Privacy policy

1. Data controller

FLOWTEC FZE (United Arab Emirates), trading as BRPROG, operator of the website portal.brprog.fr. For any question about your data: e-mail contact@brprog.fr or WhatsApp +33 7 53 08 69 40.

2. Data we collect

• Account: name, e-mail address, company or workshop, phone, password (stored hashed, never in plain text).
• Files and vehicles: uploaded and modified ECU files, vehicle details you enter (make, model, year, engine, ECU, reading tool, optional mileage and registration, note).
• Orders and payments: solutions ordered, amounts, credit history. Card numbers never go through our servers: they are processed by PayPal or iyzico.
• Technical data: IP address, login date and time, error logs, technical cookies (see section 6).
• Fraud prevention: at sign-up and at each login, IP address, a random browser identifier and a technical device fingerprint (screen, graphics card, time zone, languages). They are only used to spot accounts created several times by the same person; they never block a sign-up and are not shared with anyone.

3. Why, and on what basis

• Providing the Service, analysing and modifying your files, managing your account, credit and support: performance of the contract.
• Keeping accounts and meeting legal duties: legal obligation.
• Securing the site, preventing fraud, improving the reliability of solutions: legitimate interest.

We do not sell your data and do not use it for advertising.

4. Who receives your data

• Hetzner Online GmbH (Germany): hosting of the site and files, within the European Union.
• PayPal and iyzico: payment processing, under their own policies. iyzico is based in Turkey: paying with iyzico involves a transfer of data outside the European Union, needed to carry out the payment.
• Google Fonts: the site's fonts are loaded from Google's servers, which then receive your IP address.
• WhatsApp (Meta): if you contact us by WhatsApp.

5. How long we keep data

• Account, files and vehicle details: while the account is active, then 3 years after the last activity; you can ask for deletion earlier.
• Accounting records (payments): 10 years, as required by law.
• Technical logs: 12 months at most.
• Fraud-prevention data (IP, browser identifier, fingerprint): 12 months.

6. Cookies

The site only uses cookies needed for it to work: login session (ecu_portal_session), chosen language (nrk_lang), form protection and a browser identifier for fraud prevention (nrk_dev, also kept in the browser's local storage, 1 year). If you arrive through one of our ads, the brprog_src cookie keeps its name (for example "ad1") for 30 days, to know how many visits and sign-ups it brings; it contains nothing else and is only read by our site. There are no third-party advertising cookies and no external audience-measurement tools.

7. Your rights

You can ask to access, correct or delete your data, restrict or object to its processing, or receive it in a portable format, by writing to us (section 1). We reply within one month. You may also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or with the authority of your country.

8. Security

The site is only reachable over HTTPS, passwords are hashed, files can only be accessed when logged in and administration is restricted to the operator.