1. Data controller
[Section to complete with real company details before launch: name, address, VAT/tax ID, business registry number, contact details.]
The controller of personal data collected through the BimmerBase.eu store is [name / company name], VAT/tax ID: [to be added], address: [to be added], email: [to be added].
2. What data we collect
When you place an order we process: your name, email address, phone number, shipping and billing address, and — for businesses — company name and VAT/tax ID. Providing this data is voluntary but necessary to place and fulfil an order — without it we cannot enter into a contract with you.
3. Purpose and legal basis for processing
- Order fulfilment and issuing a proforma invoice — GDPR Art. 6(1)(b) (performance of a contract).
- Handling contact inquiries — GDPR Art. 6(1)(f) (legitimate interest).
- Accounting and tax obligations — GDPR Art. 6(1)(c) (legal obligation).
4. Data retention period
Order-related data is kept for the period required by tax regulations (generally 5 years from the end of the tax year). Data from the contact form is kept only as long as needed to handle the enquiry, no more than 12 months after the last contact.
5. Your rights
You have the right to access your data, correct it, delete it, restrict its processing, request data portability, and object to processing, as well as the right to lodge a complaint with the President of the Personal Data Protection Office (UODO). Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.
6. Data recipients
Data may be shared with parcel delivery providers, accounting service providers, and hosting/IT service providers, strictly to the extent necessary to fulfil the order or run the store.
7. Transfers outside the EEA
As a rule, personal data is not transferred outside the European Economic Area. Should we use a tool that involves such a transfer in the future, it will rely only on mechanisms that ensure an adequate level of data protection under GDPR (e.g. standard contractual clauses).
8. Automated decision-making
Customer data is not used for automated decision-making with legal effects, including profiling.
9. Cookies
Rules regarding cookies are described in a separate Cookie policy.