Privacy policy

Draft for legal review. This text describes the technical state of this website as of 8 August 2026. It replaces the version carried over from the previous Shopify store, which did not describe this website. Before go-live, Racing23 GmbH has it reviewed and approved by its legal counsel. Passages marked [to be confirmed: ...] must be settled beforehand.

1. Controller

Racing23 GmbH
Hannoversche Straße 43
49328 Melle
Germany

Phone: +49 (0)5226 4538911
Email: info@racing23-brakes.de
Managing director: Stefan Kissling

[to be confirmed: whether a data protection officer has been appointed and, if so, their contact details.]

2. Principles and legal bases

We process personal data only where this is necessary to operate this website, to handle orders and to answer your enquiries. Depending on the purpose, the legal basis is Article 6(1)(b) GDPR (contract and pre-contractual steps), (c) (legal obligations, in particular commercial and tax retention duties), (f) (legitimate interest in a secure and functioning service) or (a) (consent, where we obtain it).

3. Visiting the website and server log files

This website is a static site. It is stored on the server of an external web host and delivered from there. [to be confirmed: name and address of the host and the conclusion of a data processing agreement under Article 28 GDPR. The preview currently runs at racing23.accsolutions.de on infrastructure operated by Ritter Systems.]

Every time a page is called up, your browser transmits technically necessary data to that server, which records it in log files: IP address, date and time, the address requested, volume transferred, status message, the previously visited page (referrer) and the browser and operating system identifier. A page cannot be delivered without this data. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is secure, undisturbed operation and the defence against attacks. This data is not combined with other sources, and we do not evaluate the log files for marketing purposes. [to be confirmed: the retention period for log files at the host.]

4. Encryption

All traffic between your browser and the server is encrypted with TLS. You can recognise this by the address beginning with "https://" and by the padlock symbol in your browser.

5. Cookies and storage in your browser

We use no cookies for advertising, analytics or profiling. Only the following entries are used:

• NEXT_LOCALE (a cookie with a lifetime of one year plus an entry of the same name in local storage): remembers the language you selected.
• Local storage: r23.cart (contents of the shopping cart), r23.cartCoupon (discount code entered), r23.vehicle and r23.vehicleRemembered (the vehicle last selected), r23.cookieConsent (your decision in the notice banner), r23.shopifyConfig (operator mode only, for the connection to the shop system).
• Session storage: r23.kbaDraft and r23.mmvDraft (intermediate state of the vehicle search), r23.brakeSel (selected brake system), r23.orderNote and r23.orderNoteCustomer (vehicle note attached to the order). Your browser deletes these entries as soon as you close the tab.

These entries remain in your browser. They are not transmitted to us and contain no identifier that would let us recognise you across visits. The legal basis is section 25(2) no. 2 TDDDG in conjunction with Article 6(1)(f) GDPR, because without this storage the cart, the language choice and the vehicle selection do not work. You can delete all entries at any time in your browser settings.

6. Consent notice banner

On your first visit we show a banner with the equally weighted buttons "Necessary only" and "Accept all". We store your decision in your browser's local storage (r23.cookieConsent). You can change or revoke it at any time via the "Cookie settings" link in the page footer. [Note for the review: this website currently embeds no service requiring consent, so the choice neither triggers nor prevents any additional processing. As soon as analytics or marketing services are added, this section must be adjusted and the banner must actually control those services.]

7. No audience measurement and no tracking

We use no web analytics, no advertising networks, no social media plugins, no chat or review widgets and no fingerprinting. No visitor profiles are created and no data is passed to third parties for advertising purposes.

8. Fonts

The fonts used (Inter, Oswald and Noto Sans Arabic) are stored on our own server and loaded from there. No connection to Google Fonts or any other font service is made when you visit this website.

9. Images from third-party providers

Some product and article images are not stored on our server but are loaded directly from the following providers when the page is opened. In doing so, the provider necessarily receives your IP address and your browser identifier and can infer a page view from it:

• Shopify (cdn.shopify.com), operated by Shopify International Limited, Dublin, Ireland, with its parent company in Canada: product and brand images.
• Unsplash (images.unsplash.com), Unsplash Inc., Canada: individual editorial images in the knowledge articles.
• Wikimedia Commons (upload.wikimedia.org), Wikimedia Foundation Inc., United States: individual technical photographs in the knowledge articles.

The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in the reliable and fast delivery of these images. Where data is transferred to countries outside the European Union, we rely on the safeguards provided for by the European Commission. [to be confirmed: the adequacy basis for each provider. Recommendation: move these images onto our own server before go-live, which removes this section entirely.]

10. Ordering and payment

Your shopping cart is created solely in your browser. Only when you start the checkout do we transmit the cart lines to our shop system and forward you to the checkout. The shop system and the checkout are operated by Shopify International Limited, Dublin, Ireland. There you enter your delivery, billing and payment details; Shopify's own privacy policy applies to that processing in addition. The legal basis is Article 6(1)(b) GDPR.

Which payment methods are actually available is shown during checkout. If you choose a payment service provider such as PayPal or Klarna, the data required for the payment is transmitted to them. That provider processes it under its own responsibility and its own privacy policy, among other things for payment handling and, depending on the method, for a credit check. [to be confirmed: the company name and registered office of each payment service provider. Which payment methods are enabled was read off the real checkout on 8 August 2026; the terms, the shipping page and the footer have named the same list since. Apple Pay remains open - it could not be verified technically in the screenshots used.]

11. Contacting us

If you contact us by email, telephone or post, we process your details in order to deal with your request. The legal basis is Article 6(1)(b) GDPR where your enquiry concerns a contract, otherwise (f).

The form on our contact page works in one of two modes, which you can tell apart by what happens when you send it. If the email program on your own device opens with the text prefilled, nothing is transmitted to a server of ours; the message is only sent by you, and we receive it as an ordinary email. If instead a confirmation with a reference number appears straight away, the form has transmitted your details – name, email address, optionally your vehicle, subject and message – to our own web server; no third-party form service is involved. The server forwards the message by email to info@racing23-brakes.de and sends you a copy to the address you gave; beyond that it is not stored there. The legal basis for the transmission is your consent under Article 6(1)(a) GDPR, which you give via the checkbox. To prevent abuse we limit the number of submissions per hour; for this, a hash formed from your IP address and the current hour is kept on the server for at most two hours, and the IP address itself is not stored.

12. Withdrawal form

The withdrawal function ("Withdraw from contract") lets you withdraw from a purchase contract electronically. There you enter your name, your address, an email address for the acknowledgement of receipt, details of the order and the goods concerned. Giving a reason is voluntary and has no effect on the validity of the withdrawal. We process these details in order to handle the withdrawal and reverse the contract. The legal bases are Article 6(1)(b) and (c) GDPR.

At present the form hands your declaration to the email program on your device. There is no server of ours that receives or stores form data. [to be added as soon as a receiving endpoint exists: provider, storage location, retention period and, where applicable, the data processing agreement.]

13. Vehicle search

The search by German type key numbers (HSN/TSN) and the selection by make, model and variant run entirely in your browser, against data files delivered with the website. Your search entries are not transmitted to us, not logged and not evaluated.

14. Recipients of your data

Within our company, only those people who need it to process your order or enquiry have access to your data. Outside the company, the possible recipients are: the web host, the Shopify shop system, the payment service provider you chose, the company engaged for shipping, and our tax advisers and, in the event of a dispute, our legal advisers. With service providers processing on our behalf we conclude agreements under Article 28 GDPR. [to be confirmed: the shipping service providers used.]

15. Retention period

We store personal data only for as long as is necessary for the respective purpose. Contract and invoice data are subject to the commercial and tax retention periods of six and ten years respectively (section 257 HGB, section 147 AO). Enquiries unrelated to a contract are deleted once they have been dealt with conclusively and no retention obligation stands in the way.

16. Your rights

You have the right of access (Article 15 GDPR), to rectification (Article 16), to erasure (Article 17), to restriction of processing (Article 18) and to data portability (Article 20). Where we process data on the basis of a legitimate interest, you may object to that processing under Article 21 GDPR. You can withdraw consent you have given at any time with effect for the future. Please contact the address or email address given above.

17. Right to lodge a complaint

Independently of this, you may lodge a complaint with a data protection supervisory authority, in particular with the authority of your place of residence or the authority competent for our registered office. For a registered office in Melle this is the Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany.

18. Changes to this policy

We adapt this policy when the website or the legal situation changes. The version published here at the time applies. Version: 8 August 2026 (draft).