Privacy policy

1Who is responsible

The controller for the processing described here is colorNdrive UG (haftungsbeschränkt), Bürgermeister-Widmeierstr. 23, 86179 Augsburg, Germany. You can reach us by phone on +49 151 4722 0949 or by e-mail at [email protected].

We have not appointed a data protection officer; we are below the threshold at which German law requires one. Send data protection enquiries to the contact above.

2What we process

Visiting the site. Our server records the request: IP address, date and time, the page requested, the referring page, and your browser and operating system. These records let us deliver the site, keep it secure and diagnose faults.

Ordering. To fulfil an order we process your name, delivery and billing address, e-mail address, phone number, the paint code and vehicle you gave us, and the payment details needed to take payment.

Contacting us. If you write to us we process the message and the address you sent it from, in order to answer.

Cookies. See our cookie policy for what is set, by whom, and how to refuse anything that is not strictly necessary.

3Legal basis

• Performance of a contract, or steps taken at your request before entering one — Art. 6(1)(b) GDPR: order processing, delivery, payment, warranty and withdrawal handling.
• Legal obligation — Art. 6(1)(c) GDPR: retention of invoices and commercial correspondence under tax and commercial law.
• Legitimate interests — Art. 6(1)(f) GDPR: operating and securing the site, preventing abuse, and answering enquiries. Our interest is in a site that works and is not attacked.
• Consent — Art. 6(1)(a) GDPR: non-essential cookies and any marketing e-mail. You can withdraw consent at any time with effect for the future.

4Who receives the data

We pass on only what a given task requires, and only to parties bound to process it on our instructions or under their own legal duty:

Hosting

Cloudflare (Cloudflare Germany GmbH / Cloudflare, Inc.), DigitalOcean, LLC

Payment

Shopify (Shopify International Limited, Ireland), Shopify Payments, PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg), Stripe (Stripe Payments Europe, Limited, Ireland)

Delivery

DHL, UPS, FedEx

Analytics

Google Analytics 4 (Google Ireland Limited)

Tax advisers, auditors and authorities receive data where the law requires it. We do not sell personal data, and we do not pass it to third parties for their own advertising.

5Transfers outside the EEA

Where a recipient processes data outside the European Economic Area, that transfer is covered either by an adequacy decision of the European Commission or by the Commission’s standard contractual clauses together with additional safeguards. Shipping outside the EEA necessarily involves passing your address to the carrier and to customs in the destination country.

6How long we keep it

Server logs

Deleted or anonymised after 30 days at the latest

Order and invoice data

10 years, as required by German tax and commercial law

Enquiries not leading to an order

Deleted once the matter is closed

Consent records

For as long as the consent is relied on, plus the limitation period

7Your rights

• Access — a copy of the data we hold about you and the information in this notice (Art. 15).
• Rectification — correction of inaccurate data and completion of incomplete data (Art. 16).
• Erasure — deletion, where no retention obligation stands in the way (Art. 17).
• Restriction — processing paused while a dispute about accuracy or lawfulness is resolved (Art. 18).
• Portability — the data you gave us, in a machine-readable format (Art. 20).
• Objection — to processing based on legitimate interests, on grounds relating to your situation. Against direct marketing you may object at any time, without giving reasons (Art. 21).
• Withdrawal of consent — at any time, with effect for the future; this does not affect processing already carried out.

To exercise any of these, write to us at [email protected]. We answer within one month.

8Complaints

You may complain to a data protection supervisory authority — in the member state where you live or work, or where you believe an infringement occurred. The authority competent for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Ansbach.

9Is providing data required?

Browsing the site requires no personal data beyond what your browser sends to reach our server. Placing an order requires the data marked as mandatory at checkout: without it we cannot conclude or perform the contract.

10Automated decision-making

We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.