Privacy policy

Privacy policy

Protecting your personal data matters to us. Here you can read which data we process when you visit our online shop or order from us.

1. Controller

[Company name and legal form], [Street and number, postcode, city], Germany
Email: info@racecraft-eu.com, phone: [phone number]

2. Hosting and technical provision (Shopify)

Our online shop runs on the Shopify platform. For customers in the EU, the provider is Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify processes data on our behalf (Art. 28 GDPR), in particular to operate the shop, handle orders and process payments. This may involve a transfer of data to third countries, in particular the USA. Shopify relies on the EU Commission's standard contractual clauses or the EU-US Data Privacy Framework for this.

When you visit our pages, technical data is processed automatically (for example IP address, date and time, page visited, browser and operating system). This is necessary to display the pages and to run the shop securely. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure and functioning online shop).

3. Orders and contract processing

When you order, we process your details (name, address, email, phone number, ordered goods, payment details) to perform the contract, deliver the goods and process payments. The legal basis is Art. 6(1)(b) GDPR. Statutory retention duties (in particular under commercial and tax law) are based on Art. 6(1)(c) GDPR. We usually keep order data for ten years where the law requires this.

We pass your data to the following recipients where this is necessary for processing: freight forwarders and transport companies (name, delivery address, phone number), payment service providers [add payment service providers, e.g. Shopify Payments, PayPal], tax advisers and bookkeeping, and our manufacturers in South Africa where details such as construction or paddler weight are needed to build your boat (without your name and address).

4. Customer account

If you create a customer account, we store your account data and order history so that you can order faster in future and view your orders. The legal basis is Art. 6(1)(b) GDPR. You can have the account deleted at any time.

5. Contacting us

If you contact us via the contact form, the withdrawal function or by email, we process your details to handle your request. The legal basis is Art. 6(1)(b) GDPR (contractual and pre-contractual enquiries) or Art. 6(1)(f) GDPR. We delete the data once it is no longer needed and no retention duties apply.

6. Cookies and similar technologies

We use cookies and similar technologies. Technically necessary cookies (for example shopping cart, language setting, security) are used on the basis of section 25(2) TDDDG and Art. 6(1)(f) GDPR. All other cookies (for example for statistics or marketing) are only used with your consent (section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change or withdraw your choice at any time through "Cookie preferences" at the bottom of every page.

[Add analytics and marketing tools in use, e.g. Shopify Analytics, Meta Pixel, Google Analytics. If none are used, delete this note.]

7. Newsletter

If you sign up for our email list, we use your email address to send you offers and news. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future, for example through the unsubscribe link in every email.

8. External links and social networks

Our site contains links to social networks (for example Facebook, Instagram, YouTube, TikTok, X). These are only links. Data is only transferred to the respective provider once you click a link; its privacy information then applies.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing (Art. 21 GDPR). If processing is based on your consent, you can withdraw it at any time with effect for the future. Please contact info@racecraft-eu.com for this.

Right to object: Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation.

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is [competent authority; if based in Bavaria: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach].

10. Obligation to provide data

To conclude a contract you must provide the details marked as required during checkout. Without them we cannot conclude the contract.

11. Changes

We adjust this privacy policy when our data processing changes. The current version applies.

Version: [date]