Terms and Conditions of <tc>Carrera</tc> Toys GmbH

Privacy policy

We, Carrera Toys GmbH (Carrera“we”), are pleased that you have visited our website. In the following provisions, we inform you about the nature, scope, and purpose of the collection and use of your personal data on this website and in connection with the services we offer.

Personal data refers to any information relating to an identified or identifiable natural person. This includes, in particular, your name, address, and email address.

Please read this Privacy Policy carefully before using this website. We reserve the right to amend parts of this Privacy Policy at our discretion and in accordance with legal requirements. Please therefore review this Privacy Policy regularly for changes.

1.
Website Provider and Data Protection
OfficerThe provider of this website and the controller within the meaning of data protection law is

CarreraToys GmbH, Renn

bahn Allee 1

5, 41

2 Puch/Salzburg, Austria

. Authorized Managing Director: Mr. Stefan Krings

. Tel.: +43 662 88921-0. Email:shop@carrera-toys.com
CarreraYou can contact the Data Protection Officer at CarreraToys GmbH at:

krupna LEGALwww.krupna.legal

. Email:datenschutz@carrera-toys.com
2. Data Processing to Enable Website UseEach
time you access content on our website, connection data is transmitted to our web server. This connection data includes:

· the IP address (Internet Protocol address) of the respective user,

· the date and time of the request,

· the referrer URL,

· device numbers such as z.B. UDID (Unique Device Identifier) and similar device numbers, device information ( z.B. device type)

, and

browser type/version.

This connection data is not used to identify the user personally or combined with data from other sources, but is used to provide the website. The legal basis for the processing of your data is Art. 6(1)(f) GDPR. After no later than 7 days, the data is anonymized by truncating the IP address at the domain level.

3. Data Processing at Your
Initiative
The use of our website is generally possible without providing personal data. You are neither obligated to visit this website nor to provide personal data in the process. However, the provision of personal data isz.B. required to receive newsletters or in the event of registration. If you do not provide us with personal data for the purposes listed below, you may not be able to use certain features of this website or individual services.

3.1. Provider and Data Protection
OfficerIf you register with us as a merchant and use the merchant service or the B2B portal on our website, we will process your information for this purpose. Details about the B2B portal can be found in the instructions on our portal underhttps://carrera-toys.com/dealer-portal.

The processing of your personal data is based on Art. 6(1)(b) of the GDPR.

3.2. Newsletter
The provider of the website and the controller within the meaning of data protection law is

CarreraToys GmbH

, Rennbahn Allee 1

5, 41

2 Puch/Salzburg, Austria.




Carrera





Authorized Managing Director: Mr. Stefan Krings

, Tel.: +43 662 88921-0 Email:shop@carrera-toys.com
CarreraYou can contact the Data Protection Officer at CarreraToys GmbH at:

krupna LEGALwww.krupna.legal

Email:datenschutz@carrera-toys.com
3.3. Customer Registration
If you wish to register with us as a customer, we will collect the required mandatory information from you (name, country, email address, password), which is marked accordingly (*). The provision of any additional personal information is voluntary.

Registration is not required, but it simplifies the ordering process for future orders, as you can reuse the data you have already saved. Alternatively, you can also place an order as a guest. In this case, with the exception of a password, we collect the same data from you as during registration. However, this data is not stored in a customer account for you, so you do not have access to a customer account.

After registration, you can log in by entering your email address and password. Please always make sure to log out before leaving the website.

When using a password, please take appropriate security measures. A password should be at least 8 characters long and, whenever possible, consist of a combination of uppercase and lowercase letters, numbers, and special characters. In this regardz.B. ,trivial passwords such as “ABC” or keyboard sequences (z.B. “qwert” or “asdfgh”), all types of names (such as those of friends, acquaintances, colleagues, family members, or pets), city and building names, comic book characters, car brands, license plate numbers, terms, dates of birth, phone numbers, common abbreviations, etc.

Your personal data is processed on the basis of your consent in accordance with Article 6(1)(a) of the GDPR. Please note that in the event of a withdrawal of consent, any bonus points collected will be forfeited without replacement. Furthermore, please refer to the relevant terms of use on our website regarding bonus points.

In addition, we store your IP address and the time of registration during the registration process. This is necessary to ensure the security of our IT systems. The legal basis for the processing of your data in this case is Article 6(1)(f) of the GDPR.

3.4. Login
If you are registered as a customer, you can access your customer account via the login function on this website. You log in by entering your email address and password.

Login credentials must be kept strictly confidential. If your password has nevertheless been disclosed—for example, to allow third parties to access certain data in an emergency—you must change it immediately. For your own protection, you are prohibited from reusing passwords that have already been used.

In addition, when you log in, we store your IP address and the time of access. This is necessary to ensure the security of our IT systems.

We also set a session cookie with every login. This session cookie prevents automatic logout while the account or associated services are in active use. After you log out, the session cookie is automatically deleted within a few minutes.

The legal basis for the processing of your data is Art. 6(1)(f) GDPR and, insofar as your contractual relationship is concerned, Art. 6(1)(b) and/or (f) GDPR.

3.5. Wish
ListIf you are logged in as a customer (see Section 3.4. f.), you can add individual products from the store to your wish list. You can access this wish list until you log out, where you will see all the products you have added. The legal basis for the processing of your data in this case is Article 6(1)(f) of the GDPR. When you log out as a customer

, the wish list is automatically deleted

.3.6. Ordering in the Shop
When you place an order with us, we process the following data from you:

· Registration data from your customer account or your guest data,

· Purchase data (order/shopping cart),

· Payment data (payment method, bank account and credit card details, billing addresses)

The processing of your personal data is based on Art. 6(1)(b) GDPR.

3.7. ContestsIf
you would like to participate in a contest we offer through our website, you must first create an account. Providing your data is necessary for the purpose of conducting the contest. After the contest has ended, this data and the account will be deleted, provided there are no legal retention requirements.

The processing of your personal data is based on your consent pursuant to Art. 6(1)(a) of the GDPR. There is no legal or contractual obligation to provide personal data. Failure to consent simply means that you cannot participate in the contest. You may revoke your consent at any time with future effect. Revoking your consent does not affect the lawfulness of the processing carried out on the basis of your consent prior to revocation.

4. CarreraClub
CarreraWe have set up a separate club section on our website for our Carreraclub. The data processing related to our Carreraclub is described in the following sections.

4.1. Registration as Carrera a Club
MemberIf you would like to register with us as a club member, you must first purchase a membership in our online store. We will then collect the required mandatory information from you (name, address, email address, password) to set up your member account so that you can enjoy the club benefits.

After registration,

you can log in by entering your club username and password via the club section on our website. Please always remember to log out before leaving the website.

When using a password, please ensure you take appropriate security measures. A password should be at least 8 characters long and, whenever possible, consist of a combination of uppercase and lowercase letters, numbers, and special characters. In this regardz.B . ,common passwords such as “ABC” or keyboard sequences (z.B. “qwert” or “asdfgh”), all types of names (such as those of friends, acquaintances, colleagues, family members, or pets), city and building names, comic book characters, car brands, license plate numbers, terms, dates of birth, phone numbers, common abbreviations, etc.

The processing of your personal data is carried out for the purpose of fulfilling the contract. The legal basis is Art. 6(1)(b) GDPR.

In addition, we store your IP address and the time of registration as part of the registration process. This is necessary to ensure the security of our IT systems. The legal basis for the processing of your data in this case is Art. 6(1)Article 1(1)(f) of the GDPR.

4.2 Login
If you are a club member, you can use the login feature on this website to access specific information or features in our club area.

Login credentials must be kept strictly confidential. If they are shared—for example, to allow a third party to access certain data in an emergency—the password must be changed immediately. For your own protection, you are prohibited from reusing passwords that have already been used.

In addition, when you log in, we store your IP address and the time of access. This is necessary to ensure the security of our IT systems.

We also set a session cookie with every login. This session cookie prevents automatic logout while the account or associated services are in active use. Once you log out, the session cookie is automatically deleted within a few minutes.

The legal basis for the processing of your data is Art. 6(1)(f) GDPR and, insofar as your contractual relationship is concerned, Art. 6(1)(b) GDPR.

4.3 Member
AccountIf you have purchased a club membership, a member account will be created for you, which is visible to other club members. You can use the settings to select which information about you should be visible to other club members.

If you already have a customer account in accordance with Section 2.3 et seq., the data from your existing customer account will be linked to your member account. This allows you to take advantage of club benefits when placing orders in our online shop.

The legal basis for the processing of your personal data is Art. 6(1)(b) GDPR.

4.4 Communication with Other Club
Members/Club
ForumAs a club member, you have the opportunity to connect with other club members via chat in our club forum. The content of your posts in the forum (text, photos, or videos), as well as your username Carrera, is Carreravisible exclusively to other club members and the administrators of Carrera. In this respect, the club forum is a closed area that Carrerais moderated and administered by Carrera. The legal basis for the processing of your personal data is Art. 6(1)(b) of the GDPR.

If posts within the forum Carreraare also Carrera of interest to other customers of [ CarreraCompany Name], [Company Name] will Carrera contact the club member who published the post andu.a. Carrerarequest consent to publish the postu.a. on [Company Name]’s social media channels Carrera.The processing of your personal data is then based on your explicit consent pursuant to Article 6(1)(a)

of the GDPR

.5 Payment for Club
Membership
Please note the provisions in this Privacy Policy under Section 7

4.6 Club Newsletter
The provider
of the website and the controller within the meaning of data protection law is

CarreraToys GmbH

, Rennbahn Allee

15,

41

2 Puch/Salzburg, Austria

. Authorized Managing Director: Mr. Stefan Krings

. Tel.: +43 662 88921-0 Email: shop@carrera-toys.com
CarreraYou can contact the data protection officer of CarreraToys GmbH at:

krupna LEGAL www.krupna.legal

Email: datenschutz@carrera-toys.com
5. Data processing for the needs-based design of the website and tracking
To make your use of our website as pleasant as possible, we use so-called Web tracking systems. These systems i.d.R.usei.d.R. cookies, d.h. which are small text files sent from a web server to your browser and stored on your computer’s hard drive. This allows us to recognize the device you are using when you visit our online store. In this wayz.B. , we canz.B. determine whether you are logged in, have an active shopping cart, and what items are in that cart. The session cookies used for the shop are deleted at the end of the browser session. Other cookies remain on your device and allow us to recognize your device on your next visit.

Details about the cookies used on the website can be found in the cookie banner and in the following provisions. The legal basis for the processing of your data is set forth in the following provisions in Section 5.1 et seq. as set forth in Article 6(1)(f) of the GDPR. Our legitimate interest lies in designing the website to meet user needs. Finally, please note that if you disable cookies, you may not be able to use all features of this website to their full extent. Please also note that deactivation may need


to be performed for each browser and for each device.

5.1 Cookie Consent with CookiebotTo
manage your consent to the use of tracking tools, we use the cookie consent technology “Cookiebot.” The provider of this technology is Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark, website:https://www.cookiebot.com/de/(“Usercentrics”). In this context, in addition to connection data, the granting or refusal of your consent or the revocation of consent is transmitted to Usercentrics. To make the appropriate assignment, Usercentrics also places a cookie in your browser.

Cookiebot is used to obtain the legally required consent for the use of cookies. The legal basis for this is Art. 6(1)(c) GDPR.

5.2 GoGoogle Analytics
The provider of the website and the data controller within the meaning of data protection law is

CarreraToys GmbH

, Renn

bahn Allee 1

5, 41

2 Puch/Salzburg, Austria.

Authorized Managing Director: Mr. Stefan Krings

. Tel.: +43 662 88921-0 Email:shop@carrera-toys.com
CarreraYou can contact the data protection officer of CarreraToys GmbH at:

krupna LEGALwww.krupna.legal

Email: datenschutz@carrera-toys.com
5.3. YouTube
Our website uses plugins from the GoYouTube site operated by Go Google. When you visit one of our websites that includes a YouTube plugin and actively click on the corresponding field, a connection is established with YouTube’s servers. In doing so, the YouTube server is informed which of our websites you have visited. If you are logged into your YouTube account, you allow YouTube to directly associate your browsing behavior with your personal profile. You can prevent this by logging out of your YouTube account.

The legal basis for the use of YouTube is your consent, based on Section 25(1) Sentence 1 of the German Telecommunications Data Protection Act (TDDDG) for the storage of and access to information in terminal equipment, as well as Article 6(1) Sentence 1(a) of the General Data Protection Regulation (GDPR) for our further processing of your data. You provide your consent via our cookie banner. Please note that Google is Goa company based in the United States. Information about the locations of Google’s data centers Gocan www.google.combe found atwww.google.com/about/datacenters/locations/. The new EU Standard Data Protection Clauses have been adopted as appropriate safeguards to ensure an adequate level of protection for data transfers. In addition GoU.S. ,ogle LLC is Goan active participant in the EU-U.S. U.S. Data Privacy Framework, which ensures the secure transfer of personal data to the United States. Further information can be found here:https://www.dataprivacyframework.gov/list.

Further information on the handling of user data can be found in YouTube’s Privacy Policy at: https://www.google.de/intl/de/policies/privacy.

5.4. Google Tag Manager
We use the Google Tag Manager “GTM.” This service from Google allows website tags to be managed via a single interface. However, GTM only implements tags. As such, no cookies are used. The GTM only triggers other tags, which in turn may collect data; however, the GTM does not access this data. The data is analyzed exclusively within the respective tool (for details, see the tools listed in Section 5). The GTM does, however, collect your IP address and online identifiers (including cookie identifiers), which Gomay also Gobe transmitted to GoGoogle in the United States. Additional information about GTM can be found athttps://support.google.com/tagmanager/answer/6102821?hl=de

The legal basis for the use of GTM is your consent, based on Section 25(1) Sentence 1 of the German Telecommunications Data Protection Act (TDDDG) for the storage of and access to information in terminal equipment, as well as Article 6(1) Sentence 1(a) of the GDPR for our further processing of your data. You provide your consent via our cookie banner. Please note that the provider is a company based in the United States. The new EU Standard Data Protection Clauses have been adopted as appropriate safeguards to ensure an adequate level of protection during data transfers. In addition GoU.S. ,ogle LLC is Goan active participant in theU.S.EU-USU.S. Privacy Shield Framework, which ensures the secure transfer of personal data to the United States. For more information, please see here:https://www.dataprivacyframework.gov/list

5.5. Address Validation
To reduce delivery errors Go, we use Google’s Address Validation API Go. The Address Validation API allows us to determine whether an entered address refers to a real location or contains errors. To do this, your IP address and the content you entered in the address field are Gotransmitted to Google. If the entered addressz.B. is incomplete, the Address Validation API will provide a correction recommendation that you can accept. Alternatively, you will be prompted to correct the address you entered.

The legal basis for using the Address Validation API is your consent, based on Section 25(1), sentence 1 of the TDDDG for the storage of and access to information in terminal equipment, as well as Article 6(1), sentence 1(a) of the GDPR for our further processing of your data. You provide your consent via our cookie banner. Please note that the provider is a company based in the United States. The new EU Standard Data Protection Clauses have been agreed upon as appropriate safeguards to ensure an adequate level of protection during data transfers. Additionally GoU.S. ,ogle LLC is Goan active participant in the EU-USU.S. Data Privacy Framework, which ensures the secure transfer of personal data to the United States. Further information can be found here:https://www.dataprivacyframework.gov/list.

5.6. AWIN
We have integrated “AWIN” on our website.AWIN is an affiliate marketing software platform provided by AWIN AG, Eichhornstraße 3, 10785 Berlin, Germany. Through AWIN, registered providers (“advertisers”) can promote their online products and services as part of various programs. To this end, individuals registered with AWIN (so-called “Publishers”) make their advertising space, such as websites, available to the “Advertisers.” We are registered with AWIN as a “Publisher,” meaning we provide “Advertisers” with advertising space (via links) on our website.

As part of its tracking services, AWIN stores cookies on the devices of users who visit or use Advertisers’ websites or other online offerings (z.B. when placing an online order)for thez.B. purposeof documenting transactionsz.B. . These cookies serve solely to correctly attribute the success of an advertising medium and to facilitate the corresponding billing within the network.AWIN tracking cookies store a unique sequence of numbers that cannot be traced back to an individual user; this sequence is used to record the advertiser’s affiliate program, the publisher, and the time of the user’s action (click or view). In doing so, AWIN also collects information about the device from which the action is performed,z.B. the operating system, z.B . and the browser.

The legal basis for the use of AWIN is your consent, based on Section 25(1) Sentence 1 of the German Telemedia Act (TDDDG) for storage and access, as well as Article 6(1) Sentence 1(a) of the General Data Protection Regulation (GDPR) for our further processing of your data. You provide your consent via our cookie banner.

Further information on data usage by AWIN can be found in the company’s privacy policy:https://www.awin.com/de/rechtliches

5.7.Country.is
To direct the user to the appropriate online store ( z.B .To be able to redirectCountry.isCountry.isusers to our US online store, we use the so-called geolocation service from “Country.is”.Country.isis an open-source geolocation API that determines a user’s country (and nothing else) based on their IP address. IP-based geolocation is the assignment of an IP address or MAC address to the actual geographic location of a computer or mobile device connected to the Internet. In geolocation, IP addresses are assigned to, among other things, the country, region (city), latitude/longitude, Internet service provider, and domain name. Based on this, the user is automatically redirected to the online store appropriate for their location.

The legal basis for the use of Country.isthis feature is your consent, based on Section 25(1) Sentence 1 of the German Telecommunications Data Protection Act (TDDDG) for the storage of and access to information in terminal equipment, as well as Article 6(1) Sentence 1(a) of the General Data Protection Regulation (GDPR) for our further processing of your data. You can give your consent via our cookie banner.

5.8. Azure Content Delivery NetworkWe
use Microsoft’s “Azure Content Delivery Network” on our website, a service provided by Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

Azure Content Delivery Network allows us to reduce loading times and improve the performance of our high-bandwidth website content by distributing user requests and serving them directly from Microsoft servers. When you access website content, you connect to Microsoft servers, transmitting your IP address and, where applicable, browser data such as your user agent, as well as the time and date of your visit to the website. This data is processed exclusively for the purposes mentioned above and to maintain the security and functionality of the Azur Content Delivery Network. We have no control over the specific retention period for the processed data; it is determined by Microsoft. Additional information can be found at:https://azure.microsoft.com/de-de/support/legal/.

The legal basis for our use of the Azure Content Delivery Network is your consent, based on Section 25(1) Sentence 1 of the German Telecommunications Data Retention Act (TDDDG) for the storage of and access to information in terminal equipment, as well as Article 6(1) Sentence 1(a) of the GDPR for our further processing of your data. You can provide your consent via our cookie banner. Please note that Microsoft is a company based in the United States. Information about the locations of Microsoft’s data centers can be found at: https://www.microsoft.com/de-de/privacy/privacystatement#mainwherewestoreandprocessdatamodule. The new EU Standard Data Protection Clauses have been agreed upon as appropriate safeguards to ensure an adequate level of protection during data transfers. In additionU.S. ,Microsoft is an active participant in the EU-U.S. U.S. Data Privacy Framework, which ensures the secure transfer of personal data to the United States. Further information can be found here:https://www.dataprivacyframework.gov/listand here:https://learn.microsoft.com/en-us/compliance/regulatory/offering-eu-model-clauses.

5.9. Findologic
We use the service provided by Findologic GmbH, Jakob-Haringer-Str. 5a, 5020 Salzburg (“Findologic”) on our website to provide a search function for our articles as well as for navigation. Cookies are used for the aforementioned service, and various data is transmitted to Findologic. This includes, in particular, the IP address and browser data of users, as well as associated behavioral data resulting from search queries.This allows us, on the one hand, to optimize the shopping experience for our users and, on the other hand, to better understand which products interest our users the most. For further information on Findologic’s privacy policy, please visit:https://findologic.com/datenschutz/

The legal basis for the use of Findologic is your consent, based on Section 25(1) sentence 1 of the German Telecommunications Data Protection Act (TDDDG) for the storage of and access to information in terminal equipment, as well as Article 6(1) sentence 1(a) of the General Data Protection Regulation (GDPR) for our further processing of your data. You provide your consent via our cookie banner.

5.10. Meta Pixel
The so-called “Meta Pixel” involves embedding an invisible pixel on our website, through which the online behavior of every website visitor is analyzed by Meta Platforms Ireland Limited (formerly Facebook Ireland Limited), 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Meta”). The Meta Pixel makes it possible z.B. to transmitcustomer data such asz.B. first name, last name, email address, etc.,z.B. to Meta and enrich it with existing tracking data. This makes it possible to collect data from people who aren’t Facebook users or to track users who aren’t logged into Facebook while visiting a website. As a result, website visitors who deliberately block third-party cookies are tracked via Meta. This allows us to target you with an advertisement on Facebook. However, the Meta Pixel also enables us to specifically acquire new customers and target new individuals who resemble website visitors.

In addition to us,

Meta itself is also responsible for data processing. Meta processes the data in accordance with its Privacy Policy. Details can be found in Meta’s Privacy Policy. For specific information and details about the Meta Pixel and how it works, please visit Meta’s Help Center.

In this regard, we are jointly i.S.d. responsiblewith Meta i.S.d. for the processing of your personal data under Article 26 of the GDPR. In this case, you may generally exercise your rights (see Section 12) with either us or Meta. However, Meta is your primary point of contact. We have entered into a joint controller agreement with Meta regarding the processing of personal data. You can view this agreement at the following link:https://www.facebook.com/legal/controller_addendum.

The legal basis for the use of the Meta Pixel is your consent, based on Section 25(1) sentence 1 of the German Telecommunications Data Protection Act (TDDDG) for the storage of and access to information in terminal equipment, as well as Article 6(1) sentence 1(a) of the GDPR for our further processing of your data. You provide your consent via our cookie banner. Please note that Meta is a U.S.-based company. The new EU Standard Data Protection Clauses have been agreed upon as appropriate safeguards to ensure an adequate level of protection for data transfers. In additionU.S. ,Meta is an active participant in the EU-U.S.U.S. Data Privacy Framework, which ensures the secure transfer of personal data to the United States. Further information can be found here:https://www.dataprivacyframework.gov/list.

5.11. TikTok Conversion Tracking
We use the TikTok Pixel for conversion tracking, an analytics service provided by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland (“TikTok”).

The TikTok Pixel is a snippet of JavaScript code that enables us to analyze visitor activity on our website. The TikTok Pixel collects certain information from visitors for this purpose (so-called“Event Data”), which is then forwarded to TikTok. This includes user-generated content, date of birth, profile information, profile picture, usage data, device information, smartphone-related information, last name, first name, internet service provider, IP address, email address, and browser history.

Further information and TikTok’s privacy policy can be found at:https://www.tiktok.com/legal/page/eea/privacy-policy/de

TikTok also offers users the option to view their profile:https://support.tiktok.com/de/account-and-privacy/personalized-ads-and-data/requesting-your-data

The legal basis for the use of the TikTok Pixel is your consent, based on Section 25(1) Sentence 1 TDDDG for the storage of and access to information in terminal equipment, as well as Art. 6(1)(a) of the GDPR for the processing of your data. You provide your consent via our cookie banner. Please note that TikTok is a company based in China. TikTok uses the so-called Standard Contractual Clauses as the basis for data processing outside the EU. See:https://www.tiktok.com/legal/page/eea/privacy-policy/de

5.12. Pinterest Conversion Tracking
Our website uses the Pinterest Tag as a pixel from Pinterest Europe Ltd., Palmerston House, 2nd Floor Fenian Street, Dublin 2, Ireland (“Pinterest”) for remarketing purposes, so that we can re-engage with you on the Pinterest social network within 180 days. This allows users of our website to be shown interest-based advertisements (so-called “Pinterest Ads”) while visiting Pinterest.

If you have given your consent (as described below), your browser automatically establishes a direct connection to the Pinterest server. By integrating the Pinterest pixel, Pinterest receives the information that you have visited the corresponding page on our website or clicked on one of our ads. If you are registered with Pinterest, Pinterest can associate your visit with your account.

In addition to your IP address and marketing identifier, Pinterest also receives information about the device you are using, the website you visited, and the time of your visit, and can associate this data with your Pinterest account. Pinterest processes this data on its own responsibility. We have no influence over the collection of data or its further processing by Pinterest. We only have access to conversion reports and event history.

To set directly on Pinterest which types of ads are displayed to you within Pinterest, you can visit the page set up by Pinterest and edit your personalization settings there. The settings are platform-independent;d.h. they apply to all devices, such as desktop computers or mobile devices. You can alsoaboutads.info youronlinechoices.comobject to the use of cookies for audience measurement and advertising purposes via the Network Advertising Initiative’s opt-out page, as well as the U.S. website aboutads.info or the European websiteyouronlinechoices.com.

For more information on data processing by Pinterest, please refer to the Pinterest Advertising Policies. You can also find general information on the display of Pinterest ads in the Ad Data Policy.

The legal basis for the use of the Pinterest Pixel is your consent, based on Section 25(1) Sentence 1 of the German Telemedia Act (TDDG) for the storage of and access to information on end devices, as well as Article 6(1) Sentence 1(a) of the General Data Protection Regulation (GDPR) for the processing of your data. You provide your consent via our cookie banner. Please note that Pinterest is a company based in the United States. Pinterest uses the so-called Standard Contractual Clauses as the basis for data processing outside the EU. For more information, see:https://policy.pinterest.com/de/privacy-policy#section-residents-of-the-eea

5.13. Snapchat Conversion Tracking
Our website uses the Snapchat Pixel, an analytics tool provided by Snap Inc., 2772 Donald Douglas Loop N, Santa Monica (HQ), CA, USA (“Snapchat”). The Snapchat Pixel allows us to track the behavior of users who have arrived at our website via Snapchat ads. This enables us to measure the effectiveness of our advertising efforts, track conversions, and better tailor our ads to your interests. The Snapchat Pixel is a JavaScript code that transmits the following data to Snapchat:

· HTTP header information (u.a.IP address, web browser information, page location, document, website URL, and web browser user agent, as well as the date and time of use),

· pixel-specific data; this includes the pixel ID and your hashed email address (this data is used to link events to a specific Snapchat advertising account and attribute them to a Snapchat user),

· additional information about visits to our websites, as well as standard and custom data events,

· orders placed (purchases made),

· the completion of registrations and purchases,

· items added to the shopping cart, and

· the viewing of product information.

The aforementioned data processing applies only to users who have an account with Snapchat. If an email address can be linked to a Snapchat user, Snapchat will assign that user to a target group (“Custom Audience”) based on the rules we have established, provided those rules are applicable. We use the information obtained in this way to present our advertising content via Snapchat.

Please note that it cannot be ruled out that Snapchat may process the data in question here for its own purposes and under its own responsibility, and in doing so may combine this information with data already available to Snapchat, such as user profiles (if available).

The legal basis for our use of the Snapchat pixel is your consent, based on Section 25(1) Sentence 1 of the TDDDG for the storage of and access to information in terminal equipment, as well as Article 6(1) Sentence 1(a) of the GDPR for the processing of your data. You can provide your consent via our cookie banner.

You also have the option to object to data collection by the Snapchat pixel by adjusting the privacy settings in your Snapchat account or disabling cookies. For further information and to learn about the privacy settings available for advertising purposes, please refer to Snapchat’s Privacy Policy, whichhttps://support.snapchat.com/en-US/a/advertising-preferencescan be found athttps://support.snapchat.com/en-US/a/advertising-preferences[link]https://support.snapchat.com/en-US/a/advertising-preferences.

Please note that Snapchat is a U.S.-based company. Pinterest uses the so-called Standard Contractual Clauses as the basis for data processing outside the EU. For more information, see:https://www.snap.com/terms/standard-contractual-clauses?lang=en-US

6. Links to Other Websites
Our website contains links to other websites, such asz.B. the CarreraClub website or social media platforms (Facebook or Meta, YouTube, Instagram).These websites are operated partly by us and partly by third parties. If you follow the links, information may therefore be transmitted to these third parties in the latter case. For information regarding the purpose and scope of data collection by third-party websites, as well as the further processing and use of your data on those sites, and your rights and privacy settings in this regard, please refer to the respective privacy policies of the operators.

7. Data
TransferWe will only disclose your personal data to third parties or other recipients if this is necessary for the provision of services, you have given your consent, there is a legal obligation to do so, or the data transfer is permissible on another legal basis. Data may be shared, for example, with the relevant payment or shipping service provider, service providers for marketing services (z.B. email marketing), technical service providers, or—in the case of a corporate transaction—with prospective buyers or purchasers, etc. Where necessary, we have entered into data processing agreements with the recipients of your data in accordance with Article 28 of the GDPR.

If you choose a payment method offered via the payment service provider Shopify Payments, payment processing is handled by the technical service provider Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, to whom we will transfer the information you provided during the ordering process, along with information regarding your order (name, address, account number, bank routing number, credit card number if applicable, invoice amount, currency, and transaction number).Your data will be shared exclusively for the purpose of processing payments with Stripe Payments Europe Ltd. and only to the extent necessary for this purpose. For more information on Shopify Payments’ privacy policy, please visit the following website:https://www.shopify.com/legal/privacy. Privacy policy information for Stripe Payments Europe Ltd. can be found here:https://stripe.com/de/privacy

Please also note the separate privacy policies of the payment methods you have selected.

Klarna: You have the option to use the payment options offered by Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden (hereinafter “Klarna”). Payment is then made to Klarna. Use of the payment methods “Invoice” and “Direct Debit/Instant Transfer” requires a positive credit check.If you wish to use Klarna, your data will be forwarded to Klarna during the purchase process and fulfillment of the sales contract for the purpose of address and credit checks. Depending on the results of the credit check, not all payment methods may be available to you. Please note that we have no influence over this. You can find further information and Klarna’s terms of use here. Klarna’s privacy policy can be found here.

PayPal:https://www.paypal.com/de/webapps/mpp/ua/privacy-fullWhen paying via PayPal, credit card via PayPal, direct debit via PayPal, or—if offered—“purchase on account” or “installment payment” via PayPal, we will forward your payment data to PayPal (Europe)S.a.r.l. et Cie,S.C.A. 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter “PayPal”). This transfer is made in accordance with Art. 6(1)(b) of the GDPR and only to the extent necessary for payment processing.PayPal reserves the right to carry out a credit check for the payment methods credit card via PayPal, direct debit via PayPal or - if offered - "purchase on account" or "payment by installments" via PayPal. For this purpose, your payment data may be passed on to credit agencies in accordance with Art. 6 para. 1 lit. f GDPR on the basis of PayPal's legitimate interest in determining your solvency. PayPal uses the result of the credit check with regard to the statistical probability of non-payment for the purpose of deciding on the provision of the respective payment method. The credit report may contain probability values (so-called score values). If score values are included in the result of the credit report, they are based on a scientifically recognized mathematical-statistical procedure. The calculation of the score values includes, but is not limited to, address data. For further information regarding data protection, including details on the credit reporting agencies used, please refer to PayPal’s Privacy Policy:https://www.paypal.com/de/webapps/mpp/ua/privacy-fullYou may object to this processing of your data at any time by sending a message to PayPal. However, PayPal may still be entitled to process your personal data if this is necessary for the contractual processing of payments.

VISA:www.visaeurope.com

MasterCard:https://www.mastercard.de/de-de.html

8. Social Media Presence
8.1. Data Processing by Carreraand Legal
BasisOur social media presence (Facebook or Meta, X, TikTok, YouTube, LinkedIn, Xing, and Instagram) serves the purpose of Carrerainforming you about Carreraas well as new developments, services, and products from us. Depending on the offerings of the respective providers, you havez.B. the option to engage in various interactions (commenting, recommending, etc.)z.B.in connection with our social media presence. User interaction is an important factor for us in conducting targeted marketing. This allows usz.B. to determine which posts are most frequently read. We therefore also use the statistics compiled by the providers for our own purposes. If we process users’ personal data in this context, the legal basis for this is Art. 6(1)(f) GDPR. Our legitimate interest in this regard consists, in particular, of targeted information and advertising. You will be informed separately by the providers regarding the legal basis on which they process your data for their own purposes.

8.2. Joint Responsibility
In certain cases,


we are jointly responsible with the social media providers for the processing of your personal data. In this case, you may generally exercise your rights (see Section 12) against bothYou may assert these rights against us as well as against the social media provider. However, the social media provider is your first point of contact.

We have entered into an agreement with Meta regarding joint responsibility for the processing of personal data. This agreement applies to the processing of so-called “Insights data.” This refers to page statistics, particularly regarding interactions by Facebook users. Details about Insights data can be found here:https://www.facebook.com/business/pages/manage#page_insights. You can view our agreement with Meta at the following link:www.facebook.com/legal/terms/page_controller_addendum. Please note that Meta is a company based in the United States. Meta is an active participant in theU.S.EU-U.S.U.S. Data Privacy Framework, which ensures the secure transfer of personal data to the United States. Further information can be found here:https://www.dataprivacyframework.gov/list

We have entered into an agreement with LinkedIn Ireland regarding so-called“Page Insights”: We have also entered into a joint liability agreement. Through Page Insights, LinkedIn Ireland does not provide us with any personal data about you, but only aggregated data. We are unable to draw conclusions about individual users based on the information provided by Page Insights. You can view details about Page Insights and our agreement with LinkedIn Ireland at the following link:https://legal.linkedin.com/pages-joint-controller-addendum. Please note that LinkedIn Ireland may also process your data outside the EU/EEA. LinkedIn Corporation is an active participant in the EU-U.S.U.S. Data Privacy Framework, which ensures the secure transfer of personal data to the U.S. For more information, please visit:https://www.dataprivacyframework.gov/list.

We use the analytics features of “TikTok Insights.” Through TikTok Insights, we receive an aggregated analysis of visitor behavior on our profile.For example, we may collect data such as likes, video shares, and the age and gender of visitors. We use this analysis via TikTok Insights to improve our profile, our reach, and our audience reach. To the extent that the data you provide to us via TikTok is processed exclusively by TikTok, TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland (“TikTok Ireland”), and TikTok Information Technologies UK Limited, WeWork, 125 Kingsway, London, WC2B 6NH (“TikTok UK”) are also data controllers alongside us. When we process data jointly with TikTok, we have also entered into a joint responsibility agreement with TikTok. Details can be found under:https://ads.tiktok.com/i18n/official/policy/jurisdiction-specific-terms, Part B 1, Sections 3 and 4). A summary of the key provisions of this agreement can be found at:https://www.tiktok.com/legal/page/global/information-about-tiktok-analytics/en.

With regard to the retention period for the data we process from you for our own purposes, please refer to our explanation in Section 10. In all other respects, please refer to the privacy policies of the respective social media provider.

9. Data Transfer to Countries Outside the EUTo
the
extent necessary for our purposes, we may also transfer your data to recipients outside the EU if you have given your consent, there is a legal obligation to do so, or the data transfer is permissible on another legal basis. For example, your data may also be transferred to recipients based in the United States as part of our data processing activities. An adequate level of data protection isU.S. ensuredthrough the conclusion of the new so-called EU Standard Contractual Clauses and/or the service provider’s participation in the EUU.S. Data Privacy Frameworkin the U.S.U.S. An overview of the participants in the EU-U.S.You can find the Data Privacy Framework here:https://www.dataprivacyframework.gov/s/participant-search

10. Duration of personal data storage/Criteria for determining the duration
. We generally store your personal data for as long as is necessary for the aforementioned processing purposes, provided that, in the event of an objection, there Carreraare no compelling legitimate grounds for Carreraprocessing Carrerathat override your interests, Carreraor, in the event of a withdrawal of consent, there is no other legal basis for data processing. Please also refer to the information in the cookie banner.

In certain cases,z.B. however, where a legal retention obligation applies, your personal data will not be deleted immediately but will first be blocked.

11.Security Measures to Protect Your Personal Data
We protect your data from unauthorized access, loss, or destruction through technical and organizational measures. Our security measures are continuously improved in line with technological advancements. Our employees and all persons involved in data processing are required to comply with data protection laws and to handle personal data confidentially. Our employees are trained accordingly.

To protect our users’ personal data, we use a secure online transmission method known as “Secure Socket Layer” (SSL) transmission. You can recognize this by the “s” appended to the address component http:// (“https://”) or by a green, closed padlock icon. By clicking on the icon, you can view information about the SSL certificate being used. The appearance of the icon depends on the version of your browser. SSL encryption ensures that your data is transmitted securely and in its entirety.

12. Provider and Data Protection
OfficerIn accordance with legal requirements Carrera

, you Carreragenerally have Carrerathe right to Carrera

: confirmation as to whether personal data concerning you Carrerais being processed by Carreraus Carrera,
information about this data and the circumstances of its processing,
correction if this data is inaccurate,
erasure if there is no justification for processing and no obligation to retain the data (any longer),
restriction of processing in specific cases defined by law, and
objection in the event of data processing based on Art. 6(1)(f). GDPR and
the transfer of your personal data—to the extent that you have provided it—to you or a third party in a structured, commonly used, and machine-readable format.

To the extent that the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time, with the result that the processing of your personal data will no longer be permitted in the future. However, this does not affect the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal.

Please direct your specific request in writing or by email, clearly identifying yourself, to our Data Protection Officer:

krupna LEGAL

email:datenschutz@carrera-toys.com
To the extent that we process your data under joint responsibilityi.S.d. pursuant to Art.26 GDPR with third parties, the third party is primarily responsible for ensuring that all data subjects’ rights are upheld. However, you are free to exercise your rights directly with us as well.

Finally, we would like todsb@dsb.gv.at

remind you of your right to lodge a complaint with the supervisory authority (Austrian Data Protection Authority, Barichgasse 40-42, 1030 Viennadsb@dsb.gv.at)

13. No Automated Individual Decision-Making
We do not use your personal data for automated individual decision-making.

14. Changes to the Privacy Policy
New legal requirements, business decisions, or technical developments may necessitate changes to our Privacy Policy. The Privacy Policy will then be updated accordingly. You can always find the most current version on our website.

As of: January 14, 2024

Privacy
PolicyIn the following, we, d.h. Carrera Toys GmbH (hereinafter referred to as “Carrera we”Carrera or “us”), informd.h . CarreraCarrerayou about the nature, scope, and purpose of the collection and use of your personal data in connection with the Carrera Hybridapp (hereinafter referred to as the “App”). Personal data refers to any information relating to an identified or identifiable natural person. This includes, in particular, your name, your address, and your email address.

1. Data Controller and Data
Protection OfficerThe data
controller for the App and the data controller within the meaning of data protection law is

CarreraToys GmbH
Rennbahn Allee 1
5 412 Puch/Salzburg


Austria Managing Director: Stefan Krings

Tel.: +43 662 88921-0Email

:shop@carrera-revell.com
Data Protection Officer:

krupna LEGAL

E-mail:datenschutz@carrera-toys.com
2.Data Processing and PurposeDepending
on the specific use of the app, personal data is processed for the purposes listed below. Unless otherwise specified, the legal basis for data processing is Article 6(1)(b) of the GDPR.

2.1. Downloading the App

When you download the app, the necessary information is transmitted to the respective app store,d.h. including your username, email address, and account number, the time of download, payment information, and individual device codes. We have no influence over this data collection and are not responsible for it. We process the data provided to the extent necessary for downloading the app to your device. We do not store this data beyond that.

2.2.Device and Connection Data

When your device connects to our server, your device and connection data are processed. This includes your IP address, the date and time of the request, device identification numbers (UDID and similar device numbers), and other device information (operating system and version, manufacturer and model, IMEI, IMSI, mobile phone number, MAC address). The connection data is not used to draw conclusions about the user’s identity or combined with data from other sources, but rather serves to identify your device, improve the app, and troubleshoot issues. The legal basis is Article 6(1)(f) of the GDPR. After the respective session or use of the app, the data is anonymized by truncating the IP address at the domain level.

2.3. Initial

RegistrationTo use the app, you must first register. To register for the first time, you must enter your email address, username, and password (hereinafter referred to as “login credentials”), accept the Terms and Conditions, and you will then receive a confirmation link via email. Once you click the link in the email, the registration process is complete. A password must be at least 8 characters long and should preferably consist of a combination of uppercase and lowercase letters, numbers, and special characters. Common words such as "ABC" or keyboard sequences (z.B. "qwert" or "asdfgh"), all types of names (z.B. of friends, colleagues, family members, pets), names of cities and buildings, comic book characters, car brands, license plate numbers, terms, dates of birth, phone numbers, common abbreviations, etc.,are problematicz.B.z.B. .

Your login credentials must be kept strictly confidential. For your own protection, you must not reuse passwords that have already been used.

In addition, we store your IP address and the time of registration as part of the initial registration process. This is necessary to ensure the security of our IT systems. The legal basis for the processing of your data in this case is Article 6(1)(f) of the GDPR.

Information that is strictly necessary for using the app is marked as required. Failure to provide this information will result in your inability to complete the registration process and use the app.

2.4. Login Data - Regular Login

To log in to the app in the future after successful initial registration (Section 2.3), you will regularly be required to enter your login data. Your login credentials are transmitted to the server in encrypted form and cannot be viewed by third parties. You do not need to re-enter your login credentials every time you use the app. Instead, your login credentials are temporarily stored on your device using a refresh token. However, to prevent unauthorized use of the app by third parties, we recommend that you log out after use and re-enter your login credentials each time you use the app.

2.5. App Usage and FunctionalityThe

following features are available to you when using the app:

Creating drivers, vehicles, and
routesListing races (esp. times and routes)
Performance measurement

Within the app, you have the optionz.B. to name drivers individually. It is not necessary to use real names when using the app.

To connect the app to your vehicle, the app requires your permission to access the Bluetooth function on your device. You will be prompted to grant this permission within the app.

The legal basis for data processing—insofar as you are asked to grant permission—is your consent pursuant to Article 6(1)(a) of the GDPR. You are not obligated to give your consent. However, if you do not give your consent, you will not be able to use the app’s full functionality. You can revoke or grant your consent at any time in the future via your device’s settings.

Other processing of your data is based on Art. 6(1)(f) GDPR.

2.6. Authorization for Location

ServicesTo function fully, the app requires your authorization for the location services on your device. The so-called The Location Access Service is required for a data-based Bluetooth connection. The legal basis for data processing is therefore your consent pursuant to Art. 6(1)(a) of the GDPR. You are not required to give your consent. However, if you do not give your consent, you will not be able to use the app’s full functionality. You can revoke or grant your consent at any time in the future via the settings on your device.

2.7. Crash Reports/Error Messages

If you consent to the transmission of a crash report following a system crash of the app or another technical error, the relevant information will be transmitted anonymously to the app’s developers for the purpose of analysis.

3. Links to Other Websites
The app may contain links to social networks (Facebook or Meta, YouTube). These websites are operated by third parties. If you follow the links, information may be transmitted to these third parties. For information on the purpose and scope of data collection by third-party websites, as well as the further processing and use of your data on those sites, and your rights and privacy settings in this regard, please refer to the respective privacy policies of the operators.

4. Recipients/Categories of Recipients of Your
DataWe only disclose your personal data to third parties or other recipients if this is necessary for the provision of services, you have consented, there is a legal obligation, or the disclosure of data is permissible on another legal basis. Where necessary, we have entered into data processing agreements with the recipients of your data in accordance with Art. 28 of the GDPR. In accordance with this policy, we use, for example, the hosting services of Amazon Web Services Inc., EMEA SARL, 38 avenue John F. Kennedy, L-1855, Luxembourg, which operates a data center in Frankfurt am Main.

We disclose your data to government authorities only in accordance with legal obligations or based on an official order or court decision.

Furthermore, your personal data may be transferred to the following recipients or categories of recipients in accordance with the aforementioned provisions:

Companies within the corporate group of Carrerain its current or future form (a corporate group consists of a controlling company and its subsidiaries, see Art. 4 No. 19 GDPR).
Business partners, sales partners, etc.
Employees and freelancersService providers
(z.B.IT service providers,
corporate buyers or prospective buyers
, and/or
investors; where applicable
, government agencies or other public authorities.

5. Data Transfer to Countries Outside the EU
As a general rule, we do not transfer your data to recipients outside the EU. However, if it is necessary for our purposes, we will only transfer your data if it is ensured that the recipient of the data guarantees an adequate level of data protection and no other legitimate interests oppose the data transfer.

6. Retention Period for Personal Data/Criteria for Determining the Retention
PeriodYour personal data will be Carrerastored by us Carrerafor as long as is necessary for the aforementioned processing purposes, provided that, in the event of an objection, there Carreraare no compelling legitimate grounds on our part that Carrera override your interests, Carreraor, in the event of a withdrawal of consent, there is no other legal basis for the data processing. In certain cases,z.B. however,z.B. where a legal retention obligation exists, your personal data will not be deleted immediately but will first be blocked.

7. Security measures to protect your personal data
We protect your data from unauthorized access, loss, or destruction through technical and organizational measures. Our security measures are continuously improved in line with technological developments.In this context, however, it is important that you actively manage updates to ensure that the software on your devices is always up to date. If youz.B. are using outdated versions of iOS or Android, certain security measures related to the app may not be guaranteed.

8. Your Rights

Within the framework of legal requirements Carrera

, you Carreragenerally have Carrerathe right to

: confirmation as to whether personal data concerning you Carrerais being processed by Carreraus,
information about this data and the circumstances of the processing,
correction if this data is inaccurate,
erasure if there is no justification for processing and no obligation to retain it (any longer),
restriction of processing in specific cases defined by law, and
objection in the event of data processing based on Art.Article 6(1)(f) of the GDPR and
the transmission of your personal data—to the extent that you have provided it—to you or a third party in a structured, commonly used, and machine-readable format.
To the extent that the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time, with the result that the processing of your personal data will no longer be permitted in the future. However, this does not affect the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal. Please note the settings on your device in this regard.

Please submit your specific request in writing or by email, ensuring that your identity can be clearly verified, to:

CarreraToys GmbH
Rennbahn Allee 1
5 412 Puch/Salzburg


Austria Email:datenschutz@carrera-toys.com
Finally, we would like todsb@dsb.gv.atinform you of your right to lodge a complaint with the supervisory authority (Austrian Data Protection Authority, Wickenburggasse 8, 1080 Vienna,dsb@dsb.gv.at).

9. No Automated Individual
Decision-MakingWe do not use your personal data for automated individual decision-making.

10. Changes to the Privacy
PolicyNew legal requirements, business decisions, or technical developments may necessitate changes to our Privacy Policy. The Privacy Policy will then be updated accordingly. You can always find the current version in the app.

Privacy Policy: <tc>Carrera</tc> Race Management App

In the following provisions, we, d.h. Carrera Toys GmbH, informd.h . Carrerayou about the nature, scope, and purposes of the collection and use of your personal data in connection with the CarreraRace Management app (hereinafter: “Race App”). Personal data refers to any information relating to an identified or identifiable natural person. This includes, in particular, your name and email address.

1. Provider and Data Protection Officer
The provider
of the Race App and the controller within the meaning of data protection law is

CarreraToys GmbH
, Renn
bahn Allee 1, 5412
Puch/Salzburg
, Austria

. Managing


Director

: Stefan Krings
. Tel.: +43 (0) 662 88921-0
Email:shop@carrera-toys.com
CarreraYou can contact the data protection officer of CarreraToys GmbH at

Email:datenschutz@carrera-toys.com
CarreraToys GmbH
Rennbahn Allee 1
5412 Puch/Salzburg

2.Data Processing and PurposeDepending
on the specific use of the Race App, personal data is processed for the purposes listed below. Unless otherwise stated, the legal basis for data processing is Article 6(1)(b) of the GDPR.

2.1. Downloading the Race App
When you download the Race App, the necessary information is transmitted to the respective app store, d.h . including your username, email address, and account number, the time of download, payment information, and your device’s unique identifier. We have no influence over this data collection and are not responsible for it. We process this provided data to the extent necessary for downloading the Race App onto your device. It is not stored further beyond this.

2.2. Device and Connection
Data
When your device establishes a connection with our server, your device and connection data are processed. This includes your IP address, the date and time of the request, device identifiers (UDID and similar device numbers), and other device information (operating system and version, manufacturer and model, IMEI, IMSI, mobile phone number, MAC address). Connection data is not used to identify the user personally or combined with data from other sources, but serves to identify your device, improve the RC MicroHD app, and troubleshoot issues. The legal basis is Art. 6(1)(f) of the GDPR.

2.3. Functions of the RC MicroHD App and Data
Processing
When using the Race App, the following functions are available to you in particular:

• Creating drivers, vehicles, and tracks
• Conducting championships (including Training and Qualification)
• List of fastest races
• Performance measurement

After entering the above data and before the race begins:

• Adjust speed/fuel/brakes

Within the Race App, you canz.B. name drivers individually and assign a photo to each one. As part of these features, you can access the photo album stored on your device or—after individually enabling the camera function—take a new photo.

To establish a connection between the Race App and the vehicle, the Race App requires your permission to access your device’s Bluetooth function. You will be prompted accordingly within the Race App. The legal basis for data processing—insofar as you are asked for authorization—is your consent pursuant to Art. 6(1)(a) of the GDPR. You are not obligated to provide your consent.However, if you do not give your consent, you will not be able to use all the features of the Race app. You can revoke or grant your consent at any time in the settings of your device, effective for the future. The processing of your data in other respects is based on Art. 6(1)(f) GDPR.

2.4. Authorization for Location
ServicesTo function fully, the app requires your authorization to access the location services on your device. The so-called Location Access Service is required for a data-based Bluetooth connection. The legal basis for data processing is therefore your consent pursuant to Art. 6(1)(a) GDPR. You are not obligated to give your consent. However, if you do not give your consent, you will not be able to use the app’s full functionality. You can revoke or grant your consent at any time in the future via the settings on your device.

3. Links to Other Websites
The Race App contains links to social media platforms (Facebook, YouTube). These websites are operated by third parties. If you follow the links, information may be transmitted to these third parties. For the purpose and scope of data collection by third-party websites, as well as the further processing and use of your data there, and your rights and settings options regarding the protection of your privacy, please refer to the respective privacy policies of the operators.

4. Data
TransferYour personal data will only be transferred to third parties or other recipients if there is legal authorization to do so or if you have given your prior consent. Where necessary, we have entered into data processing agreements with the recipients of your data in accordance with Article 28 of the GDPR. We disclose your data to government agencies only to the extent required by law or pursuant to an official order or court decision.

5. Data Transfer to Countries Outside the EU
We generally do not transfer your data to recipients outside the EU. However, should it be necessary for our purposes, we will only transfer your data if it is ensured that the recipient of the data guarantees an adequate level of data protection and no other legitimate interests oppose the data transfer.

6. Period for which personal data is stored/Criteria for determining the period
Your personal data will be Carrera stored by CarreraToys GmbH for as long as is necessary for the aforementioned purposes of processing, provided that, in the event of an objection, there Carreraare no compelling legitimate grounds on the part of CarreraToys GmbH that would prevent this, Carreraor, in the event of a withdrawal of consent, there is no other legal basis for data processing. In certain cases,z.B. however,z.B . where a legal retention obligation applies, your personal data will not be deleted immediately but will first be blocked.

7. Data
SecurityWe protect your data against unauthorized access, loss,


or destruction through technical and organizational measures. Our security measures are continuously improved in line with technological developments.In this context, however, it is important that you actively manage updates yourself to ensure that the software on your devices is always up to date. If youz.B. are using outdated versions of iOS or Android, some security measures related to the RC MicroHD app may not be guaranteed.

8.Your Rights
: Within the framework of legal requirements Carrera

Carrera, you Carreragenerally have Carrerathe following rights with respect to CarreraToys GmbH:

• Confirmation as to whether personal data concerning you Carrerais being processed by CarreraToys GmbH,
• Access to this data and information regarding the circumstances of its processing,
• Rectification, if this data is inaccurate,
• Erasure, if there is no justification for the processing and no obligation to retain the data (any longer),
• Restriction of processing in specific cases provided for by law,
• Objection in the event of data processing based on Art. 6(1)(f) GDPR, and
• Transfer of your personal data—to the extent you have provided it—to you or a third party in a structured, commonly used, and machine-readable format.

To the extent that the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time, with the result that the processing of your personal data will no longer be permitted going forward. However, this does not affect the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal. Please note the settings on your device in this regard. Please submit your specific request in writing or by email, clearly identifying yourself, to:

Email:datenschutz@carrera-toys.com
CarreraToys GmbH

Rennbahn Allee 1

541

2 Puch/Salzburg Finally

, we would like todsb@dsb.gv.atinform you of your right to lodge a complaint with the supervisory authority (Austrian Data Protection Authority, Wickenburggasse 8, 1080 Viennadsb@dsb.gv.at).

9. No automated individual
decision-makingWe do not use your personal data for automated individual decision-making.

10. Changes to the Privacy
PolicyNew legal requirements, business decisions, or technological developments may require changes to our Privacy Policy. The Privacy Policy will then be updated accordingly.

Privacy Policy: <tc>Carrera</tc> <tc>GO!!!</tc> Plus App

In the following provisions, we, d.h. Carrera Toys GmbH, inform d.h . Carrera you about the nature, scope, and purposes of the collection and use of your personal data in connection with the Carrera Go!!! Plus app (hereinafter: “Carrera Go!!! app”). Personal data refers to any information relating to an identified or identifiable natural person. This includes, in particular, your name and email address.

1. Provider and Data Protection
OfficerThe provider of GO!!! the GO!!!Plus App and the controller within the meaning of data protection law is

CarreraToys GmbH
Rennbahn Allee 1 5412
Puch/Salzburg Austria Managing


Director: Stefan Krings
Tel.: +43 (0) 662 88921-0
Email:shop@carrera-toys.com
CarreraYou can contact the data protection officer of Carrera Toys GmbH at

Email:datenschutz@carrera-toys.com
CarreraToys GmbH
Rennbahn Allee 1
5412 Puch/Salzburg

2. Data Processing and Purpose
: Depending on the specific use of the GO!!!Plus App, personal data is processed for the purposes listed below. Unless otherwise stated, the legal basis for data processing is Art. 6(1)(b) of the GDPR.

2.1. Downloading the Carrera GO!!!
App
When you download the RC MicroHD App, the necessary information is transmitted to the respective app store, d.h . including your username, email address, and account number, the time of download, payment information, and your device’s unique identifier. We have no influence over this data collection and are not responsible for it. We process this provided data to the extent necessary for downloading the RC MicroHD app onto your device. It is not stored further beyond this.

2.2.Device and Connection
DataWhen you download the Carrera GO!!! Plus App, the necessary information is transmitted to the respective app store, d.h . including your account username, email address, and customer number, the time of the download, payment information, and your device’s unique identifier. We have no control over this data collection and are not responsible for it. We process this provided data to the extent Carrera Go necessary for downloading the Carrera Go!!! Plus App onto your device. It is not stored beyond that.

2.3. Features of the Carrera GO!!! Plus App and Data
ProcessingWhen using the Carrera GO!!! Plus App, the following features are available to you:

• Adding drivers
• Pursuit
mode• Training
• Lap races

Within the Carrera GO!!!Plus App, you canz.B. name drivers individually. To connect the Carrera Go!!! App to the vehicle, the Carrera Go!!!app requires your approval/authorization for the Bluetooth function on your device. You will be GO!!!prompted accordingly in the GO!!!Plus App. The legal basis for data processing—insofar as you are asked for approval/authorization—is your consent pursuant to Art. 6(1)(a) GDPR. You are not obligated to give your consent.However, if you do not give your consent, you will GO!!!not be able to GO!!!use all features of GO!!!the GO!!!Plus App. You can revoke or grant your consent at any time in the future via the settings on your device. Other processing of your data is based on Art. 6(1)(f) GDPR.

2.4. Authorization for Location
ServicesFor the app to function fully, it requires your authorization for the location services on your device. The so-called Location Access Service is required for a data-based Bluetooth connection. The legal basis for data processing is therefore your consent pursuant to Art. 6(1)(a) GDPR. You are not obligated to give your consent. However, if you do not give your consent, you will not be able to use the app’s full functionality. You can revoke or grant your consent at any time in the future via the settings on your device.

3. Data
Transfer Your personal data will only be transferred to third parties or other recipients if there is a legal basis for doing so or if you have given your prior consent. Where necessary, we have entered into data processing agreements with the recipients of your data in accordance with Article 28 of the GDPR. We only disclose your data to government agencies within the scope of our legal obligations or pursuant to an official order or court decision.

4. Data Transfer to Countries Outside the EU
We generally do not transfer your data to recipients outside the EU. However, if it is necessary for our purposes, we will only transfer your data if we are certain that the recipient of the data ensures an adequate level of data protection and there are no other legitimate interests that would prevent the transfer of data.

5. Duration for which personal data is stored/Criteria for determining the durationYour
personal data will be Carrera stored by CarreraToys GmbH for as long as is necessary for the aforementioned processing purposes, provided that, in the event of an objection, Carrera there are no compelling legitimate grounds on the part of Carrera Toys GmbH to the contrary, Carreraor, in the event of a withdrawal of consent, there is no other legal basis for data processing. In certain cases,z.B. however,z.B. where a statutory retention obligation applies, your personal data will not be deleted immediately but will first be blocked.

6. Data
Security: We protect your data from unauthorized access, loss, or destruction through technical and organizational measures. Our security measures are continuously improved in line with technological developments. In this context, however, it is important that you actively manage updates yourself to ensure that the software on your devices is always up to date. If you z.B. are using outdated versions of iOS or Android, some security measures related to the Carrera Go !!! Plus app may Carrera Gonot be guaranteed.

7.Your Rights
: Within the framework of legal requirements Carrera

Carrera, you Carreragenerally have Carrerathe following rights with respect to CarreraToys GmbH

: • Confirmation as to whether CarreraToys GmbH is processing personal data concerning you Carrera,
• Information about this data and the circumstances of its processing,
• Rectification, if this data is inaccurate,
• Erasure, if there is no justification for the processing and no obligation to retain the data (any longer),
• restriction of processing in specific cases provided for by law,
• objection in the event of data processing based on Art. 6(1)(f) GDPR, and
• transmission of your personal data—to the extent you have provided it—to you or a third party in a structured, commonly used, and machine-readable format.

To the extent that the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time, with the result that the processing of your personal data will no longer be permitted going forward. However, this does not affect the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal. Please note the settings on your device in this regard. Please submit your specific request in writing or by email, including clear identification of your identity, to:

Email:datenschutz@carrera-toys.com
CarreraToys GmbH

Rennbahn Allee 1

541

2 Puch/Salzburg Finally

, we would like todsb@dsb.gv.atinform you of your right to lodge a complaint with the supervisory authority (Austrian Data Protection Authority, Wickenburggasse 8, 1080 Viennadsb@dsb.gv.at).

8. No automated individual
decision-makingWe do not use your personal data for automated individual decision-making.

9. Changes to the Privacy
PolicyNew legal requirements, business decisions, or technological developments may require changes to our Privacy Policy. The Privacy Policy will then be updated accordingly.

Privacy Policy: <tc>Carrera</tc> RC App

In the following provisions, we, d.h. Carrera Toys GmbH, informd.h . Carrerayou about the nature, scope, and purposes of the collection and use of your personal data in connection with Carrerathe CarreraRC App (hereinafter: “RC App”). Personal data refers to any information relating to an identified or identifiable natural person. This includes, in particular, your name and email address.

1. Provider and Data Protection OfficerThe
provider
of the RC App and the controller within the meaning of data protection law is

CarreraToys GmbH
, Renn
bahn Allee 1, 5412
Puch/Salzburg
, Austria

. Managing Director


: Stefan Krings
. Tel.: +43 (0) 662 88921-0
Email:shop@carrera-toys.com
CarreraYou can contact the data protection officer of CarreraToys GmbH at

Email:datenschutz@carrera-toys.com
CarreraToys GmbH
Rennbahn Allee 1
5412 Puch/Salzburg

2.Data Processing and PurposeDepending
on the specific use of the RC app, personal data is processed for the purposes listed below. Unless otherwise stated, the legal basis for data processing is Art. 6(1)(b) of the GDPR.

2.1. Downloading the RC
App
When you download the RC App, the necessary information is transmitted to the respective app store, d.h. including your username, email address, and account number, the time of the download, payment information, and your device’s unique identifier. We have no influence over this data collection and are not responsible for it. We process this provided data to the extent necessary for downloading the RC app to your device. It is not stored further beyond this.

2.2.Device and Connection
Data
When your device establishes a connection with our server, your device and connection data are processed. This includes your IP address, the date and time of the request, device identifiers (UDID and similar device numbers), and other device information (operating system and version, manufacturer and model, IMEI, IMSI, mobile phone number, MAC address). Connection data is not used to identify the user personally or combined with data from other sources, but serves to identify your device, improve the RC MicroHD app, and troubleshoot issues. The legal basis is Art. 6(1)(f) of the GDPR.

2.3. RC App Features and Data
ProcessingWhen using the RC App, the following features are available to you:

• Setting up a local network between your mobile phone and the quadcopter
• Transmission of real-time images (video/photo) to the app
• Saving of video/photos from the transmission in the app/local image/video folder

To establish a connection between the RC app and the vehicle, the RC app requires your approval/authorization for the Wi-Fi function of your device. You will be prompted accordingly in the RC app. The legal basis for data processing—insofar as you are asked for authorization—is your consent pursuant to Art. 6(1)(a) of the GDPR. You are not obligated to give your consent. However, if you do not give your consent, you will not be able to use the full functionality of the RC app.You can revoke or grant your consent at any time in the future via the settings on your device. Any other processing of your data is based on Article 6(1)(f) of the GDPR.

3. Link to the Online Store
This RC app contains a link to the online store of Carrera Toys GmbH. Please note the separate privacy policy of the online shop in this regard.

4. Data
TransferYour personal data will only be transferred to third parties or other recipients if there is legal authorization to do so or if you have given your prior consent. Where necessary, we have entered into data processing agreements with the recipients of your data in accordance with Article 28 of the GDPR. We will only disclose your data to government authorities within the scope of our legal obligations or pursuant to an official order or court decision.

5. Data Transfer to Countries Outside the EUWe
generally do not transfer your data to recipients outside the EU. However, if it is necessary for our purposes, we will only transfer your data if it is ensured that the recipient of the data guarantees an adequate level of data protection and no other legitimate interests preclude the data transfer.

6. Duration for which personal data is stored/Criteria for determining the duration
Your personal data will be Carrerastored by CarreraToys GmbH for as long as is necessary for the aforementioned purposes of processing, provided that, in the event of an objection, Carrerathere are no compelling legitimate grounds on the part of CarreraToys GmbH to the contrary, Carreraor, in the event of a withdrawal of consent, there is no other legal basis for data processing. In certain cases,z.B . However, if there is a legal obligation to retain data, your personal data will not be deleted immediately but will first be blocked.

7. Data
Security We protect your data from unauthorized access, loss, or destruction through technical and organizational measures. Our security measures are continuously improved in line with technological developments. In this context, however, it is important that you actively manage updates yourself to ensure that the software on your devices is always up to date. If youz.B . are using outdated versions of iOS or Android, some security measures related to the RC MicroHD app may not be guaranteed.

8.Your Rights
: Within the framework of legal requirements Carrera

Carrera , you Carreragenerally have Carrerathe following rights with respect to CarreraToys GmbH:

• Confirmation as to whether personal data concerning you Carrerais being processed by CarreraToys GmbH,
• Information about this data and the circumstances of the processing,
• Rectification, if this data is inaccurate,
• Erasure, if there is no justification for the processing and no obligation to retain the data (any longer),
• restriction of processing in specific cases provided for by law,
• objection in the event of data processing based on Art. 6(1)(f) GDPR, and
• transmission of your personal data—to the extent you have provided it—to you or a third party in a structured, commonly used, and machine-readable format.

To the extent that the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time, with the result that the processing of your personal data will no longer be permitted in the future. However, this does not affect the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal. Please refer to the settings on your device for more information. Please submit your specific request in writing or by email, clearly identifying yourself, to:

Email:datenschutz@carrera-toys.com
CarreraToys GmbH

Rennbahn Allee 1

5412 Puch/Salzburg

Finally, we would like todsb@dsb.gv.atinform you of your right to lodge a complaint with the supervisory authority (Austrian Data Protection Authority, Wickenburggasse 8, 1080 Viennadsb@dsb.gv.at).

9. No automated individual
decision-makingWe do not use your personal data for automated individual decision-making.

10. Changes to the Privacy
PolicyNew legal requirements, business decisions, or technological developments may require changes to our Privacy Policy. The Privacy Policy will then be updated accordingly.

Privacy Policy: <tc>Carrera</tc> RC FPV App

In the following provisions, we, d.h. Carrera Toys GmbH, informd.h . Carrerayou about the nature, scope, and purposes of the collection and use of your personal data in connection with the CarreraRC FPV app (hereinafter: “RC FPV app”). Personal data refers to any information relating to an identified or identifiable natural person. This includes, in particular, your name and email address.

1. Provider and Data Protection OfficerThe
provider
of the RC FPV App and the controller within the meaning of data protection law is

CarreraToys GmbH
, Renn
bahn Allee 1, 5412
Puch/Salzburg
, Austria

. Managing


Director: Stefan Krings
. Tel.: +43 (0) 662 88921-0
Email:shop@carrera-toys.com
CarreraYou can contact the data protection officer of CarreraToys GmbH at

Email:datenschutz@carrera-toys.com
CarreraToys GmbH
Rennbahn Allee 1
5412 Puch/Salzburg

2.Data Processing and PurposeDepending
on the specific use of the RC FPV app, personal data is processed for the purposes listed below. Unless otherwise stated, the legal basis for data processing is Article 6(1)(b) of the GDPR.

2.1. Downloading the RC FPV
App
When you download the RC FPV App, the necessary information is transmitted to the respective app store,d.h . including your username, email address, and account number, the time of download, payment information, and your device’s unique identifier. We have no influence over this data collection and are not responsible for it. We process this provided data to the extent necessary for downloading the RC FPV app onto your device. It is not stored further beyond that.

2.2.Device and Connection
Data
When your device establishes a connection with our server, your device and connection data are processed. This includes your IP address, the date and time of the request, device identifiers (UDID and similar device numbers), and other device information (operating system and version, manufacturer and model, IMEI, IMSI, mobile phone number, and MAC address). Connection data is not used to identify the user personally or combined with data from other sources, but serves to identify your device, improve the RC MicroHD app, and troubleshoot issues. The legal basis is Article 6(1)(f) of the GDPR.

2.3. RC FPV App Features and Data
ProcessingWhen using the RC FPV app, the following features are available to you:

• Setting up a local network between your mobile phone and the
quadcopter• Streaming real-time images (videoand photos) to the app
• A special display mode for use with 3D glasses, in which the mobile phone serves as the display device.
• Saving videoand photos from the transmission to the app/local image/video folder

To establish a connection between the RC FPV app and the vehicle, the RC FPV app requires your permission to access the Wi-Fi function of your device. You will be prompted accordingly within the RC FPV app. The legal basis for data processing is—insofar as you are asked for authorization—your consent pursuant to Art. 6(1)(a) of the GDPR. You are not obligated to give your consent.However, if you do not give your consent, you will not be able to use all the features of the RC FPV app. You can revoke or grant your consent at any time in the future via the settings on your device.

The processing of your data for other purposes is based on Art. 6(1)(f) of the GDPR.

3. Link to the Online Store
This RC FPV app contains a link to the online store of CarreraToys GmbH. Please note the separate privacy policy of the online shop in this regard.

4. Data
TransferYour personal data will only be transferred to third parties or other recipients if there is legal authorization to do so or if you have given your prior consent. Where necessary, we have entered into data processing agreements with the recipients of your data in accordance with Article 28 of the GDPR. We disclose your data to government agencies only to the extent required by law or pursuant to an official order or court decision.

5. Data Transfer to Countries Outside the EU
We generally do not transfer your data to recipients outside the EU. However, should it be necessary for our purposes, we will only transfer your data if it is ensured that the recipient of the data guarantees an adequate level of data protection and no other legitimate interests oppose the data transfer.

6. Period for which personaldata is stored/Criteria for determining the period
Your personal data will be Carrerastored by Carrera Toys GmbH for as long as is necessary for the aforementioned purposes of processing, provided that, in the event of an objection, there Carreraare no compelling legitimate grounds on the part of CarreraToys GmbH that would prevent this, Carreraor, in the event of a withdrawal of consent, there is no other legal basis for data processing. In certain cases,z.B. however, z.B. where a legal retention obligation applies, your personal data will not be deleted immediately but will first be blocked.

7. Data
SecurityWe protect your data against unauthorized access, loss,


or destruction through technical and organizational measures. Our security measures are continuously improved in line with technological developments.In this context, however, it is important that you actively manage updates yourself to ensure that the software on your devices is always up to date. If you z.B. are using outdated versions of iOS or Android, some security measures related to the RC MicroHD app may not be guaranteed.

8.Your Rights
: Within the framework of legal requirements Carrera

Carrera, you Carreragenerally have Carrerathe following rights with respect to CarreraToys GmbH:

• Confirmation as to whether CarreraToys GmbH is processing personal data concerning you Carrera,
• Information about this data and the circumstances of its processing,
• Rectification, if this data is inaccurate,
• Erasure, if there is no justification for the processing and no obligation to retain the data (any longer),
• Restriction of processing in specific cases defined by law,
• Objection in the event of data processing based on Art. 6(1)(f) GDPR, and
• Transfer of your personal data—to the extent you have provided it—to you or a third party in a structured, commonly used, and machine-readable format.

To the extent that the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time, with the result that the processing of your personal data will no longer be permitted going forward. However, this does not affect the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal. Please note the settings on your device in this regard. Please submit your specific request in writing or by email, including clear identification of your identity, to:

Email:datenschutz@carrera-toys.com
CarreraToys GmbH

Rennbahn Allee 1

541

2 Puch/Salzburg Finally

, we would like todsb@dsb.gv.atinform you of your right to lodge a complaint with the supervisory authority (Austrian Data Protection Authority, Wickenburggasse 8, 1080 Vienna,dsb@dsb.gv.at).

9. No automated individual
decision-makingWe do not use your personal data for automated individual decision-making.

10. Changes to the Privacy
PolicyNew legal requirements, business decisions, or technological developments may require changes to our Privacy Policy. The Privacy Policy will then be updated accordingly.