Privacy notice

1. Privacy at a glance

This notice explains what happens to your personal data when you visit this website and submit a VIN request. Personal data is any data by which you can be personally identified.

2. General information and mandatory disclosures

We treat your personal data confidentially and in accordance with the statutory data protection provisions and this privacy notice.

Controller:
Hirsch Racing
Waldemar Hirsch
Zum Damm 1
88356 Ostrach, Germany
E-mail: support@jlr-activations.eu

3. What we actually store

The following is a factual description of what this application stores. It is deliberately specific; do not change these statements without changing the software.

• VIN request: vehicle identification number, name, e-mail address, country, optionally a phone number and a free-text message.
• Vehicle and offer data: the technical details a member of staff records after the compatibility check, and the package price.
• Your configuration: which of the released factory features you selected, and when.
• Orders and payments: order number, amount, currency, payment status and the identifiers of your payment provider. We never receive or store card details; they are handled entirely by the payment provider.
• Support chat: the messages exchanged in your portal.
• Technical data: server log files and rate limiting counters, used to keep the service available and to prevent abuse.

4. Your personal portal link

Access to your activation portal works through a personal link. We store only a cryptographic hash of that link, never the link itself. Portal pages are excluded from search engines and send no referrer information to other sites. Treat the link like a password and do not share it.

5. Cookies

In its default configuration this website sets only the cookies required for it to work: a session cookie and a cross-site request forgery token. No analytics or marketing cookies are set.

6. Server log files

Our hosting provider automatically collects and stores information in server log files which your browser transmits automatically, such as IP address, browser type and time of access.

7. Recipients

Payment processing is carried out by the payment provider you choose at checkout (Stripe or PayPal). E-mail is delivered through our mail provider, and the application is hosted by our hosting provider.

• Payments: Stripe Payments Europe Ltd., Dublin, Ireland, or PayPal (Europe) S.a.r.l. et Cie, S.C.A., Luxembourg, depending on the method you choose. You enter your payment details directly with the provider; we receive only the payment status and the provider's own references.
• E-mail: our mail provider, used to deliver the confirmation, your activation link and the status notifications.
• Hosting: our hosting provider, on whose servers the application and the database run, located within the European Union.

Where these providers act on our behalf, this is governed by data processing agreements pursuant to Art. 28 GDPR. No data is passed to anyone else, and none is used for advertising.

8. Legal bases and retention

We process your VIN request, your configuration and your order on the basis of Art. 6 (1) (b) GDPR: performance of a contract and steps taken at your request before entering into one. The compatibility check is exactly such a step.

Server log files, rate limiting counters and the security measures around your portal link rest on Art. 6 (1) (f) GDPR, our legitimate interest in operating the service securely and in preventing abuse.

Where you have given consent, for instance by ticking the privacy box on the VIN form, the basis is Art. 6 (1) (a) GDPR. You may withdraw that consent at any time with effect for the future.

How long we keep it

• VIN requests that do not lead to an order: deleted no later than twelve months after the last contact, unless you ask us to delete them sooner.
• Orders, invoices and payment records: retained for the statutory periods under German commercial and tax law, currently up to ten years (section 147 German Fiscal Code, section 257 German Commercial Code). During that period the data is restricted to that purpose.
• Chat messages: kept for the duration of the business relationship and deleted together with the request unless they form part of an order.
• Server log files: deleted after no more than 30 days.

9. Your rights

You have the right at any time to obtain information free of charge about your stored personal data, its origin and recipients and the purpose of the processing, as well as a right to rectification, restriction or erasure of that data. You also have the right to data portability, to object to processing, to withdraw consent you have given, and to lodge a complaint with a supervisory authority.

10. Language

This notice is published in English. Hirsch Racing is established in Germany; where German law prescribes the wording of a statutory notice, the German version governs. We provide the German wording on request.