Your data. Clear terms.

Your email is used for sign-in codes and order updates. We store VIN, country provided during payment or equipment selection, language, timezone, phone number, Stripe payment identifiers and status, appointment details, consent records and change history. We do not store card numbers or CVCs. The data required by the form, including your phone number, is necessary to conclude and perform the contract; we use your phone number to contact you about the installation. Your country helps us select equipment information. If you leave a review, we also store the review data described in the section on reviews.

Orders, accounts, payment and scheduling are processed to perform a contract or take steps before it (GDPR Article 6(1)(b)). Tax and accounting duties rely on legal obligations (c). Security, abuse prevention and legal claims rely on legitimate interests (f). We do not use order data for marketing or automated profiling. Review-request emails, publishing reviews and using customer videos rely on your consent (Article 6(1)(a)), which you can withdraw at any time.

Stripe processes payments, Resend delivers transactional emails, and AnyDesk provides the remote session you approve. Discord provides private operator notifications containing the order reference, VIN and status. WhatsApp communication is also governed by its own policies. Infrastructure and accounting providers receive information necessary for their roles. We do not sell personal data. You open external equipment shop links yourself; we do not send those shops your VIN or account data. Discord Inc. (USA) also receives reviews and approved videos that you agreed to publish and shows them on our public Discord channel.

Providers may process data outside the EEA with safeguards appropriate to the provider, including standard contractual clauses and applicable adequacy decisions. See their privacy policies for details. We retain order records for fulfilment, required accounting periods and the period needed for claims. Sign-in codes expire after 10 minutes; expired codes and sessions are removed from the service database by a housekeeping task. Published reviews and approved videos are transferred to Discord Inc. in the USA. Customer videos are stored on our server in the EU until the licence is terminated or you ask us to delete them.

You may request access, correction, erasure, restriction and portability, and object where we rely on legitimate interests. You may complain to a data protection authority, including Poland’s UODO. Email the controller to exercise your rights. Erasure does not cover data we are legally required to keep.

The necessary bs_store_session cookie keeps you signed in for up to seven days. It is inaccessible to JavaScript and only sent to the store API. This version of the website uses no advertising cookies or tracking pixels. Signing out deletes the session.

If you allow marketing cookies, we use Meta Pixel and Conversions API to measure page views, product views, WhatsApp clicks, checkout, purchases and appointment bookings. Meta may receive cookie and click identifiers, IP address, browser information, page path, event time, purchase amount and hashed email address and phone number. Hashing does not make these data anonymous. We do not send your VIN or remote access code. Your choice is stored for 180 days and can be changed under Cookie settings in the footer. Withdrawing consent stops future events and cancels pending delivery. Unsent event payloads expire after 36 hours; delivery records are kept for 30 days. Meta processes received data under its privacy policy, which also describes international transfers. Google Ads also measures WhatsApp clicks and paid purchases. It receives advertising identifiers, browser data and an opaque transaction ID with the purchase amount and currency. This integration does not send VINs, contact details or remote-access codes to Google.

Review requests: if you tick the optional box at checkout, we use your email and order details to send at most 2 messages asking for a review after the installation, a request and one reminder. The legal basis is your consent (GDPR Article 6(1)(a)). Every such email has a one-click opt-out, and you can also withdraw consent by email. The completion email that every customer receives contains a short rating link. Reviews: we store your rating, comment, display name, car, country, installation date and the text and version of your consents, linked to your order. Without publication consent, your review stays private. With consent, we publish the rating, comment, display name, car, country and installation date on our Discord channel and website (Article 6(1)(a)). You can withdraw this consent at any time, and we then remove the published review. We keep reviews while they are published and for as long as needed to document consent and handle claims. Videos: videos you send, including your image if you appear, are stored on our server in the EU until the licence is terminated or you ask us to delete them. An approved, shortened copy may be published on Discord and in the places named in the licence. Recipient outside the EEA: published reviews and approved videos are sent to Discord Inc. (USA), which makes them publicly visible on Discord. This is a transfer outside the EEA. Discord Inc. participates in the EU-U.S. Data Privacy Framework, covered by the European Commission’s adequacy decision of 10 July 2023, and also uses standard contractual clauses. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

Stripe · Resend · Discord · AnyDesk · WhatsApp · Meta · Google · UODO

contact@bimmerstart.com