe your purchase status or balance is incorrect. We publish the policy date and version here; a materially new processing purpose requires appropriate notice and, where needed, separate consent.