Privacy Statement

This Privacy Statement explains how personal data is processed when you visit bpa-racing.com, place an order, contact us or use our withdrawal form.

1. Who We Are

BPA-Racing
Paulstr. 11A
31226 Peine
Germany
Email: info@bpa-racing.com

The store is operated under the business name Cutean Trade & Logistics. Full details of the legal operator responsible for processing your personal data are provided in our Imprint. Please use the contact details above for privacy enquiries.

2. Orders, Customer Accounts and Contact

We process the information you provide, including your name, email address, billing and delivery addresses, telephone number where provided, order details and messages. If you create an account, we also process the information needed to manage that account.

We use this information to handle enquiries, fulfil orders, arrange delivery, administer your account and provide support. The legal basis is Article 6(1)(b) GDPR for contractual and pre-contractual matters. For other enquiries, our legitimate interest in responding to your message is the basis under Article 6(1)(f) GDPR.

Delivery administration also involves shipment references, carrier names and delivery status. These records support shipment updates, delivery enquiries and returns. Where needed to document delivery or resolve a payment dispute, relevant shipment information may be supplied to the payment provider. The legal bases are Article 6(1)(b) GDPR for delivery administration and Article 6(1)(f) GDPR for our legitimate interest in documenting delivery and resolving disputes.

When we send service emails, the email delivery provider processes the recipient address, message content and delivery information needed to transmit the message. This includes order confirmations, support replies and withdrawal acknowledgements. The legal basis follows the purpose of the message as described in this statement.

Information marked as required is needed for the relevant service. Without sufficient contact, delivery or payment information, we may be unable to process an order or respond to an enquiry. Optional fields can be left blank.

3. Website Operation and Technical Data

When you access the website, technical information may be processed, including your IP address, browser and device information, requested pages, referring website, and the date and time of access.

This information is used to deliver the website, investigate errors and protect against misuse. Hosting, technical support and content-delivery providers may receive the information necessary to supply their services. Our legitimate interest in operating a reliable, secure website is the basis under Article 6(1)(f) GDPR.

4. Payments

Payments are handled through the providers available at checkout, including WooPayments/Stripe, PayPal and Klarna. The providers involved depend on your chosen payment method.

Information needed to process a payment may include your contact and billing details, payment credentials, order amount, transaction reference, and technical information used for authentication and fraud prevention. We receive payment status and transaction references so that we can manage your order and any refund.

Our store does not store full card numbers or card security codes. Where saving a payment method is available and selected, the payment provider manages the credentials; our store may retain a payment token and limited details such as the card brand and last digits.

Processing necessary for your payment is based on Article 6(1)(b) GDPR. Applicable accounting obligations are addressed under Article 6(1)(c) GDPR. Payment providers also process information for their own legal, security and fraud-prevention purposes. Some payment methods may involve credit assessments or automated eligibility decisions by the provider.

Further information is available in the privacy information of Automattic/Woo, Stripe, PayPal and Klarna.

5. Withdrawal Requests and Returns

When you use our Withdraw from contract form, we process your name, email address, contract identification or order reference, the date and time of submission, and any additional information you provide. Where applicable, we also record the items concerned and the processing status.

The withdrawal system also records your IP address and browser information for security and documentation purposes. These technical records are processed on the basis of our legitimate interest in preventing misuse and maintaining reliable submission records under Article 6(1)(f) GDPR.

We use your withdrawal details to record your declaration, send an email acknowledgement with return instructions, and handle the return and refund. The legal bases are Article 6(1)(c) GDPR for applicable legal obligations, including Section 356a BGB, and Article 6(1)(b) GDPR for handling the contractual relationship.

Additional information is optional. Please do not include sensitive personal information that is unnecessary for your request.

6. News and Offers Sign-Up

If you submit your email address through our News & Offers form, we save your address and the related form submission in our website database using Elementor. This records your request to receive updates and offers from BPA-Racing. The legal basis is your consent under Article 6(1)(a) GDPR.

The current form saves the submission; it does not automatically send a newsletter or an email subscription confirmation.

You can withdraw your consent and request removal from the sign-up list at any time by contacting info@bpa-racing.com. This does not affect order confirmations, withdrawal acknowledgements or other communications needed to handle your purchases.

7. Cookies and Third-Party Features

Cookies and similar technologies support functions such as the shopping basket, account sessions and recording your privacy choices. Storage or access that is strictly necessary for a service you expressly request falls under Section 25(2) TDDDG. The legal basis for the related personal-data processing depends on its purpose, including Article 6(1)(b) or (f) GDPR.

Non-essential storage or access, including optional analytics and advertising technologies, requires your consent under Section 25(1) TDDDG. Where the associated personal-data processing is based on consent, Article 6(1)(a) GDPR applies.

Use the website's Manage consent control to review your choices. You can also remove cookies in your browser, although this may reset your preferences or affect shopping functions.

The website includes third-party integrations with different purposes:

  • WooCommerce/Jetpack: site and store features supplied through Automattic services. Statistics features can process page visits, referring pages, technical information and approximate location derived from an IP address to help us understand website use. Optional statistics processing is based on consent under Article 6(1)(a) GDPR. Other site and store processing depends on the feature and purpose described in this statement. See Automattic's privacy notice for website visitors.
  • Meta/Facebook: marketing integrations can measure visits and shopping events and associate them with advertising activity. Consent is required for optional advertising tracking. See Meta's Privacy Policy.
  • YouTube: playing an embedded video connects your browser to Google's services and may disclose your IP address, device information and video interactions. Consent-based loading of this external content is covered by Article 6(1)(a) GDPR. See Google's Privacy Policy.
  • GTranslate: the language selector provides website translation. Using the translation feature may involve processing your language choice and connection information by the relevant translation services. See GTranslate's Privacy Policy. Any non-essential storage or access requires consent as described above.

8. Who Receives Your Data

Depending on the service used, necessary information may be shared with:

  • Payment providers and banks handling transactions or refunds.
  • Shipping and fulfilment partners handling your delivery or return.
  • Hosting, IT, email and other service providers supporting the website and customer communications.
  • Accounting and professional advisers where needed for their services.
  • Public authorities where disclosure is legally required.
  • Providers of the optional features described above, subject to the applicable legal basis.

Providers may act on our instructions or as independent controllers for their own processing. Their privacy notices explain their responsibilities and how to exercise your rights with them.

9. International Processing

Some providers operate internationally and may process data outside the European Economic Area, including in the United States. The destination and applicable protection depend on the provider and service used.

Such transfers require a valid basis under Chapter V GDPR, such as an applicable European Commission adequacy decision or appropriate safeguards, including standard contractual clauses. The linked provider notices describe their international processing. Contact us for information about the arrangements applicable to your data and how to obtain relevant safeguards.

10. How Long Data Is Kept

Retention depends on why the information is needed:

  • Orders and accounting records: the period needed to fulfil the order and meet the applicable tax and commercial record-keeping obligations.
  • Enquiries, withdrawals and returns: the period needed to resolve the matter and meet applicable documentation duties or establish, exercise or defend legal claims.
  • Technical records: the period needed for operation, troubleshooting and security investigations, taking account of any incident requiring longer retention.
  • News and offers sign-up records: while needed to administer your request to receive updates, subject to withdrawal of consent or erasure rights. Limited records may be retained where needed to document consent or respect a request not to receive marketing.

The 14-day withdrawal period is not a deletion period for withdrawal records. Where data is no longer needed and no legal basis for continued retention applies, it must be deleted or anonymised. Provider-specific retention information is available in the relevant privacy notices.

11. Your Rights

Subject to the applicable GDPR conditions, you can request access to your personal data, correction, erasure, restriction of processing and data portability.

You can object to processing based on legitimate interests for reasons relating to your particular situation. You can object to processing for direct marketing at any time.

You can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Contact info@bpa-racing.com to exercise your rights. Where reasonably necessary, we may request information to verify your identity.

You can also complain to a data protection supervisory authority, particularly in the country of your habitual residence, workplace or the alleged infringement. The authority in Lower Saxony is Der Landesbeauftragte für den Datenschutz Niedersachsen.

12. Data Security

The website uses HTTPS to encrypt data in transit. Technical and organisational safeguards are used to protect personal data against unauthorised access, loss and misuse. No transmission or storage system can guarantee absolute security.

13. Changes to This Statement

We may update this statement when our services, data-processing practices or legal requirements change. The current version is published on this page.

Last updated: 7 September 2026