Privacy policy

PRIVACY POLICY

1. Controller

The controller responsible for the processing of personal data in connection with this online shop is:

Boris Herrmann Racing GmbH
Venusberg 16
20459 Hamburg
Germany

E-mail: shop@borisherrmannracing.com

The controller within the meaning of the General Data Protection Regulation (“GDPR”) is

2. General Information on Data Processing

We process personal data only where this is necessary to operate our online shop, process and fulfil orders, communicate with customers, comply with legal obligations, analyse and improve our services or carry out marketing activities where permitted.

Depending on the purpose of the processing, the legal basis may in particular be:

• Art. 6(1)(a) GDPR – consent;
• Art. 6(1)(b) GDPR – performance of a contract or steps taken prior to entering into a contract;
• Art. 6(1)(c) GDPR – compliance with a legal obligation; or
• Art. 6(1)(f) GDPR – legitimate interests.

Where information is stored on or accessed from your terminal device, the applicable requirements of the German Telecommunications Digital Services Data Protection Act (TDDDG) also apply.

3. Shopify

Our online shop is operated using the Shopify platform.

The relevant Shopify entity for merchants established in Europe is:

Shopify International Limited
Victoria Buildings, 2nd Floor
1–2 Haddington Road
Dublin 4, D04 XN32
Ireland

Shopify provides the technical infrastructure required for the operation of our online shop, including hosting, checkout, order processing, customer accounts and shop administration.

Depending on your use of the shop, Shopify may process in particular:

• name;
• billing and delivery address;
• e-mail address;
• telephone number, where provided;
• IP address and device information;
• shopping cart and order information;
• customer account information;
• transaction and payment-related information; and
• communications relating to orders or customer service.

Processing required for the operation of the shop and fulfilment of orders is generally based on Art. 6(1)(b) GDPR. Processing necessary to ensure the secure and technically reliable operation of the shop may additionally be based on Art. 6(1)(f) GDPR.

Shopify may use affiliated companies and subprocessors outside the European Economic Area. Where personal data is transferred internationally, Shopify uses the safeguards required under applicable data protection law.

Further information on data processing by Shopify is available in Shopify’s privacy information.

4. Orders and Contract Processing

When you place an order through our online shop, we process the personal data required to enter into and fulfil the contract.

This may include in particular:

• first and last name;
• billing and delivery address;
• e-mail address;
• telephone number, where provided;
• products ordered;
• order value;
• order and transaction numbers;
• delivery information; and
• information relating to returns or complaints.

The legal basis for this processing is Art. 6(1)(b) GDPR.

Where statutory commercial, accounting or tax retention obligations apply, the relevant data is additionally processed on the basis of Art. 6(1)(c) GDPR.

5. Fulfilment, Shipping and Returns

We use DECH Group for the fulfilment, handling and dispatch of orders and for the handling of returned goods.

For this purpose, we transmit only the personal data necessary to process the relevant order, dispatch the goods or process a return.

This may include in particular:

• your name;
• delivery address;
• order number;
• e-mail address and/or telephone number where required for delivery;
• products ordered; and
• information required to process a return.

Returns may be processed through:

DECH Group
Peter Krauseneck Strasse 16
79618 Rheinfelden (Baden)
Germany

The legal basis for processing and transferring this information is Art. 6(1)(b) GDPR.

Where necessary for delivery, personal data may also be transmitted to the respective postal or parcel delivery company.

6. Payment Processing

We offer payment methods through Shopify Checkout and the payment providers integrated into our shop.

Depending on your location and the payment method selected, the following payment methods may currently be available:

• Visa;
• Mastercard;
• American Express;
• Maestro;
• Apple Pay; and
• Google Pay.

When you select a payment method, the data required to process the payment may be transmitted to Shopify and/or the relevant payment service provider.

This may include:

• name;
• billing address;
• order amount;
• currency;
• transaction number; and
• payment-related information.

We do not receive complete credit or debit card details where these are processed directly by the payment service provider.

The legal basis for payment processing is Art. 6(1)(b) GDPR.

The payment methods available to you may vary depending on your country and will be displayed during checkout.

7. Invoicing and Accounting

We use Shopify applications and service providers to create invoices and order documents and to support our accounting processes, including the transfer of relevant accounting information to DATEV.

For these purposes, the following information may in particular be processed:

• name;
• billing address;
• order number;
• invoice details;
• products ordered;
• invoice amount; and
• transaction information.

Processing necessary for the performance of the contract is based on Art. 6(1)(b) GDPR.

Processing required to comply with accounting and tax obligations is based on Art. 6(1)(c) GDPR.

8. Customer Service and Communication

If you contact us by e-mail, through our online shop or through a customer-service function, we process the information you provide in order to respond to your enquiry.

We may use Shopify Inbox / Shopify Messaging to manage customer communications.

Depending on your enquiry, we may process:

• your name;
• e-mail address;
• order number;
• the content of your enquiry; and
• any information you voluntarily provide.

Where your enquiry relates to an existing or prospective order, the legal basis is Art. 6(1)(b) GDPR.

For other enquiries, processing is based on our legitimate interest in providing efficient customer service pursuant to Art. 6(1)(f) GDPR.

9. Electronic Withdrawal Requests

We provide an electronic function that allows consumers to exercise their statutory right of withdrawal.

When you use this function, we may process in particular:

• your name;
• e-mail address;
• order number;
• information identifying the contract or goods concerned; and
• the date and time of your withdrawal request.

We use Shopify applications to provide and process electronic withdrawal requests.

Processing takes place to comply with our statutory obligations and is based on Art. 6(1)(c) GDPR and, where applicable, Art. 6(1)(b) GDPR.

Data relating to withdrawal requests is retained for as long as necessary to process and document the withdrawal and to comply with statutory retention obligations.

10. Cookies and Consent Management

Our online shop uses cookies and similar technologies.

Some cookies and technologies are strictly necessary for the operation of the shop, for example for:

• shopping cart functionality;
• checkout;
• security;
• customer authentication; and
• storing privacy preferences.

Other technologies are used for analytics, advertising or marketing purposes only where the legally required consent has been obtained.

We use Consentmo GDPR to manage cookie and privacy preferences.

Where consent is required, processing takes place on the basis of Art. 6(1)(a) GDPR and § 25(1) TDDDG.

Technologies that are strictly necessary to provide a service expressly requested by you may be used without consent in accordance with § 25(2) TDDDG.

You can change or withdraw your privacy choices at any time using the Cookie Preferences function available on our website.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

11. Google & YouTube

We use the Google & YouTube integration provided through Shopify.

The relevant Google entity in the European Union is:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Depending on your consent settings and the functions enabled, Google technologies may be used for purposes such as:

• website and shop analytics;
• measuring visits and interactions;
• conversion measurement;
• measuring completed purchases;
• advertising performance; and
• optimisation of advertising campaigns.

Our Shopify configuration uses Google customer-event technology through web-based and server-side integrations.

Depending on the function used, the information processed may include:

• IP address;
• browser and device information;
• pages viewed;
• product interactions;
• shopping cart events;
• checkout events;
• purchase and transaction events; and
• technical identifiers.

Analytics and marketing processing that is not strictly necessary takes place only after the required consent has been provided.

The legal basis is Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG.

You can withdraw your consent at any time through Cookie Preferences.

Google may process data outside the European Economic Area. Where personal data is transferred internationally, the applicable legal safeguards are used.

12. Facebook and Instagram by Meta

We use the Facebook & Instagram by Meta integration provided through Shopify.

The provider in the European Union is:

Meta Platforms Ireland Limited
Merrion Road
Dublin 4
Ireland

The integration may use the Meta Pixel and related Meta Business Tools for purposes including:

• measuring visits to our online shop;
• measuring product interactions;
• shopping cart and checkout measurement;
• measuring purchases;
• conversion tracking;
• advertising measurement; and
• improving the relevance and performance of advertising.

Depending on the configuration and your consent settings, information such as the following may be processed:

• pages viewed;
• product interactions;
• shopping cart activity;
• checkout events;
• purchase events;
• browser and device information;
• technical identifiers; and
• other data permitted by the selected Meta data-sharing settings.

Processing for analytics and advertising purposes takes place only after the required consent has been provided.

The legal basis is Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG.

You can withdraw your consent at any time via Cookie Preferences.

Meta may process personal data outside the European Economic Area. Where international transfers take place, the applicable safeguards under data protection law are used.

13. Newsletter and Marketing Communications

You may subscribe to our newsletter or other marketing communications through our online shop.

When you subscribe, we process in particular:

• your e-mail address;
• your marketing consent status; and
• where technically recorded, the date and time and other information required to document your consent.

Subscription and consent information may be stored and managed through Shopify.

Marketing communications are sent only where the applicable legal requirements have been met.

The legal basis for sending marketing communications is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with the applicable provisions of German competition law.

You may withdraw your consent at any time with effect for the future, for example by using the unsubscribe link contained in our marketing e-mails.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

14. Embedded YouTube Content

Our online shop may contain embedded YouTube videos.

YouTube is provided by Google Ireland Limited.

When you activate or play embedded YouTube content, information about your use of the relevant page may be transmitted to Google and YouTube.

Where legally required, non-essential YouTube functionality is activated only after you have provided your consent.

The legal basis is Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG.

You can withdraw your consent via Cookie Preferences.

15. Social Media Links

Our website may contain links to our profiles on social networks, including Facebook, Instagram, LinkedIn, YouTube or other platforms.

A simple link to a social network does not by itself result in personal data being transmitted to the relevant social network before you activate the link.

If you follow a link to an external social media platform, the privacy policy of the respective platform applies to the subsequent processing.

16. Server Log Data and Technical Security

When you access our online shop, technical information may automatically be processed in order to provide and secure the website.

This may include:

• IP address;
• browser type and version;
• operating system;
• referring URL;
• date and time of access;
• pages requested; and
• technical identifiers and security information.

Processing is based on our legitimate interest in providing a secure, reliable and technically functional online service pursuant to Art. 6(1)(f) GDPR.

17. International Data Transfers

Some of our service providers are part of international groups of companies or use service providers located outside the European Economic Area.

Where personal data is transferred to a country outside the EEA, the transfer takes place only where an appropriate legal mechanism is available.

This may include in particular:

• an adequacy decision of the European Commission, including participation in the EU-US Data Privacy Framework where applicable;
• Standard Contractual Clauses approved by the European Commission; or
• another transfer mechanism permitted under applicable data protection law.

 Periods

We retain personal data only for as long as necessary for the purpose for which it was collected, unless longer retention is required or permitted by law.

Order, invoice and accounting information may in particular be retained for the statutory retention periods applicable under German commercial and tax law.

Data processed on the basis of consent is generally processed until consent is withdrawn, unless another legal basis permits or requires further processing.

Customer-service communications are retained only for as long as necessary to process the relevant enquiry, subject to applicable statutory retention requirements.

19. Your Rights

Subject to the requirements of the GDPR, you have the right to:

• obtain access to your personal data pursuant to Art. 15 GDPR;
• request rectification pursuant to Art. 16 GDPR;
• request erasure pursuant to Art. 17 GDPR;
• request restriction of processing pursuant to Art. 18 GDPR;
• receive personal data in a portable format pursuant to Art. 20 GDPR;
• object to certain processing pursuant to Art. 21 GDPR; and
• withdraw consent at any time pursuant to Art. 7(3) GDPR.

Where you withdraw consent, the withdrawal applies for the future and does not affect the lawfulness of processing carried out before the withdrawal.

To exercise your rights, please contact:

shop@borisherrmannracing.com

20. Right to Lodge a Complaint

You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection law.

You may in particular contact the supervisory authority responsible for our registered office in Hamburg.

21. Changes to this Privacy Policy

We may update this Privacy Policy where our services, technical systems, service providers or legal requirements change.

The current version of the Privacy Policy is always available on this website.

Last updated: September 2026