Privacy Policy:
In the following, we, d.h. Carrera Toys GmbH (hereinafter referred to as “weCarrera ” or “us”), inform . you about the nature, scope, and purpose of the collection and use of your personal data in connection with the Carrera Hybrid app (hereinafter referred to as the “App”). Personal data refers to any information relating to an identified or identifiable natural person. This includes, in particular, your name, address, and email address.

1. Data Controller and Data Protection
OfficerThe datacontroller for the App and the data controller within the meaning of data protection law is

Carrera Toys GmbH, Renn
bahn Allee
15, 412 Puch /


Salzburg, Austria. Managing Director: Stefan Krings

. Tel.: +43 662 88921-0Email

:shop@carrera-revell.comData Protection Officer:

krupna

LEGALE-mail:datenschutz@carrera-toys.com2. Data Processing and Purpose
: Depending on the specific use of the app, personal data is processed for the purposes listed below. Unless otherwise specified, the legal basis for data processing is Article 6(1)(b) of the GDPR.

2.1. Downloading the App

: When you download the app, the necessary information is transmitted to the respective app store,d.h. including,. in particular, your account’s username, email address, and customer number; the time of the download; payment information; and individual device codes. We have no control over this data collection and are not responsible for it. We process this provided data to the extent necessary for downloading the app to your device. We do not store this data beyond that.

2.2. Device and Connection Data: When

your device connects to our server, your device and connection data are processed. This includes your IP address, the date and time of the request, device identification numbers (UDID and similar device numbers), and other device information (operating system and version, manufacturer and model, IMEI, IMSI, mobile phone number, MAC address). The connection data is not used to draw conclusions about the user’s identity or to be combined with data from other sources; rather, it is used to identify your device, improve the app, and troubleshoot issues. The legal basis is Article 6(1)(f) of the GDPR. After each session or use of the app, the data is anonymized by truncating the IP address at the domain level.

2.3. Initial Registration

To use the app, you must first register. To register for the first time, you must enter your email address, username, and password (hereinafter referred to as “login credentials”), accept the Terms and Conditions, and you will then receive a confirmation link via email. Once you click the link in the email, the registration process is complete. A password must be at least 8 characters long and should ideally consist of a combination of uppercase and lowercase letters, numbers, and special characters. Common words such as “ABC” or keyboard sequences (z.B. “qwert” or “asdfgh”), all types of names (z.B. of friends, colleagues, family members, pets), names of cities and buildings, comic book characters, car brands, license plate numbers, terms, dates of birth, phone numbers, common abbreviations, etc.

Your login credentials must be kept strictly confidential. For your own protection, you must not reuse passwords that have already been used.

In addition, we store your IP address and the time of registration as part of the initial registration process. This is necessary to ensure the security of our information technology systems. The legal basis for processing your data in this case is Article 6(1), first sentence, letter f of the GDPR.

Information that is absolutely necessary for using the app is marked as required. Failure to provide this information means that you will not be able to complete the registration process or use the app.

2.4. Login Credentials—Regular

LoginTo log in to the app in the future after successful initial registration (Section 2.3), you will generally need to enter your login credentials. Your login credentials are transmitted to the server in encrypted form and cannot be viewed by third parties. You do not need to re-enter your login credentials every time you use the app. Instead, your login credentials are temporarily stored on the device using a refresh token. However, to prevent unauthorized use of the app by third parties, we recommend that you log out after use and re-enter your login credentials each time you use the app.

2.5. App Usage and FunctionalityWhen

using the app, the following features are available to you in particular:

Creating drivers, vehicles, and
routesListing races (especially times and routes)
Performance

measurementWithin the app, you have the optionz.B. to name drivers individually. It is not necessary to use your real name to use the app.

To establish a connection between the app and the vehicle, the app requires your permission to access the Bluetooth function on your device. You will be prompted accordingly within the app.

The legal basis for data processing—insofar as you are asked for authorization or consent—is your consent pursuant to Art. 6(1), sentence 1, subparagraph (a) of the GDPR. You are not required to give your consent. However, if you do not grant your consent, you will not be able to use the app’s full functionality. You can revoke or grant your consent at any time for the future in your device’s settings.

All other processing of your data is based on Article 6(1), first sentence, (f) of the GDPR.

2.6. Permission for the Location ServiceFor

the app to function fully, it requires your permission to access the location service on your device. The so-called Location Access Service is required for a data-based Bluetooth connection. The legal basis for data processing is therefore your consent pursuant to Article 6(1), first sentence, letter a of the GDPR. You are not required to give your consent. However, if you do not give your consent, you will not be able to use the app to its full extent. You can revoke or grant your consent at any time in the future through your device’s settings.

2.7. Crash Reports/Error MessagesIf

you consent to the transmission of a crash report following a system crash of the app or another technical error, the relevant information will be transmitted in anonymized form to the app’s developers for the purpose of analysis.

3. Links to Other
Websites: The app may contain links to social networks (Facebook or Meta, YouTube). These websites are operated by third parties. If you follow the links, information may be transmitted to these third parties. For information on the purpose and scope of data collection by third-party websites, as well as the further processing and use of your data on those sites, and your related rights and privacy settings, please refer to the respective privacy policies of the operators.

4. Recipients/Categories of Recipients of Your Data
We disclose your personal data to third parties or other recipients only if this is necessary for the provision of services, you have given your consent, there is a legal obligation, or the disclosure of data is permitted on another legal basis. Where necessary, we have entered into data processing agreements with the recipients of your data in accordance with Art. 28 of the GDPR. In accordance with this provision, we use, for example, the hosting services of Amazon Web Services Inc., EMEA SARL, 38 avenue John F. Kennedy, L-1855, Luxembourg, with a data center in Frankfurt am Main.

We disclose your data to government agencies only to the extent required by law or based on an official order or court decision.

In addition, your personal data will be or may be transferred to the following recipients or categories of recipients in accordance with the aforementioned provisions:

Companies within the corporate group of Carrerain its current or future form (a corporate group consists of a controlling company and its subsidiaries, see Art. 4 No. 19 GDPR).
Business partners, sales partners, etc.
Employees and independent
contractorsz.B. Service providers (. IT service providers)
Company buyers/prospective buyers and/or
investors Government agencies or other public authorities, if applicable.

5. Data Transfer to Countries Outside the EU
: As a general rule, we do not transfer your data to recipients outside the EU. However, if it is necessary for our purposes, we will transfer your data only if it is ensured that the recipient of the data guarantees an adequate level of data protection and no other legitimate interests preclude the data transfer.

6. Retention Period for Personal Data/Criteria for Determining the Duration
Your personal data will be Carrerastored by us for as long as necessary for the aforementioned processing purposes, provided that, in the event of an objection, there Carreraare no compelling legitimate grounds to the contrary, or, in the event of a withdrawal of consent, there is no other legal basis for data processing. In certain cases, z.B . However, if there is a legal obligation to retain data, your personal data will not be deleted immediately but will first be blocked.

7. Security Measures to Protect Your Personal Data
We protect your data from unauthorized access, loss, or destruction through technical and organizational measures. Our security measures are continuously improved in line with technological developments. In this context, however, it is important that you actively manage updates to ensure that the software on your devices is always up to date. If youz.B. are using outdated versions of iOS or Android, some security measures related to the app may not be guaranteed.

8. Your Rights

: Within the framework of legal requirements, you Carreragenerally have the right

to: confirmation as to whether personal data concerning you Carrerais being processed by [company name] ,
information about this data and the circumstances of its processing,
rectification if such data is inaccurate,
erasure if there is no longer any legal basis for processing or obligation to retain the data,
restriction of processing in specific cases prescribed by law,
objection in the event of data processing based on Article 6(1)(f) of the GDPR;
and the transfer of your personal data—to the extent you have provided it—to you or a third party in a structured, commonly used, and machine-readable format.
To the extent that the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time, with the result that the processing of your personal data will no longer be permitted going forward. However, this does not affect the lawfulness of the processing carried out on the basis of your consent up until the time of withdrawal. Please refer to the settings on your device for more information.

Please submit your specific request in writing or by email, ensuring that you can be clearly identified, to:

CarreraToys GmbH,
Rennbahn Allee
15, 412 Puch /


Salzburg, Austria. Email:datenschutz@carrera-toys.com
Finally, we would like todsb@dsb.gv.atinform you of your right to file a complaint with the supervisory authority (Austrian Data Protection Authority, Wickenburggasse 8, 1080 Vienna).

9. No Automated Individual Decision-Making We
do not use your personal data for automated individual decision-making.

10. Changes to the Privacy Policy New
legal requirements, business decisions, or technical developments may require changes to our Privacy Policy. The Privacy Policy will then be updated accordingly. You can always find the current version in the app.

Other languages: