Privacy Policy

1. Controller

KTH Parts GmbH
Am Tönniesberg 16, 30453 Hannover, Germany
Managing Director: Sascha Schöning
Phone: +49 (0)511 56968381 · E-mail: info@black-boost.eu

This privacy policy applies to the KTH online shop and the online shop “BlackBoost Europe”, both operated by KTH Parts GmbH.

2. Hosting and server log files

Our online shops are operated on our own servers in data centres within the European Union (infrastructure: netcup GmbH, Karlsruhe, Germany, under a data processing agreement). When the pages are accessed, the web server automatically processes technical access data (IP address, date and time, page accessed, browser type) insofar as this is necessary to deliver the pages and to ensure stability and security (Art. 6(1)(f) GDPR). Log data is not merged with other data sources. Web server access logs are deleted after 14 days at the latest, error and system logs after 90 days at the latest. Login attempts to the customer account and the admin area (e-mail address, IP address, browser identifier, time) are stored for 90 days to prevent misuse.

For backup purposes, a nightly backup copy of the server including the shop database is stored on Google Drive (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The backup is encrypted on our server before transfer; Google receives no key and cannot read the contents. Backups are deleted after 7 days. The legal basis is our legitimate interest in being able to restore data and our obligation to ensure data security (Art. 6(1)(f), Art. 32 GDPR); a data processing agreement with Google is in place (Art. 28 GDPR). A transfer to the USA cannot be ruled out; Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR), and EU standard contractual clauses apply in addition.

3. Cookies and local storage

We use only technically necessary cookies and comparable storage technologies (Section 25(2) TDDDG, Art. 6(1)(b) and (f) GDPR): session/login cookies for the customer account and the admin area, local storage of the shopping cart and wishlist in your browser, storage of your cookie settings and of your language and price-country selection. We do not use any analytics, statistics or marketing tools. The only content requiring consent is external media (YouTube videos, see section 12); they are only loaded after your consent via the cookie banner or a click on “Load video” (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change or withdraw your selection at any time via “Cookie settings” in the footer.

4. Location-based price display (geolocation)

To display the value added tax expected to apply in your country, we assign your IP address to a country when the page is accessed. This assignment takes place exclusively locally on our server using an offline database; your IP address is not transmitted to third parties for this purpose and is not stored (Art. 6(1)(f) GDPR — interest in transparent price presentation). You can change the display country manually in the footer at any time; the selection is stored in a cookie.

5. Customer account, orders and invoicing data

For orders and the use of the customer account, we process the data you provide (name, address, e-mail address, telephone number, VAT ID where applicable, order and payment data) for the performance of the contract (Art. 6(1)(b) GDPR). Passwords are stored exclusively in encrypted (hashed) form; stored payment configuration data is kept encrypted. To calculate shipping costs, the destination country, postcode, city and state (if any) are transmitted to our server while you enter them. We retain invoices and accounting vouchers for eight years (Section 147(1) no. 4, (3) AO, Section 14b UStG), commercial letters for six years (Section 257 HGB) and records of supplies under the One-Stop-Shop scheme for ten years (Art. 63c VAT Implementing Regulation 282/2011, Section 22 UStG), in each case from the end of the calendar year (Art. 6(1)(c) GDPR). If you delete your customer account, the account, address book, cart and wishlist are deleted immediately; order and invoice data are restricted until these periods expire (Art. 17(3)(b), Art. 18 GDPR) and then anonymised automatically. Details of a withdrawal declared via the withdrawal function (name, contract details, e-mail address for the acknowledgement, time of receipt) are stored as proof for three years (Art. 6(1)(c) and (f) GDPR).

6. Payment service providers

Payments by credit card, Apple Pay, Google Pay, PayPal, Klarna, Amazon Pay, Revolut Pay and bank transfer are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. For this purpose we transmit the order number, amount, e-mail address and – for bank transfers – your name; you enter the payment data itself directly on Stripe’s payment page (Art. 6(1)(b) GDPR). For bank transfers, Stripe creates a customer record with a personal IBAN through which your payment is assigned automatically. Stripe also processes data for fraud prevention and in the USA; the transfer is based on the EU-US Data Privacy Framework or standard contractual clauses (Art. 45, 46 GDPR).

For fraud prevention, Stripe uses its “Stripe Radar” service on the payment page to analyse device and connection data (e.g. IP address, browser and device information) and payment data and to assess the fraud risk of a payment. If the risk is high, Stripe may decline a payment; you can then choose another payment method or contact us. The legal basis is our and Stripe’s legitimate interest in protection against payment fraud (Art. 6(1)(f) GDPR).

Depending on the payment method chosen, the respective provider additionally receives the data required for the payment as an independent controller: PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg); Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden – for pay later and instalments Klarna may check your identity and creditworthiness in accordance with its own privacy policy; Amazon Payments Europe S.C.A. (Luxembourg); Revolut Bank UAB (Lithuania). For prepayment we only receive the transfer data from our bank; for purchase on account we process the invoice data ourselves.

6a. Verification of VAT IDs (VIES)

If business customers from another EU member state provide a VAT ID, we verify its validity via the VAT Information Exchange System (VIES) of the European Commission before accepting a tax-exempt intra-Community supply. Only the VAT ID is transmitted; we store the result as proof (Art. 6(1)(c) GDPR in conjunction with Section 6a UStG, Section 17d UStDV).

7. Shipping service providers, shipping costs and customs

For delivery, we transmit your name, delivery address, company (if any) and – where required for delivery or customs clearance – telephone number and e-mail address to the shipping company commissioned, in particular Deutsche Post / DHL Paket GmbH (Bonn, Germany) and United Parcel Service Deutschland S.à r.l. & Co. OHG (Neuss, Germany) (Art. 6(1)(b) GDPR). To calculate shipping costs, we transmit the destination country, postcode, city and parcel data (without your name) to the UPS rating interface during the ordering process.

For deliveries outside the EU, the description of goods, value, customs tariff number and country of origin are additionally transmitted to the shipping company and the customs authorities of the country of destination. For countries without an adequacy decision of the European Commission, the transfer takes place because it is necessary for the performance of the contract concluded with you (Art. 49(1)(b) GDPR); a level of data protection comparable to the EU may not exist there.

8. Shipment tracking (17TRACK)

For shipment tracking in our shops, we register the tracking number of your delivery with the service 17TRACK (17TRACK Technology Limited, Hong Kong). Only the tracking number and our internal order number as a reference are transmitted — not your name, address or contact details. The legal basis is our legitimate interest in convenient shipment tracking (Art. 6(1)(f) GDPR). As the provider is located in a third country without an adequacy decision, we limit the transmission to this pseudonymous shipping data.

9. E-mail communication and newsletter

We send e-mails for the performance of the contract (acknowledgement of order receipt, order, payment and shipping confirmations, payment reminders, acknowledgement of a withdrawal) on the basis of Art. 6(1)(b) and (c) GDPR. Our mailboxes and e-mail delivery are hosted by ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, under a data processing agreement (Art. 28 GDPR); the servers are located in Germany.

Only with your express consent (Art. 6(1)(a) GDPR, Section 7(2) no. 2 UWG) do we send a one-time request to review the purchased items after delivery (optional checkbox at checkout), reminders about items left in your cart (setting in your customer account) and our newsletter with offers and product news (sign-up in the footer, double opt-in: you only receive it after confirming the link we send you). For the sign-up we store your e-mail address, the time of sign-up and confirmation and, as proof of consent, a hashed (non-readable) form of your IP address and browser. We do not track whether you open the newsletter or click on links. Unconfirmed sign-ups are deleted after 30 days; after you unsubscribe we keep your e-mail address and the proof of consent for up to three years to defend against claims (Art. 6(1)(f) GDPR). Each of these e-mails contains an unsubscribe link; you can also withdraw your consent at any time by e-mail, and the cart reminder also in your customer account.

For deliveries outside Germany we store a proof of delivery after the parcel has been delivered (tracking number, tracking log with time and place of delivery, delivery address and, where available, a capture of the carrier’s public tracking page). It serves as evidence for tax obligations and the defence of claims (Art. 6(1)(c) and (f) GDPR in conjunction with Section 147 AO, Section 17b UStDV) and is deleted when the retention period expires.

10. Contact form and product reviews

For enquiries via the contact form, we process your details in order to handle the enquiry (Art. 6(1)(b) or (f) GDPR). Product reviews can be submitted by anyone; they are checked by us before publication (moderation), a purchase is not verified. The review text, star rating and the display name you provide are published (Art. 6(1)(a) GDPR).

B2B application: If you apply for a business account (application form, in your account or when registering as a business), we process the company, contact person, contact and address details and the VAT ID to review the application (Art. 6(1)(b) GDPR). We check the VAT ID together with the company name and address via the VAT Information Exchange System (VIES) of the European Commission, which queries the competent tax administration; we keep the result as evidence (Art. 6(1)(c) GDPR in conjunction with Section 18e of the German VAT Act). Rejected applications are deleted six months after the decision.

11. Your rights

You have the right vis-à-vis us to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21, see below). You may withdraw any consent given at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority; the authority responsible for us is the Landesbeauftragte für den Datenschutz Niedersachsen (State Commissioner for Data Protection of Lower Saxony), Prinzenstraße 5, 30159 Hannover, Germany.

Right to object (Art. 21 GDPR): Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR, e.g. server log files, geolocation, shipment tracking, fraud prevention), you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds which override your interests, or the processing serves the establishment, exercise or defence of legal claims. An informal message to info@black-boost.eu is sufficient.

12. External media: videos (YouTube)

Individual product descriptions contain videos (e.g. sound samples). They are only loaded when you click “Load video” or have allowed “External media” in the cookie banner; before that, no connection to Google is established. We embed the videos via the domain youtube-nocookie.com of Google Ireland Limited. When loading, your IP address is transmitted to Google, including to the USA; if you start the video, Google processes further data in accordance with its own privacy policy. The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can withdraw at any time via “Cookie settings”. The transfer to the USA is based on the EU-US Data Privacy Framework (Art. 45 GDPR).

13. Automated decision-making, changes

We do not make any automated decisions, including profiling, ourselves. For Stripe’s fraud check and Klarna’s identity and credit check, see section 6. We will amend this privacy policy as soon as the processing changes (e.g. when new services are introduced); the version published here at any given time applies.