General Terms and Conditions of <tc>Carrera</tc> Toys GmbH

Privacy policy

We, Carrera Toys GmbH ("Carrera/we"), are pleased that you are visiting our website. In the following provisions, we inform you about the type, scope and purpose of the collection and use of your personal data on this website and as part of the services we offer.

Personal data is all information that relates to an identified or identifiable natural person. This includes in particular your name, your address and your e-mail address.

Please read the privacy policy carefully before using this website. We reserve the right to amend parts of this privacy policy at our own discretion and in accordance with legal requirements. Please therefore check this privacy policy regularly for changes.

1. Provider and data protection officer
Provider of the website and controller within the meaning of data protection law is

Carrera Toys GmbH

Rennbahn Allee 1

5412 Puch/Salzburg Austria

Managing director with power of representation: Mr. Stefan Krings

Tel.: +43 662 88921-0 E-Mail: shop@carrera-toys.comYou can reach the data protection officer of Carrera Toys GmbH at:

krupna LEGAL www.krupna.legal

Email: datenschutz@carrera-toys.com2. data processing to enable website use
Every time you access content on our website, connection data is transmitted to our web server. This connection data includes:

- the IP address (Internet Protocol address) of the respective user,

- the date and time of the request,

- the referrer URL,

- device numbers such as z.B. UDID (Unique Device Identifier) and comparable device numbers, device information (z.B. device type) and

- the browser type/browser version.

This connection data is not used to draw conclusions about the user's person or merged with data from other data sources, but is used to provide the website. The legal basis for the processing of your data is Art. 6 para. 1 sentence 1 lit. f GDPR. After 7 days at the latest, the data is anonymized by shortening the IP address at domain level.

3. Data processing at your request
The use of our website is generally possible without providing personal data. You are neither obliged to access this website nor to provide personal data. However, z.Bthe provision of personal data is required for the receipt of newsletters or in the case of registration. If you do not provide us with personal data for the purposes listed below, you may not be able to use the functionalities of this website or some of these services.

3.1 Provider and data protection officer
If you register with us as a merchant and use the merchant service or the B2B portal on our website, your data will be processed by us for this purpose. Details on the B2B portal can be found in the instructions in our portal at https://carrera-toys.com/dealer-portal.

Your personal data is processed on the basis of Art. 6 para. 1 sentence 1 lit. b GDPR.

3.2. Newsletter
The provider of the website and controller within the meaning of data protection law is

Carrera Toys GmbH

Rennbahn Allee 1

5412 Puch/Salzburg Austria

Managing director with power of representation: Mr. Stefan Krings

Tel.+43 662 88921-0 E-Mail: shop@carrera-toys.com
You can reach the data protection officer of CarreraToys GmbH at:

krupna LEGALwww.krupna.legal

E-mail:datenschutz@carrera-toys.com3.3 Registration as a customer
If you would like to register with us as a customer, we will collect the required mandatory information (name, country, e-mail address, password), which is marked accordingly (*). Entering any additional information about yourself is voluntary.

Registration is not necessary, but makes the ordering process easier for you for future orders, as you can reuse the data you have already saved. Alternatively, you can also place an order as a guest. In this case, we collect the same data from you as when you register, with the exception of a password. However, this data is not stored in a customer account for you, so you do not have access to a customer account.

After registering, you can log in by entering your e-mail address and password. Please always ensure that you log out before leaving the website.

When using a password, please ensure that you take appropriate security measures. For example, a password should be at least 8 characters long and, if possible, always consist of a combination of upper and lower case letters, numbers and special characters. Trivial passwords such as "ABC" or keyboard sequences (z.B. "qwert" or "asdfgh"), all kinds of names (e.g. of friends, acquaintances, colleagues, family members, pets), city and building names, comic characters, car brands, license plates, terms, dates of birth, telephone numbers, common abbreviations, etc. are problematic in this respect.

Your personal data will be processed on the basis of your consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR. Please note that in the event of revocation, any bonus points collected will be forfeited without replacement. With regard to bonus points, please refer to the corresponding usage information on our website.

In addition, your IP address and the time of registration are stored by us as part of the registration process. This is necessary to ensure the security of our information technology systems. The legal basis for the processing of your data in this case is Art. 6 para. 1 sentence 1 lit. f GDPR.

3.4 Login
If you are registered as a customer, you have access to your customer account via the login function on this website. You can log in by entering your email address and password.

Login data must be kept strictly confidential. If a password is nevertheless disclosed, for example to enable third parties to access certain databases in an emergency, the password must be changed immediately. For your own protection, it is prohibited to reuse passwords that have already been used.

In addition, your IP address and the time of access are stored by us when you log in. This is necessary to ensure the security of our information technology systems.

We also set a session cookie each time you log in. This session cookie prevents automatic logout during active use of the account or associated services. After the respective logout, the session cookie is automatically deleted within a few minutes.

The legal basis for the processing of your data is Art. 6 para. 1 sentence 1 lit. f GDPR and, if your contractual relationship is affected, Art. 6 para. 1 sentence 1 lit. b and/or f GDPR.

3.5 Wish list
If you are registered as a customer (see section 3.4. f.), you can add individual products from the store to your wish list. Until you log out, you can access this wish list and see all the products you have added there. The legal basis for the processing of your data in this case is Art. 6 para. 1 sentence 1 lit. f GDPR. When you deregister as a customer, the wish list is automatically deleted

3.6. Ordering in the shop
When you place an order with us, we process the following data from you:

- Registration data from the customer account or Your guest data,

- Purchase data (order/shopping cart),

- Payment data (payment method, account and credit card data, billing addresses)

Your personal data is processed on the basis of Art. 6 para. 1 sentence 1 lit. b GDPR.

3.7. Competitions
If you would like to take part in a competition offered by us via the website, you must first create an account. The provision of your data is necessary for the purpose of running the competition. After completion of the competition, this data or the account will be deleted, provided there are no statutory retention obligations.

The processing of your personal data is based on your consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR. There is no legal or contractual obligation to provide the personal data. The only consequence of not giving your consent is that you will not be able to take part in the competition. You can withdraw your consent at any time with effect for the future. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

4. CarreraClub
We provide a separate club area on our website for our Carrera Club. The data processing in connection with our CarreraClub is described in the following sections.

4.1 Registration as a CarreraClub member
If you would like to register with us as a Club member, you must first order a membership in our online store. We will then collect the mandatory information required from you (name, address, email address, password) to set up your member account so that you can take advantage of the club benefits.

After registering, you can log in by entering your club user name and password via the club area on our website. Please always ensure that you log out before leaving the website.

When using a password, please ensure that you take appropriate security measures. A password should be at least 8 characters long and, if possible, always consist of a combination of upper and lower case letters, numbers and special characters. Trivial passwords such as "ABC" or keyboard sequences (z.B. "qwert" or "asdfgh"), all types of names (e.g. of friends, acquaintances, colleagues, family members, pets), city and building names, comic characters, car brands, license plates, terms, dates of birth, telephone numbers, common abbreviations, etc. are problematic in this respect.

The processing of your personal data is carried out for the performance of the contract. The legal basis is Art. 6 para. 1 sentence 1 lit. b GDPR.

In addition, your IP address and the time of registration are stored by us as part of the registration process. This is necessary to ensure the security of our information technology systems. The legal basis for the processing of your data in this case is Art. 6 para. 1 sentence 1 lit. f GDPR.

4.2 Login
If you are a club member, you have the option of using the login function on this website to access separate information or functionalities in our club area.

Login data must be kept strictly confidential. If the password is nevertheless disclosed, for example to enable access to certain databases by third parties in an emergency, it must be changed immediately. For your own protection, it is prohibited to reuse passwords that have already been used.

In addition, your IP address and the time of access are stored by us when you log in. This is necessary to ensure the security of our information technology systems.

We also set a session cookie each time you log in. This session cookie prevents automatic logout during active use of the account or associated services. After logging out, the session cookie is automatically deleted within a few minutes.

The legal basis for the processing of your data is Art. 6 para. 1 sentence 1 lit. f GDPR and, if your contractual relationship is affected, Art. 6 para. 1 sentence 1 lit. b GDPR.

4.3 Member account
If you have purchased a club membership, a member account will be created for you, which can be viewed by other club members. You can use the settings to select which information about you should be visible to other Club members.

If you already have a customer account in accordance with section 2.3 f., the data from your previous customer account will be linked to your member account. This enables you to take advantage of the club benefits when ordering in our online store.

The legal basis for the processing of your personal data is Art. 6 para. 1 sentence 1 lit. b GDPR.

4.4 Communication with other Club members/Club forum
As a Club member, you have the opportunity to get in touch with other Club members via chat in our Club forum. The content of your posts in the forum (text, photos or videos) and your user name can only be viewed by other club members and the Carrera administrators. In this respect, the club forum is a closed area that is moderated and administered by Carrera. The legal basis for the processing of your personal data is Art. 6 para. 1 sentence 1 lit. b GDPR.

If posts within the forum are also of interest to other customers of Carrera , Carrera will ask the club member who published the post and request consent to publish the post u.a . on the social media sites of Carrera. Your personal data will then be processed on the basis of your express consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR

4.5 Payment for club membership
Please note the provisions in this privacy policy under Section 7

4.6 Club newsletter
The provider of the website and the controller within the meaning of data protection law is

CarreraToys GmbH

Rennbahn Allee 1

5412 Puch/Salzburg Austria

Managing director with power of representation: Mr. Stefan Krings

Tel.: +43 662 88921-0 E-Mail: shop@carrera-toys.com

You can reach the data protection officer of CarreraToys GmbH at:

krupna LEGALwww.krupna.legal

E-mail:datenschutz@carrera-toys.com
5. Data processing for the needs-based design of the website and tracking
In order to make the use of our website as pleasant as possible for you, we use so-called. Web tracking systems. For this purpose,i.d.R. Cookies,d.h. small text files that are sent from a web server to your browser and stored on the hard disk of your computer. This enables us to recognize the device you are using when you use our store. This enables usz.B. to determine whether you are logged in, have an active shopping cart and what the contents of the shopping cart are. The session cookies used to use the store are deleted at the end of the browser session. Other cookies remain on your end device and enable us to recognize your end device on your next visit.

Details on the cookies used on the website can be found in the cookie banner and in the following provisions. The legal basis for the processing of your data follows, insofar as the following provisions in Section 5.1 ff. unless otherwise stated, from Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest lies in the needs-based design of the website. Finally, we would like to point out that if cookies are deactivated, it may not be possible to use all the functions of this website to their full extent. Please also note that deactivation may have to be carried out for each browser and for each end device.

5.1 Cookie consent with Cookiebot
We use the cookie consent technology "Cookiebot" to manage your consent to the use of tracking tools. The provider of this technology is Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark, Website:https://www.cookiebot.com/de/("Usercentrics"). In this context, in addition to the connection data, the granting or refusal of your consent or the revocation of consent is transmitted to Usercentrics. Usercentrics also sets a cookie in your browser in order to be able to make the corresponding assignment.

The use of Cookiebot takes place in order to obtain the legally required consent for the use of cookies. The legal basis for this is Art. 6 para. 1 sentence 1 lit. c GDPR.

5.2 GoGoogle Analytics
The provider of the website and controller within the meaning of data protection law is

CarreraToys GmbH

Rennbahn Allee 1

5412 Puch/Salzburg Austria

Managing director with power of representation: Mr. Stefan Krings

Tel.: +43 662 88921-0 E-Mail:shop@carrera-toys.com
You can reach the data protection officer of CarreraToys GmbH at:

krupna LEGALwww.krupna.legal

E-mail:datenschutz@carrera-toys.com5.3 YouTube
Our website uses plugins from the YouTube page operated by GoGoogle. If you visit one of our websites equipped with a YouTube plugin and actively click on the corresponding field, a connection to the YouTube servers is established. This tells the YouTube server which of our websites you have visited. If you are logged into your YouTube account, you enable YouTube to assign your surfing behavior directly to your personal profile. You can prevent this by logging out of your YouTube account.

The legal basis for the use of YouTube is your consent, based on § 25 para. 1 sentence 1 TDDDG for the storage and access to information in end devices and Art. 6 para. 1 sentence 1 lit. a GDPR for our further processing of your data. You give your consent to this via our cookie banner. Please note that Google is a company from the USA. Information on the locations of Google's data centers can be found atwww.google.com/about/datacenters/locations/. The new EU standard data protection clauses have been agreed as suitable guarantees to ensure an appropriate level of protection for data transmission. In addition, Google LLC is an active participant in the EU- U.S. Data Privacy Framework, which ensures the secure transfer of personal data to the USA. Further information can be found here:https://www.dataprivacyframework.gov/list.

For more information on the handling of user data, please refer to YouTube's privacy policy at:https://www.google.de/intl/de/policies/privacy.

5.4. Google Tag Manager
We use the Google Tag Manager "GTM". This service from Google allows website tags to be managed via an interface. However, the GTM only implements tags. In this respect, no cookies are used. The GTM only triggers other tags, which in turn may collect data, but the GTM does not access this data. The data is only analyzed in the respective tool (see the tools listed in section 5 for details). However, the GTM records your IP address and online identifiers (including cookie identifiers), which may also be transmitted to GoGoogle in the USA. You can find additional information on GTM athttps://support.google.com/tagmanager/answer/6102821?hl=de

The legal basis for the use of GTM is your consent, based on Section 25 (1) sentence 1 TDDDG for the storage and access to information in terminal equipment and Art. 6 (1) sentence 1 lit. a GDPR for our further processing of your data. You give your consent to this via our cookie banner. Please note that the provider is a company from the USA. The new EU standard data protection clauses were agreed as appropriate safeguards to ensure an adequate level of protection for data transfers. In addition, Google LLC is an active participant in the EU-U.S. Data Privacy Framework, which ensures the secure transfer of personal data to the USA. Further information can be found here: https://www.dataprivacyframework.gov/list

5.5 Address validation
To reduce delivery errors, we use the Address Validation API from Google. The Address Validation API can be used to determine whether an entered address refers to a real location or contains errors. To do this, your IP address and the content you enter in the address field are transmitted to Google. If the entered addressz.B. is incomplete, a correction recommendation is made via the Address Validation API, which you can accept. Alternatively, you will be asked to correct the address you have entered.

The legal basis for the use of the Address Validation API is your consent, based on § 25 para. 1 sentence 1 TDDDG for the storage and access to information in terminal equipment and Art. 6 para. 1 sentence 1 lit. a GDPR for our further processing of your data. You give your consent to this via our cookie banner. Please note that the provider is a company from the USA. The new EU standard data protection clauses have been agreed as suitable guarantees to ensure an adequate level of protection when transferring data. In addition, Google LLC is an active participant in the EU-U.S. Data Privacy Framework, which guarantees the secure transfer of personal data to the USA. Further information can be found here:https://www.dataprivacyframework.gov/list.

5.6. AWIN
We have integrated "AWIN" on our website. AWIN is an affiliate marketing software of AWIN AG, Eichhornstraße 3, 10785 Berlin, Germany. Registered providers ("advertisers") can use AWIN to advertise their online goods and services as part of programs. For this purpose, the persons registered with AWIN (so-called "publishers") make their advertising spaces, such as websites, available to the "advertisers". We are registered with AWIN as a "publisher", i.e. we provide the "advertisers" with advertising space (through links) on our website.

As part of its tracking services, AWIN stores cookies on the end devices of users who visit or use websites or other online offers from advertisers (z.B. when placing an online order) in order to document transactions. These cookies serve the sole purpose of correctly assigning the success of an advertisement and the corresponding billing within the network. In the AWIN tracking cookies, an individual number sequence is stored, which cannot be assigned to the individual user, with which the partner program of an advertiser, the publisher and the time of the user's action (click or view) are documented. AWIN also collects information about the end device from which an action is performed,z.B the operating system and the browser.

The legal basis for the use of AWIN is your consent, based on § 25 para. 1 sentence 1 TDDDG for storage and access and Art. 6 para. 1 sentence 1 lit. a GDPR for our further processing of your data. You give your consent via our cookie banner.

For more information on the use of data by AWIN, please refer to the company's privacy policy:https://www.awin.com/de/rechtliches

5.7. Country.is
To direct the user to the right webshop (z.B. the US webshop) from us, we use the so-called geo-localization of " Country.is ".Country.isis an open source geolocation API that determines the country of a user (and nothing else) based on their IP address. IP-based geolocation is the mapping of an IP address or MAC address to the real geographic location of a computer or mobile device connected to the Internet. In geolocalization, IP addresses are assigned to the country, the region (city), the latitude/longitude, the Internet provider and the domain name, among other things. On this basis, the user is automatically redirected to the webshop that is locally appropriate for them.

The legal basis for the use ofCountry.isis your consent, based on Section 25 (1) sentence 1 TDDDG for the storage and access to information in terminal equipment and Art. 6 (1) sentence 1 lit. a GDPR for our further processing of your data. You give your consent via our cookie banner.

5.8 Azure Content Delivery Network
On our website we use "Azure Content Delivery Network" from Microsoft, a service of Microsoft Ireland Operations Ltd, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

The Azure Content Delivery Network allows us to reduce load times and improve performance for our high-bandwidth website content by distributing user requests and delivering them directly from Microsoft servers. When you access website content, you establish a connection to Microsoft servers, whereby your IP address and possibly browser data such as your user agent, but also the time and date of your visit to the website are transmitted. This data is processed exclusively for the above-mentioned purposes and to maintain the security and functionality of Azur Content Delivery Network. The specific storage period of the processed data cannot be influenced by us, but is specified by Microsoft. You can find additional information at:https://azure.microsoft.com/de-de/support/legal/.

The legal basis for the use of Azur Content Delivery Network by us is your consent, based on § 25 para. 1 sentence 1 TDDDG for the storage and access to information in terminal equipment and Art. 6 para. 1 sentence 1 lit. a GDPR for our further processing of your data. You give your consent to this via our cookie banner. Please note that Microsoft is a company from the USA. Information about the locations of Microsoft's data centers can be found athttps://www.microsoft.com/de-de/privacy/privacystatement#mainwherewestoreandprocessdatamodule. The new EU standard data protection clauses were agreed as suitable guarantees to ensure an appropriate level of protection when transferring data. In addition, Microsoft is an active participant in the EU-U.S. Data Privacy Framework, which guarantees the secure transfer of personal data to the USA. Further information can be found here:https://www.dataprivacyframework.gov/listand here: https://learn.microsoft.com/en-us/compliance/regulatory/offering-eu-model-clauses.

5.9 Findologic
We use the service of Findologic GmbH, Jakob-Haringer-Str. 5a, 5020 Salzburg ("Findologic") on our website to provide a search function for our articles and for navigation. Cookies are used for the aforementioned service and various data is transmitted to Findologic. This includes in particular the IP address and browser data of the user as well as associated behavioral data resulting from the search queries. This enables us to optimize the shopping experience for our users and to better understand which products our users are most interested in. Further information on Findologic's data protection provisions can be found athttps://findologic.com/datenschutz/

The legal basis for the use of Findologic is your consent, based on § 25 para. 1 sentence 1 TDDDG for the storage and access to information in terminal equipment and Art. 6 para. 1 sentence 1 lit. a GDPR for our further processing of your data. You give your consent via our cookie banner.

5.10. Meta Pixel
The so-called "meta pixel" is an invisible pixel embedded on our website, which is used by Meta Platforms Ireland Limited (formerly Facebook Ireland Limited), 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Meta") to analyze the online behavior of each website visitor. The meta pixel makes it possible to transmit customer data such asz.B. First name, surname, email address, etc. to Meta and enrich it with existing tracking data. This makes it possible to collect data from non-users of the Facebook social network or to record users who are not logged in to Facebook while visiting a website. As a result, website visitors are tracked via Meta, which deliberately prevents the storage of third-party cookies. This gives us the opportunity to target you on Facebook with an advertisement. However, the Meta pixel also makes it possible to acquire new customers and target new people who are similar to website visitors.

In addition to us, Meta itself is also responsible for data processing. Meta processes the data in accordance with Meta's privacy policy. Details can be found in Meta's privacy policy. Specific information and details about the Meta pixel and how it works can be found in Meta's help section.

In this respect, we are jointly responsible with Metai.S.d. Art. 26 GDPR for the processing of your personal data. In this case, you can assert your rights (see Section 12) against both us and Meta. However, Meta serves as the first point of contact. We have concluded an agreement with Meta on joint responsibility for the processing of personal data. You can view this at the following link: https://www.facebook.com/legal/controller_addendum.

The legal basis for the use of the Meta pixel is your consent, based on Section 25 (1) sentence 1 TDDDG for the storage and access to information in terminal equipment and Art. 6 (1) sentence 1 lit. a GDPR for our further processing of your data. You give your consent via our cookie banner. Please note that Meta is a company from the USA. The new EU standard data protection clauses have been agreed as appropriate safeguards to ensure an adequate level of protection for data transfers. Meta is also an active participant in the EU-U.S. Data Privacy Framework, which ensures the secure transfer of personal data to the USA. Further information can be found here:https://www.dataprivacyframework.gov/list.

5.11. TikTok Conversion Tracking
We use the TikTok Pixel for conversion tracking, an analytics service provided by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland ("TikTok").

The TikTok Pixel is a JavaScript code snippet that allows us to analyze the activities of visitors on our website. The TikTok pixel collects certain information from the respective visitors for this purpose (so-called "event data"), which is then forwarded to TikTok. This includes user content, date of birth, profile information, profile picture, usage data, device information, smartphone-related information, surname, first name, internet service provider, IP address, email address and browser history.

Further information and TikTok's privacy policy can be found at:https://www.tiktok.com/legal/page/eea/privacy-policy/de

Tik Tok also offers users the opportunity to view their profile:https://support.tiktok.com/de/account-and-privacy/personalized-ads-and-data/requesting-your-data

The legal basis for the use of the TikTok Pixel is your consent, based on § 25 para. 1 sentence 1 TDDDG for the storage and access to information in terminal equipment and Art. 6 para. 1 sentence 1 lit. a GDPR for the processing of your data. You give your consent via our cookie banner. Please note that TikTok is a company from China. TikTok uses the so-called standard contractual clauses as the basis for data processing outside the EU. For this see:https://www.tiktok.com/legal/page/eea/privacy-policy/de

5.12. Pinterest Conversion Tracking
Our website uses the Pinterest tag as a pixel from Pinterest Europe Ltd, Palmerston House, 2nd Floor Fenian Street, Dublin 2, Ireland ("Pinterest") for remarketing purposes in order to be able to address you again on the Pinterest social network within 180 days. This allows users of our website to be shown interest-based advertisements (so-called "Pinterest ads") when they visit Pinterest.

If you have consented (as described below), your browser automatically establishes a direct connection with the Pinterest server. By integrating the Pinterest pixel, Pinterest receives the information that you have accessed the corresponding website of our Internet presence or have clicked on an advertisement from us. If you are registered with Pinterest, Pinterest can assign the visit to your account.

In addition to the IP address and the marketing identifier, Pinterest also receives information about the device you are using, the website visited and the time and can assign this data to your Pinterest account. Pinterest processes this data under its own responsibility. We have no influence on data collection and further processing by Pinterest. We only have access to conversion reports and the event history.

To set directly with Pinterest which types of ads are displayed to you within Pinterest, you can call up the page set up by Pinterest and edit your personalization settings there. The settings are platform-independent,d.hthey are applied to all devices, such as desktop computers or mobile devices. You can also object to the use of cookies for reach measurement and advertising purposes via the deactivation page of the network advertising initiative and additionally the US websiteaboutads.infoor the European websiteyouronlinechoices.com.

Further information on data processing by Pinterest can be found in the Pinterest advertising guidelines. You will also find general information on the display of Pinterest ads in the Ad Data Policy.

The legal basis for the use of the Pinterest Pixel is your consent, based on Section 25 (1) sentence 1 TDDDG for the storage and access to information in end devices and Art. 6 (1) sentence 1 lit. a GDPR for the processing of your data. You give your consent via our cookie banner. Please note that Pinterest is a company from the USA. Pinterest uses the so-called standard contractual clauses as the basis for data processing outside the EU. For this see:https://policy.pinterest.com/de/privacy-policy#section-residents-of-the-eea

5.13. Snapchat Conversion Tracking
Our website uses the Snapchat pixel, an analytics tool provided by Snap Inc, 2772 Donald Douglas Loop N, Danta Monica (HQ), CA USA ("Snapchat"). With the Snapchat pixel, we can track the behavior of users who have reached our website via Snapchat ads. This enables us to measure the effectiveness of our advertising measures, track conversions and better tailor our ads to your interests. The Snapchat pixel is a JavaScript code that transmits the following data to Snapchat:

- HTTP header information (u.a. IP address, web browser information, page location, document, web page URL and web browser user agent, and date and time of use),

- pixel-specific data; this includes the pixel ID and your hashed email address (this data is used to link events to a specific Snapchat advertising account and associate them with a Snapchat user),

- additional information about the visit to our websites, as well as standard and user-defined data events,

- orders placed (purchase transactions),

- the completion of registrations and purchase transactions,

- additions to the shopping cart and

- the retrieval of product information.

The aforementioned data processing only affects users who have an account with Snapchat. If the email address can be assigned to a Snapchat user, Snapchat assigns this user to a target group ("Custom Audience") based on the rules we have defined, provided the rules are relevant. We use the information obtained in this way for the presentation of our advertising content via Snapchat.

Please note that it cannot be ruled out that Snapchat processes the data concerned here for its own purposes and on its own responsibility and combines this information with the data already available at Snapchat, such as user profiles (if available).

The legal basis for our use of the Snapchat pixel is your consent, based on § 25 para. 1 sentence 1 TDDDG for the storage and access to information in terminal equipment and Art. 6 para. 1 sentence 1 lit. a GDPR for the processing of your data. You give your consent via our cookie banner.

You also have the option of objecting to the collection of data by the Snapchat pixel by adjusting the privacy settings in your Snapchat account or deactivating the use of cookies. For more information and the setting options for protecting your privacy for advertising purposes, please refer to Snapchat's privacy policy, which can be found athttps://support.snapchat.com/en-US/a/advertising-preferences.

Please note that Snapchat is a company from the USA. Pinterest uses the so-called standard contractual clauses as the basis for data processing outside the EU. For this, see:https://www.snap.com/terms/standard-contractual-clauses?lang=en-US

6. Links to other websites
Our website contains links to other websites such asz.B . to the CarreraClub website or to social networks (Facebook or Meta, YouTube, Instagram). These websites are operated partly by us and partly by third parties. If you follow the links, information may be transmitted to these third parties in the latter case. For the purpose and scope of data collection by the third-party websites and the further processing and use of your data there, as well as your rights in this regard and setting options for protecting your privacy, please refer to the respective data protection notices of the operators.

7. Data transfer
We only pass on your personal data to third parties or other recipients if this is necessary for the provision of services, if you have given your consent, if there is a legal obligation or if the transfer of data is permitted on the basis of another legal basis. Data is passed on, for example, to the respective payment or shipping service provider, service providers for the provision of marketing services ( z.B. email marketing), technical service providers or - in the case of a company transaction - to interested parties/buyers, etc. If necessary, we have concluded agreements with the recipients of your data on order processing in accordance with Art. 28 GDPR.

If you choose a payment method offered via the payment service provider Shopify Payments, payment processing is carried out via the technical service provider Stripe Payments Europe Ltd, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, to whom we pass on your information provided during the ordering process together with the information about your order (name, address, account number, bank code, credit card number if applicable, invoice amount, currency and transaction number). Your data will only be passed on for the purpose of payment processing with Stripe Payments Europe Ltd. and only to the extent that it is necessary for this purpose. You can find more information about Shopify Payments' data protection at the following Internet address:https://www.shopify.com/legal/privacy Data protection information on Stripe Payments Europe Ltd. can be found here:https://stripe.com/de/privacy

Please also note the separate data protection provisions of the payment methods you have selected.

Klarna: It is possible to use the payment options of Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden (hereinafter "Klarna"). Payment is then made to Klarna. The use of the payment methods invoice and direct debit/immediate transfer requires a positive credit check. If you wish to use Klarna, your data will be forwarded to Klarna for the purpose of address and credit checks as part of the purchase initiation and processing of the purchase contract. Based on the credit check, not all payment methods may be available to you. Please note that we have no influence on this. Further information and Klarna's terms of use can be found here. Klarna's privacy policy can be found here.

PayPal:https://www.paypal.com/de/webapps/mpp/ua/privacy-fullWhen paying via PayPal, credit card via PayPal, direct debit via PayPal or - if offered - "purchase on account" or "installment payment" via PayPal, we will pass on your payment data to PayPal (Europe)S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal"), as part of the payment processing. The transfer takes place in accordance with Art. 6 para. 1 lit. b GDPR and only insofar as this is necessary for payment processing. PayPal reserves the right to carry out a credit check for the payment methods credit card via PayPal, direct debit via PayPal or - if offered - "purchase on account" or "payment by installments" via PayPal. For this purpose, your payment data may be passed on to credit agencies in accordance with Art. 6 para. 1 lit. f GDPR on the basis of PayPal's legitimate interest in determining your solvency. PayPal uses the result of the credit check with regard to the statistical probability of non-payment for the purpose of deciding on the provision of the respective payment method. The credit report may contain probability values (so-called score values). If score values are included in the result of the credit report, they are based on a scientifically recognized mathematical-statistical procedure. The calculation of the score values includes, but is not limited to, address data. Further data protection information, including information on the credit agencies used, can be found in PayPal's privacy policy:https://www.paypal.com/de/webapps/mpp/ua/privacy-fullYou can object to this processing of your data at any time by sending a message to PayPal. However, PayPal may still be entitled to process your personal data if this is necessary for contractual payment processing.

VISA:www.visaeurope.com

MasterCard:https://www.mastercard.de/de-de.html

8. Social media presences
8.1. Data processing by Carreraand legal basis
Our social media presences (Facebook or Meta, X, TikTok, YouTube, LinkedIn, Xing and Instagram) serve the purpose of informing you about Carreraand new developments, services and products from us. Depending on the offer of the respective provider, youz.B. have the option of different interactions (comments, recommendations, etc.)z.Bin connection with our social media presence. User interaction is an important criterion for us in order to conduct targeted marketing. This allows us toz.B. determine which posts are read most frequently. We therefore also use the statistics determined by the providers in this regard for our own purposes. If we process users' personal data in the process, the legal basis for this is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest then lies in particular in targeted information/advertising. You will be informed separately by the providers about the legal basis on which the providers process your data for their own purposes.

8.2 Joint responsibility
In individual cases, we are jointly responsible with the social media providers for the processing of your personal data. In this case, you can exercise your rights (see section 12) against both the social media providers and us. us as well as against the social media provider. However, the social media provider serves as the first point of contact.

We have concluded an agreement with Meta on joint responsibility for the processing of personal data. This applies to the processing of so-called "Insights data". This involves page statistics, in particular regarding the interactions of Facebook users. Details on the Insights data can be found here:https://www.facebook.com/business/pages/manage#page_insights. You can view our agreement with Meta at the following link:www.facebook.com /legal/terms/page_controller_addendum. Please note that Meta is a company from the USA. Meta is an active participant in the EU- U.S. Data Privacy Framework, which guarantees the secure transfer of personal data to the USA. Further information can be found here:https://www.dataprivacyframework.gov/list

We have concluded an agreement with LinkedIn Ireland with regard to so-called. "Page Insights" also concluded an agreement on joint responsibility. With the Page Insights, LinkedIn Ireland does not provide us with any personal data about you, but only aggregated data. It is not possible for us to draw conclusions about individual users from the information in the Page Insights. Details on Page Insights and our agreement with LinkedIn Ireland can be found at the following link:https://legal.linkedin.com/pages-joint-controller-addendumPlease note that LinkedIn Ireland may also process your data outside the EU/EEA. LinkedIn Corporation is an active participant in the EU- U.S. Data Privacy Framework, which ensures the secure transfer of personal data to the USA. Further information can be found here: https://www.dataprivacyframework.gov/list.

We use the analysis functions of "TikTok Insights". TikTok Insights provides us with an aggregated analysis of visitor behavior on our profile. For example, likes or the sharing of videos, the age and gender of visitors can be recorded. We use this analysis via TikTok Insights to improve our profile, reach and target group reach. Insofar as the data you provide to us via TikTok is processed exclusively by TikTok, TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland ("TikTok Ireland"), TikTok Information Technologies UK Limited WeWork, 125 Kingsway, London, WC2B 6NH ("TikTok UK") is also responsible for data processing in addition to us. Where we process data jointly with TikTok, we have also entered into a joint controllership agreement with TikTok. Details of this can be found at:https://ads.tiktok.com/i18n/official/policy/jurisdiction-specific-terms, Part B 1, points 3 and 4). A summary of the main contents of this agreement can be found athttps://www.tiktok.com/legal/page/global/information-about-tiktok-analytics/en.

With regard to the storage period of the data processed by us for our own purposes, please refer to our explanations under Section 10. In addition, please note the data protection provisions of the respective social media provider.

9. Data transfer to countries outside the EU
If necessary for our purposes, we also transfer your data to recipients outside the EU if you have given your consent, if there is a legal obligation or if the data transfer is permitted on another legal basis. As part of data processing, your data will also be transferred to recipients based in the USA. An adequate level of data protection is ensured by the conclusion of the new so-called EU standard contractual clauses and/or the participation of the service provider in the USA in the EU-U.S. Data Privacy Framework is ensured. An overview of the participants in the EU-U.S. Data Privacy Framework can be found here:https://www.dataprivacyframework.gov/s/participant-search

10. duration for which personal data is stored/criteria for determining the duration
In principle, we store your personal data for as long as it is necessary for the aforementioned purposes of processing, in the event of an objection there are no compelling reasons worthy of protection from Carreraor in the event of a revocation there is no other legal basis for data processing. Please also note the information in the cookie banner.

In certain cases,z.B. if there is a legal obligation to retain data, your personal data will not be deleted immediately, but will first be blocked.

11. Security measures to protect your personal data
We use technical and organizational measures to protect your data from unauthorized access, loss or destruction. Our security measures are continuously improved in line with technological developments. Our employees and all persons involved in data processing are obliged to comply with data protection laws and to handle personal data confidentially. Our employees are trained accordingly.

To protect the personal data of our users, we use a secure online transmission method, the so-called "Secure Socket Layer" (SSL) transmission. You can recognize this by the fact that an "s" is appended to the address component http:// ("https://") or a green, closed lock symbol is displayed. By clicking on the symbol, you will receive information about the SSL certificate used. The display of the symbol depends on the browser version you are using. SSL encryption guarantees the encrypted and complete transmission of your data.

12. Provider and data protection officer
Within the framework of the legal requirements, you have a fundamental right to

confirmation as to whether personal data concerning you is being processed by Carrera,
information about this data and the circumstances of the processing,
rectification if this data is incorrect,
erasure if there is no justification for the processing and no obligation to retain it (any longer),
restriction of processing in specific cases determined by law,
objection in the event of data processing on the basis of Art. 6 para. 1 sentence 1 lit. f. GDPR and
transmission of your personal data - insofar as you have provided it - to you or to a third party in a structured, commonly used and machine-readable format.

If the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time, with the consequence that the processing of your personal data will become inadmissible for the future. However, this does not affect the lawfulness of the processing carried out on the basis of the consent until revocation.

Please send your specific request in writing or by e-mail, clearly identifying yourself, to our data protection officer:

krupna LEGAL

E-mail:datenschutz@carrera-toys.comInsofar as we process your data under joint responsibility i.S.d. Art. 26 GDPR with third parties, the third party is centrally responsible for exercising all data subject rights. However, you are free to assert your rights against us as well.

Finally, we would like to draw your attention to your right to lodge a complaint with the supervisory authority (Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna,dsb@dsb.gv.at)

13. No automated individual decision-making
We do not use your personal data for automated individual decision-making.

14. Changes to the privacy policy
New legal requirements, business decisions or technical developments may require changes to our privacy policy. The privacy policy will then be adapted accordingly. You will always find the latest version on our website.

Status: 14.01.2024

General Terms and Conditions (Carrera Club)
I. Scope of application and amendments to the General Terms and Conditions
1. These Terms and Conditions apply to all deliveries and services of

Carrera Toys GmbH
Rennbahn Allee 1
5412 Puch bei Salzburg
AUSTRIA

Managing Director: Stefan Krings
Phone number: +4366288921333
Telefax: +4366288921510
Email: shop@carrera-toys.com

(hereinafter "Carrera/we"), which are provided to customers (hereinafter "Customer/Club Member") in connection with the Carrera Club, as well as for the use of the Club area on our website.

2. club members within the meaning of these terms and conditions are consumers within the meaning of § 13 BGB. The Club Member is a consumer insofar as the purpose of the ordered deliveries and services cannot be predominantly attributed to his commercial or independent professional activity.
3. Carrera reserves the right to amend these General Terms and Conditions in the event of changed market conditions, changes in the legal situation or supreme court rulings, even within an existing contractual relationship. Club members will be informed of planned changes by e-mail at least six (6) weeks before the changes come into effect. In this e-mail, the changes to the previous contractual provisions will be identified and, if necessary, explained in addition. Within six (6) weeks of receipt of the aforementioned e-mail, the Club member may object to the changes to the General Terms and Conditions. If the club member does not object to the changes or does not do so in due time, his or her consent to the amended General Terms and Conditions shall be deemed to have been given and the changes shall be deemed to have been effectively agreed. The club member will be informed of this legal consequence separately in connection with the planned changes.

II. purchase/term of club membership
1. the purchase of a club membership is required to use the Carrera Club. The customer has the option of selecting a corresponding club membership in the Carrera online store. The ordering process is carried out in accordance with Section 3 of the General Terms and Conditions of the online store. Notwithstanding Section 5 of the General Terms and Conditions of the online store, however, the customer may only use the following payment methods to pay the price of the club membership: Credit card, Klarna and gift and promotional vouchers.
2. The Club Membership contract (hereinafter "Club Membership") is initially concluded for a term of twelve (12) months. The Club Membership is then automatically extended for an indefinite period.
3. Club Membership can be terminated at any time during the first year of membership by sending a message via the termination button on the website, so that Club Membership ends at the end of the twelve (12) months. If the Club Membership has been extended for an indefinite period, the Club Member may terminate the Club Membership at any time by giving one (1) month's notice.
4. Carrera may terminate the Club Membership by email to the Club Member subject to the same notice periods as in the previous section.
5. If Club membership ends, it is then no longer possible to use the member account or the Club benefits (see section III).

III. scope of Club membership benefits
1. Club membership includes u.a. the following services, functionalities and benefits for club members:

- Use of the club area
- Access to exclusive products and special models for club members in the online shop
- Price advantages for the online shop
- Club newsletter
- Annual club event

2. The exclusive special models for the Carrera Club are published once a year (subject to availability) and can be ordered via the Carrera online store. The prerequisite for purchasing a special model is an existing Club membership at the time the special model is released. The provisions of the General Terms and Conditions of the online store apply to the ordering process and the purchase of special models and other exclusive products for club members, unless otherwise stipulated in these GTC.

3. If the club member receives price advantages for the online store in the form of promotional vouchers, the provisions in Section 6 et seq. of the General Terms and Conditions of the online store shall apply to the redemption of these vouchers - unless otherwise stated in the promotional voucher itself.

IV. Price of Club Membership
1. The price of Club Membership is stated on the website of Carrera and includes the applicable statutory value added tax.
2. When purchasing Club Membership, the customer has the option of choosing between an annual and a monthly direct debit. This does not affect the term of the Club membership in accordance with Clause II.2.
3. Carrera reserves the right to make price changes (both price reductions and price increases), which may occur due to u.a. changes in wage and material costs, taxes and higher expenses for product improvements. Increases in the aforementioned costs only lead to a price increase if they are not offset by decreasing costs in another area. The same applies accordingly to a price reduction. Carrera shall select the timing of the price change in such a way that cost reductions have at least the same price effect as cost increases. Carrera shall notify the Club Member of price changes in text form three (3) weeks before the price change comes into effect. In the event of a price change, the Club Member has the right to terminate the Club Membership in text form without observing a notice period at the time the change comes into effect. The Club member will be informed of this in the notification of the price change. Otherwise, Section 315 BGB remains unaffected.

V. Terms of use for the Club area
In order to use the Club area, it is necessary to set up a member account. With regard to the processing of personal data in the context of the member account, please refer to the privacy policy of Carrera . As soon as registration as a club member has taken place, the club member has access to the club area via our website. The following terms of use apply to the use of the Club Area.

1. access/availability/changes to functionalities
1.1 Carrera will endeavor to keep the Club Area available without interruption. However, there is no entitlement to this.
1.2 The establishment and availability of the data connection is not part of Club membership. Club members are therefore solely responsible for the selection and functionality of their data connection, including the transmission paths. Carrera has no influence on the connection costs.
1.3 Carrera is entitled, without prejudice to the assertion of other rights, to prohibit the Club Member from accessing the Club Area at any time and to block access to the Club Area in accordance with Section V.7 if the Club Member violates the Terms of Use.
1.4 Carrera is entitled to make changes to the Club Area if this is necessary to adapt to a new technical environment, an increased number of users, to improve usability or for other important operational reasons.

2. Scope of services

In particular, the following functionalities are available when using the club area:

- Communication with other club members in the forum via chat, images and videos
- Test reports etc.

3. Basic obligations of the Club Member

II.

1.
2.
3.

3.1 The Club Member is obliged to use the Club Area in accordance with this section. V and in accordance with applicable law.

3.2 When using a password, appropriate security measures must be observed. For example, a password should be at least 8 characters long and, if possible, always consist of a combination of upper and lower case letters, numbers and special characters. Trivial passwords such as "ABC" or keyboard sequences (z.B. "qwert" or "asdfgh"), all kinds of names (e.g. of friends, acquaintances, colleagues, family members, pets), city and building names, comic characters, car brands, license plates, terms, dates of birth, telephone numbers, common abbreviations, etc. are problematic in this respect.

3.3 The club member is obliged to provide truthful information during registration and in the membership account and to keep this information up to date at all times. If a change occurs to the data provided during the period of use, the Club member shall update this immediately within the personal settings of the member account.

3.4 Login data must be kept strictly confidential. If a disclosure has nevertheless been made, for example to enable access to certain databases by third parties in an emergency, the password must be changed immediately. In addition, Carrera must be informed immediately as soon as and insofar as there are indications of imminent or existing password misuse in order to block access and subsequently store a new password. For your own protection, it is prohibited to reuse passwords that have already been used.

4. Prohibited actions

4.

4.1 The club member undertakes not to offer any activities or to post, disseminate or carry out any content within the scope of using the club area that violates legal prohibitions, morality, the rights of third parties and/or the following regulations.

4.2 Prohibited activities/content are in particular

- those in the area of "eroticism" or "pornography";

- services that violate the regulations for protection against illegal employment, such as the Act to Combat Illegal Employment and Illegal Employment (SchwarzArbG), the Youth Protection Act or data protection regulations;

- offering or advertising services that are not in line with the purpose of the Club Area or that have not been agreed with and approved by Carrera in advance.

4.3 Club members are also prohibited from the following actions:

- spreading viruses, Trojans and other harmful files;
- gaining access to and/or using data that is not intended for him or her and that is specially secured against unauthorized access by overcoming the access security;
- sending junk or spam e-mails and chain letters;
- disseminating lewd, offensive, sexually explicit, obscene or defamatory content or communication as well as content or communication which Communication as well as such content or communication that is likely to promote or support racism, fanaticism, hatred, physical violence or illegal acts (in each case explicitly or implicitly);
- harassing other club members, z.B. by repeatedly contacting them personally without or contrary to the reaction of other club members as well as promoting or Supporting such harassment;
- requesting other Club Members to disclose passwords or personal data for commercial or illegal or unlawful purposes;
- distributing and/or publicly reproducing content available in the Club Area, unless this is expressly permitted by the respective author or is expressly provided for in the sense and purpose of the functionality of the Club Area.

4.4 The Club Member is also prohibited from any action that is likely to impair the smooth operation of the Club Area, in particular from placing an excessive load on the network systems.

4.5 If the Club Member becomes aware of any illegal, abusive or otherwise unauthorized use of the Club Area, the Club Member is obliged to contact Carrera . Carrera will then review the matter and, if necessary, take appropriate action.

4.6 If there is a suspicion of illegal or criminal activity, Carrera is entitled and, if necessary, obliged to review the Club Member's activities and, if necessary, take appropriate legal action. This may also include forwarding a case to the public prosecutor's office.

5. Content provided by the Club Member

5.

5.1 The Club Member is fully responsible for the content posted by it. Carrera does not check the content for completeness, accuracy, legality, topicality, quality and suitability for a specific purpose.

5.2 The Club Member undertakes not to make any content publicly accessible within the Club Area that constitutes a breach of competition or a breach of relevant professional regulations or infringes the rights of third parties, such as trademark rights, copyrights and ancillary copyrights, title protection rights or personal rights, and to make publicly accessible only such content to the specific use of which the Club Member has an exclusive right or is otherwise entitled (z.B. through a license or permission from the rights holder).

5.3 Carrera reserves the right to temporarily remove the specific infringing content from the profile in the event of an indication of possible legal violations caused by the Club Member or in the event of existing indications that suggest a legal violation and to subsequently investigate the factual and legal situation with regard to the content. of the alleged infringement (notice-and-takedown procedure). The club member shall cooperate with Carrera in the clarification process in order to enable clarification as soon as possible. Carrera will, however, take into account the legitimate interests of the Club Member and choose the mildest means of defense against the infringement.

5.4 In the event of obvious and serious infringements, Carrera is entitled to remove the infringing content immediately and permanently from the Club Member's profile. Carrera shall inform the Club Member of the taking of such measures.

6. Right of use

6.

6.1 The Club Member shall be granted a non-exclusive (simple), non-sublicensable and non-transferable right to use the Club Area, limited to the term of the respective contractual relationship. The Club Area may only be used in the intended scope of functions in accordance with these Terms of Use.

6.2 In particular, the Club Member is not permitted to provide access to the Club Area to third parties for a fee or free of charge or to exploit the Club Area commercially in any other way. Finally, no rights to the Club Area may be rented, leased or otherwise transferred.

6.3 The Club Member is entitled to access and display the content available within the Club Area online exclusively for personal purposes while using the Club Area. The club member is not permitted to edit, present, make publicly accessible, publish or distribute content in whole or in part beyond this, unless such use is expressly permitted within the framework of these terms of use or is deliberately made possible by a special functionality within the club area (z.Bthrough a download button).

7. blocking

I.

1.
2.
3.
4.
5.
6.
7.

7.1 Carrera is entitled to temporarily or permanently block the Club Member's profile if and as soon as there are concrete indications of a breach of the provisions set out in Sections V.4 and V.5 and/or applicable legal norms and/or these Terms of Use. When deciding whether to block a Club Member, Carrera will take due account of the Club Member's legitimate interests.

7.2 Carrera will notify the Club Member in advance by email of any intended blocking, stating the reason, and give the Club Member the opportunity to comment on the matter. After the Club Member has responded, Carrera shall make the final decision on any suspension and inform the Club Member of the result by e-mail.

7.3 In the event of a temporary suspension, Carrera shall restore the Club Member's profile after a necessary and reasonable suspension period has expired and inform the Club Member of this by e-mail.

7.4 In the event of a permanent suspension, reactivation of the profile is not possible. Permanently blocked Club members are permanently excluded from using the Club area and may not register again.

VI. Right of withdrawal regarding Club membership
Consumers generally have a statutory right of withdrawal when concluding a distance selling transaction, about which Carrera the following information is provided in accordance with the statutory model.

Right of withdrawal

Right of withdrawal

You have the right to withdraw from this contract within fourteen days without giving any reason.

VII. liability
1. The liability of Carrera for damages of any kind is excluded. This exclusion does not apply to claims for damages by the Club member arising from injury to life, limb or health or from the breach of essential contractual obligations (cardinal obligations) or to liability for other damages based on an intentional or grossly negligent breach of duty by Carrera, its legal representatives or vicarious agents. Essential contractual obligations are all obligations whose fulfillment is essential for the proper execution of the contract and on whose compliance the Club member regularly relies and may rely.

2. In cases of negligent breach (simple negligence) of essential contractual obligations, Carrera shall only be liable for the foreseeable damage typical for the contract, unless it concerns claims for damages by the Club member arising from injury to life, body or health.

3. The provisions of the Product Liability Act shall remain unaffected. Liability in the event of a guarantee also remains unaffected.

VIII. Data protection
1. it is Carrera's quality standard to handle the personal data of Club members responsibly. The personal data processed in connection with registration as a Club member and the use of the available services is therefore only collected, stored and processed by Carrera insofar as this is necessary for the provision of the service in accordance with its intended use and is permitted by law or ordered by the legislator. Carrera will treat the personal data confidentially and in accordance with the provisions of the applicable data protection law and will not pass it on to third parties. Details can be found in the privacy policy (see website).

2. Please note that you are responsible for the content of your communication. In this context, please always observe the legal provisions, in particular with regard to the processing of special categories of personal data and the violation of the confidentiality of the word § 201 StGB and of private secrets pursuant to § 203 StGB.

3. The club member is aware that the content in the forum can be accessed by other authorized club members.

IX. Dispute resolution
1. the European Commission provides a platform for the online resolution of consumer disputes, which can be accessed via the following link: http://ec.europa.eu/consumers/odr/

2. our email address is: carreraclub@carrera-toys.com

3. Carrera is neither obliged nor willing to participate in dispute resolution proceedings before a consumer arbitration board.

X. Final provisions
The law of the Federal Republic of Germany shall apply to contracts between Carrera and the club member, to the exclusion of the UN Convention on Contracts for the International Sale of Goods. However, this choice of law shall not result in the Club Member being deprived of the protection of the mandatory provisions of the law of the country in which he has his habitual residence.

As of: March 2023

Privacy policy <tc>Carrera</tc> <tc>Hybrid</tc> App

Data protection provisions
We, d.h Carrera Toys GmbH (hereinafter: "Carrera or we"), hereby inform you about the type, scope and purpose of the collection and use of your personal data in the context of the Carrera Hybrid app (hereinafter: "app"). Personal data is any information relating to an identified or identifiable natural person. This includes in particular your name, your address and your email address.

1. Controller and data protection officer
The controller responsible for the app and the controller within the meaning of data protection law is

Carrera Toys GmbH
Rennbahn Allee 1
5412 Puch/Salzburg
Austria

Managing Director: Stefan Krings

Tel.: +43 662 88921-0

Email: shop@carrera-revell.com

Data Protection Officer:

krupna LEGAL

Email:datenschutz@carrera-toys.com

2. Data processing and purpose
Depending on the specific use of the app, personal data is processed for the purposes listed below. Unless otherwise stated, the legal basis for data processing is Art. 6 para. 1 sentence 1 lit. b GDPR.

2.1 Downloading the app

When the app is downloaded, the necessary information is transmitted to the respective app store,d.hin particular user name, email address and customer number of your account, time of download, payment information and individual device codes. We have no influence on this data collection and are not responsible for it. We process the data provided to the extent necessary to download the app to your device. We do not store this data beyond this.

2.2. Device and connection data

When your device establishes a connection with our server, your device and connection data are processed. This includes the IP address, date and time of the request, device identification number (UDID and comparable device numbers) and other device information (operating system and version, manufacturer and model, IMEI, IMSI, mobile phone number, MAC address). The connection data is not used to draw conclusions about the person of the user or merged with data from other data sources, but is used to identify your device, improve the app and rectify errors. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR. After the respective session or use of the app, the data is anonymized by shortening the IP address at domain level.

2.3 First-time registration

To use the app, you must first register. For the initial registration, you must enter your e-mail address, your user name and a password (user name and password hereinafter: "login data"), accept the GTC and then receive a confirmation link by e-mail. As soon as you click on the link in the e-mail, the registration process is complete. A password must be at least 8 characters long and preferably always consist of a combination of upper and lower case letters, numbers and special characters. Trivial words such as "ABC" or keyboard sequences (z.B. "qwert" or "asdfgh"), all kinds of names (z.B. of friends, colleagues, family members, pets), names of cities and buildings, comic characters, car brands, license plates, terms, dates of birth, telephone numbers, common abbreviations, etc. are problematic.

The login data must be kept strictly secret. For your own protection, it is forbidden to reuse previously used passwords.

In addition, your IP address and the time of registration are stored by us as part of the initial registration process. This is necessary to ensure the security of our information technology systems. The legal basis for the processing of your data in this case is Art. 6 para. 1 sentence 1 lit. f GDPR.

Details that are mandatory for the use of the app are marked as mandatory information. Failure to provide this information will mean that you will not be able to complete the registration process and use the app.

2.4 Login data - regular login

In order to be able to log in to the app in the future after successful initial registration (section 2.3), it is regularly necessary to enter your login data. Your login data is transmitted to the server in encrypted form and cannot be viewed by third parties. You do not have to re-enter your login details every time you use the app. Instead, your login data is temporarily stored on the end device by using a refresh token. However, to prevent unauthorized use of the app by third parties, we recommend that you log out after use and re-enter your login data each time you use the app.

2.5. Use of the app and how it works

The following functions in particular are available to you when using the app:

Creating drivers, vehicles and routes
Listing of races (in particular time and routes)
Performance measurement

Within the app, you have the option ofz.B. Name drivers individually. It is not necessary to use real names to use the app.

For the connection between the app and the vehicle, the app requires your approval/authorization for the Bluetooth function of your end device. You will be asked accordingly in the app.

The legal basis for data processing - insofar as you are asked for approval/authorization - is your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR. You are not obliged to give your consent. However, if you do not give your consent, you will not be able to use the full functionality of the app. You can revoke your consent for the future at any time in the settings of your end device or allow it again.

The other processing of your data is based on Art. 6 para. 1 sentence 1 lit. f GDPR.

2.6. release/authorization for the location function

For full functionality, the app requires your release/authorization for the location function of your end device. The so-called Location Access Service is required for a data-based Bluetooth connection. The legal basis for data processing is then your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR. You are not obliged to give your consent. However, if you do not give your consent, you will not be able to use the full functionality of the app. You can revoke your consent for the future at any time in the settings of your end device or allow it again.

2.7 Crash reports/error messages

If you agree to the transmission of a crash report after a system crash of the app or another technical error, the corresponding information will be transmitted anonymously to the developers of the app for the purpose of evaluation.

3. links to other websites
The app may contain links to social networks (Facebook or Meta, YouTube). These websites are operated by third parties. If you follow the links, information may be transmitted to these third parties. For the purpose and scope of data collection by the third-party websites and the further processing and use of your data there, as well as your rights in this regard and setting options for protecting your privacy, please refer to the respective data protection notices of the operators.

4. Recipients/categories of recipients of your data
We only pass on your personal data to third parties or other recipients if this is necessary for the provision of services, if you have consented, if there is a legal obligation or if the transfer of data is permitted on another legal basis. Where necessary, we have concluded data processing agreements with the recipients of your data in accordance with Art. 28 GDPR. In accordance with this requirement, we use, for example, the hosting services of Amazon Web Services Inc, EMEA SARL 38 avenue John F. Kennedy, L-1855, Luxembourg with a data center in Frankfurt am Main.

We only disclose your data to government agencies within the scope of legal obligations or on the basis of an official order or court decision.

Furthermore, your personal data will or may be transferred to the following recipients or categories of recipients in accordance with the aforementioned provisions:

companies within the Carreragroup of companies in their current or future form (a group of companies consists of a controlling company and the companies dependent on it, cf. Art. 4 No. 19 GDPR).
Trade partners, distribution partners etc.
Employees and freelancers
Service providers (z.B. IT service providers)
Company buyers/prospective buyers and/or investors
Possible authorities or other government agencies.

5. Data transfer to countries outside the EU
As a rule, we do not transfer your data to recipients outside the EU. However, if it is necessary for our purposes, we will only transfer your data if it is ensured that the recipient of the data guarantees an adequate level of data protection and no other interests worthy of protection speak against the data transfer.

6. Duration of storage of personal data/criteria for determining the duration
Your personal data will be stored by Carrera as long as it is necessary for the aforementioned purposes of processing, in the event of an objection there are no compelling reasons for Carreraworthy of protection or in the event of revocation there is no other legal basis for data processing. However, in certain cases,z.B. if there is a legal obligation to retain data, your personal data will not be deleted immediately, but will first be blocked.

7. Security measures to protect your personal data
We use technical and organizational measures to protect your data from unauthorized access, loss or destruction. Our security measures are continuously improved in line with technological developments. In this context, however, it is important that you maintain active update management to keep the software on your devices up to date. If youz.B. use outdated versions of iOS or Android, some security measures in connection with the app may not be guaranteed.

8. Your rights

Within the framework of the legal requirements, you have the right to

confirmation as to whether personal data concerning you is being processed by Carrera ,
information about this data and the circumstances of the processing,
rectification, if this data is incorrect,
deletion if there is no justification for the processing and no (further) obligation to retain it,
restriction of processing in specific cases determined by law,
objection in the event of data processing on the basis of Art. 6 para. 1 lit. f GDPR and
transmission of your personal data - insofar as you have provided it - to you or to a third party in a structured, commonly used and machine-readable format.
If the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time, with the consequence that the processing of your personal data will become unlawful for the future. However, this does not affect the lawfulness of the processing carried out on the basis of the consent until revocation. Please note the settings on your device.

Please send your specific request in writing or by email, clearly identifying yourself, to:

Carrera Toys GmbH
Rennbahn Allee 1
5412 Puch/Salzburg
Austria

Email: datenschutz@carrera-toys.comFinally, we would like to draw your attention to your right to lodge a complaint with the supervisory authority (Austrian Data Protection Authority, Wickenburggasse 8, 1080 Vienna, dsb@dsb.gv.at).

9. No automated individual decision-making
We do not use your personal data for automated individual decision-making.

10. Changes to the data protection provisions
New legal requirements, business decisions or technical developments may make it necessary to change our data protection provisions. The data protection provisions will then be adapted accordingly. You will always find the current version in the app.

Privacy policy: <tc>Carrera</tc> Race Management App

In the following provisions, we, d.h. the Carrera Toys GmbH, inform you about the type, scope and purpose of the collection and use of your personal data in the context of the Carrera Race Management App (hereinafter: "Race App"). Personal data is any information relating to an identified or identifiable natural person. This includes, in particular, your name and email address.

1. Provider and data protection officer
Provider of the Race-App and controller within the meaning of data protection law is

Carrera Toys GmbH
Rennbahn Allee 1 5412
Puch/Salzburg
Austria

Managing Director: Stefan Krings
Tel.: +43 (0) 662 88921-0
Email: shop@carrera-toys.com
You can reach the data protection officer of Carrera Toys GmbH at

E-mail:datenschutz@carrera-toys.com
CarreraToys GmbH
Rennbahn Allee 1
5412 Puch/Salzburg

2. Data processing and purpose
Depending on the specific use of the Race App, personal data is processed for the purposes specified below. Unless otherwise stated, the legal basis for data processing is Art. 6 para. 1 sentence 1 lit. b GDPR.

2.1 Downloading the Race App
When the Race App is downloaded, the necessary information is transferred to the respective app store,d.hin particular user name, email address and customer number of your account, time of download, payment information and individual device identification number. We have no influence on this data collection and are not responsible for it. We process the data provided to the extent necessary to download the Race app to your device. They are not stored beyond this.

2.2. Device and connection data
When your device establishes a connection with our server, your device and connection data are processed. These are IP address, date and time of the request, device identification number (UDID and comparable device numbers) and other device information (operating system and version, manufacturer and model, IMEI, IMSI. Mobile phone number, MAC address). Connection data is not used to draw conclusions about the person of the user or merged with data from other data sources, but is used to identify your end device, to improve the RC MicroHD app and for troubleshooting. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR.

2.3 Functions of the RC MicroHD app and data processing
In particular, the following functions are available to you when using the Race app:

- Creating drivers, vehicles and tracks
- Organizing championships (incl. Training and qualification)
- List of the fastest races
- Performance measurement

After entering the above data and before the start of the race:

- Adjust speed/fuel/brakes

Within the race app, you have the option ofz.B. Name riders individually and assign a photo to them. As part of these functionalities, you can access the photo album stored in your end device or - after individually enabling the camera function - take a new picture.

For the connection between the Race app and the vehicle, the Race app requires your approval/authorization for the Bluetooth function of your end device. You will be asked accordingly in the race app. The legal basis for data processing - insofar as you are asked for approval/authorization - is your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR. You are not obliged to give your consent. However, if you do not give your consent, you will not be able to use the Race app to its full extent. You can revoke your consent for the future at any time in the settings of your end device or allow it again. The other processing of your data is based on Art. 6 para. 1 sentence 1 lit. f GDPR.

2.4 Release/authorization for the location function
For full functionality, the app requires your release/authorization for the location function of your end device. The so-called location access service is required for a data-based Bluetooth connection. The legal basis for data processing is then your consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR. You are not obliged to give your consent. However, if you do not give your consent, you will not be able to use the full functionality of the app. You can revoke your consent for the future at any time in the settings of your end device or allow it again.

3. Link to other websites
The Race app contains links to social networks (Facebook, YouTube). These websites are operated by third parties. If you follow the links, information may be transmitted to these third parties. For the purpose and scope of data collection by the third-party websites and the further processing and use of your data there, as well as your rights in this regard and setting options for protecting your privacy, please refer to the respective data protection notices of the operators.

4. Data transmission
Your personal data will only be transmitted to third parties or other recipients if there is legal permission to do so or if you have given your prior consent. Where necessary, we have concluded data processing agreements with the recipients of your data in accordance with Art. 28 GDPR. We only pass on your data to government agencies within the scope of legal obligations or on the basis of an official order or court decision.

5. Data transfer to countries outside the EU
We generally do not transfer your data to recipients outside the EU. However, if it is necessary for our purposes, we will only transfer your data if it is ensured that the recipient of the data guarantees an adequate level of data protection and no other interests worthy of protection speak against the data transfer.

6. Duration for which personal data is stored/criteria for determining the duration
Your personal data will be stored by Carrera Toys GmbH for as long as is necessary for the aforementioned purposes of processing, in the event of an objection there are no compelling legitimate grounds for CarreraToys GmbH to the contrary or in the event of revocation there is no other legal basis for data processing. However, in certain cases,z.B. if there is a legal obligation to retain data, your personal data will not be deleted immediately, but will first be blocked.

7. Data security
We protect your data against unauthorized access, loss or destruction through technical and organizational measures. Our security measures are continuously improved in line with technological developments. In this context, however, it is important that you actively manage updates yourself to ensure that the software on your devices is always up to date. If you are usingz.B. outdated versions of iOS or Android, some security measures in connection with the RC MicroHD app may not be guaranteed.

8. Your rights
Within the framework of the legal requirements, you have the right to

- confirmation as to whether personal data concerning you is being processed by CarreraToys GmbH,
- information about this data and the circumstances of the processing,
- rectification if this data is incorrect,
- erasure if there is no justification for the processing and no (further) obligation to retain it,
- restriction of processing in specific cases determined by law,
- objection in the case of data processing on the basis of Art. 6 para. 1 lit. f GDPR and
- transmission of your personal data - insofar as you have provided it - to you or a third party in a structured, common and machine-readable format.

If the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time, with the result that the processing of your personal data will become unlawful for the future. However, this does not affect the lawfulness of the processing carried out on the basis of the consent until revocation. Please note the settings on your end device. Please send your specific request in writing or by e-mail, clearly identifying yourself, to:

E-mail:datenschutz@carrera-toys.com
CarreraToys GmbH

Rennbahn Allee 1

5412 Puch/Salzburg

Finally, we would like to draw your attention to your right to lodge a complaint with the supervisory authority (Austrian Data Protection Authority, Wickenburggasse 8, 1080 Vienna,dsb@dsb.gv.at)

9. No automated individual decision-making
We do not use your personal data for automated individual decision-making.

10. Changes to the privacy policy
New legal requirements, business decisions or technical developments may require changes to our privacy policy. The privacy policy will then be adapted accordingly.

Privacy policy: <tc>Carrera</tc> <tc>GO!!!</tc> Plus App

In the following provisions, we, d.h. the Carrera Toys GmbH, inform you about the type, scope and purpose of the collection and use of your personal data in the context of the Carrera Go!!! Plus app (hereinafter: "Carrera Go!!! app"). Personal data is any information relating to an identified or identifiable natural person. This includes, in particular, your name and your email address.

1. Provider and data protection officer
Provider of the GO!!! Plus App and controller within the meaning of data protection law is

Carrera Toys GmbH
Rennbahn Allee 1 5412
Puch/Salzburg
Austria

Managing Director: Stefan Krings
Tel.: +43 (0) 662 88921-0
Email: shop@carrera-toys.com
You can reach the data protection officer of Carrera Toys GmbH at

E-mail:datenschutz@carrera-toys.com
CarreraToys GmbH
Rennbahn Allee 1
5412 Puch/Salzburg

2. Data processing and purpose
Depending on the specific use of the GO!!!Plus app, personal data is processed for the purposes specified below. Unless otherwise stated, the legal basis for data processing is Art. 6 para. 1 sentence 1 lit. b GDPR.

2.1 Downloading the Carrera GO!!!app
When the RC MicroHD app is downloaded, the necessary information is transferred to the respective app store,d.hin particular user name, email address and customer number of your account, time of download, payment information and individual device identification number. We have no influence on this data collection and are not responsible for it. We process the data provided to the extent necessary to download the RC MicroHD app to your device. They are not stored beyond this.

2.2. Device and connection data
When you download the Carrera GO!!! Plus app, the necessary information is transmitted to the respective app store, d.hin particular your user name, email address and customer number of your account, time of download, payment information and individual device identification number. We have no influence on this data collection and are not responsible for it. We process the data provided to the extent necessary to download the Carrera Go!!! Plus app on your device. They are not stored beyond this.

2.3. Functions of the Carrera GO!!! Plus app and data processing
The following functions in particular are available to you when using the Carrera GO!!!Plus app:

- Creating drivers
- Chase
- Training and
- Lap races

Within the Carrera GO!!! Plus app, you have the option of z.B. Name drivers individually. For the connection between the Carrera Go!!! app and the vehicle, the Carrera Go !!! app requires your approval/authorization for the Bluetooth function of your end device. You will be prompted accordingly in the GO!!!Plus app. The legal basis for data processing - insofar as you are asked for approval/authorization - is your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR. You are not obliged to give your consent. However, if you do not give your consent, you will not be able to use the full functionality of the GO!!!Plus app. You can revoke your consent for the future at any time in the settings of your end device or allow it again. The other processing of your data is based on Art. 6 para. 1 sentence 1 lit. f GDPR.

2.4 Release/authorization for the location function
For full functionality, the app requires your release/authorization for the location function of your end device. The so-called Location Access Service is required for a data-based Bluetooth connection. The legal basis for data processing is then your consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR. You are not obliged to give your consent. However, if you do not give your consent, you will not be able to use the full functionality of the app. You can revoke your consent for the future at any time in the settings of your end device or allow it again.

3. Data transfer
Your personal data will only be transferred to third parties or other recipients if there is legal permission to do so or if you have given your prior consent. Where necessary, we have concluded data processing agreements with the recipients of your data in accordance with Art. 28 GDPR. We only pass on your data to government agencies within the scope of legal obligations or on the basis of an official order or court decision.

4. Data transfer to countries outside the EU
We generally do not transfer your data to recipients outside the EU. However, if it is necessary for our purposes, we will only transfer your data if it is ensured that the recipient of the data guarantees an adequate level of data protection and no other interests worthy of protection speak against the data transfer.

5. Duration for which personal data is stored/criteria for determining the duration
Your personal data will be stored by CarreraToys GmbH for as long as is necessary for the aforementioned purposes of processing, in the event of an objection there are no compelling legitimate grounds for CarreraToys GmbH to the contrary or in the event of revocation there is no other legal basis for data processing. However, in certain cases,z.B. if there is a legal obligation to retain data, your personal data will not be deleted immediately, but will first be blocked.

6. Data security
We use technical and organizational measures to protect your data from unauthorized access, loss or destruction. Our security measures are continuously improved in line with technological developments. In this context, however, it is important that you actively manage updates yourself to ensure that the software on your devices is always up to date. If you are using z.B. outdated versions of iOS or Android, some security measures in connection with the Carrera Go!!! Plus app may not be guaranteed.

7. Your rights
In accordance with the statutory provisions, you have the right to

- confirmation as to whether personal data concerning you is being processed by CarreraToys GmbH,
- information about this data and the circumstances of the processing,
- rectification if this data is incorrect,
- erasure if there is no justification for the processing and no (further) obligation to retain it,
- restriction of processing in specific cases determined by law,
- objection in the case of data processing on the basis of Art. 6 para. 1 lit. f GDPR and
- transmission of your personal data - insofar as you have provided it - to you or a third party in a structured, common and machine-readable format.

If the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time, with the result that the processing of your personal data will become unlawful for the future. However, this does not affect the lawfulness of the processing carried out on the basis of the consent until revocation. Please note the settings on your end device. Please send your specific request in writing or by e-mail, clearly identifying yourself, to:

E-mail:datenschutz@carrera-toys.com

Toys GmbH

Rennbahn Allee 1

5412 Puch/Salzburg

Finally, we would like to draw your attention to your right to lodge a complaint with the supervisory authority (Austrian Data Protection Authority, Wickenburggasse 8, 1080 Vienna,dsb@dsb.gv.at)

8. No automated individual decision-making
We do not use your personal data for automated individual decision-making.

9. Changes to the privacy policy
New legal requirements, business decisions or technical developments may require changes to our privacy policy. The privacy policy will then be adapted accordingly.

Privacy policy: <tc>Carrera</tc> RC App

In the following provisions, we, d.h. the Carrera Toys GmbH, inform you about the type, scope and purpose of the collection and use of your personal data in the context of the Carrera RC app (hereinafter: "RC app"). Personal data is any information relating to an identified or identifiable natural person. This includes, in particular, your name and email address.

1. Provider and data protection officer
Provider of the RC app and controller within the meaning of data protection law is

Carrera Toys GmbH
Rennbahn Allee 1 5412
Puch/Salzburg
Austria

Managing Director: Stefan Krings
Tel.: +43 (0) 662 88921-0
Email: shop@carrera-toys.comYou can reach the data protection officer of Carrera Toys GmbH at

E-mail: datenschutz@carrera-toys.com
CarreraToys GmbH
Rennbahn Allee 1
5412 Puch/Salzburg

2. Data processing and purpose
Depending on the specific use of the RC app, personal data is processed for the purposes specified below. Unless otherwise stated, the legal basis for data processing is Art. 6 para. 1 sentence 1 lit. b GDPR.

2.1 Downloading the RC app
When the RC app is downloaded, the necessary information is transferred to the respective app store,d.hin particular user name, email address and customer number of your account, time of download, payment information and individual device identification number. We have no influence on this data collection and are not responsible for it. We process the data provided to the extent necessary to download the RC app to your device. They are not stored beyond this.

2.2. Device and connection data
When your device establishes a connection with our server, your device and connection data are processed. These are IP address, date and time of the request, device identification number (UDID and comparable device numbers) and other device information (operating system and version, manufacturer and model, IMEI, IMSI. Mobile phone number, MAC address). Connection data is not used to draw conclusions about the person of the user or merged with data from other data sources, but is used to identify your end device, to improve the RC MicroHD app and for troubleshooting. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR.

2.3. Functions of the RC app and data processing
The following functions in particular are available to you when using the RC app:

- Establishing a local network between cell phone and quadrocopter
- Transferring real-time images (video & photo) to the app
- Saving video & photos from the transfer in the app/local image/video folder

For the connection between the RC app and the vehicle, the RC app requires your release/authorization for the WLAN function of your end device. You will be prompted accordingly in the RC app. The legal basis for data processing - insofar as you are asked for approval/authorization - is your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR. You are not obliged to give your consent. However, if you do not give your consent, you will not be able to use the full functionality of the RC app. You can revoke your consent for the future at any time in the settings of your end device or allow it again. The other processing of your data is based on Art. 6 para. 1 sentence 1 lit. f GDPR.

3. Link to the online shop
This RC app contains a link to the online store of CarreraToys GmbH. Please note the separate data protection provisions of the online store.

4. Data transmission
Your personal data will only be transmitted to third parties or other recipients if there is legal permission to do so or if you have given your prior consent. Where necessary, we have concluded data processing agreements with the recipients of your data in accordance with Art. 28 GDPR. We only disclose your data to government agencies within the scope of legal obligations or on the basis of an official order or court decision.

5. Data transfer to countries outside the EU
We generally do not transfer your data to recipients outside the EU. However, if it is necessary for our purposes, we will only transfer your data if it is ensured that the recipient of the data guarantees an adequate level of data protection and no other interests worthy of protection speak against the data transfer.

6. Duration for which personal data is stored/criteria for determining the duration
Your personal data will be stored by Carrera Toys GmbH for as long as is necessary for the aforementioned purposes of processing, in the event of an objection there are no compelling legitimate grounds for Carrera Toys GmbH or in the event of revocation there is no other legal basis for data processing. In certain cases,z.B. however, if there is a statutory retention obligation, your personal data will not be deleted immediately, but will first be blocked.

7. Data security
We use technical and organizational measures to protect your data from unauthorized access, loss or destruction. Our security measures are continuously improved in line with technological developments. In this context, however, it is important that you actively manage updates yourself to ensure that the software on your devices is always up to date. If you are usingz.B. outdated versions of iOS or Android, some security measures in connection with the RC MicroHD app may not be guaranteed.

8. Your rights
In accordance with the statutory provisions, you have the right to

- confirmation as to whether personal data concerning you is being processed by
Toys GmbH,
- information about this data and the circumstances of the processing,
- rectification if this data is incorrect,
- erasure if there is no justification for the processing and no (further) obligation to retain it,
- restriction of processing in specific cases determined by law,
- objection in the case of data processing on the basis of Art. 6 para. 1 lit. f GDPR and
- transmission of your personal data - insofar as you have provided it - to you or a third party in a structured, common and machine-readable format.

If the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time, with the result that the processing of your personal data will become unlawful for the future. However, this does not affect the lawfulness of the processing carried out on the basis of the consent until revocation. Please note the settings on your end device. Please send your specific request in writing or by email, clearly identifying yourself, to:

Email: datenschutz@carrera-toys.com
Carrera Toys GmbH

Rennbahn Allee 1

5412 Puch/Salzburg

Finally, we would like to draw your attention to your right to lodge a complaint with the supervisory authority (Austrian Data Protection Authority, Wickenburggasse 8, 1080 Vienna,dsb@dsb.gv.at).

9. No automated individual decision-making
We do not use your personal data for automated individual decision-making.

10. Changes to the privacy policy
New legal requirements, business decisions or technical developments may require changes to our privacy policy. The privacy policy will then be adapted accordingly.

Privacy policy: <tc>Carrera</tc> RC FPV app

In the following provisions, we, d.h. the Carrera Toys GmbH, inform you about the type, scope and purpose of the collection and use of your personal data in the context of the Carrera RC FPV app (hereinafter: "RC FPV app"). Personal data is any information relating to an identified or identifiable natural person. This includes, in particular, your name and email address.

1. Provider and data protection officer
Provider of the RC FPV app and controller within the meaning of data protection law is

Carrera Toys GmbH
Rennbahn Allee 1 5412
Puch/Salzburg
Austria

Managing Director: Stefan Krings
Tel.: +43 (0) 662 88921-0
Email: shop@carrera-toys.com
You can reach the data protection officer of Carrera Toys GmbH at

E-mail:datenschutz@carrera-toys.com
CarreraToys GmbH
Rennbahn Allee 1
5412 Puch/Salzburg

2. Data processing and purpose
Depending on the specific use of the RC FPV app, personal data is processed for the purposes specified below. Unless otherwise stated, the legal basis for data processing is Art. 6 para. 1 sentence 1 lit. b GDPR.

2.1 Downloading the RC FPV app
When the RC FPV app is downloaded, the necessary information is transferred to the respective app store,d.hin particular user name, email address and customer number of your account, time of download, payment information and individual device identification number. We have no influence on this data collection and are not responsible for it. We process the data provided to the extent necessary to download the RC FPV app to your device. They are not stored beyond this.

2.2. Device and connection data
Your device and connection data are processed when your device establishes a connection with our server. These are IP address, date and time of the request, device identification number (UDID and comparable device numbers) and other device information (operating system and version, manufacturer and model, IMEI, IMSI. Mobile phone number, MAC address). Connection data is not used to draw conclusions about the person of the user or merged with data from other data sources, but is used to identify your end device, to improve the RC MicroHD app and for troubleshooting. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR.

2.3. Functions of the RC FPV app and data processing
In particular, the following functions are available to you when using the RC FPV app:

- Establishing a local network between the cell phone and quadrocopter
- Transferring real-time images (video & photo) to the app
- Special display for using 3D glasses with the cell phone as the display device.
- Saving video & photos from the transmission in the app/local image/video folder

For the connection between the RC FPV app and the vehicle, the RC FPV app requires your release/authorization for the WLAN function of your end device. You will be prompted accordingly in the RC FPV app. The legal basis for data processing - insofar as you are asked for approval/authorization - is your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR. You are not obliged to give your consent. However, if you do not give your consent, you will not be able to use the full functionality of the RC FPV app. You can revoke your consent for the future at any time in the settings of your end device or allow it again.

The other processing of your data is based on Art. 6 para. 1 sentence 1 lit. f GDPR.

3. Link to the online shop
This RC FPV app contains a link to the online store of CarreraToys GmbH. Please note the separate privacy policy of the online store.

4. Data transmission
Your personal data will only be transmitted to third parties or other recipients if there is legal permission to do so or if you have given your prior consent. Where necessary, we have concluded data processing agreements with the recipients of your data in accordance with Art. 28 GDPR. We only pass on your data to government agencies within the scope of legal obligations or on the basis of an official order or court decision.

5. Data transfer to countries outside the EU
We generally do not transfer your data to recipients outside the EU. However, if it is necessary for our purposes, we will only transfer your data if it is ensured that the recipient of the data guarantees an adequate level of data protection and no other interests worthy of protection speak against the data transfer.

6. Duration for which personal data is stored/criteria for determining the duration
Your personal data will be stored by CarreraToys GmbH for as long as it is necessary for the aforementioned purposes of processing, in the event of an objection there are no compelling legitimate grounds for CarreraToys GmbH to the contrary or in the event of revocation there is no other legal basis for data processing. However, in certain cases,z.B. if there is a legal obligation to retain data, your personal data will not be deleted immediately, but will first be blocked.

7. Data security
We protect your data against unauthorized access, loss or destruction through technical and organizational measures. Our security measures are continuously improved in line with technological developments. In this context, however, it is important that you actively manage updates yourself to ensure that the software on your devices is always up to date. If youz.B. use outdated versions of iOS or Android, some security measures in connection with the RC MicroHD app may not be guaranteed.

8. Your rights
Within the framework of the legal requirements, you have the right to

- confirmation as to whether personal data concerning you is being processed by CarreraToys GmbH,
- information about this data and the circumstances of the processing,
- rectification if this data is incorrect,
- erasure if there is no justification for the processing and no (further) obligation to retain it,
- restriction of processing in specific cases determined by law,
- objection in the case of data processing on the basis of Art. 6 para. 1 lit. f GDPR and
- transmission of your personal data - insofar as you have provided it - to you or a third party in a structured, common and machine-readable format.

If the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time, with the result that the processing of your personal data will become unlawful for the future. However, this does not affect the lawfulness of the processing carried out on the basis of the consent until revocation. Please note the settings on your end device. Please send your specific request in writing or by email, clearly identifying yourself, to:

Email: datenschutz@carrera-toys.com

CarreraToys GmbH

Rennbahn Allee 1

5412 Puch/Salzburg

Finally, we would like to draw your attention to your right to lodge a complaint with the supervisory authority (Austrian Data Protection Authority, Wickenburggasse 8, 1080 Vienna,dsb@dsb.gv.at)

9. No automated individual decision-making
We do not use your personal data for automated individual decision-making.

10. Changes to the privacy policy
New legal requirements, business decisions or technical developments may require changes to our privacy policy. The privacy policy will then be adapted accordingly.