Privacy policy

The controller responsible for data processing on this website is:

Custom-Automotive GmbHIndustriestraße 2263517 RodenbachGermany

Represented by: Nderim Leka
Phone: +49 (0) 6184 99 47 120
Email: info@customwheel.de

We only process personal data insofar as this is necessary to operate this website, to process your order or to answer your enquiries. The legal bases are Art. 6(1)(b) GDPR (contract), (c) (legal obligation), (f) (legitimate interest) and, where we ask you, (a) (consent). You can withdraw your consent at any time with effect for the future.

When a page is accessed, the server concerned automatically processes: IP address, date and time, the page accessed, the amount of data transferred, browser and operating system, and the previously visited page (referrer). We need this data to deliver the page, to operate it in a stable and secure manner and to detect attacks (Art. 6(1)(f) GDPR). It is not combined with other data and is deleted after 30 days at the latest, unless it is needed as evidence of an attack.

The website (storefront) is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Vercel is certified under the EU-US Data Privacy Framework; in addition, the European Commission’s standard contractual clauses apply; the data processing agreement is part of the Vercel contracts. More: vercel.com/legal/privacy-policy.

Cart handover, checkout, customer account and orders run on the Shopify platform of Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify processes the data on our behalf; a data processing agreement under Art. 28 GDPR is part of Shopify’s terms of service (Data Processing Addendum). Shopify may also process data in Canada and the USA; for this there is an adequacy decision of the European Commission (Canada) and the European Commission’s standard contractual clauses as well as certification under the EU-US Data Privacy Framework (USA). More: shopify.com/legal/privacy.

Until checkout, the cart is stored exclusively in your browser (local storage) and contains only the selected items and quantities. When you click “To checkout”, we hand it over to Shopify, where you enter your details. For “Order again”, the items and quantities of your last visit to checkout remain stored in your browser for up to one year – without personal data; they do not leave your browser and can be deleted in the cart with “Forget”. Likewise, for “Recently viewed”, your browser remembers the last eight product pages (only the product identifiers); to display the cards, the page requests their names and prices from our server. The history can be removed on any product page with “Clear history”.

When you place an order, we process: name, billing and delivery address, email address, telephone number if applicable, the items ordered and your payment method (not the payment data itself, see section 6). Without this information we cannot deliver (Art. 6(1)(b) GDPR). You will receive the order confirmation and the shipping notification by email from Shopify. For shipping, we pass on your name, delivery address and – if you provide them – your email address or telephone number for delivery notifications to the shipping company we use.

Payment is processed via the payment service providers offered at checkout. You enter your payment data directly with the respective provider; we do not receive it, only the confirmation of payment. The provider processes the data under its own responsibility in accordance with its privacy notice, which is shown to you at checkout. The legal basis is Art. 6(1)(b) GDPR.

You can voluntarily create a customer account. In it we store your master data and your order history until you delete the account. You sign in with a one-time code sent by email; we do not store a password. The legal basis is Art. 6(1)(b) GDPR.

If you write to us by email or via the contact form, or apply for a business account, we store your details and your message in order to answer your enquiry (Art. 6(1)(b) or (f) GDPR). We send the forms to our mailbox via Resend (Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) on the basis of the European Commission’s standard contractual clauses. We delete the enquiry once it has been dealt with, provided no statutory retention obligations prevent this.

We set technically necessary cookies and similar storage without consent: for the cart, checkout, customer account, session security and for your cookie choice itself. They are required to operate the shop (§ 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR).

All other cookies and identifiers – for statistics and marketing, see section 10 – are only set with your consent via the cookie banner (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can choose statistics and marketing separately. We store your choice in your browser for one year; you can change it or withdraw it with effect for the future at any time via “Cookie settings” at the bottom of the page.

Google Analytics 4 (statistics) and Google Ads (marketing) of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The Google services only load once you have given consent – without consent, no connection to Google is established. With your consent, usage data (pages visited, events such as “add to cart”, truncated IP address, device information) is processed and conversions are attributed to ads. Google may transfer data to the USA (EU-US Data Privacy Framework, standard contractual clauses). More: policies.google.com/privacy.

Meta Pixel (marketing) of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland: only loads after consent and reports page views and events (cart, checkout, enquiry) so that we can measure and target ads on Facebook and Instagram. Joint controllership under Art. 26 GDPR for the collection; Meta may transfer data to the USA (EU-US Data Privacy Framework). More: facebook.com/privacy/policy.

Microsoft Clarity (statistics) of Microsoft Ireland Operations Limited, One Microsoft Place, Dublin 18, Ireland: only loads after consent and records how visitors use the site (clicks, scrolling, movements), without form entries. Microsoft may transfer data to the USA (EU-US Data Privacy Framework). More: privacy.microsoft.com.

You can see which of these tools are actually integrated in the cookie banner. If none is integrated, no banner appears.

We keep invoices and accounting records relating to orders for 8 years under commercial and tax law, and commercial books and annual financial statements for 10 years (§ 147(3) AO, § 257(4) HGB). We delete enquiries once they have been dealt with, customer accounts when you delete them, and server log data after 30 days. Data from statistics and marketing is kept by the respective providers according to their own retention periods (Google Analytics: 2 months for event data in the default setting).

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). You can withdraw any consent you have given at any time. To do so, contact info@customwheel.de. You can also lodge a complaint with a data protection supervisory authority, for example the Hessian Commissioner for Data Protection and Freedom of Information (Hessischer Beauftragter für Datenschutz und Informationsfreiheit), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

We do not make any decisions based solely on automated processing that produce legal effects concerning you.

We update this policy when our processing or the legal situation changes. The version published here at any given time applies.