Version 2.0 – 12 September 2026. This policy is published in six languages. In case of any difference between the versions, the English version prevails.
This policy explains which personal data AD TYRES INTERNATIONAL collects on the website www.adtyre.com and on the supplier portal onboarding.adtyre.com, why we process it, how long we keep it, with whom we share it, and which rights you have. We wrote it to be read, not just published: if anything is unclear, write to dpo@adtyre.com.
1. Who is responsible for your data
The controller is AD TYRES INTERNATIONAL SLU, a company incorporated under the laws of the Principality of Andorra, C. Prat de la Creu 59–65, AD500 Andorra la Vella, Andorra, acting through its establishment in the European Union:
AD TYRES INTERNATIONAL EU (Malta Branch)
Registered with the Malta Business Registry under number OC 1277 – VAT number MT26896033
Level 3, Suite 2407, Tower Business Centre, Tower Street, Swatar, Birkirkara BKR 4013, Malta
In this policy, “AD TYRES”, “we”, “us” and “our” refer to this company. Our Malta branch is our establishment in the European Union for the processing described here, and the Office of the Information and Data Protection Commissioner (IDPC) of Malta is our lead supervisory authority.
Data Protection Officer. We have appointed a Data Protection Officer (DPO). You can contact the DPO at dpo@adtyre.com, or by post at the Malta address above, marked “Data Protection Officer”.
2. What this policy covers
- our corporate website www.adtyre.com, published in six languages;
- our supplier portal onboarding.adtyre.com (the “Portal”), which suppliers use to be referenced by AD TYRES and to exchange documents with us;
- the emails we send in connection with these two sites.
It does not cover the B2B and B2C e-commerce websites operated by the AD TYRES group, which each have their own privacy policy, nor the websites of third parties we link to, such as LinkedIn or WhatsApp.
The use of cookies and similar technologies is described in our separate Cookie Policy.
3. The data we process, why, and for how long
We process personal data only for the specific purposes described below. We never sell personal data. We use no advertising network and no audience measurement tool on either site.
3.1 Visiting our websites
| Data | Technical information sent by your browser: IP address, date and time, page requested, browser type and version, referring page. On the Portal, we also count the requests received from each IP address during 60 seconds in order to prevent abuse. |
|---|---|
| Purpose | Display the sites, ensure their security and availability, detect and block abusive traffic. |
| Legal basis | Our legitimate interest in operating and securing our websites (Article 6(1)(f) GDPR). |
| Retention | Server logs of www.adtyre.com are kept by our hosting provider for a maximum of 12 months. Portal rate-limiting counters are kept in memory for 60 seconds only. |
3.2 Contact form (www.adtyre.com)
| Data | Name, email address, subject, message, and any information you choose to include. The form is protected by a mathematical question checked on our own server; no third-party anti-spam service is used. |
|---|---|
| Purpose | Answer your request and follow it up. |
| Legal basis | Steps taken at your request prior to entering into a contract (Article 6(1)(b)) or our legitimate interest in answering the people who contact us (Article 6(1)(f)). |
| Recipients | The AD TYRES teams concerned at our Malta branch, at our headquarters in Andorra and at our Dubai branch (see section 5). |
| Retention | 3 years after our last exchange with you. |
3.3 Claim form (“File a claim”)
| Data | Full name, email address, website where you made your purchase, order number, description of the problem, and any information or document you provide. You may be a business customer or a consumer of one of the websites of the AD TYRES group. |
|---|---|
| Purpose | Register, investigate and settle your claim, and keep evidence of how it was handled. |
| Legal basis | Performance of the contract concluded with the group website concerned and of the related legal warranties (Article 6(1)(b) and (c)); our legitimate interest in managing claims and in establishing, exercising or defending legal claims (Article 6(1)(f)). |
| Recipients | Our customer service teams at our headquarters in Andorra and at our Dubai branch. |
| Retention | 5 years after the claim is closed. |
3.4 Your Portal account
| Who | Supplier contacts invited by AD TYRES or who request access to the Portal, and AD TYRES administrators. |
|---|---|
| Data | Name, work email address, preferred language, role, company on whose behalf you request access, account status, dates of request and review. Your password is stored only as a salted hash (scrypt), never in clear text. If you enable two-factor authentication: the authentication secret (encrypted) and your recovery codes (hashed). The devices you chose to trust for 14 days, your active sessions, and the invitation and password reset tokens sent to you (stored hashed; reset links are valid for 30 minutes). |
| Purpose | Create and secure your account, authenticate you, manage your access rights, and let AD TYRES administrators review access requests. |
| Legal basis | Steps prior to, and performance of, the supplier relationship (Article 6(1)(b)); our legitimate interest in securing the Portal (Article 6(1)(f)). |
| Retention | For as long as you use the Portal. An account is deleted 36 months after its last sign-in, or earlier at the request of your company or of yourself. Sessions expire after 12 hours, trusted devices after 14 days, two-factor challenges after 5 minutes. |
3.5 Sign-in security and activity logs
| Data | IP address, email address used, result of each sign-in attempt (success, wrong credentials, blocked) with its date and time; temporary blocks applied after repeated failures; a log of the actions performed in the Portal (who did what, and when), including sessions in which an AD TYRES administrator acts on behalf of a supplier. Your browser type is not recorded. |
|---|---|
| Purpose | Protect accounts against unauthorised access, detect and block attacks, and give administrators a trace of the actions performed on each dossier. |
| Legal basis | Our legitimate interest in the security of the Portal and our obligation to secure personal data (Articles 6(1)(f) and 32). |
| Recipients | AD TYRES administrators. When an IP address is blocked, an alert containing that address is emailed to our IT team. |
| Retention | 30 days, after which these records are deleted automatically. |
3.6 Your supplier onboarding dossier
| Data | The information you enter step by step to be referenced as a supplier:
|
|---|---|
| Purpose | Reference you as a supplier, set up the commercial, logistics, IT and financial flows between our companies, exchange and validate documents, and pay your invoices. |
| Legal basis | Steps prior to, and performance of, the supplier relationship (Article 6(1)(b)); our accounting and tax obligations (Article 6(1)(c)); for the contacts who are not Portal users, our legitimate interest in managing the relationship with your company (Article 6(1)(f)). |
| Retention | For the duration of the business relationship. After it ends, data and documents of accounting or tax value are archived for 10 years; the other data is deleted. |
| Security | Passwords, tokens and other secrets you share with us are encrypted at rest. Uploaded documents are stored on a private disk, outside the web server’s public directory, and delivered only to authenticated users of the dossier. Secrets are never included in emails or logs. |
| Your colleagues | If you enter data about other people in your company, you must have made sure that they know their data will be shared with AD TYRES and that they can read this policy. |
3.7 Emails we send you
| Data | Recipient address, subject and content of the email, delivery status. |
|---|---|
| Purpose | Send you invitations, sign-in and security notices, password reset links, reminders while your onboarding is incomplete (at most one every 7 to 10 business days), and notifications about documents requested or returned. |
| Legal basis | Performance of the supplier relationship and our legitimate interest in following up onboarding (Article 6(1)(b) and (f)). |
| Processor | Emails are sent from administrator@adtyre.com through Google’s Gmail service (Google Workspace), see section 5. |
| Retention | An encrypted copy of each email is kept for 30 days to diagnose delivery problems, then deleted. |
| Objection | Reminders stop automatically when your onboarding is complete. To stop them earlier, ask your AD TYRES contact or write to dpo@adtyre.com. |
3.8 Backups
| Data | Encrypted copies of the Portal database and of the uploaded documents. |
|---|---|
| Purpose | Restore the service after an incident. |
| Legal basis | Our legitimate interest in the continuity of the service and our obligation to secure personal data (Articles 6(1)(f) and 32). |
| Retention | Backups are encrypted before storage and kept for a maximum of 90 days. |
4. Cookies
The Portal only uses cookies that are strictly necessary to keep you signed in and to secure your account; it therefore shows no cookie banner. On www.adtyre.com, the only technology that requires your consent is the YouTube video player, which is loaded only if you accept it in the cookie banner. The full list is in our Cookie Policy.
5. Who has access to your data
Within AD TYRES. Authorised staff only, on a need-to-know basis: purchasing, customer service, accounting and IT teams at our Malta branch, at our headquarters in Andorra and at our Dubai branch.
Our processors. They act on our instructions, under a data processing agreement, and may not use your data for their own purposes.
| Processor | Service | Location of the data |
|---|---|---|
| Seo Hosting Ltd, 19 St. Mark Street, Valletta VLT 1362, Malta | Hosting of www.adtyre.com (shared server) | European Union |
| OVH GmbH, Christophstraße 19, 50670 Cologne, Germany | Dedicated server hosting the Portal, its database and its documents | Data centre in Frankfurt, Germany |
| Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland | Google Workspace: our business email, and the sending of Portal emails through Gmail | European Union and United States (see section 6) |
Other recipients. Banks and payment service providers, to pay our suppliers; public authorities, courts and our legal advisers, where the law requires it or to establish, exercise or defend our rights.
We never sell or rent personal data, and we share it with no advertising or data broker company.
6. Transfers outside the European Economic Area
- Andorra. Our headquarters is located in Andorra, a country that the European Commission recognises as ensuring an adequate level of protection (Decision 2010/625/EU). Your data therefore travels there with the same protection as in the European Union.
- United Arab Emirates. Our Dubai branch (AD TYRES INTERNATIONAL SLU – DMCC Branch, Mazaya Business Avenue BB1, Floor 45, Unit 4501, Dubai) may access the data described in sections 3.2, 3.3 and 3.6. The United Arab Emirates are not covered by an adequacy decision. This access is internal to our company, restricted to authorised staff who need it for purchasing and customer service, protected by the measures described in section 8 (encrypted connections, personal accounts, two-factor authentication, logging), and governed by our internal data protection rules, which require our Dubai staff to apply this policy. You can obtain more information about these safeguards by writing to dpo@adtyre.com.
- Google. Google processes email in data centres located in the European Union and in the United States. These transfers are covered by the Standard Contractual Clauses of the European Commission included in Google’s data processing terms, and by Google LLC’s certification under the EU-U.S. Data Privacy Framework.
7. Your rights
Under the GDPR you have the right to:
- access your personal data and obtain a copy;
- rectify inaccurate or incomplete data;
- erase your data, in the cases provided by law;
- restrict the processing, in the cases provided by law;
- object to processing based on our legitimate interest, for reasons relating to your particular situation, and object at any time to reminders and follow-up emails;
- receive the data you provided to us in a structured, commonly used and machine-readable format (portability);
- withdraw your consent at any time where processing is based on it, which applies to the YouTube player on www.adtyre.com;
- not be subject to a decision based solely on automated processing: we make no such decision.
How to exercise them. Write to dpo@adtyre.com or to the postal address in section 1. We may ask you to confirm your identity. We answer within one month; this period may be extended by two further months for complex requests, in which case we will tell you.
On the Portal. You can change your name and your email language yourself in “My profile”. To change your email address, to pause reminders or to delete your account, ask your AD TYRES contact or write to dpo@adtyre.com.
Complaints. You can lodge a complaint with our lead supervisory authority, the Office of the Information and Data Protection Commissioner (IDPC), Malta, idpc.org.mt, or with the supervisory authority of the country where you live or work, for example the CNIL in France (www.cnil.fr).
8. How we protect your data
- Encrypted connections (HTTPS with HSTS) on both sites.
- Portal passwords hashed with scrypt and a unique salt; optional two-factor authentication; automatic blocking after repeated failed attempts; sessions limited to 12 hours.
- Secrets, two-factor keys and outgoing email copies encrypted with AES-256-GCM using keys stored outside the database.
- Documents stored outside the public web directory, named by cryptographic hash, and delivered only to authenticated users.
- Activity and sign-in logs, purged automatically after 30 days.
- Dedicated server, hardened service account, security headers, encrypted backups.
- Access restricted to authorised staff with personal accounts.
No system is entirely secure. If you suspect an incident affecting your data, please write to dpo@adtyre.com immediately.
9. Other information
- Sources. We obtain your data from you, from your company or your colleagues when they enter your contact details in the Portal, from our systems (logs), and from our staff (notes and statuses).
- Automated decisions. We make no decision producing legal or similarly significant effects based solely on automated processing, and we do no profiling.
- Minors. Our sites are intended for professionals and adult customers; we do not knowingly collect data about children.
- Changes. We update this policy when our processing or the law changes. The version and date appear at the top. Significant changes are announced on the website or in the Portal.