Privacy policy
VR T-POWER UG (haftungsbeschränkt)
for www.vr-tuning.com and www.vectortuning.com
As of: October 2026
1. Scope
This privacy policy provides information on the nature, scope and purposes of the processing of personal data when using the online services www.vr-tuning.com and www.vectortuning.com operated by VR T-POWER UG (haftungsbeschränkt), including the shop, contact, customer account, dealer and other online functions offered there.
Personal data are processed in accordance with the General Data Protection Regulation (GDPR), the BDSG (German Federal Data Protection Act) and – where applicable – the TDDDG (German Telecommunications Digital Services Data Protection Act).
2. Controller
VR T-POWER UG (haftungsbeschränkt)
Managing Director: Zoran Malnar
Heerstraße 339
13593 Berlin
Germany
Phone: +49 163 7066077
Email: info@vr-tuning.com
Websites: www.vr-tuning.com and www.vectortuning.com
3. Data Protection Officer
Where there is no statutory obligation to designate a data protection officer and no data protection officer has been appointed, enquiries regarding data protection may be addressed directly to the controller named above.
4. General Legal Bases
Depending on the processing operation, we base the processing of personal data in particular on:
Art. 6(1)(a) GDPR – consent;
Art. 6(1)(b) GDPR – performance of a contract and pre-contractual measures;
Art. 6(1)(c) GDPR – compliance with legal obligations;
Art. 6(1)(f) GDPR – pursuit of legitimate interests, unless such interests are overridden by the interests or fundamental rights of the data subject.
Where information is stored in terminal equipment or information already stored there is accessed, Section 25 TDDDG additionally applies. Cookies and similar technologies that are not technically necessary are, as a rule, used only with prior consent.
5. Hosting with Shopify
Our website and our online shop are operated and hosted on the e-commerce platform Shopify. Shopify provides the server infrastructure, the content delivery network (CDN) and the shop, shopping cart and checkout systems. Information on the provider, on data processing on our behalf and on data transfers outside the European Economic Area can be found in section 11a; the technical data collected when the website is accessed are described in section 6.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and fault-free provision of our online services. Where the processing serves the execution of orders, Art. 6(1)(b) GDPR is an additional legal basis.
6. Server Log Files
When our websites are accessed, technical information is automatically collected by Shopify's servers. This may include:
IP address
date and time of access
URL or file accessed
referrer URL
browser type and browser version
operating system
HTTP status code
volume of data transferred
The processing serves in particular system security, error analysis, the detection of misuse and attacks, and the technical provision of the website. The legal basis is Art. 6(1)(f) GDPR.
7. SSL/TLS Encryption and Data Security
Our websites use SSL or TLS encryption to protect transmitted content. In addition, we take appropriate technical and organisational measures in accordance with the statutory requirements to protect personal data against loss, manipulation, unauthorised access and other risks.
8. Cookies and Consent Management
Our websites use cookies and similar technologies. Strictly necessary technologies may be used without consent, provided that the statutory requirements are met. For analytics, marketing or similar non-essential technologies, we generally obtain consent before they are used.
For technologies requiring consent, the legal basis for storing information in, or accessing information from, the terminal equipment is Section 25(1) TDDDG; the subsequent processing of personal data is, as a rule, based on Art. 6(1)(a) GDPR.
Consent may be withdrawn or modified at any time with effect for the future via the cookie/privacy settings provided on the respective website.
To manage consent, we use Shopify's consent management tool (cookie banner). Your choice is stored in a technically necessary cookie so that it can be taken into account on subsequent visits. You can change your settings at any time via the "Cookie settings" link in the footer of the website.
9. Contacting Us
If you contact us via the contact form, by email or by telephone, we process the information provided in order to handle your enquiry. This may include in particular your name, company, contact details, the content of your message and any attachments you voluntarily provide.
Where the enquiry relates to a contract or pre-contractual measures, the processing is based on Art. 6(1)(b) GDPR. Otherwise, Art. 6(1)(f) GDPR may serve as the legal basis; our legitimate interest lies in the proper handling and documentation of business communications.
10. Customer Account
Where customer accounts are offered on our websites, we process the data required for registration, login and account management. This may include in particular name, email address, billing and delivery address, telephone number, order history and login credentials.
Where the processing is necessary for the performance of a contract or for pre-contractual measures, it is based on Art. 6(1)(b) GDPR. Statutory retention obligations remain unaffected even after a customer account has been deleted.
11. Orders and Shop System (Shopify)
Our online shop is operated using the e-commerce platform Shopify (see sections 5 and 11a). In connection with an order, we process the data required for ordering, payment, delivery, invoicing and customer service.
Name and contact details
Billing and delivery address
Order and product data
Payment method and payment status
Shipping and delivery information
Where applicable, customer account and technical transaction data
The legal basis is Art. 6(1)(b) GDPR. Data required under tax and commercial law are additionally processed on the basis of Art. 6(1)(c) GDPR.
11a. Shopify
We use the e-commerce platform Shopify to operate and host our online shop. For merchants in Europe, the primary Shopify contracting party is, as a rule, Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland.
Shopify provides the technical shop infrastructure and, in this context, processes personal data required for accessing and operating the shop as well as for orders, customer accounts, shopping cart and checkout functions, fraud and security prevention and technical administration. This may include in particular name, address, email address, telephone number, IP address, device and browser information, order, product, payment and delivery information, and technical usage and log data.
Where Shopify processes personal data on our behalf, it does so under the data processing agreements in place with Shopify. For certain Shopify consumer services – such as Shop or Shop Pay – Shopify may also process personal data as an independent controller. Whether such services are used depends on the specific configuration of our shop.
The processing of data required for the execution of orders and the provision of contractual shop functions is, as a rule, based on Art. 6(1)(b) GDPR. Where the processing is necessary for the secure and functional provision of the shop, it may additionally be based on Art. 6(1)(f) GDPR. Analytics, marketing or tracking functions requiring consent are, as a rule, used only with prior consent.
Shopify International Limited may engage affiliated companies and sub-processors to provide the platform services. In doing so, personal data may also be processed outside the European Economic Area, in particular in Canada and – depending on the sub-processors engaged – in other countries. According to Shopify, it bases international data transfers in particular on adequacy decisions and, where necessary, on standard contractual clauses of the European Commission.
According to Shopify, new Shopify merchants in Europe generally use an infrastructure in which certain shop, order and customer data are stored at rest in Europe. Irrespective of this, international data transfers may take place in order to provide the Shopify services.
Further information on the processing of personal data by Shopify can be found in Shopify's privacy policy.
12. Dealer Enquiries and Dealer Registration
In connection with dealer enquiries or dealer registration, the data processed may include in particular company name, legal form, contact person, address, contact details, VAT identification number, commercial register or trade licence documentation and further information evidencing business (trader) status.
The processing serves the assessment, initiation and conduct of a business relationship and is based on Art. 6(1)(b) GDPR and – where necessary – Art. 6(1)(f) GDPR.
13. Payment Processing
For payment processing, we may use external payment service providers, depending on the payment methods actually offered in the respective checkout. In this case, the data required for the selected payment method are transmitted to the respective provider.
Possible payment methods may include in particular PayPal, Klarna, credit card, Apple Pay, Google Pay, SEPA direct debit or bank transfer.
Processing for payment purposes is, as a rule, based on Art. 6(1)(b) GDPR. Where a payment provider processes data for its own purposes, it is an independent controller for that processing.
14. Shipping Service Providers
For the performance of the contract, we transmit the data required for delivery to the shipping or logistics service provider engaged in each case. This may include in particular name, delivery address and – where necessary for delivery – contact details.
Depending on the order, DHL, DPD, GLS, UPS or other national or international shipping service providers may be used, for example. The legal basis is Art. 6(1)(b) GDPR.
15. Invoicing, Accounting and Statutory Retention
We process invoicing, payment and accounting data to comply with obligations under commercial and tax law. The legal basis is Art. 6(1)(c) GDPR.
Personal data are, as a rule, stored only for as long as is necessary for the respective purpose. Where statutory retention periods apply, the relevant documents are retained for the period prescribed by law in each case and subsequently deleted, unless there is a further legal basis for their storage.
16. Google Analytics 4
Where activated on the respective website and where corresponding consent has been given, Google Analytics 4 may be used for audience measurement and analysis of user behaviour. For users in the European Economic Area, the provider is usually Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
In this context, the data processed may include in particular device and browser information, interactions with the website, approximate location information, referrer information, event and conversion data, and technical identifiers.
It is used only with consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG, where information is stored in or accessed from the end device.
17. Google Tag Manager
Where used, we employ Google Tag Manager to manage website tags. Tag Manager may process technical data and trigger other services. Services requiring consent may only be activated via Tag Manager once the corresponding consent has been given.
18. Google Ads and Conversion Measurement
Where activated and consented to, Google Ads conversion tracking and, where applicable, remarketing functions may be used to measure the success of advertising measures and to manage the delivery of advertising.
The legal basis is consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG, where the end device is accessed or information is stored on it.
19. Meta Pixel and Meta Advertising Services
Where activated and consented to, the Meta Pixel of Meta Platforms Ireland Limited may be used to measure the effectiveness of advertisements on Facebook and Instagram and to create target audiences for advertising measures.
In this context, the data processed may include in particular page views, interactions, device and browser information, IP address, timestamps, and conversion and order data.
The legal basis is consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG, where applicable.
20. YouTube
Where YouTube videos are embedded on our websites, data may be transmitted to Google/YouTube when a video is loaded or played. External media should – where consent is required – only be loaded once the corresponding consent has been given.
Where technically possible, the privacy-enhanced mode may be used.
21. Google Maps
Where Google Maps is embedded, a connection to Google may be established when the map is loaded, and in particular IP address, device and location information may be processed. Any embedding that requires consent takes place only once the corresponding consent has been given.
22. Newsletter
Where a newsletter is offered, we process the data required for this purpose, in particular the email address and, where applicable, the name, as well as technical records of the subscription and consent.
Promotional newsletters are, as a rule, sent on the basis of consent pursuant to Art. 6(1)(a) GDPR, unless another statutory legal basis applies. Consent given may be withdrawn at any time with effect for the future.
23. Social Media Presences
We maintain company presences on social networks, in particular Facebook, Instagram, YouTube, LinkedIn and TikTok.
When you visit our profiles, the respective platform operators process personal data in accordance with their own privacy policies. Depending on the platform and function, joint controllership may exist for certain statistical or interaction data.
Simple links from our websites to social media profiles generally only transmit data to the respective platform once the link is actively clicked, provided that no additional social plugins or embedded content are used.
24. Recipients and Processors
Where necessary for the respective purpose, personal data may be transmitted in particular to hosting and IT service providers, payment service providers, shipping and logistics companies, tax advisers, banks, legal advisers, public authorities or other recipients.
Service providers that process personal data exclusively on our behalf are engaged in accordance with Art. 28 GDPR, where the statutory requirements are met.
25. Transfers to Third Countries
When international service providers are used, personal data may be processed outside the European Union or the European Economic Area.
Any such transfer takes place only in compliance with the requirements of Art. 44 et seq. GDPR. Depending on the recipient, it may be based in particular on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for appropriately certified US companies, or on appropriate safeguards such as the standard contractual clauses of the European Commission.
Which transfer mechanism applies in a specific case must be assessed separately for each service actually used.
26. Storage Period
Unless a more specific storage period is stated in this privacy policy, we store personal data only for as long as is necessary for the respective processing purpose. The data are then deleted or anonymised, unless statutory retention obligations, legal claims or other statutory grounds require further storage.
27. Rights of Data Subjects
Subject to the statutory requirements, data subjects have in particular the following rights:
access pursuant to Art. 15 GDPR;
rectification pursuant to Art. 16 GDPR;
erasure pursuant to Art. 17 GDPR;
restriction of processing pursuant to Art. 18 GDPR;
data portability pursuant to Art. 20 GDPR;
objection to certain processing pursuant to Art. 21 GDPR;
withdrawal of consent given, at any time with effect for the future.
To exercise your rights, you can use the contact details provided in section 2.
28. Objection to Direct Marketing
Where personal data are processed for direct marketing purposes, data subjects have the right to object at any time to the processing of personal data concerning them for the purpose of such marketing. Following such an objection, the personal data will no longer be processed for these purposes.
29. Right to Lodge a Complaint with a Supervisory Authority
Pursuant to Art. 77 GDPR, data subjects have the right to lodge a complaint with a data protection supervisory authority.
The following supervisory authority is of particular relevance to our company:
Berlin Commissioner for Data Protection and Freedom of Information
Alt-Moabit 59-61
10555 Berlin
Germany
Phone: +49 30 13889-0
Email: mailbox@datenschutz-berlin.de
30. No Solely Automated Decision-Making
Unless expressly stated otherwise in an individual case, we do not use any decision-making based solely on automated processing, including profiling, which produces legal effects concerning data subjects or similarly significantly affects them.
31. Changes to This Privacy Policy
We may amend this privacy policy if our data processing operations, the services we use or the legal requirements change. The version currently published on our websites shall apply.