Cookies

We, Carrera Toys GmbH (“Carrera/we”), are pleased about your visit to our website. In the following provisions we inform you about the type, scope and purpose of the collection and use of your personal data on this website and within the framework of the services we offer.

Personal data is any information relating to an identified or identifiable natural person. This includes in particular your name, your address and your email address.

Please read the privacy policy carefully before using this website. We reserve the right to adapt parts of this data protection declaration at our own discretion and as required by law. Please check this data protection declaration regularly for changes.

1. Data processing to enable website use

Every time the content of our website is accessed, connection data is transmitted to our web server. This connection data includes:

the IP address (Internet Protocol address) of the respective user,
the date and time of the request,
the referrer URL,
Device numbers such as UDID (Unique Device Identifier) and comparable device numbers, device information (e.g. device type) as well
the browser type/version.

This connection data is not used to identify the user or combined with data from other data sources, but is used to provide the website. The legal basis for the processing of your data is Article 6 Paragraph 1 Sentence 1 Letter f GDPR. After 7 days at the latest, the data will be anonymized by shortening the IP address at the domain level.

2. Data processing on request

It is generally possible to use our website without providing any personal data. You are neither obliged to access this website nor to provide any personal data. However, the provision of personal data is required, for example, to receive newsletters or when registering. If you do not provide us with personal data for the purposes listed below, you may not be able to use the functionalities of this website or individual services.

2.1. Dealer service “B2B portal”

If you register with us as a dealer and use the dealer service or the B2B portal on our website, we will process your information for this purpose. Details about the B2B portal can be found in the instructions in our portal at https://b2b.carrera-revell.com.

Your personal data is processed on the basis of Article 6 Paragraph 1 Sentence 1 Letter b GDPR.

2.2. newsletter

If you have expressly consented, you will receive our newsletter. To receive our newsletter, it is sufficient to provide your email address. Entering any additional information about yourself is voluntary, marked accordingly (*) and only serves to personalize the newsletter for you.

To register for our newsletter, we use the so-called double opt-in procedure. This means that after you register, we will send you an email to the email address you provided, in which we will ask you to confirm that you would like to receive the newsletter. If you do not confirm your registration within 24 hours, your information will be blocked and automatically deleted after one month.

The processing of your personal data is based on your consent in accordance with Article 6 Paragraph 1 Sentence 1 Letter a GDPR. There is no legal or contractual obligation to provide personal data. Failure to consent will only result in you not receiving an email newsletter. You can revoke your consent at any time with future effect. The revocation of consent does not affect the lawfulness of the processing carried out based on the consent before its revocation. There is a link at the end of each newsletter to exercise your revocation. Alternatively, you can revoke your consent at any time, for example by sending an email to shop@carrera-revell.com.

When you register for a newsletter, we also store your IP address and the time of registration in order to be able to fulfill our legal documentation obligations. The legal basis for data processing in this case is Article 6 Paragraph 1 Sentence 1 Letter c GDPR.

2.3. Registration as a customer

If you would like to register with us as a customer, we will collect the required mandatory information from you (name, country, email address, password), which is marked accordingly (*). Entering any additional information about yourself is voluntary.

Registration is not necessary, but it will make the ordering process easier for future orders because you can reuse the data you have already saved. Alternatively, you can also place an order as a guest. In this case, we collect the same data from you as when you registered, with the exception of a password. However, this data is not stored in a customer account for you, so you do not have access to a customer account.

After registering, you log in by entering your email address and password. Please always ensure that you log out before leaving the website.

When using a password, please take appropriate security measures. A password should be at least 8 characters long and, if possible, always consist of a combination of upper and lower case letters, numbers and special characters. In this respect, trivial passwords such as “ABC” or keyboard sequences (e.g. “qwert” or “asdfgh”), all kinds of names (e.g. of friends, acquaintances, colleagues, family members, pets), city and building names, cartoon characters, car brands, license plates, terms, dates of birth, telephone numbers, common abbreviations, etc. are problematic.

The processing of your personal data is based on your consent in accordance with Article 6 Paragraph 1 Sentence 1 Letter a GDPR. Please note that in the event of cancellation, any bonus points you may have collected will be lost without replacement.

In addition, as part of the registration process, we store your IP address and the time of registration. This is necessary to ensure the security of our information technology systems. The legal basis for the processing of your data in this case is Article 6 Paragraph 1 Sentence 1 Letter f GDPR.

2.4. Login

If you are registered as a customer, you have access to your customer account via the login function on this website. You log in by entering your email address and password.

Login details must be kept strictly secret. If the data has nevertheless been passed on, for example to enable third parties to access certain data sets in an emergency, the password must be changed immediately. For your own protection, it is prohibited to reuse passwords that have already been used.

In addition, when you log in, we store your IP address and the time of access. This is necessary to ensure the security of our information technology systems.

We also set a session cookie with every login. This session cookie prevents automatic logout during active use of the account or associated services. After you log out, the session cookie is automatically deleted within a few minutes.

The legal basis for the processing of your data is Article 6 Paragraph 1 Sentence 1 Letter f GDPR and, if your contractual relationship is affected, Article 6 Paragraph 1 Clause 1 Letter b and/or f GDPR.

2.5. Wishlist

If you are registered as a customer (see Section 2.4 f.), you can add individual products from the shop to your wish list. Until you unsubscribe, you can access this wish list and see all the products you have added. The legal basis for the processing of your data in this case is Article 6 Paragraph 1 Sentence 1 Letter f GDPR. When you unsubscribe as a customer, the wish list will be automatically deleted.

2.6. Order in the shop

If you place an order with us, we will process the following data about you:

Registration data from the customer account or your guest data,
Purchasing data (order/shopping cart),
Payment data (payment method, account and credit card details, billing addresses)

Your personal data is processed on the basis of Article 6 Paragraph 1 Sentence 1 Letter b GDPR.

2.7. Competitions

If you would like to take part in a competition offered by us via the website, you must first create an account. Providing your data is necessary for the purpose of running the competition. After the competition has ended, this data or the account will be deleted unless there are legal retention requirements.

The processing of your personal data is based on your consent in accordance with Article 6 Paragraph 1 Sentence 1 Letter a GDPR. There is no legal or contractual obligation to provide personal data. Failure to consent will only result in you not being able to take part in the competition. You can revoke your consent at any time with future effect. The revocation of consent does not affect the lawfulness of the processing carried out based on the consent before its revocation.

3. Data processing for needs-based design of the website and tracking

To make your use of our website as pleasant as possible, we use so-called web tracking systems. Cookies are usually used for this purpose, i.e. small text files that are sent to your browser from a web server and stored on your computer's hard drive. This enables us to recognize the device you use when using our shop. In this way it is possible for us, for example, to determine whether you are logged in, have an active shopping cart and what contents the shopping cart has. The session cookies used to use the shop are deleted after the end of the browser session. Other cookies remain on your device and enable us to recognize your device on your next visit.

Most browsers are set to automatically accept cookies. You can deactivate the storage of cookies in your browser and have the option of deleting them from your hard drive at any time. However, you can also only prevent the setting of certain cookies via your browser (e.g. third-party cookies), for example if you want to prevent web tracking. You can find further information about this in the help function of your browser.

We would also like to point out that you can also install a plugin in your browser to protect your privacy, which offers the option of preventing tracking - e.g. AdBlock, Ghostery or NoScript (please note the data protection information of the respective plugin provider).

Finally, we would like to point out that if cookies are deactivated, not all functions of this website may be able to be used to their full extent. Please also note that deactivation may have to be done for each browser and for each device.

Details about the cookies used on the website can be found in the cookie banner and in the following provisions. The legal basis for the processing of your data follows, insofar as the following provisions in section 4.1. ff. not shown differently, from Art. 6 Paragraph 1 Sentence 1 Letter f GDPR. Our legitimate interest lies in the needs-based design of the website.

3.1. Cookie consent with Cookiebot

In order to be able to administer your consent to the use of tracking tools, we use the cookie consent technology “Cookiebot”. The provider of this technology is Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark, website: https://www.cookiebot.com/de/ (“Usercentrics”). In this context, in addition to the connection data, the granting or rejection of your consent or the revocation of consent are transmitted to Usercentrics. In order to be able to make the appropriate assignment, Usercentrics also sets a cookie in your browser.

Cookiebot is used to obtain the legally required consent for the use of cookies. The legal basis for this is Article 6 Paragraph 1 Sentence 1 Letter c GDPR.

3.2. Google Analytics Universal

Our website uses the tracking tool “Google Analytics”. This is a service provided by Google Ireland Limited, a company incorporated and operating under the laws of Ireland with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). This tracking tool helps us to make the website more interesting for you and to improve the user experience. Data about the use of our website is stored in pseudonymous user profiles. Cookies can also be used for this purpose. In addition, data from different devices, sessions and interactions can be linked to a so-called “User ID”. The information generated is usually transferred to a Google server in the USA and stored there. We would like to point out that Google Analytics has been expanded to include the “anonymizeIp” function on our website. As a result, your IP address will first be shortened by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area and only then transmitted to a Google server in the USA.

Shortening the IP address represents an additional measure in accordance with Article 25 Para. 1 GDPR to protect users, but it does not mean that the complete data processing is carried out anonymously. When using Google Analytics, in addition to the IP address, other usage data is also collected that is to be assessed as personal data, such as identification characteristics of individual users, which also allow a link to an existing Google account, for example.

On our behalf, Google will use the information received to evaluate your use of our website, to compile reports on website activity and to provide us with other services relating to website activity and internet usage. The pseudonymized usage profiles will not be combined with personal data about the bearer of the pseudonym without a separate consent.

For more information about Google Analytics, see:

https://support.google.com/analytics/answer/2790010?hl=de

Please note that Google also has independent access to your data collected via Google Analytics and can also use this data for its own purposes. This allows Google to link this data with other data about you, such as search history, personal account, usage data from other devices and any other data that Google has about you.

The legal basis for the use of Google Analytics is your consent, based on Section 25 Paragraph 1 Sentence 1 TTDSG for the storage and access to information in end devices and Art. 6 Paragraph 1 Sentence 1 lit. a GDPR for our further processing of your data. You give your corresponding consent via our cookie banner. Please note that Google is a US company. According to a recent ruling by the European Court of Justice (ECJ), there is no adequate level of data protection in the USA and therefore a risk to the protection of your data. For example, under certain conditions, your data can be processed by US authorities for control and monitoring purposes. The new EU standard data protection clauses were agreed upon as suitable safeguards to ensure an adequate level of protection during data transfer.

3.3. Google Analytics 4

Our website uses the tracking tool “Google Analytics”. This is a service provided by Google Ireland Limited, a company incorporated and operated under Irish law with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter “Google”). This tracking tool helps us to make the website more interesting for you and to improve the user experience. Data about the use of our website is stored in pseudonymous user profiles. Cookies can also be used for this purpose. In addition, data from different devices, sessions and interactions can be linked to a so-called “User ID”. The information generated is usually first sent to a Google server within the EU.

By default, Google automatically anonymizes users' IP addresses when collecting user data. In addition, IP addresses are neither logged nor stored by Google. However, shortening the IP addresses does not mean that the complete data processing is carried out anonymously. When using Google Analytics, usage data is collected that is to be assessed as personal data, such as identification characteristics of individual users, which also allow a link to an existing Google account, for example.

On our behalf, Google will use the information received via Google Analytics to evaluate your use of our website, to compile reports on website activity and to provide us with other services relating to website activity and internet usage. The pseudonymized usage profiles will not be combined with personal data about the bearer of the pseudonym without a separate consent.

For more information about Google Analytics, see:

https://support.google.com/analytics/answer/12017362

3.4. YouTube

Our website uses plugins from the YouTube site operated by Google. If you visit one of our websites equipped with a YouTube plugin and actively click on the corresponding field, a connection to YouTube's servers will be established. The YouTube server is informed which of our websites you have visited. If you are logged into your YouTube account, you enable YouTube to assign your surfing behavior directly to your personal profile. You can prevent this by logging out of your YouTube account.

The legal basis for the use of YouTube is your consent, based on Section 25 Paragraph 1 Sentence 1 TTDSG for the storage and access to information in end devices and Art. 6 Paragraph 1 Sentence 1 Letter a GDPR for our further processing of your data. You give your corresponding consent via our cookie banner. Please note that the provider is a company from the USA. According to a recent ruling by the European Court of Justice (ECJ), there is no adequate level of data protection in the USA and therefore a risk to the protection of your data. For example, under certain conditions, your data can be processed by US authorities for control and monitoring purposes. If you still want to consent to the use of this tool, you can do so via the cookie banner.

Further information on how to handle user data can be found in YouTube's privacy policy at: https://www.google.de/intl/de/policies/privacy.

3.5. Google Tag Manager

We use the Google Tag Manager “GTM”. This service from Google allows website tags to be managed via an interface. However, the GTM only implements tags. In this respect, no cookies are used. The GTM only triggers other tags, which in turn may collect data, but the GTM does not access this data. The data is evaluated exclusively in the respective tool (see the tools listed in section 4 for details). However, the GTM collects your IP address and online identifiers (including cookie identifiers), which may also be transmitted to Google in the USA. Additional information about the GTM can be found at https://support.google.com/tagmanager/answer/6102821?hl=de

The legal basis for the use of GTM is your consent, based on Section 25 Paragraph 1 Sentence 1 TTDSG for the storage and access to information in end devices and Art. 6 Paragraph 1 Sentence 1 lit. a GDPR for our further processing of your data. You give your corresponding consent via our cookie banner. Please note that the provider is a company from the USA. According to a recent ruling by the European Court of Justice (ECJ), there is no adequate level of data protection in the USA and therefore a risk to the protection of your data. For example, under certain conditions, your data can be processed by US authorities for control and monitoring purposes. The new EU standard data protection clauses were agreed upon as suitable safeguards to ensure an adequate level of protection during data transfer.

3.6. Address validation

We use this to reduce delivery errors Address Validation API from Google. The Address Validation API can be used to determine whether an entered address refers to a real location or whether it contains errors. For this purpose, your IP address and the content you entered in the address field are transmitted to Google. For example, if the address entered is incomplete, the Address Validation API will make a correction recommendation that you can accept. Alternatively, you will be asked to correct the address you entered.

The legal basis for the use of the Address Validation API is your consent, based on Section 25 Paragraph 1 Sentence 1 TTDSG for the storage and access to information in end devices and Art. 6 Paragraph 1 Sentence 1 lit. a GDPR for our further processing of your data. You give your corresponding consent via our cookie banner. Please note that the provider is a company from the USA. According to a recent ruling by the European Court of Justice (ECJ), there is no adequate level of data protection in the USA and therefore a risk to the protection of your data. For example, under certain conditions, your data can be processed by US authorities for control and monitoring purposes. The new EU standard data protection clauses were agreed upon as suitable safeguards to ensure an adequate level of protection during data transfer.

3.7. AWIN

We have integrated “AWIN” on our website. AWIN is an affiliate marketing software from AWIN AG, Eichhornstraße 3, 10785 Berlin, Germany. Registered providers (“advertisers”) can advertise their online goods and services as part of programs via AWIN. For this purpose, the registered people at AWIN (so-called “publishers”) provide the “advertisers” with their advertising space, such as: B. websites. We are registered with AWIN as a “publisher”, which means we provide “advertisers” with advertising space (through links) on our website.

As part of its tracking services, AWIN stores cookies to document transactions on the devices of users who visit or use advertisers' websites or other online offerings (e.g. when placing an online order). These cookies serve the sole purpose of correctly assigning the success of an advertising medium and the corresponding billing within the network. The AWIN tracking cookies store an individual number sequence that cannot be assigned to the individual user and is used to document an advertiser's partner program, the publisher and the time of the user's action (click or view). AWIN also collects information about the device from which an action is carried out, e.g. the operating system and the browser.

The legal basis for the use of AWIN is your consent, based on Section 25 Paragraph 1 Sentence 1 TTDSG for the storage and access to information in end devices and Art. 6 Paragraph 1 Sentence 1 lit. a GDPR for our further processing of your data. You give your corresponding consent via our cookie banner.

Further information on AWIN's use of data can be found in the company's data protection declaration: https://www.awin.com/de/rechtliches

3.8. Country.is

In order to be able to redirect the user to the appropriate web shop (e.g. the US web shop), we use the so-called geo-localization of “Country.is”. Country.is is an open source geolocation API that determines a user's country (and nothing else) based on their IP address. IP-based geolocation is the mapping of an IP address or MAC address to the real geographical location of an Internet-connected computer or mobile device. With geolocation, IP addresses are assigned to the country, region (city), latitude/longitude, internet provider and domain name, among other things. On this basis, the user is automatically redirected to the web shop that suits them locally.

3.9. Azure Content Delivery Network

On our website we use “Azur Content Delivery Network” from Microsoft, a service provided by Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

With Azur Content Delivery Network allows us to reduce load times and improve performance for our high-bandwidth website content by distributing user requests and delivering them directly from Microsoft servers. When you access website content, you connect to Microsoft servers, whereby your IP address and, if applicable, browser data such as your user agent, but also the time and date of your visit to the website are transmitted. This data is processed exclusively for the purposes stated above and to maintain the security and functionality of Azur Content Delivery Network. The specific storage period of the processed data cannot be influenced by us, but is specified by Microsoft. Additional information can be found at: https://azure.microsoft.com/de-de/support/legal/.

The legal basis for the use of Azur Content Delivery Network is your consent, based on Section 25 Paragraph 1 Sentence 1 TTDSG for the storage and access to information in end devices and Art. 6 Paragraph 1 Sentence 1 lit. a GDPR for our further processing of your data. You give your corresponding consent via our cookie banner. Please note that the provider is a company from the USA. According to a recent ruling by the European Court of Justice (ECJ), there is no adequate level of data protection in the USA and therefore a risk to the protection of your data. For example, under certain conditions, your data can be processed by US authorities for control and monitoring purposes. The new EU standard data protection clauses were agreed upon as suitable safeguards to ensure an adequate level of protection during data transfer.

3.10. Findologic

On our website we use the service of Findologic GmbH, Jakob-Haringer-Str. 5a, 5020 Salzburg (“Findologic”) to provide a search function for our articles and for navigation. Cookies are used for the aforementioned service and various data is transferred to Findologic. This includes, in particular, the user's IP address and browser data as well as associated behavioral data resulting from the search queries. On the one hand, this allows us to optimize the shopping experience for our users and, on the other hand, to better understand which products our users are most interested in. Further information about Findologic’s data protection regulations can be found at: https://findologic.com/datenschutz/

The legal basis for the use of Findologic is your consent, based on Section 25 Paragraph 1 Sentence 1 TTDSG for the storage and access to information in end devices and Art. 6 Paragraph 1 Sentence 1 lit. a GDPR for our further processing of your data. You give your corresponding consent via our cookie banner.

3.11. Facebook pixels

The so-called “meta pixel” involves an invisible meta pixel being integrated into our website, through which the online behavior of each website visitor is analyzed by Meta Platforms Ireland Limited (formerly Facebook Ireland Limited), 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Meta”). The meta pixel makes it possible to transmit customer data such as first name, last name, email address, etc. to Facebook and enrich it with existing tracking data. This makes it possible to collect data from non-Facebook users or to record users who are not logged in to Facebook while visiting a website. This means that website visitors are tracked via Meta, which deliberately prevents the storage of third-party cookies. For example, if you put a vehicle in your shopping cart and cancel the purchase process, Meta receives this information. We then have the opportunity to specifically target you on Facebook with an advertisement. Using the meta pixel, it is also possible to specifically attract new customers and address new people who are similar to website visitors.

In addition to us, Meta itself is also responsible for data processing. Meta processes the data in accordance with Meta's data usage guidelines. Details can be found in the Data Use Policy by Meta. You can find specific information and details about the meta pixel and how it works Help section by Meta.

In this respect, we and Meta are jointly responsible for the processing of your personal data within the meaning of Art. 26 GDPR. In this case, you can generally assert your rights (see section 11) both against us and against Meta. However, Meta serves as the first port of call. We have entered into a joint responsibility agreement with Meta for the processing of personal data. You can view these at the following link: https://www.facebook.com/legal/controller_addendum.

The legal basis for the use of the Meta-Pixel is your consent, based on Section 25 Paragraph 1 Sentence 1 TTDSG for the storage and access to information in end devices and Art. 6 Paragraph 1 Sentence 1 lit. a GDPR for our further processing of your data. You give your corresponding consent via our cookie banner. Please note that Meta is a US company. According to a recent ruling by the European Court of Justice (ECJ), there is no adequate level of data protection in the USA and therefore a risk to the protection of your data. For example, under certain conditions, your data can be processed by US authorities for control and monitoring purposes. In the event that data is transferred to Meta Platforms Inc. in the USA, the new standard data protection clauses have been agreed between Meta Platforms Ireland Limited and Meta Platforms Inc.

3.12. Pinterest pixels

Our website uses the Pinterest tag, an analysis tool from Pinterest Europe Ltd. This tool allows us to track the behavior of users who have come to our website via a Pinterest ad. This allows us to measure the effectiveness of our advertising measures and better tailor our content to the interests of our users.

The data collected is anonymous to us and does not allow any conclusions to be drawn about the identity of individual people. However, Pinterest may link the data to your Pinterest account and use it for its own advertising purposes in accordance with the Pinterest privacy policy.

You can object to the use of the Pinterest tag at any time by adjusting the personalized advertising settings in your Pinterest account or deactivating the use of cookies in your browser.

3.13. Tiktok pixels

Our website uses the TikTok Pixel, an analysis tool from TikTok Technology Limited. This tool allows us to track the behavior of users who have come to our website via a TikTok ad. This allows us to record the effectiveness of our advertising measures for statistical and market research purposes. The data collected is anonymous to us and does not allow us to draw any conclusions about the identity of the user. However, TikTok processes the data so that a connection to the respective user profile is possible and TikTok can use the data for its own advertising purposes in accordance with its data protection declaration. You can object to the recording by the TikTok pixel at any time by adjusting the appropriate settings in your TikTok account or deactivating the use of cookies in your browser.

3.14. Snapchat pixels

Our website uses the Snapchat Pixel, an analytics tool from Snap Inc. This pixel allows us to track the behavior of users who have come to our website via Snapchat ads. This allows us to measure the effectiveness of our advertising efforts, track conversions, and better tailor our ads to your interests.

The data collected is anonymous to us and does not enable direct identification of users. However, Snap Inc. may associate the information with your Snapchat account and use it for its own purposes in accordance with the Snapchat Privacy Policy.

You have the option to object to data collection by the Snapchat Pixel by adjusting the privacy settings in your Snapchat account or disabling the use of cookies in your browser.

3.15. Vimeo

This website uses plugins from the video portal Vimeo. The provider is Vimeo Inc., 555 West 18th Street, New York, New York 10011, USA.

When you visit one of our sites equipped with Vimeo videos, a connection is established to Vimeo's servers. The Vimeo server is informed which of our pages you have visited. Vimeo also obtains your IP address. However, we have set Vimeo so that Vimeo will not track your user activity and will not set cookies.

The use of Vimeo is in the interest of an attractive presentation of our online offerings. This represents a legitimate interest within the meaning of Article 6 Paragraph 1 Letter f of the GDPR. If appropriate consent has been requested, processing is carried out exclusively on the basis of Article 6 Paragraph 1 Letter a of the GDPR; consent can be revoked at any time.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission and, according to Vimeo, on “legitimate business interests”. Details can be found here: https://vimeo.com/privacy.

Further information on how we handle user data can be found in Vimeo's privacy policy at: https://vimeo.com/privacy.

4. Links to other websites

Our website contains links to other websites such as the Carrera Club website or to social networks (Facebook, YouTube, Instagram). These websites are partly operated by us and partly by third parties. In the latter case, if you follow the links, information may be transmitted to these third parties. The purpose and scope of data collection by third-party websites as well as the further processing and use of your data there, as well as your related rights and setting options to protect your privacy, can be found in the operators' respective data protection information.

5. Data transfer

We only pass on your personal data to third parties or other recipients if this is necessary to provide the service, you have given your consent, there is a legal obligation or the data transfer is permitted based on another legal basis. Data is passed on, for example, to the respective payment or shipping service provider, service provider for the provision of marketing services (e.g. email marketing), technical service providers or - in the case of a corporate transaction - to interested parties/buyers, etc. If necessary, we have made agreements with the recipients of your data regarding order processing in accordance with Art. 28 GDPR.

Please also note the separate data protection regulations of the one you have selected Payment methods.

Klara: https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/privacy

VISA: www.visaeurope.com

MasterCard: https://www.mastercard.de/de-de.html

Stripes: https://stripe.com/de/privacy

6. Social media appearances

6.1. Data processing by Carrera and legal basis

Our social media presence (Facebook, Twitter, YouTube, LinkedIn, Xing and Instagram) serves the purpose of informing you about Carrera and Revell as well as our new developments, services and products. Depending on the offer of the respective provider, you have the opportunity to have different interactions (comments, recommendations, etc.), for example in connection with our social media presence. User interaction is an important criterion for us in order to conduct targeted marketing. For example, we can determine which articles are preferred to be read. We therefore also use the statistics determined by the providers in this regard for our own purposes. If we process users' personal data, the legal basis for this is Article 6 Paragraph 1 Sentence 1 Letter f GDPR. Our legitimate interest then lies in particular in targeted information/advertising. The providers will inform you separately about the legal basis on which the providers process your data for their own purposes.

6.2. Shared responsibility

In individual cases, we and the social media providers are jointly responsible for processing your personal data. In this case, you can exercise your rights (see section 11) both. us as well as against to the social media provider. However, the first point of contact is the social media provider.

We have concluded an agreement with Meta (formerly Facebook) on shared responsibility for processing personal data. This applies to the processing of so-called “insights data”. These are page statistics, particularly on the interactions of Facebook users. For details on the Insights data, see here. You can view our agreement with Meta at the following Link see.

Please note that Meta also processes your data outside the EU/EEA. According to a recent ruling by the European Court of Justice (ECJ), there is no adequate level of data protection in the USA and therefore a risk to the protection of your data. For example, under certain conditions, your data can be processed by US authorities for control and monitoring purposes.

With regard to the storage period of the data we process from you for our own purposes, we refer to our statements in section 9. Otherwise, please note the data protection regulations of the respective social media provider.

7. Data transfer to countries outside the EU

If necessary for our purposes, we will also transmit your data to recipients outside the EU You have given your consent, there is a legal obligation or the data transfer is permitted on the basis of another legal basis. As part of data processing, your data will also be transmitted to recipients who are based in the USA. Please note, however, that according to a recent ruling by the European Court of Justice (ECJ), there is no adequate level of data protection in the USA and therefore a risk to the protection of your data. For example, under certain conditions, your data can be processed by US authorities for control and monitoring purposes. For the rest, we would like to refer to Article 49 of the GDPR regarding the legal basis for data transfer. An appropriate level of data protection will be ensured in the future through the conclusion of the new so-called EU standard data protection clauses.

8. Duration for which personal data is stored / criteria for determining the duration

In principle, we will store your personal data for as long as it is necessary for the aforementioned purposes of processing, in the event of an objection there are no compelling legitimate reasons on the part of Carrera or in the event of a revocation there is no other legal basis for data processing.

In certain cases, e.g. if there is a legal retention requirement, your personal data will not be deleted immediately but will first be blocked.

9. Security measures to protect your personal data

We protect your data from unauthorized access, loss or destruction using technical and organizational measures. Our security measures are continuously improved in line with technological developments. Our employees and all persons involved in data processing are obliged to comply with data protection laws and to handle personal data confidentially. Our employees are trained accordingly.

To protect our users' personal data, we use a secure online transmission process, the so-called "Secure Socket Layer" (SSL) transmission. You can recognize this by the fact that an "s" is appended to the address component http:// ("https://") or a green, closed lock symbol is displayed. By clicking on the symbol you will receive information about the SSL certificate used. The display of the symbol depends on the browser version you are using. SSL encryption ensures the encrypted and complete transmission of your data.

10. Your Rights

Within the framework of the legal requirements, you are generally entitled to claim from Carrera

Confirmation as to whether personal data concerning you is being processed by Carrera,
Information about this data and the circumstances of processing,
Correction if this data is incorrect,
Deletion if there is no justification for the processing and no obligation to store it (any longer),
Restriction of processing in special cases determined by law,
Objection in the event of data processing based on Art. 6 Para. 1 Sentence 1 Letter f. GDPR and
Transmission of your personal data – if you have provided it – to you or a third party in a structured, common and machine-readable format.

To the extent that the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time, with the result that the processing of your personal data will be inadmissible in the future. However, this does not affect the lawfulness of the processing carried out based on consent until its revocation.

Please address your specific request in writing or by email to our data protection officer, clearly identifying yourself:

krupna LEGAL

Dr. Karsten Krupna
Swivel track 7
20354 Hamburg

Email: datenschutz@carrera-revell.com

To the extent that we process your data with third parties under joint responsibility within the meaning of Art. 26 GDPR, the third party is centrally responsible for exercising all rights of those affected. However, you are free to assert your rights against us.

Finally, we would like to point out your right to complain to the supervisory authority (Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at).

11. No automated individual decision

We do not use your personal data for automated individual decisions.

12. Changes to the privacy policy

New legal requirements, business decisions or technical developments may require changes to our data protection declaration. The data protection declaration will then be adjusted accordingly. You can always find the latest version on our website.

As of: June 21, 2023