Privacy Policy

Privacy Policy for the Craftspares Online Shop

Below we inform you about which personal data we process when visiting the shop, placing orders, making payments, deliveries, contact inquiries and when using cookies or similar technologies.

1. Controller

A data protection officer has not been appointed. Data protection inquiries can be directed to the above email address.

2. Shop Access and Technical Log Data

When accessing our online shop, technically necessary data is processed to deliver the shop, ensure security, provide shopping cart and order functions and prevent abuse. This may include IP address, date and time of access, browser and device information, accessed pages, referrer URL, language settings and technical log data.

Legal basis is Art. 6 para. 1 lit. f GDPR, insofar as processing is necessary for the secure and functional provision of the shop, as well as Art. 6 para. 1 lit. b GDPR, insofar as processing is necessary for the performance of pre-contractual measures or a contract.

3. Technical Shop Platform and Operation of the Online Shop

Our online shop is operated with external technical infrastructure. This includes in particular hosting, shop interface, shopping cart, checkout, customer account functions, security functions, fraud prevention, technical analysis and interfaces to payment and shipping processes.

Depending on the use of the shop, order, contact, payment status, shipping, device, usage and log data may be processed. Technical service providers used process data either on our behalf based on data protection agreements or, insofar as they fulfill their own legal obligations, on their own responsibility.

4. Orders, Customer Account and Contract Processing

If you order in the shop, we process the data necessary for order and contract processing, in particular name, billing and delivery address, email address, phone number if provided, order data, payment status, shipping data, communication, return information and complaint information.

Legal basis is Art. 6 para. 1 lit. b GDPR. If statutory retention obligations exist, legal basis is Art. 6 para. 1 lit. c GDPR.

5. Payment Service Providers

External payment service providers may be integrated in the checkout, in particular providers for card payments, digital wallets, Klarna, PayPal and local payment methods. Depending on the selected payment method, payment, order, contact, device, risk and transaction data are transmitted to the respective payment service provider as far as necessary for payment processing, fraud prevention, identity or credit checks and contract execution.

Legal basis is Art. 6 para. 1 lit. b GDPR, for legally required checks Art. 6 para. 1 lit. c GDPR and for fraud prevention Art. 6 para. 1 lit. f GDPR. The respective payment service provider may be responsible for its own processing operations.

6. Shipping Service Providers and Delivery Communication

For delivery, we pass on the necessary data to shipping service providers, in particular name, delivery address, shipment data and, as far as necessary for shipping notification or delivery, email address or phone number. Depending on the shipping method, parcel and letter service providers such as DHL/Deutsche Post or other service providers involved in the shipping process may be involved.

Legal basis is Art. 6 para. 1 lit. b GDPR. If shipping service providers provide their own tracking or notification services, their privacy information may apply additionally.

7. Contact, Fit Inquiries and Customer Service

If you contact us, we process your data to handle the inquiry. This may include name, email address, order number, device or engine data, reference numbers, photos of old parts, communication content and processing notes.

Legal basis is Art. 6 para. 1 lit. b GDPR, insofar as the inquiry relates to a contract or pre-contractual measures, otherwise Art. 6 para. 1 lit. f GDPR.

8. Newsletter and Marketing Communication

We only send newsletters or promotional emails if consent has been given or a legal permission exists. Consent can be revoked at any time with effect for the future.

Legal basis is Art. 6 para. 1 lit. a GDPR for consent or Art. 6 para. 1 lit. f GDPR insofar as legally permissible customer advertising applies.

9. Cookies, Similar Technologies and Consent

We use technically necessary cookies and similar technologies so that the shop functions, shopping cart and checkout are provided, security is ensured and language, market or consent settings can be stored.

For non-essential cookies, analysis, marketing, personalization or pixel technologies, we obtain your consent if required. Legal basis for technically necessary operations is § 25 para. 2 TDDDG and Art. 6 para. 1 lit. f GDPR or Art. 6 para. 1 lit. b GDPR. For consent-required technologies, legal basis is § 25 para. 1 TDDDG and Art. 6 para. 1 lit. a GDPR.

You can change or revoke your consent at any time via the cookie settings in the shop.

10. Cookie Banner, Consent Settings and Opt-out

The shop uses consent functions to separate technically necessary cookies from optional analysis, marketing, personalization or pixel technologies and to save your selection.

Optional technologies are controlled according to your consent decision. If additional third-party pixels or embedded services are used, they must be technically integrated so that they respect the consent decision.

11. Analysis, Google Services and Campaign Measurement

If you have consented and the corresponding services are activated, we may use Google Analytics, Google Ads or comparable services to analyze the use of our shop, measure campaigns, perform conversion tracking and, if separately permitted, enable interest-based advertising or remarketing.

Provider of Google services is regularly Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; integration of other Google companies, especially Google LLC in the USA, cannot be excluded depending on the service and data flow.

Legal basis for storing or accessing non-essential information on your device is § 25 para. 1 TDDDG; legal basis for subsequent processing of personal data is Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future.

12. Google Customer Reviews and Review Requests

After an order, a voluntary dialog from Google Customer Reviews may be displayed in the checkout or on the order confirmation page. If you agree there, the order data required for the review request may be transmitted to Google. This may include email address, order number, delivery country, expected delivery date and the Merchant Center ID.

Provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Depending on processing, integration of other Google companies, especially Google LLC in the USA, cannot be excluded. Google uses the data to send you a short review survey by email after completion of the order and to process the feedback within Google Customer Reviews or shop ratings.

Participation is voluntary. Legal basis is your consent pursuant to Art. 6 para. 1 lit. a GDPR. Any processing by Google is additionally subject to Google's privacy information.

13. Other Pixels and Embedded Services

Other analysis, marketing, review, support, security, translation or other embedded services are only used if activated in the shop and legal requirements are met. Non-essential tracking or marketing technologies are only activated after consent if required.

The specific service and pixel landscape must be reviewed again and this privacy policy updated accordingly after activation of new payment, marketing or analysis functions.

14. Recipients, Processors and Third Country Transfers

Recipients of personal data may include technical shop, hosting, merchandise management and process service providers, payment service providers, shipping service providers, IT security service providers, tax consultants, authorities, banks and communication service providers.

Transfers to countries outside the European Union or European Economic Area may occur especially with internationally active platform, payment, analysis or support service providers. They only take place if there is an adequacy decision, suitable guarantees such as EU standard contractual clauses or a legal exception.

15. Storage Duration

We store personal data only as long as necessary for the respective purposes or statutory retention obligations exist. Commercial and tax relevant documents are kept according to legal deadlines, usually up to six or ten years.

Data from inquiries, returns, complaints and warranty cases are stored as long as necessary for processing and for asserting or defending legal claims.

16. Rights of Data Subjects

You have rights to information, correction, deletion, restriction of processing, data portability and objection according to legal requirements. If processing is based on consent, you can revoke this consent at any time with effect for the future.

You also have the right to complain to a data protection supervisory authority. For Kay GmbH, the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia is the responsible supervisory authority.

17. Obligation to Provide Data

Provision of certain data is necessary for order, payment, delivery, return or customer service. Without this data, we cannot perform the contract or not fully.