This is a convenience translation. The German version is legally binding.
1. Controller
The controller within the meaning of the GDPR is the provider named in the imprint.
2. Purposes and legal bases of processing
- Contract performance (Art. 6(1)(b) GDPR): customer account, order processing, shipping, payment, support.
- Legal obligations (Art. 6(1)(c) GDPR): commercial and tax-law retention (§ 147 AO, § 257 HGB, 6–10 years).
- Legitimate interests (Art. 6(1)(f) GDPR): IT security, fraud prevention.
- Consent (Art. 6(1)(a) GDPR, § 25 TDDDG): optional cookies, analytics, marketing — revocable at any time.
3. Hosting and processors
We host the shop with providers in the EU. Database, authentication (login/registration) and the API server are provided by our cloud vendor; a data-processing agreement under Art. 28 GDPR is in place.
4. Account and login
When registering we process your email address, password hash and optionally name/phone. We use double opt-in (confirmation email). Passwords are checked against the Have I Been Pwned database of compromised passwords. For "Continue with Google" we receive name and email from Google (USA — adequacy decision under the EU-US Data Privacy Framework).
5. Orders and payment
For orders we process billing and shipping address, selected items, order number and payment status. Payment methods are bank transfer (prepayment) and PayPal. For bank transfer your bank collects the data required for the transfer; for PayPal, PayPal processes the data required for payment as an independent controller per its own privacy policy.
6. Shipping
For delivery we transmit name and shipping address to the carrier (GLS/DPD).
7. Cookies and similar technologies
Necessary cookies and local storage (session, cart, login, consent choice, language) are set without consent on the basis of § 25(2) TDDDG. Optional cookies (analytics/marketing) are only set with your consent via our cookie banner and can be changed at any time.
8. Services and recipients
- Fonts are self-hosted — no connection to Google Fonts or any font CDN.
- PayPal: when you choose PayPal, the PayPal JavaScript SDK is loaded from www.paypal.com at checkout; PayPal receives your IP address and browser data (Art. 6(1)(b) GDPR; transfers based on the EU-US Data Privacy Framework or standard contractual clauses).
- Address autocomplete: postal code / street suggestions are requested from the free OpenPLZ API (openplzapi.org, EU servers) — Art. 6(1)(f) GDPR.
- Email delivery, hosting and CDN are provided by our cloud vendor as processor under Art. 28 GDPR (EU data centres).
9. Contact form
We process name, email, subject, purpose and message. For spam and abuse prevention we also store your IP address and browser user agent (Art. 6(1)(b) and (f) GDPR). Requests are deleted once handled; security data after 90 days at the latest.
9a. Interest list for the planned drift location
If you sign up for the interest list of the planned "RC Drift Tracks NRW Headquarters" (/drift-location), we process your email address, your voluntary details (first name, town or postcode, own drift car, expected visits, interest in the loan chassis), the wording and version of the consent text, the time of your consent and confirmation, your IP address and browser user agent (abuse prevention). Legal basis: Art. 6(1)(a) GDPR (consent) and Art. 6(1)(f) GDPR (IT security). We use a double opt-in: without confirming the link in the email, no active entry is kept. Unconfirmed entries are deleted after 30 days at the latest. You can withdraw your consent at any time via the unsubscribe link in our emails or by emailing shop@drifttracks.de; we then stop sending and mark the entry as unsubscribed. The list is accessible only to authorised administrators. Emails are sent through Lovable's managed email service; entries are stored in our Supabase database (EU). No personal data from this form is passed to analytics services.
9b. Online withdrawal
When you submit a withdrawal declaration, we store your name, email, contract description, optional items and submission time to document and process your declaration (Art. 6(1)(b), (c) GDPR). Only authorised staff can access it. We email you a receipt confirmation; failed deliveries remain visible to staff for retry. These records are retained for statutory limitation and documentation periods. No analytics or account is required.
10. Shopping cart
Cart contents are stored on our server together with a random session ID (or your user ID when logged in) so your cart persists. Staff can view carts in the internal admin area solely to provide the cart and improve the ordering process (Art. 6(1)(b) and (f) GDPR). Abandoned carts are deleted after 90 days at the latest. We only send a single email reminder about an unfinished order if you actively opted in at checkout (Art. 6(1)(a) GDPR); without that opt-in no reminder or advertising is sent based on this data. You can withdraw your consent at any time by email.
11. Customer photos / existing-customer marketing
About 14 days after your order we send one email asking for photos of your track (§ 7(3) UWG, Art. 6(1)(f) GDPR). You can object free of charge at any time by emailing shop@drifttracks.de or using the unsubscribe link. Photos are published only with your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.
12. Retention periods
- Account data: until you delete your account.
- Order and invoicing data: up to 10 years due to commercial and tax-law obligations.
- Contact requests: after completion; IP/user agent max. 90 days.
- Carts: max. 90 days after last activity.
- Server logs: max. 30 days.
13. Transfers to third countries
Transfers outside the EU/EEA only occur in the cases named above (PayPal, "Continue with Google"), based on an adequacy decision (EU-US Data Privacy Framework) or the EU standard contractual clauses (Art. 45, 46 GDPR).
14. Your rights
- Access (Art. 15 GDPR) — available in your account under "Export data".
- Rectification (Art. 16 GDPR)
- Erasure (Art. 17 GDPR) — self-service in your account under "Delete account".
- Restriction (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection (Art. 21 GDPR), including against direct marketing at any time
- Withdrawal of consent (Art. 7(3) GDPR)
- Complaint to a supervisory authority (Art. 77 GDPR), e.g. the data protection authority of North Rhine-Westphalia.
15. Data protection officer
We are not legally required to appoint a data protection officer (§ 38 BDSG). Please direct privacy questions to shop@drifttracks.de or the address in our imprint.
16. No automated decision-making
No profiling or automated individual decision-making takes place.