Rechtliches

Privacy Policy

1) Introduction and contact details of the controller

1.1 We are pleased that you are visiting our website and thank you for your interest. Below we inform you about how your personal data is handled when you use our website. Personal data is all data that can be used to identify you personally.

1.2 The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Tobias Keusch, Hansestraße 149, 23558 Lübeck, Germany, email: info@valve-cartel.com, trading as Valve Cartel. The controller responsible for the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

2) Data collection when visiting our website

2.1 When you use our website for information purposes only, that is, if you do not register or otherwise transmit information to us, we only collect the data that your browser transmits to our server (so-called „server log files“). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:

  • The page of our website you visited
  • Date and time of access
  • Amount of data sent in bytes
  • Source or referrer from which you reached the page
  • Browser used
  • Operating system used
  • IP address used (where applicable in anonymised form)

The processing is carried out in accordance with Art. 6 (1) (f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not passed on or used in any other way. However, we reserve the right to check the server log files retrospectively if there are concrete indications of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or enquiries to the controller), this website uses SSL or TLS encryption. You can recognise an encrypted connection by the string „https://“ and the lock symbol in your browser bar.

3) Hosting and shop platform

This online shop is operated on the platform of the following provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (parent company: Shopify Inc., Canada).

On our behalf, the provider processes order, contact and usage data as well as server log files in order to provide the shop, handle the ordering process and keep operations secure and stable. The legal basis is Art. 6 (1) (b) GDPR for the performance of a contract and Art. 6 (1) (f) GDPR on the basis of our legitimate interest in secure and efficient operation.

We have concluded a data processing agreement with the provider which ensures the protection of our site visitors' data and prohibits unauthorised disclosure to third parties. Insofar as data is transferred to third countries, this takes place on the basis of appropriate safeguards, in particular the standard contractual clauses of the European Commission; for Canada there is also an adequacy decision of the European Commission for commercial organisations.

4) Cookies

To make visiting our website attractive and to enable the use of certain functions, we use cookies, that is, small text files that are stored on your device. Some of these cookies are automatically deleted when you close your browser (so-called „session cookies“), while others remain on your device for longer and allow page settings to be saved (so-called „persistent cookies“). In the latter case, you can find the storage period in the cookie settings overview of your web browser.

We set technically necessary cookies, for example for the shopping cart, the session and the language selection, in accordance with § 25 (2) TDDDG and Art. 6 (1) (b) or (f) GDPR without separate consent.

Cookies and comparable technologies that are not technically necessary, in particular for marketing and measurement purposes (see section 9), are used exclusively with your consent in accordance with § 25 (1) TDDDG and Art. 6 (1) (a) GDPR. You can give, refuse and at any time withdraw or adjust this consent with effect for the future via the cookie banner provided on the website.

You can also set your browser to inform you when cookies are set and to decide individually whether to accept them, or to exclude the acceptance of cookies in certain cases or generally. Please note that the functionality of our website may be limited if cookies are not accepted.

5) Contacting us

When you contact us, for example via the contact form or by email, personal data is processed exclusively for the purpose of handling and responding to your enquiry and only to the extent necessary for this. You can see which details are required from the respective form; mandatory fields are marked there.

The legal basis for processing this data is our legitimate interest in responding to your enquiry in accordance with Art. 6 (1) (f) GDPR. If your enquiry is aimed at concluding a contract, the additional legal basis for the processing is Art. 6 (1) (b) GDPR. Your data will be deleted when it can be inferred from the circumstances that the matter concerned has been conclusively clarified, provided that no statutory retention obligations prevent this.

6) Data processing when opening a customer account

In accordance with Art. 6 (1) (b) GDPR, personal data will continue to be collected and processed to the extent required if you provide it to us when opening a customer account. You can see which data is required to open an account from the input form on our website.

Your customer account can be deleted at any time by sending a message to the address of the controller stated above. After your customer account has been deleted, your data will be erased, provided that all contracts concluded through it have been fully performed, no statutory retention periods prevent this and we have no continuing legitimate interest in further storage.

7) Waiting list for vehicles not yet available

If no controller is available for your vehicle yet, you can add yourself to a waiting list using the „Wunschfahrzeug“ form. We will then notify you by email as soon as a suitable module is available.

The mandatory details for this are your email address and the vehicle; providing your name is voluntary and is used so that we can address you personally. By submitting the form you give us your consent in accordance with Art. 6 (1) (a) GDPR to contact you by email for this purpose. The data collected during registration is used strictly for that purpose.

You can withdraw your consent at any time with effect for the future, either via the unsubscribe link in the respective email or by sending a message to the controller named at the beginning. After withdrawal, your email address will be deleted from the distribution list set up for this purpose without delay, unless you have expressly consented to further use of your data.

8) Data processing for order fulfilment

8.1 When you place an order, we process the data required for this, in particular your name, address, email address as well as payment and order data, in accordance with Art. 6 (1) (b) GDPR for the performance of the contract. In order to fulfil retention obligations under tax and commercial law, we process invoice data in accordance with Art. 6 (1) (c) GDPR.

8.2 Insofar as this is necessary for the performance of the contract for delivery and payment purposes, the personal data we collect is passed on to the commissioned transport company and the commissioned credit institution in accordance with Art. 6 (1) (b) GDPR. The data is only passed on to the extent actually necessary for the delivery of the goods or the processing of the payment.

8.3 In order to prepare and carry out shipping, we pass on the data required for this, generally your name and delivery address, to the shipping or logistics company commissioned in each case. The legal basis is Art. 6 (1) (b) GDPR. If you have expressly consented during the ordering process, we will additionally pass on your email address and/or telephone number in accordance with Art. 6 (1) (a) GDPR for the purpose of announcing the delivery or arranging a delivery date. This consent can be withdrawn at any time with effect for the future, either towards the controller designated above or towards the shipping service provider.

8.4 Use of payment service providers

To process payments, we pass on your payment data to the payment service provider you have selected. The disclosure takes place in accordance with Art. 6 (1) (b) GDPR exclusively for the purpose of processing the payment and only to the extent necessary for this. Depending on the payment method chosen, these are:

Shopify Payments and Shop Pay (credit and debit cards as well as other payment methods offered during the ordering process such as eps, iDEAL or Wero), provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Further payment service providers may be used to process the payment; these will be communicated to you during the ordering process. The payment data you provide during the ordering process is transmitted, including name, address, card and bank information, currency and transaction number, as well as information about the content of your order.

PayPal, provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. If you select a payment method of the provider in which you pay in advance, the payment data you provide during the ordering process and information about the content of your order will be passed on to the provider in accordance with Art. 6 (1) (b) GDPR. If you select a payment method in which the provider pays in advance, for example purchase on account or instalment payment, the provider reserves the right to carry out a credit check. For this purpose, your payment data may be passed on to credit agencies in accordance with Art. 6 (1) (f) GDPR on the basis of the legitimate interest in establishing your ability to pay. The credit report may contain probability values (so-called score values) based on a scientifically recognised mathematical and statistical procedure; address data is among the factors included in the calculation, though not the only one. You can object to this processing at any time by sending a message to us or to the provider. Further information: https://www.paypal.com/de/legalhub/paypal/privacy-full

Klarna, provider: Klarna Bank AB (publ), Sveavägen 46, 11134 Stockholm, Sweden. If you select a payment method of the provider, the payment data you provide during the ordering process and information about the content of your order will be passed on to the provider in accordance with Art. 6 (1) (b) GDPR. For payment methods in which the provider pays in advance, for example purchase on account or instalment payment, you will be asked to provide further personal data during the ordering process. In order to protect our legitimate interest in establishing your ability to pay, this data is forwarded to the provider for a credit check in accordance with Art. 6 (1) (f) GDPR; the provider may also include identity and creditworthiness information from credit agencies for this purpose. You can object to this processing at any time by sending a message to us or to the provider. Further information: https://www.klarna.com/international/privacy-policy/

Apple Pay, provider: Apple Distribution International, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. The payment is processed via the Apple Pay function of your device by charging a payment card stored there. For the purpose of processing the payment, the information you provide during the ordering process together with the information about your order is passed on to the provider in encrypted form. Further information: https://support.apple.com/en-us/HT203027

Google Pay, provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland. The payment is processed via the Google Pay application of your device by charging a payment card stored there or a payment system verified there. For the purpose of processing the payment, the information you provide during the ordering process together with the information about your order is passed on to the provider, which verifies a completed payment by means of a single-use transaction number. Further information: https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice

The privacy policies of the respective provider apply in addition.

9) Retargeting and conversion tracking

Meta Pixel

Within our online offering we use the service „Meta Pixel“ of the following provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland („Meta“).

If a user clicks on an advertisement placed by us on Facebook and/or Instagram, the URL of our linked page is extended by a parameter with the help of the Meta Pixel. After the redirect, this URL parameter is then written into the user's browser by a cookie that our linked page itself sets.

On the one hand, this enables Meta to determine the visitors of our online offering as a target group for displaying advertisements. Accordingly, we use the service in order to show the Facebook and/or Instagram advertisements placed by us only to those users who have also shown an interest in our online offering. On the other hand, the Meta Pixel makes it possible to track whether users were redirected to our website after clicking on an advertisement and which actions they take there, for example viewing a product page or completing an order (so-called conversion tracking).

The data collected is anonymous for us, so it does not allow us to draw any conclusions about the identity of users. However, the data is stored and processed by Meta, so that a connection to the respective user profile is possible and Meta can use the data for its own advertising purposes. For certain processing operations we are joint controllers together with Meta within the meaning of Art. 26 GDPR.

All processing described above, in particular the setting of cookies for reading out information on the device used, is only carried out if you have given us your express consent in accordance with Art. 6 (1) (a) GDPR. Technically, the service is only loaded after consent has been given; without consent its use is omitted entirely during your visit. You can withdraw your consent at any time with effect for the future by deactivating this service via the cookie banner provided on the website.

The information generated by Meta is generally transmitted to a Meta server and stored there; in this context, a transfer to servers of Meta Platforms Inc. in the USA may also occur. For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.

Further information on data protection at Meta: https://www.facebook.com/privacy/policy

10) Rights of the data subject

10.1 Applicable data protection law grants you the following rights as a data subject vis-à-vis the controller with regard to the processing of your personal data, whereby reference is made to the legal basis cited for the respective conditions of exercise:

  • Right of access pursuant to Art. 15 GDPR;
  • Right to rectification pursuant to Art. 16 GDPR;
  • Right to erasure pursuant to Art. 17 GDPR;
  • Right to restriction of processing pursuant to Art. 18 GDPR;
  • Right to notification pursuant to Art. 19 GDPR;
  • Right to data portability pursuant to Art. 20 GDPR;
  • Right to withdraw consent given pursuant to Art. 7 (3) GDPR;
  • Right to lodge a complaint pursuant to Art. 77 GDPR.

A message to info@valve-cartel.com is sufficient to exercise these rights. You can assert the right to lodge a complaint in particular with a supervisory authority in the Member State of your habitual residence or of the place of the alleged infringement.

10.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST AS PART OF A BALANCING OF INTERESTS, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED. HOWEVER, FURTHER PROCESSING REMAINS RESERVED IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

IF YOUR PERSONAL DATA IS PROCESSED BY US FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR SUCH ADVERTISING. YOU CAN EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

11) Duration of storage of personal data

The duration of the storage of personal data is determined by the respective legal basis, the purpose of the processing and, where applicable, additionally by the respective statutory retention period, such as retention periods under commercial and tax law.

Where personal data is processed on the basis of express consent pursuant to Art. 6 (1) (a) GDPR, the data concerned is stored until you withdraw your consent.

Where statutory retention periods exist for data processed in the context of legal or quasi-legal obligations on the basis of Art. 6 (1) (b) GDPR, this data is routinely deleted after expiry of the retention periods, provided it is no longer required for the performance or initiation of a contract and/or we have no continuing legitimate interest in further storage.

Where personal data is processed on the basis of Art. 6 (1) (f) GDPR, this data is stored until you exercise your right to object under Art. 21 (1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing purposes on the basis of Art. 6 (1) (f) GDPR, this data is stored until you exercise your right to object under Art. 21 (2) GDPR.

Unless otherwise stated in the other information in this policy on specific processing situations, stored personal data is otherwise deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.

12) Status and changes

We adapt this privacy policy as soon as changes in data processing or in the legal situation make this necessary. The current version published here applies.

Status: August 2026

This English text is a courtesy translation. The authoritative version is the German one; in case of discrepancies, the German version applies.