Data Privacy Policy


Data Privacy Policy Wolf Racing Neuenstein GmbH & Co. KG

We are pleased about your interest in our company. Data protection has a very high priority for the Wolf Racing GmbH & Co. KG and we take our position as controller within the meaning of the GDPR very seriously.

By means of this data privacy policy, our company would like to inform the public in general and you in particular about the type, scope and purpose of the personal data collected, used and processed by us and to inform affected persons about the rights to which you are entitled.

This data privacy policy take into account the requirements of the General Data Protection Regulation (GDPR) to be implemented by 25th of May 2018 at the latest, which already came into force on 25th of May 2016, as well as the german national Federal Data Protection Act (BDSG).

1. Definitions

Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subjects wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

Personal data means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

This includes in particular name, address(es), bank details, e-mail address, telephone or fax number or client IP address.

Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Restriction of processing means the marking of stored personal data with the aim of limiting their processing in the future.

Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

Third party means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

Supervisory authority means an independent public authority which is established by a Member State pursuant to Article 51.

2. Handling of personal data and data storage

We use personal data in particular for the processing of orders, the delivery of goods and the provision of services as well as the processing of payment. We also use personal data fort he communication with the data subject, to update our data records and to maintain the data subjects customer account. We also use personal data to improve our platform, to prevent or detect misuse, in particular fraud, or to enable third parties to perform technical, logistical or other services on our behalf. The collection, storage and processing of personal data is particularly necessary because this is the only way we can provide the service requested by the data subject. The personal data is stored for the duration of the processing of the order and execution of the contract or to the extent required by legal regulations (e.g. tax regulations).

Personal data are used for the justification of the contract, the content design and implementation or settlement of the contract(Art. 6 para. 1 lit. b) GDPR). In addition, personal data will only be processed if we have received the consent of the data subject (Art. 6 para. 1 lit. a) GDPR). This consent will be recorded.

Furthermore, personal data will only be processed and collected by default to the extent necessary for the intended purpose. If the processing of the personal data of the data subject is based on a consent, he has the right to revoke this consent at any time. Art. 7 para. 3 GDPR is expressly referred to.

3. Use of the website

The use of the (publicy accessible) website is generally possible without providing personal data. If parts of the website (e.g. the contact to us) are dependent on the provision of personal data in order to ensure the function or to be able to fulfil the data subject will be requested to enter the personal data at the appropriate place and can decide on the entry.

Insofar as personal data is collected via forms on our pages (e. g. name, address or e-mail address), this is always done on a voluntary basis and with the express consent of the data subject, which will be recorded.

You can contact us by e-mail, fax or telephone. We store the data transmitted to us and provided by you for processing the request.

Every time a data subject accesses a page of our website and every time a file stored on the website is called up, access data about this process is stored in a log file. Each data record consists of:

  • (1) the page from which the file was requested,
  • (2) the name of the file,
  • (3) the date and time of the request,
  • (4) the amount of data transferred,
  • (5) the access status (file transferred, file not found etc. )/http status code,
  • (6) a description of the type of operating system and web browser used,
  • (7) the client IP address.

The data is stored each time a data subject accesses a page of our offer and each time our website is accessed and is deleted as soon as it is no longer required for the purpose of collection or processing.

The temporary storage of the personal data is carried out on the legal basis of Art. 6 para. 1 lit. f) GDPR. The legitimate interest lies in the provision of our website. The data subject may object to the processing at any time.

4. Priciple of data avoidance, legality of personal data processing

In addition, as far as we can possibly do, personal data will not be collected. In doing so, we adhere to the principle of data avoidance, which we take very seriously. We treat personal data confidentially and in accordance with legal data protection regulations.

The scope of the personal data communicated to us is appropriate to the purpose and limited to what is necessary for the purpose of the processing. The processing of personal data is carried out for the performance of the contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

The same applies if the data subject voluntarily contacts us at their own request and initiative.

5. Persons under the age of 16

Persons under the age of 16 should not transmit any personal data to us or consent to such data without the consent of their legal representative(s).

6. Illegal acts by third parties

In the case of concrete indications of an illegal action or if we are requested to do so by legal authorities, we will hand over the data available to the competent legal authorities for prosecution.

7. Data transfer

The stored data will not be transferred to third parties. The following exceptions apply:

For the performance of the contract the data will be transferred on to the shipping company commissioned with the delivery, as far as this is necessary for the delivery of the ordered goods. For the processing of payments, the payment data required for this – insofar as this is necessary with regard to the type of payment and the extent of the transfer – shall be passed on to the credit institution commissioned with the payment and, if applicable, to the commissioned and selected payment service provider. Your personal data will only be processed within the EU.

Personal data will also be transmitted to a credit institution if the analysis of a financing request is made to the credit institution by the controller. This request is fulfilled in the customers interest and to fulfill the purchase contract with the customer.

The data may also be stored at a licensing office of the responsible authorities for performance of the contract. If your data is forwarded in this way, we will also process this data carefully and securely. Please note that the information in this table is not visible. Please note that the following information does not apply to the user.

8. Data security

All personal data on our website is protected by technical and organisational measures against loss, destruction, external access, modification and distribution. We would like to point out that data transmission over the Internet (e g. communication by e-mail or infiltration of the visitors computer (e.g. the computer of the data subject) by third parties) may have security gaps. A complete protection of data against access by third parties is not possible for us.

We are not responsible for personal data collected and processed by third parties.

9. Communication of personal data

We collect personal data if the data subject voluntarily provides it in connection with his order, when contacting us (e.g. via contact form or e-mail) and when opening a customer account and the necessary registration.

We collect and store all information that the data subject enters on our website or transmits to us in any other way. In addition, personal data will only be processed and collected by default to the extent necessary for the intended purpose.

10. Necessity of data collection, cookies and use of Google (Universal) Analytics for web analysis

The processing of personal data is necessary to protect the legitimate interests of the controller. These legitimate interests of the controller generally outweigh the interests of the data subject, because central functions of the website depend on the use of cookies. This also serves the recognition of the browser of the data subject in order to ensure the full functionality of the website for the customer. This ensures the better usability of the website. The cookies on the controller`s website are designed in such a way that the data subject can set via his browser settings whether he accepts cookies or excludes them for certain cases or in general. In this way, the interests of the data subject are protected.

The data subject has the right to object at any time to the processing of his personal data in accordance with Art. 6 para. 1 lit. 1 f) GDPR. Art. 21 DSGVO is expressly referred to.

This website uses Google Analytics, a web analytics service provided by Google, Inc. (“Google”). Google Analytics uses “cookies”, which are text files placed on the users’ computers, to help the website analyze how users use the site. The information generated by the cookie about the use of the website by users will be transmitted to and stored by Google on servers in the United States. The IP-anonymisation is activated on this website and the users’ IP address will be truncated within the area of Member States of the European Union or other parties to the Agreement on the European Economic Area. Only in exceptional cases the whole IP address will be first transferred to a Google server in the USA and truncated there. The IP-address that your browser conveys within the scope of Google Analytics will not be associated with any other data held by Google.

The users can also prevent the collection of data generated by the cookie and data related to their use of the website (including their IP address) as well as the use of such data by Google by downloading and installing the browser plug-in that is available under: http://tools.google.com/dlpage/gaoptout?hl=en.

In case this website is being used via browsers from mobile devices, the users can refuse the use of Google Analytics by clicking on the following link: verhindern. An opt-out cookie is stored on your mobile device. In case the users delete the cookies in this browser, they have to click the link again in order to deactivate Google Analytics.

11. Right to lodge a complaint with a supervisory authority, Art. 77 GDPR

Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.

The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

12. Recht auf Auskunft, Art. 15 DSGVO

The data subject has the right tot he following informations:

  • a) the purposes of the processing
  • b) the categories of personal data concerned
  • c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations
  • d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period
  • e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
  • f) the right to lodge a complaint with a supervisory authority
  • g) where the personal data are not collected from the data subject, any available information as to their source
  • h) the existence of automated decision-making, including profiling, referred to in Art. 22 Abs. 1 and 4 and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Art. 46 relating to the transfer.

We provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, we may charge a reasonable fee based on administrative costs.

13. Right to rectification, Art. 16 GDPR

The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

14. Right to erasure (‘right to be forgotten’), Art. 17 GDPR

The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

  • a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed
  • b) the data subject withdraws consent on which the processing is based according to Art. 6 Abs. 1 lit. a), or Art. 9 Abs. 2 lit. a), and where there is no other legal ground for the processing
  • c) the data subject objects to the processing pursuant to Art. 21 Abs. 1 and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Art. 21 Abs. 2.
  • d) the personal data have been unlawfully processed
  • e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject
  • f) the personal data have been collected in relation to the offer of information society services referred to in Art. 8 Abs. 1 GDPR.

After complete justification of the contract, the personal data will be blocked for further use and deleted after expiry of the storage periods under tax and commercial law, unless the data subject has expressly consented to further use of his data or we reserve the right to use data beyond this which is permitted by law. Please note that these are legally standardized retention periods. Because of the storage and processon oft he data for the execution of the contract, an objection or premature deletion is not possible

15. Right to restriction of processing, Art. 18 GDPR

The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:

  • a) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data
  • b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead
  • c) the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims
  • d) the data subject has objected to processing pursuant to Art. 21 Abs. 1 pending the verification whether the legitimate grounds of the controller override those of the data subject.

16. Notification obligation regarding rectification or erasure of personal data or restriction of processing, Art. 19 GDPR

The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with At. 16. Art. 17 Abs. 1 and Art. 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.

17. Right to data portability, Art. 20 GDPR

The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:

  • the processing is based on consent pursuant to Art. 6 Abs. 1 lit. a) or Art 9 Abs. 2 lit. a) or on a contract pursuant to Art. 6 Abs. 1 lit. b) and
  • the processing is carried out by automated means.

In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.

The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Art. 17. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others.

18. Right to object, Art. 21 GDPR

The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on Art. 6 Abs. 1 lit. e) or f) GDPR, including profiling based on those provisions.

We will no longer process the personal data unless we demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.

Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

19. Automated individual decision-making, including profiling, Art. 22 DSGVO

The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

This shall not apply if the decision:

  • is necessary for entering into, or performance of, a contract between the data subject and a data controller;
  • is necessary for entering into, or performance of, a contract between the data subject and a data controller;
  • is based on the data subjects explicit consent.

Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Art. 9 Abs. 1 GDPR, unless Art. 9 Abs. 2 lit. a) or g) GDPR applies and suitable measures to safeguard the data subjects rights and freedoms and legitimate interests are in place.

In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall implement suitable measures to safeguard the data subjects rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

20. Right to an effective judicial remedy against a controller or processor, Art. 79 GDPR

Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.

Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has his or her habitual residence, unless the controller or processor is a public authority of a Member State acting in the exercise of its public powers.

21. Contact and controller

Walter Wolf, Steffen Walter
Wolf Racing Neuenstein GmbH & Co. KG,
vertreten durch die Geschäftsführer Walter Wolf und Steffen Walter
Max-Eyth Straße 17
74632 Neuenstein
Deutschland

Telefon: 00 49 (0) 79 42/94 46 0 oder 00 49 (0) 79 42/30 01
Fax: 00 49 (0) 79 42/94 46 22 oder 00 49 (0) 79 42/34 16
Website: http://www.wolf-racing.de/
Email: info@wolf-racing.de

June 2018