We, Carrera Toys GmbH (Carrera“we”), are pleased that you are visiting our website. In the following provisions, we inform you about the nature, scope, and purpose of the collection and use of your personal data on this website and in connection with the services we offer.

Personal data refers to any information relating to an identified or identifiable natural person. This includes, in particular, your name, address, and email address.

Please read this Privacy Policy carefully before using this website. We reserve the right to amend parts of this Privacy Policy at our discretion and in accordance with legal requirements. Therefore, please review this Privacy Policy regularly for changes.

1. Data Processing to Enable Use of the Website:

Each time you access content on our website, connection data is transmitted to our web server. This connection data includes:

  • the IP address (Internet Protocol address) of the respective user,
  • the date and time of the request,
  • the referrer URL,
  • device numbers such as z.B. UDID (Unique Device Identifier) and similar device numbers, device information (z.B. device type), and
  • the browser type and version.

This connection data is not used to identify the user personally or combined with data from other sources; rather, it is used to provide the website. The legal basis for the processing of your data is Article 6(1)(f) of the GDPR. After no more than 7 days, the data is anonymized by truncating the IP address to the domain level.

2. Data Processing at Your Request

: You can generally use our website without providing any personal data. You are under no obligation to visit this website or to provide personal data while doing so. However, providing personal data is z.B. required to receive newsletters or to register. If you do not provide us with personal data for the purposes listed below, you may not be able to use certain features of this website or individual services.

2.1. “B2B Portal” Dealer Service: If

you register with us as a dealer and use the dealer service or the B2B Portal on our website, we will process your information for this purpose. You can find details about the B2B Portal in the instructions on our portal under https://b2b.carrera-revell.com.

“The processing of your personal data is based on Article 6(1), sentence 1, letter b of the GDPR.”

2.2.

Newsletter: If you have expressly consented, you will receive our newsletter. To receive our newsletter, simply provide your email address. Providing any additional personal information is voluntary, marked accordingly (*), and serves solely to personalize the newsletter for you.

We use the so-called double opt-in procedure for subscribing to our newsletter. This means that after you subscribe, we will send an email to the email address you provided, asking you to confirm that you wish to receive the newsletter. If you do not confirm your registration within 24 hours, your information will be suspended and automatically deleted after one month.

The processing of your personal data is based on your consent pursuant to Article 6(1)(a) of the GDPR. There is no legal or contractual obligation to provide personal data. Failure to give consent simply means that you will not receive the email newsletter. You may withdraw your consent at any time with future effect. Withdrawing your consent does not affect the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal. A link to exercise your right to withdraw consent is provided at the end of each newsletter. Alternatively, you may withdraw your consent at any time z.B. by sending an email to shop@carrera-revell.com widerrufen.

When you subscribe to a newsletter, we also store your IP address and the time of your subscription in order to comply with our legal documentation requirements. The legal basis for data processing in this case is Article 6(1), first sentence, letter c of the GDPR.

2.3. Customer Registration

: If you wish to register with us as a customer, we will collect the required mandatory information (name, country, email address, password), which is marked accordingly (*). Providing any additional personal information is voluntary.

Registration is not required, but it simplifies the ordering process for future orders, as you can reuse the information you have already saved. Alternatively, you can also place an order as a guest. In this case, with the exception of a password, we collect the same information from you as we do during registration. However, this information is not stored in a customer account for you, so you do not have access to a customer account.

After registration, you log in by entering your email address and password. Please always make sure to log out before leaving the website.

When using a password, please take appropriate security measures. A password should be at least 8 characters long and, whenever possible, consist of a combination of uppercase and lowercase letters, numbers, and special characters. In this regard, trivial passwords such as “ABC” or keyboard sequences (z.B. “qwert” or “asdfgh”), all kinds of names (such as those of friends, acquaintances, coworkers, family members, and pets), city and building names, comic book characters, car brands, license plate numbers, terms, dates of birth, phone numbers, common abbreviations, etc.

The processing of your personal data is based on your consent in accordance with Article 6(1)(a) of the GDPR. Please note that in the event of a withdrawal of consent, any bonus points that may have been collected will be forfeited without replacement.

In addition, we store your IP address and the time of registration as part of the registration process. This is necessary to ensure the security of our information technology systems. The legal basis for the processing of your data in this case is Article 6(1)(f) of the GDPR.

2.4. Login

: If you are a registered customer, you can access your customer account using the login feature on this website. To log in, enter your email address and password.

Login credentials must be kept strictly confidential. If they have been disclosed—for example, to allow a third party to access certain data in an emergency—the password must be changed immediately. For your own protection, you are prohibited from reusing passwords that have already been used.

In addition, when you log in, we store your IP address and the time of access. This is necessary to ensure the security of our IT systems.

We also set a session cookie each time you log in. This session cookie prevents you from being automatically logged out while actively using your account or associated services. After you log out, the session cookie is automatically deleted within a few minutes.

The legal basis for the processing of your data is Article 6(1)(f) of the GDPR and, insofar as your contractual relationship is concerned, Article 6(1)(b) and/or (f) of the GDPR.

2.5. Wish List: If

you are logged in as a customer (see Section 2.4. f.), you can add individual products from the store to your wish list. You can access this wish list until you log out, where you will see all the products you have added. The legal basis for the processing of your data in this case is Article 6(1), first sentence, subparagraph (f) of the GDPR. When you log out as a customer, the wish list is automatically deleted.

2.6. Ordering in the Store

: When you place an order with us, we process the following data about you:

  • registration data from your customer account or your guest data,
  • purchase data (order/shopping cart),
  • payment data (payment method, bank account and credit card information, billing addresses)

. The processing of your personal data is based on Article 6(1)(b) of the GDPR.

2.7. Contests: If

you wish to participate in a contest offered by us via the website, you must first create an account. Providing your data is necessary for the purpose of conducting the contest. After the contest has ended, this data and the account will be deleted, provided there are no legal retention requirements.

Your personal data is processed on the basis of your consent pursuant to Article 6(1)(a) of the GDPR. There is no legal or contractual obligation to provide personal data. Failure to provide consent simply means that you will not be able to participate in the contest. You may withdraw your consent at any time with future effect. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of your consent prior to withdrawal.

3. Data Processing for the User-Friendly Design of the Website and Tracking

To make your use of our website as pleasant as possible, we use so-called web tracking systems. This involves i.d.R. the use of cookies, d.h. which are small text files sent by a web server to your browser and stored on your computer’s hard drive. This allows us to recognize the device you are using when you visit our online store. This enables us z.B. to determine whether you are logged in, have an active shopping cart, and what items are in your shopping cart. The session cookies used for the online store are deleted at the end of your browser session. Other cookies remain on your device and allow us to recognize your device the next time you visit.

Most browsers are set to automatically accept cookies. You can disable the storage of cookies in your browser and have the option to delete them from your hard drive at any time. Howeverz.B. , you can also use your browser to prevent only certain cookies from being set (  . third-party cookies), for example, if you wish to block web tracking. For more information on this, please refer to your browser’s help section.

We would also like to point out that you can install a privacy plugin in your browser that allows you to block tracking—such as z.B . AdBlock, Ghostery, or NoScript (please refer to the privacy policy of the respective plugin provider).

Finally, please note that if you disable cookies, you may not be able to use all features of this website to their full extent. Please also note that you may need to disable cookies for each browser and each device.

 

Details regarding the cookies used on the website can be found in the cookie banner and in the provisions below. The legal basis for the processing of your data is Article 6(1)(f) of the GDPR, unless otherwise specified in the provisions below in Section 4.1 et seq. Our legitimate interest lies in designing the website to meet user needs. 3

.1. Cookie Consent with Cookiebot

 

To manage your consent to the use of tracking tools, we use the “Cookiebot” cookie consent technology. This technology is provided by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark, website:https://www.cookiebot.com/de/  (  “Usercentrics”) .In this context, in addition to connection data, information regarding whether you have granted or denied consent, or whether you have revoked consent, is transmitted to Usercentrics. To ensure proper assignment, Usercentrics also sets a cookie in your browser.

Cookiebot is used to obtain the legally required consents for the use of cookies. The legal basis for this is Art. 6(1)(c) of the GDPR.

3.2. GoGoogle Analytics Universal

Go: Our website uses the“Google Analytics” tracking tool. This is a service Goprovided by Google Ireland Limited, a company incorporated and operating under Irish law, with its registered office at GoArdon House, Barrow Street, Dublin 4, Ireland (Go“Google”). This tracking tool helps us make our website more interesting for you and improve your user experience. Data regarding the use of our website is stored in pseudonymous user profiles. Cookies may also be used for this purpose. In addition, data from various devices, sessions, and interactions may be linked to a so-called “User ID.” The information generated is generally Gotransmitted to an ogle server in the United States and stored there. We would like to inform you that Google Analytics on our website has been enhanced with the “anonymizeIp” feature. As a result, your IP address is Go first truncated by ogle within member states of the European Union or in other signatory states to the Agreement on the European Economic Area and only then Gotransmitted to an ogle server in the United States.

The truncation of the IP address constitutes an additional measure pursuant to Article 25(1) of the GDPR to protect users; however, it does not result in the entire data processing being anonymized. Thus, when using Go ogle Analytics, in addition to the IP address, other usage data is collected that is considered personal data, such asz.B. identifying characteristics of individual users, which also Goallow for a link, for example, to an existing ogle account.

On our behalf Go , ogle will use the information it receives to analyze your use of our website, to compile reports on website activity, and to provide us with other services related to website and Internet usage. The pseudonymized usage profiles will not be merged with personal data about the holder of the pseudonym without separately granted consent.

GoFor more information about ogle Analytics,

https://support.google.com/analytics/answer/2790010?hl=deplease visit:

Please note that Google also Gohas independent access to your data collected via ogle Analytics and may use this data for its own purposes. This allows Go ogle Goto link this data with other data it has about you, such as your search history, your personal account, usage data from other devices , and any other data ogle has about you.

The legal basis for the use of Google Analytics is your consent, based on Section 25(1), Sentence 1 of the German Telesommunications Data Protection Act (TTDSG) for the storage of and access to information on end devices, as well as Article 6(1), Sentence 1(a) of the General Data Protection Regulation (GDPR) for our further processing of your data. You provide your consent via our cookie banner. Please note that Go ogle is a U.S.-based company. According to a recent ruling by the European Court of Justice (ECJ), the United States does not provide an adequate level of data protection, which poses a risk to the protection of your data. Thus,z.B. Under certain conditions, your data may be processed by U.S. authorities for monitoring and surveillance purposes. The new EU Standard Data Protection Clauses have been agreed upon as appropriate safeguards to ensure an adequate level of protection during data transfers.

3.3. Go ogle Analytics 4 Our

website uses the tracking tool “ogleGoAnalytics.” This is a service Goprovided by ogle Ireland Limited, a company incorporated and operating under Irish law with its registered office at Go rdon House, Barrow Street, Dublin 4, Ireland (hereinafterGo“ogle”). This tracking tool helps us make our website more interesting for you and improve the user experience. In doing so, data regarding the use of our website is stored in pseudonymous user profiles. Cookies may also be used for this purpose. In addition, data from various devices, sessions, and interactions can be linked to a so-called “user ID.” The information generated is generally Gosent first to an ogle server within the EU.

Go By default, ogle automatically anonymizes users’ IP addresses as soon as user data is collected. Furthermore Go, ogle neither logs nor stores IP addresses . However, truncating the IP addresses does not result in the entire data processing being anonymized. For example, when using Google Analytics, usage data is collected that is considered personal data, such asz.B . identifying characteristics of individual users, which also Goallow for a link, for example, to an existing ogle account.

On our behalf Go Go, ogle will use the information obtained through ogle Analytics to analyze your use of our website, to compile reports on website activity, and to provide us with other services related to website and Internet usage. The pseudonymized usage profiles will not be merged with personal data about the person behind the pseudonym without your separate consent.

GoFor more information about ogle Analytics, please visit:

https://support.google.com/analytics/answer/12017362

 

Please note that Google also Gohas independent access to your data collected via ogle Analytics and may use this data for its own purposes. This allows Go ogle Goto link this data with other data it has about you, such as your search history, your personal account, usage data from other devices , and any other data ogle has about you.

The legal basis for the use of Google Analytics is your consent, based on Section 25(1), Sentence 1 of the German Telesommunications Data Protection Act (TTDSG) for the storage of and access to information on end devices, as well as Article 6(1), Sentence 1(a) of the General Data Protection Regulation (GDPR) for our further processing of your data. You provide your consent via our cookie banner. Please note that Go ogle is a U.S.-based company. According to a recent ruling by the European Court of Justice (ECJ), the United States does not provide an adequate level of data protection, which poses a risk to the protection of your data. Thus,z.B. Under certain conditions, your data may be processed by U.S. authorities for control and surveillance purposes. The new EU Standard Data Protection Clauses have been agreed upon as appropriate safeguards to ensure an adequate level of protection during data transfers.

3.4. YouTube

: Our website uses plugins from GoYouTube, a site operated by Google. When you visit one of our websites equipped with a YouTube plugin and actively click on the corresponding field, a connection is established to YouTube’s servers. In doing so, the YouTube server is informed which of our websites you have visited. If you are logged into your YouTube account, you allow YouTube to associate your browsing activity directly with your personal profile. You can prevent this by logging out of your YouTube account.

 

The legal basis for the use of YouTube is your consent, based on Section 25(1), sentence 1 of the TTDSG for the storage of and access to information in terminal equipment, as well as Article 6(1), sentence 1(a) of the GDPR for our further processing of your data. You can provide your consent via our cookie banner. Please note that the provider is a company based in the United States. According to a recent ruling by the European Court of Justice (ECJ), the United States does not provide an adequate level of data protection, which poses a risk to the protection of your data.z.B. Under certain circumstances,. your data may . be processed by U.S. authorities for monitoring and surveillance purposes. If you still wish to consent to the use of this tool, you can do so via the cookie banner.

For more information on how user data is handled, please see YouTube’s Privacy Policy at: 3 https://www.google.de/intl/de/policies/privacy.

.5. Go Google Tag Manager

We use GoGoogle Tag Manager (“GTM”). This Go Google service allows website tags to be managed through a single interface. However, GTM merely implements tags. As such, no cookies are used. GTM only triggers other tags, which in turn may collect data; however, GTM does not access this data. Data is analyzed exclusively within the respective tool (for details, see the tools listed in Section 4). GTM does, however, collect your IP address and online identifiers (including cookie identifiers), which Gomay also be transferred to Google in the United States. Additional information about GTM can be found athttps://support.google.com/tagmanager/answer/6102821?hl=de

The legal basis for the use of GTM is your consent, based on Section 25(1), sentence 1 of the TTDSG for the storage of and access to information in terminal equipment, as well as Art. 6(1), sentence 1, letter a of the GDPR for our further processing of your data. You provide your consent via our cookie banner. Please note that the provider is a company based in the United States. According to a recent ruling by the European Court of Justice (ECJ), the United States does not provide an adequate level of data protection, thereby posing a risk to the protection of your data.z.B . Under certain conditions,. your data may . be processed by U.S. authorities for monitoring and surveillance purposes. The new EU Standard Data Protection Clauses have been agreed upon as appropriate safeguards to ensure an adequate level of protection during data transfers.

 3.6. Address Validation:

To reduce delivery errors Go , we use ogle’s Address Validation API . The Address Validation API allows us to determine whether an entered address corresponds to a real location or contains any errors. To do this, your IP address and the information you entered in the address field are Gotransmitted to  ogle. If the address you entered z.B. is incomplete, the Address Validation API will provide a correction recommendation that you can accept. Alternatively, you will be prompted to correct the address you entered.

 

The legal basis for using the Address Validation API is your consent, based on Section 25(1), Sentence 1 of the TTDSG for the storage of and access to information in terminal equipment, as well as Article 6(1), Sentence 1(a) of the GDPR for our further processing of your data. You provide your consent via our cookie banner. Please note that the provider is a U.S. company. According to a recent ruling by the European Court of Justice (ECJ), the United States does not provide an adequate level of data protection, which poses a risk to the protection of your data.z.B. Under certain circumstances, . your data may . be processed by U.S. authorities for monitoring and surveillance purposes. The new EU Standard Data Protection Clauses have been agreed upon as appropriate safeguards to ensure an adequate level of protection during data transfers.

3.7. AWIN 

We have integrated “AWIN” into   our website. AWIN is an affiliate marketing software provided by AWIN AG, Eichhornstraße 3, 10785 Berlin, Germany. Through AWIN, registered advertisers (“Advertisers”) can promote their online goods and services as part of various programs. To this end, individuals registered with AWIN (so-called “Publishers”) make their advertising space available to the “Advertisers,” such as Websites. We are registered with AWIN as “publishers,” which means we provide “advertisers” with advertising space (via links) on our website.

As part of its tracking services, AWIN stores cookies on the devices of users who visit or use advertisers’ websites or other online offerings (z.B. when placing an online order) in order to document transactions . . These cookies serve solely to correctly attribute the success of an advertising asset and to facilitate the corresponding billing within the network. A unique sequence of numbers—which cannot be traced back to an individual user—is stored in the AWIN tracking cookies; this sequence documents the advertiser’s affiliate program, the publisher, and the time of the user’s action (click or view). In doing so, AWIN also collects information about the device from which an action is performed,z.B. the operating system and the browser.

The legal basis for the use of AWIN is your consent, based on Section 25(1), sentence 1 of the TTDSG for the storage of and access to information in terminal equipment, as well as Article 6(1), sentence 1, letter a of the GDPR for our further processing of your data. You provide your consent via our cookie banner.

For more information on AWIN’s use of data, please refer to the company’s privacy policy: 3 https://www.awin.com/de/rechtliches

.8.Country.is

z.B . In order to redirect the user to the appropriate online store (. the U.S. online store), we use the so-called geolocation service provided by “Country.is ”. isCountry.isan open-source geolocation API that determines a user’s country (and nothing else) based on their IP address. IP-based geolocation is the process of associating an IP address or MAC address with the actual geographic location of a computer or mobile device connected to the Internet. During geolocation, IP addresses are associated with, among other things, the country, region (city), latitude/longitude, Internet service provider, and domain name. Based on this information, the user is automatically redirected to the online store appropriate for their location.

3.9. Azure Content Delivery

NetworkOn our website, we use Microsoft’s “Azure Content Delivery Network,” a service provided by Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

With the Azur Content Delivery Network, we can reduce load times and improve performance for our high-bandwidth website content by distributing user requests and serving them directly from Microsoft servers. When you access website content, you connect to Microsoft servers, and your IP address and, if applicable, browser data such as your user agent, as well as the time and date of your visit to the website, are transmitted. This data is processed exclusively for the purposes mentioned above and to maintain the security and functionality of the Azure Content Delivery Network. We have no influence over the specific retention period of the processed data; it is determined by Microsoft. Additional information can be found at:https://azure.microsoft.com/de-de/support/legal/.

The legal basis for the use of the Azure Content Delivery Network is your consent, based on Section 25(1) sentence 1 TTDSG for the storage of and access to information in terminal equipment, as well as Art. 6(1), sentence 1, subparagraph (a) of the GDPR for our further processing of your data. You provide your consent via our cookie banner. Please note that the provider is a company based in the United States. According to a recent ruling by the European Court of Justice (ECJ), the United States does not provide an adequate level of data protection, thereby posing a risk to the protection of your data. z.B. Under certain conditions,. your data may. be processed by U.S. authorities for monitoring and surveillance purposes. The new EU Standard Data Protection Clauses have been agreed upon as appropriate safeguards to ensure an adequate level of protection for data transfers.

3.10. FindologicWe

use the service provided by Findologic GmbH, Jakob-Haringer-Str. 5a, 5020 Salzburg (“Findologic”) to provide a search function for our products and to facilitate navigation. Cookies are used for the aforementioned service, and various data are transmitted to Findologic. This includes, in particular, users’ IP addresses and browser data, as well as associated behavioral data derived from search queries. This allows us, on the one hand, to optimize the shopping experience for our users and, on the other hand, to better understand which products interest our users the most. For more information on Findologic’s privacy policy, please visit: https://findologic.com/datenschutz/

The legal basis for the use of Findologic is your consent, based on Section 25(1), Sentence 1 of the German Teleservices Data Protection Act (TTDSG) for the storage of and access to information in terminal equipment, as well as Article 6(1), Sentence 1(a) of the General Data Protection Regulation (GDPR) for our further processing of your data. You can provide your consent via our cookie banner.

3.11. Facebook Pixel

: The so-called “Meta Pixel” involves embedding an invisible Meta Pixel on our website, through which the online behavior of every website visitor is analyzed by Meta Platforms Ireland Limited (formerly Facebook Ireland Limited), 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Meta”). The Meta Pixel enables customer data such asz.B . first name, last name, email address, etc.,. to be transmitted to Facebook and enriched with existing tracking data. This makes it possible to collect data even from non-Facebook users or to track users who are not logged into Facebook while visiting a website. As a result, website visitors who deliberately block the storage of third-party cookies are tracked via Meta. For example, if you add a vehicle to your shopping cart and then abandon the purchase process, Meta receives this information. We then have the ability to target you with an ad on Facebook. However, the Meta Pixel also allows us to specifically acquire new customers and target new people who are similar to our website visitors. 

Meta itself is also responsible for data processing, along with us. Meta processes the data in accordance with Meta’s Data Use Policy. You can find details on this in Meta’s DataUse Policy . Specific information and details about the Meta Pixel and how it works can be found in Meta’s Help Center.

In this regard, we are jointlyi.S.d. responsible with Meta . under Article 26 of the GDPR for the processing of your personal data. In this case, you may exercise your rights (see Section 11) In principle, you may assert these rights against both us and Meta. However, Meta serves as the first point of contact. We have entered into an agreement with Meta regarding joint responsibility for the processing of personal data. You can view this agreement at the following link:https://www.facebook.com/legal/controller_addendum .

 

The legal basis for the use of the Meta Pixel is your consent, based on Section 25(1), sentence 1 of the TTDSG for the storage of and access to information in terminal equipment, as well as Article 6(1), sentence 1, letter a of the GDPR for our further processing of your data. You provide your consent via our cookie banner. Please note that Meta is a company based in the United States. According to a recent ruling by the European Court of Justice (ECJ), the United States does not provide an adequate level of data protection, which poses a risk to the protection of your data. Thus,z.B. Under certain conditions, your data may be processed by U.S. authorities for monitoring and surveillance purposes. In the event that data is transferred to Meta Platforms Inc. in the U.S., the new Standard Data Protection Clauses have been agreed upon between Meta Platforms Ireland Limited and Meta Platforms Inc.

3.12. Pinterest Pixel

Our website uses the Pinterest tag, an analytics tool provided by Pinterest Europe Ltd. This tool allows us to track the behavior of users who have arrived at our website via a Pinterest ad. This allows us to measure the effectiveness of our advertising efforts and better tailor our content to our users’ interests.

The data collected is anonymous to us and does not allow us to identify individual users. However

, Pinterest may link the data to your Pinterest account and use it for its own advertising purposes in accordance with the Pinterest Privacy Policy. You can opt out of the use of the Pinterest tag at any time by adjusting the personalized advertising settings in your Pinterest account or by disabling cookies in your browser.

3.13. TikTok Pixel

Our website uses the TikTok Pixel, an analytics tool provided by TikTok Technology Limited. This tool allows us to track the behavior of users who have arrived at our website via a TikTok ad. This allows us to measure the effectiveness of our advertising campaigns for statistical and market research purposes. The data collected is anonymous to us and does not allow us to identify individual users. However, TikTok processes the data in a way that allows it to be linked to the respective user profile, enabling TikTok to use the data for its own advertising purposes in accordance with its Privacy Policy. You can opt out of data collection by the TikTok pixel at any time by adjusting the relevant settings in your TikTok account or by disabling cookies in your browser.

3.14. Snapchat Pixel

Our website uses the Snapchat Pixel, an analytics tool provided by Snap Inc. This pixel allows us to track the behavior of users who have arrived at our website via Snapchat ads. This enables us to measure the effectiveness of our advertising campaigns, track conversions, and better tailor our ads to your interests. 

The data collected is anonymous to us and does not allow for the direct identification of users. Snap Inc. However, it may link the data to your Snapchat account and use it for its own purposes in accordance with Snapchat’s Privacy Policy. 

 You have the option to object to data collection by the Snapchat pixel by adjusting the privacy settings in your Snapchat account or disabling cookies in your browser.

3.15. Vimeo

This website uses plugins from the video portal Vimeo. The provider is Vimeo Inc., 555 West 18th Street, New York, New York 10011, USA.

When you visit one of our pages that includes Vimeo videos, a connection is established with Vimeo’s servers. In the process, the Vimeo server is informed which of our pages you have visited. Vimeo also obtains your IP address. However, we have configured Vimeo so that it does not track your user activity or set cookies.

We use Vimeo to ensure that our online content is presented in an appealing manner. This constitutes a legitimate interest within the meaning of Article 6(1)(f) of the GDPR. If consent has been obtained, processing is based exclusively on Article 6(1)(a) of the GDPR; consent may be withdrawn at any time.

 

Data transfers to the U.S. are based on the EU Commission’s Standard Contractual Clauses and, according to Vimeo, on “legitimate business interests.” Details can be found here: https://vimeo.com/privacy .

For more information on how user data is handled, please see Vimeo’s Privacy Policy at: https://vimeo.com/privacy .

4. Links to Other Websites

Our website contains links to other websites, such asz.B . the Carreraclub’s website or social media platforms (Facebook, YouTube, Instagram). These websites are operated partly by us and partly by third parties. If you follow the links, information may therefore be transmitted to these third parties in the latter case. For information on the purpose and scope of data collection by third-party websites, as well as the further processing and use of your data on those sites, and your related rights and privacy settings, please refer to the respective privacy policies of the operators.

5. Data Transfer

: We will only disclose your personal data to third parties or other recipients if this is necessary to provide services, if you have given your consent, if there is a legal obligation to do so, or if the disclosure is permitted on another legal basis. Data is disclosed, for example, to the respective payment or shipping service provider, service providers for marketing services (z.B. email marketing), technical service providers, or—in the event of a corporate transaction—to prospective buyers, etc. Where necessary, we have entered into data processing agreements with the recipients of your data in accordance with Article 28 of the GDPR.

Please also note the separate privacy policies for .

the payment methods you have selected . :https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/privacy

Klarna: VISA: www.visaeurope.com

MasterCard:https://www.mastercard.de/de-de.html

Stripe: 6 https://stripe.com/de/privacy

. Social Media Presence

6.1. Data Processing Carreraand Legal Basis:

Our social media accounts (Facebook, Twitter, YouTube, LinkedIn, Xing, and Instagram) are intended to Carrera keep you informed about Revell and our latest developments, services, and products. Depending on the features offered by the respective providers, you havez.B. the option to engage in various interactions (commenting, sharing, etc.)z.B . in connection with our social media presence. User interaction is an important factor for us in conducting targeted marketing. This allows usz.B. to determine which posts are most popular. We therefore also use the statistics compiled by the providers for our own purposes. To the extent that we process users’ personal data in this context, the legal basis for this is Article 6(1)(f) of the GDPR. Our legitimate interest in such cases consists, in particular, of providing targeted information and advertising. The providers will inform you separately about the legal basis on which they process your data for their own purposes.

6.2. Joint Responsibility

In certain cases,we are jointly responsible with the social media providers for the processing of your personal data. In this case, you may generally exercise your rights (as described in Section 11) against both us and the social media provider. However, the social media provider serves as the first point of contact.

We have entered into an agreement with Meta (formerly Facebook) regarding joint responsibility for the processing of personal data. This agreement applies to the processing of so-called “Insights data.” This refers to page statistics, particularly regarding the interactions of Facebook users. You can find details about the Insights data here.. You canview our agreement with Meta atthe followinglink.

Please note that Meta also processes your data outside the EU/EEA. According to a recent ruling by the European Court of Justice (ECJ), the United States does not provide an adequate level of data protection, thereby posing a risk to the protection of your data.z.B. Under certain circumstances,. your data may. be processed by U.S. authorities for monitoring and surveillance purposes.

Regarding the retention period for the data we process from you for our own purposes, please refer to our explanation in Section 9. In addition, please review the privacy policies of the respective social media provider.

7. Data Transfer to Countries Outside the EU

: To the extent necessary for our purposes, we may also transfer your data to recipients outside the EU ifyou have given your consent, if there is a legal obligation to do so, or if the data transfer is permitted on another legal basis. For example, as part of our data processing activities, your data is also transferred to recipients based in the United States. Please note, however, that according to a recent ruling by the European Court of Justice (ECJ), the United States does not provide an adequate level of data protection, and therefore a risk to the protection of your data exists.z.B. Under certain conditions,. your data may. be processed by U.S. authorities for monitoring and surveillance purposes. Furthermore, with regard to the legal basis for data transfer, we refer you for the time being to Article 49 of the GDPR. An adequate level of data protection will be ensured in the future through the adoption of the new so-called EU Standard Data Protection Clauses.

8. Duration for which personal data is stored/Criteria for determining the duration

: We generally store your personal data for as long as is necessary for the aforementioned purposes of processing, provided that, in the event of an objection, Carrerathere are no compelling legitimate grounds on our part that override your interests, or, in the event of a withdrawal of consent, there is no other legal basis for data processing.

In certain cases,z.B. however,. where a statutory retention obligation applies, your personal data will not be deleted immediately but will first be blocked.

9. Security Measures to Protect Your Personal

Data: We protect your data from unauthorized access, loss, or destruction through technical and organizational measures. Our security measures are continuously improved in line with technological advancements. Our employees and all persons involved in data processing are required to comply with data protection laws and to handle personal data confidentially. Our employees have received appropriate training.

To protect our users’ personal data, we use a secure online transmission method known as “Secure Socket Layer” (SSL) transmission. You can recognize this by the “s” appended to the address component http:// (“https://”) or by a green, closed padlock icon. Clicking on the icon will provide you with information about the SSL certificate being used. The appearance of the icon depends on the version of your browser. SSL encryption ensures that your data is transmitted securely and in its entirety.

10. Your Rights

: Within the framework of legal requirements, you Carreragenerally have the right

  • to: confirmation as to whether personal data concerning you Carrerais being processed by us ;
  • information about this data and the circumstances of its processing;
  • rectification, if this data is inaccurate;
  • deletion, provided there is no justification for the processing and no obligation to retain the data (any longer),
  • restriction of processing in specific cases prescribed by law, and
  • the right to object in the event of data processing based on Article 6(1), sentence 1, letter f. GDPR
  • and the transfer of your personal data—to the extent you have provided it—to you or a third party in a structured, commonly used, and machine-readable format.

To the extent that the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time, with the result that the processing of your personal data will no longer be permitted in the future. However, this does not affect the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal.

Please direct your specific request in writing or by email—including clear identification of your identity—to our Data Protection Officer:

krupna LEGAL Dr

. Karsten Krupna,

Drehbahn720354

Hamburg, Email:datenschutz@carrera-revell.com

To the extent that wei.S.d. process your data jointly. with third parties under. Article 26 of. the GDPR, the third party is primarily responsible for ensuring that all data subject rights are upheld. However, you are free to exercise your rights with us as well.

Finally, we would like to inform you of your right to lodge a complaint with the supervisory authority (Austrian Data Protection Authority, Barichgasse 40-42, 1030 Viennadsb@dsb.gv.at)

11. No Automated Individual Decision-MakingWe

do not use your personal data for automated individual decision-making.

12. Changes to the Privacy PolicyNew

legal requirements, business decisions, or technical developments may require changes to our Privacy Policy. The Privacy Policy will then be updated accordingly. You can always find the most recent version on our website.

As of June 21, 2023