General Terms and Conditions of <tc>Carrera</tc> Toys GmbH

Privacy Policy

We, Carrera Toys GmbH (Carrera“we”), are pleased that you are visiting our website. In the following provisions, we inform you about the nature, scope, and purpose of the collection and use of your personal data on this website and in connection with the services we offer.

Personal data refers to any information relating to an identified or identifiable natural person. This includes, in particular, your name, address, and email address.

Please read this Privacy Policy carefully before using this website. We reserve the right to amend parts of this Privacy Policy at our discretion and in accordance with legal requirements. Please therefore review this Privacy Policy regularly for changes.

1.
Website Provider and Data Protection
OfficerThe provider of this website and the data controller under data protection law is

CarreraToys GmbH, Renn

bahn Allee 1

5, 41

2 Puch/Salzburg, Austria

. Authorized Managing Director: Mr. Stefan Krings

. Tel.: +43 662 88921-0. Email:shop@carrera-toys.com
CarreraYou can contact the data protection officer of CarreraToys GmbH at:

krupna LEGALwww.krupna.legal

Email:datenschutz@carrera-toys.com
2. Data Processing to Enable Use of the Website
Each time you access content on our website, connection data is transmitted to our web server. This connection data includes:

· the IP address (Internet Protocol address) of the respective user,

· the date and time of the request,

· the referrer URL,

· device numbers such as z.B. UDID (Unique Device Identifier) and similar device numbers, device information ( z.B. device type)

, and

the browser type and version.

This connection data is not used to identify the user personally or combined with data from other sources; rather, it is used to provide the website. The legal basis for the processing of your data is Article 6(1)(f) of the GDPR. After no later than 7 days, the data is anonymized by truncating the IP address to the domain level.

3. Data Processing at
the User
’s Initiative
: Use of our website is generally possible without providing personal data. You are under no obligation to access this website or to provide personal data while doing so. However, providing personal data isz.B . required to receive newsletters or to register.If you do not provide us with personal data for the purposes listed below, you may not be able to use certain features of this website or some of these services.

3.1. Provider and Data Protection Officer
: If you register with us as a retailer and use the retailer service or the B2B portal on our website, we will process your information for these purposes. You can find details about the B2B portal in the instructions on our portal underhttps://carrera-toys.com/dealer-portal.

“The processing of your personal data is based on Art. 6(1)(b) of the GDPR.”

3.2. NewsletterThe provider
of the website and the data controller within the meaning of data protection law is

CarreraToys GmbH

Carrera, Renn

bahn Allee 1

5, 41

2 Puch/Salzburg, Austria.

Authorized Managing Director: Mr. Stefan Krings

. Tel.: +43 662 88921-0 Email:shop@carrera-toys.com
CarreraYou can contact the Data Protection Officer at CarreraToys GmbH at:

krupna LEGALwww.krupna.legal

Email: datenschutz@carrera-toys.com
3.3. Customer Registration
:
If you wish to register with us as a customer, we will collect the required information from you (name, country, email address, password), which is marked accordingly (*). Providing any additional personal information is voluntary.

Registration is not required, but it simplifies the ordering process for future orders, as you can reuse the information you have already saved. Alternatively, you can place an order as a guest. In this case, with the exception of a password, we collect the same information from you as we do during registration. However, this data is not stored in a customer account for you, so you do not have access to a customer account.

After registration, you log in by entering your email address and password. Please be sure to log out before leaving the website.

When using a password, please take appropriate security measures. A password should be at least 8 characters long and, whenever possible, consist of a combination of uppercase and lowercase letters, numbers, and special characters. In this regardz.B. ,trivial passwords such as “ABC” or keyboard sequences (z.B. “qwert” or “asdfgh”), all types of names (such as those of friends, acquaintances, colleagues, family members, or pets), city and building names, comic book characters, car brands, license plate numbers, terms, dates of birth, phone numbers, common abbreviations, etc.

Your personal data is processed based on your consent in accordance with Article 6(1), first sentence, letter a of the GDPR. Please note that if you withdraw your consent, any bonus points that may have been collected will be forfeited without replacement. In addition, please refer to the relevant terms of use on our website regarding bonus points.

Furthermore, during registration, we store your IP address and the time of registration. This is necessary to ensure the security of our IT systems. The legal basis for the processing of your data in this case is Article 6(1), sentence 1, subparagraph (f) of the GDPR.

3.4. Login
If you are registered as a customer, you can access your customer account via the login function on this website. You log in by entering your email address and password.

Login credentials must be kept strictly confidential. If the password has nevertheless been disclosed—for example, to allow third parties access to certain data sets in an emergency—it must be changed immediately. For your own protection, you are prohibited from reusing passwords that have already been used.

In addition, when you log in, we store your IP address and the time of access. This is necessary to ensure the security of our IT systems.

We also set a session cookie each time you log in. This session cookie prevents you from being automatically logged out while actively using your account or related services. After you log out, the session cookie is automatically deleted within a few minutes.

The legal basis for the processing of your data is Article 6(1)(f) of the GDPR and, insofar as your contractual relationship is concerned, Article 6(1)(b) and/or (f) of the GDPR.

3.5. Wish List
If you are logged in as a customer (see Section 3.4. f.), you can add individual products from the store to your wish list. You can access this wish list until you log out, and you will see all the products you have added there. The legal basis for processing your data in this case is Article 6(1)(f) of the GDPR. When you log out as a customer

, your wish list is automatically deleted

.3.6. Ordering in the
StoreWhen you place an order with us, we process the following data about you:

· Registration data from your customer account or your guest data,

· Purchase data (order/shopping cart),

· Payment data (payment method, bank account and credit card details, billing addresses)

The processing of your personal data is based on Article 6(1)(b) of the GDPR.

3.7. Contests:
If you wish to participate in a contest we offer through our website, you must first create an account. Providing your personal data is necessary for the purpose of conducting the contest. Once the contest has ended, this data and the account will be deleted, unless there are legal requirements to retain it.

The processing of your personal data is based on your consent pursuant to Article 6(1)(a) of the GDPR. There is no legal or contractual obligation to provide personal data. Failure to provide consent simply means that you will not be able to participate in the contest. You may withdraw your consent at any time with future effect. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of your consent prior to withdrawal.

4. CarreraClub
Carrera: We have set up a separate club section on our website for our Carreraclub. The data processing related to our Carreraclub is described in the following sections.

4.1. Registration as Carreraa Club Member
If you would like to register with us as a club member, you must first purchase a membership in our online store. We will then collect the required information from you (name, address, email address, password) to set up your member account so that you can enjoy the club benefits.

After registration, you can log in by entering your club username and password in the club section of our website. Please be sure to log out before leaving the website.

When using a password, please take appropriate security measures. A password should be at least 8 characters long and, whenever possible, consist of a combination of uppercase and lowercase letters, numbers, and special characters. Common passwords such as “ABC” or keyboard sequences (z.B . “qwert” or “asdfgh”), all types of names (such as those of friends, acquaintances, colleagues, family members, or pets), city and building names, comic book characters, car brands, license plate numbers, terms, dates of birth, phone numbers, common abbreviations, etc.

Your personal data is processed for the purpose of fulfilling the contract. The legal basis is Article 6(1)(b) of the GDPR.

In addition, we store your IP address and the time of registration as part of the registration process. This is necessary to ensure the security of our IT systems. The legal basis for the processing of your data in this case is Article 6( Article 1(1)(f) of the GDPR.

4.2 Login
If you are a club member, you can use the login feature on this website to access specific information or features in our club area.

Login credentials must be kept strictly confidential. If, however, they have been disclosed—for example, to allow third parties to access certain data in an emergency—the password must be changed immediately. For your own protection, you are prohibited from reusing passwords that have already been used.

In addition, when you log in, we store your IP address and the time of access. This is necessary to ensure the security of our IT systems.

We also set a session cookie with every login. This session cookie prevents you from being automatically logged out while actively using your account or related services. After you log out, the session cookie is automatically deleted within a few minutes.

The legal basis for the processing of your data is Article 6(1)(f) of the GDPR and, to the extent that your contractual relationship is affected, Article 6(1)(b) of the GDPR.

4.3 Member Account
: If you have purchased a club membership, a member account will be created for you, which is visible to other club members. Through the settings, you can choose which information about you should be visible to other club members.

If you already have a customer account in accordance with Section 2.3 et seq., the data from your existing customer account will be linked to your member account. This allows you to take advantage of club benefits when placing orders in our online store.

The legal basis for the processing of your personal data is Article 6(1)(b) of the GDPR.

4.4 Communication with Other Club Members/Club Forum
As a club member, you have the opportunity to chat with other club members in our club forum. The content of your forum posts (text, photos, or videos), as well as your username, is Carreravisible only to other club members and the administrators of the club Carrera. As such, the club forum is a closed area that Carrerais moderated and administered by Carrera. The legal basis for the processing of your personal data is Article 6(1)(b) of the GDPR.

If posts within the forum Carreraare also Carreraof interest to other customers of Carrera[Company Name], [Company Name] will Carreracontact the club member who published the post and u.a. Carrerarequesttheir consent to publish the postu.a. on [Company Name]’s social media channels Carrera.Your personal data will then be processed on the basis of your explicit consent pursuant to Article 6(1), first sentence, letter a

of the GDPR.5 Payment for Club Membership
Please note the provisions in this Privacy Policy under Section 7.

4.6 Club Newsletter
The website provider and data controller within the meaning of data protection law is

CarreraToys GmbH

Renn

bahn Allee 1

5 412 Puch/Salzburg Austria

Authorized Managing Director: Mr. Stefan Krings

, Tel.: +43 662 88921-0, Email: shop@carrera-toys.com
Carrera You can contact the Data Protection Officer of CarreraToys GmbH at:

krupna LEGALwww.krupna.legal

, Email:datenschutz@carrera-toys.com
5. Data Processing for Tailoring the Website to User Needs and Tracking
: To make your experience on our website as pleasant as possible, we use so-called Web tracking systems. These systems i.d.R. use i.d.R. cookies— d.h. small text files sent from a web server to your browser and stored on your computer’s hard drive. This allows us to recognize the device you are using when you visit our online store. This allows usz.B. to determine whether you are logged in, have an active shopping cart, and what items are in the shopping cart. The session cookies used for the online store are deleted at the end of the browser session. Other cookies remain on your device and allow us to recognize your device the next time you visit.

Details about the cookies used on the website can be found in the cookie banner and in the provisions below. The legal basis for the processing of your data is set forth in Section 5.1 et seq. of the provisions below. As stated in Article 6(1), first sentence, subparagraph (f) of the GDPR. Our legitimate interest lies in designing the website to meet user needs. Finally, we would like to point out that if you disable cookies, you may not be able to use all features of this website to their full extent. Please also note that you may need to disable cookies for each browser and each device.

5.1 Cookie Consent with Cookiebot
To manage your consent to the use of tracking tools, we use the “Cookiebot” cookie consent technology. This technology is provided by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark, website: https://www.cookiebot.com/de/(“Usercentrics”). In this context, in addition to connection data, information regarding your granting or refusal of consent, or the revocation of consent, is transmitted to Usercentrics. To make the appropriate assignment, Usercentrics also sets a cookie in your browser.

Cookiebot is used to obtain the legally required consents for the use of cookies. The legal basis for this is Art. 6(1)(c) of the GDPR.

5.2 GoGoogle Analytics
The website provider and data controller within the meaning of data protection law is

CarreraToys GmbH, Renn

bahn Allee 1

5,

41

2 Puch/Salzburg, Austria.

Authorized Managing Director: Mr. Stefan Krings

, Tel.: +43 662 88921-0, Email:shop@carrera-toys.com
CarreraYou can contact the data protection officer of CarreraToys GmbH at:

krupna LEGALwww.krupna.legal

, Email: datenschutz@carrera-toys.com
5.3. YouTube
Our website uses plugins from GoYouTube, a site operated by Google. When you visit one of our websites that includes a YouTube plugin and actively click on the corresponding field, a connection is established with YouTube’s servers. This informs the YouTube server which of our websites you have visited. If you are logged into your YouTube account, you allow YouTube to directly associate your browsing behavior with your personal profile. You can prevent this by logging out of your YouTube account.

The legal basis for the use of YouTube is your consent, based on Section 25(1), Sentence 1 of the TDDDG for the storage of and access to information in terminal equipment, as well as Article 6(1), Sentence 1(a) of the GDPR for our further processing of your data. You can provide your consent via our cookie banner. Please note that Go ogle is Go a company based in the United States. Information about the locations of Google’s data centers Go can www.google.combe found atwww.google.com/about/datacenters/locations/. The new EU Standard Data Protection Clauses have been agreed upon as appropriate safeguards to ensure an adequate level of protection during data transfers. In addition GoU.S. ,ogle LLC is Goan active participant in the EU-U.S.U.S. Data Privacy Framework, which ensures the secure transfer of personal data to the United States. For more information, please visit:https://www.dataprivacyframework.gov/list.

For more information on how user data is handled, please see YouTube’s Privacy Policy at: https://www.google.de/intl/de/policies/privacy .

5.4. Google Tag Manager
We use the Google Tag Manager (“GTM”). This service from Google allows website tags to be managed via a single interface. However, GTM only implements tags; it does not use cookies.GTM only triggers other tags, which in turn may collect data; however, GTM does not access this data. The data is analyzed exclusively within the respective tool (for details, see the tools listed in Section 5). However, GTM collects your IP address and online identifiers (including cookie identifiers), which Gomay also Gobe transferred to GoGoogle in the United States. Additional information about GTM can be found athttps://support.google.com/tagmanager/answer/6102821?hl=de

The legal basis for the use of GTM is your consent, based on Section 25(1), sentence 1 of the TDDDG for the storage of and access to information in terminal equipment, as well as Art. 6(1), sentence 1, letter a of the GDPR for our further processing of your data. You provide your consent via our cookie banner. Please note that the provider is a company based in the United States. The new EU Standard Data Protection Clauses have been agreed upon as appropriate safeguards to ensure an adequate level of protection during data transfers. In addition Go U.S. ,ogle LLC is Goan active participant in the EU-U.S.U.S. Data Privacy Framework, which ensures the secure transfer of personal data to the United States. For more information, see here: https://www.dataprivacyframework.gov/list

5.5. Address Validation
To reduce delivery errors Go, we use Google’s Address Validation API Go. The Address Validation API allows us to determine whether an entered address corresponds to a real location or contains errors. To do this, your IP address and the information you entered in the address field are Gotransmitted to Google. If the address you enteredz.B. is incomplete, the Address Validation API will provide a correction recommendation that you can accept. Alternatively, you will be prompted to correct the address you entered.

The legal basis for using the Address Validation API is your consent, based on Section 25(1), sentence 1 of the TDDDG for the storage of and access to information in terminal equipment, as well as Article 6(1), sentence 1(a) of the GDPR for our further processing of your data. You provide your consent via our cookie banner. Please note that the provider is a company based in the United States. The new EU Standard Data Protection Clauses have been agreed upon as appropriate safeguards to ensure an adequate level of protection for data transfers. In addition GoU.S. ,ogle LLC is Goan active participant in the EU-USU.S. Data Privacy Framework, which ensures the secure transfer of personal data to the United States. For more information, see here:https://www.dataprivacyframework.gov/list.

5.6. AWIN
We have integrated “AWIN” into our website. AWIN is an affiliate marketing software platform provided by AWIN AG, Eichhornstraße 3, 10785 Berlin, Germany. Through AWIN, registered providers (“advertisers”) can promote their online products and services as part of various programs. To this end, individuals registered with AWIN (known as “Publishers”) make their advertising spaces—such as websites—available to “Advertisers.” We are registered with AWIN as a “Publisher,” which means we make advertising space (via links) available to “Advertisers” on our website.

As part of its tracking services, AWIN stores cookies on the devices of users who visit or use Advertisers’ websites or other online offerings (z.B. when placing an online order)to document transactionsz.B. . These cookies serve solely to correctly attribute the success of an advertising campaign and to facilitate the corresponding billing within the network.AWIN tracking cookies store a unique sequence of numbers—which cannot be linked to an individual user—that records the advertiser’s affiliate program, the publisher, and the time of the user’s action (click or view). In doing so, AWIN also collects information about the device from which an action is performed, z.B. the operating system, z.B. and the browser.

The legal basis for AWIN’s use of your data is your consent, based on Section 25(1), Sentence 1 of the TDDDG for storage and access, and Article 6(1), Sentence 1(a) of the GDPR for our further processing of your data. You provide your consent via our cookie banner.

For more information on AWIN’s use of data,

please refer to the company’s privacy policy:https://www.awin.com/de/rechtliches

5.7.Country.is
To direct the user to the online store that is right for them (z.B.To be able to redirectCountry.isCountry.isusers to our U.S. online store, we use the so-called geolocation service from “Country.is”.Country.isis an open-source geolocation API that determines a user’s country (and nothing else) based on their IP address. IP-based geolocation is the process of associating an IP address or MAC address with the actual geographic location of a computer or mobile device connected to the Internet. In geolocation, IP addresses are associated with, among other things, the country, region (city), latitude/longitude, Internet service provider, and domain name. Based on this information, the user is automatically redirected to the online store appropriate for their location.

The legal basis for the use ofCountry.isthis feature is your consent, based on Section 25(1), Sentence 1 of the TDDDG for the storage of and access to information in terminal equipment, as well as Article 6(1), Sentence 1(a) of the GDPR for our further processing of your data. You can provide your consent via our cookie banner.

5.8. Azure Content Delivery Network
We use Microsoft’s “Azure Content Delivery Network” on our website, a service provided by Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

Azure Content Delivery Network allows us to reduce loading times and improve the performance of our high-bandwidth website content by distributing user requests and serving them directly from Microsoft servers. When you access website content, you connect to Microsoft servers, and your IP address and, if applicable, browser data such as your user agent, as well as the time and date of your visit to the website, are transmitted. This data is processed exclusively for the purposes mentioned above and to maintain the security and functionality of the Azur Content Delivery Network. We have no control over the specific retention period for the processed data; it is determined by Microsoft. Additional information can be found at:https://azure.microsoft.com/de-de/support/legal/.

The legal basis for our use of the Azure Content Delivery Network is your consent, based on Section 25(1), sentence 1 of the TDDDG for the storage of and access to information in terminal equipment, as well as Article 6(1), sentence 1, letter a of the GDPR for our further processing of your data. You provide your consent via our cookie banner. Please note that Microsoft is a U.S.-based company. Information about the locations of Microsoft’s data centers can be found at:https://www.microsoft.com/de-de/privacy/privacystatement#mainwherewestoreandprocessdatamodule.The new EU Standard Data Protection Clauses have been agreed upon as appropriate safeguards to ensure an adequate level of protection during data transfers. In additionU.S. , Microsoft is an active participant in the EU-U.S. U.S . Data Privacy Framework, which ensures the secure transfer of personal data to the United States. For more information, see here:https://www.dataprivacyframework.gov/listand here:https://learn.microsoft.com/en-us/compliance/regulatory/offering-eu-model-clauses.

5.9. Findologic
We use the service provided by Findologic GmbH, Jakob-Haringer-Str. 5a, 5020 Salzburg (“Findologic”) on our website to provide a search function for our articles and to facilitate navigation. Cookies are used for the aforementioned service, and various data are transmitted to Findologic. This includes, in particular, users’ IP addresses and browser data, as well as associated behavioral data resulting from search queries.This allows us, on the one hand, to optimize the shopping experience for our users and, on the other hand, to better understand which products interest our users the most. For more information on Findologic’s privacy policy, please visit:https://findologic.com/datenschutz/

The legal basis for the use of Findologic is your consent, based on Section 25(1), Sentence 1 of the TDDDG for the storage of and access to information in terminal equipment, as well as Article 6(1), Sentence 1(a) of the GDPR for our further processing of your data. You provide your consent via our cookie banner.

5.10. Meta Pixel
The so-called “Meta Pixel” involves embedding an invisible pixel on our website, through which the online behavior of each website visitor is analyzed by Meta Platforms Ireland Limited (formerly Facebook Ireland Limited), 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Meta”). The Meta Pixel makes it possiblez.B. to transmitcustomer data—such asz.B. first name, last name, email address, etc.—to Meta and enrich it with existing tracking data. This makes it possible to collect data even from people who do not use the Facebook social network or to track users who are not logged into Facebook while visiting a website. As a result, website visitors who deliberately block the storage of third-party cookies are tracked via Meta. This allows us to target you with an advertisement on Facebook. However, the Meta Pixel also enables us to specifically acquire new customers and target new individuals who are similar to website visitors.

Meta itself is also responsible for data processing alongside us. Meta processes the data in accordance with Meta’s Privacy Policy. Details can be found in Meta’s Privacy Policy. You can find specific information and details about the Meta Pixel and how it works in Meta’s Help Center.

In this regard, we are jointlyi.S.d. responsible with Metai.S.d. under Article 26 of the GDPR for the processing of your personal data. In this case, you may generally exercise your rights (see Section 12) with both us and Meta. However, Meta serves as the primary point of contact. We have entered into an agreement with Meta regarding joint responsibility for the processing of personal data. You can view this agreement at the following link:https://www.facebook.com/legal/controller_addendum.

The legal basis for the use of the Meta Pixel is your consent, based on Section 25(1), Sentence 1 of the TDDDG for the storage of and access to information on end devices, as well as Article 6(1), Sentence 1(a) of the GDPR for our further processing of your data. You can provide your consent via our cookie banner.Please note that Meta is a U.S.-based company. The new EU Standard Data Protection Clauses have been agreed upon as appropriate safeguards to ensure an adequate level of protection for data transfers. In additionU.S. ,Meta is an active participant in the EU U.S . Data Privacy Framework, which ensures the secure transfer of personal data to the United States. For more information, see here:https://www.dataprivacyframework.gov/list .

5.11. TikTok Conversion Tracking
We use the TikTok Pixel for conversion tracking, an analytics service provided by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland (“TikTok”).

The TikTok Pixel is a snippet of JavaScript code that enables us to analyze visitor activity on our website. For this purpose, the TikTok Pixel collects certain information about each visitor (so-called“Event Data”), which is then forwarded to TikTok. This includes user-generated content, date of birth, profile information, profile picture, usage data, device information, smartphone-related information, last name, first name, internet service provider, IP address, email address, and browser history.

Further information and TikTok’s privacy policy can be found at: https://www.tiktok.com/legal/page/eea/privacy-policy/de

TikTok also offers users the option to view their profile: https://support.tiktok.com/de/account-and-privacy/personalized-ads-and-data/requesting-your-data

The legal basis for the use of the TikTok Pixel is your consent, based on Section 25(1), Sentence 1 of the TDDDG for the storage of and access to information in terminal equipment, as well as Article 6(1), Sentence 1(a) of the GDPR for the processing of your data. You can provide your consent via our cookie banner. Please note that TikTok is a company based in China. TikTok uses the so-called Standard Contractual Clauses as the basis for data processing outside the EU. See section https://www.tiktok.com/legal/page/eea/privacy-policy/de

5.12 for more informationhttps://www.tiktok.com/legal/page/eea/privacy-policy/de

. Pinterest Conversion Tracking
: Our website uses the Pinterest tag—a pixel provided by Pinterest Europe Ltd., Palmerston House, 2nd Floor Fenian Street, Dublin 2, Ireland (“Pinterest”)—for remarketing purposes, so that we can re-engage with you on the Pinterest social network within 180 days. This allows users of our website to be shown interest-based advertisements (so-called “Pinterest Ads”) when they visit Pinterest.

If you have given your consent (as described below), your browser automatically establishes a direct connection to Pinterest’s server. Through the integration of the Pinterest pixel, Pinterest receives the information that you have visited the corresponding page on our website or clicked on one of our ads. If you are registered with Pinterest, Pinterest can associate your visit with your account.

In addition to your IP address and marketing identifier, Pinterest also receives information about the device you are using, the website you visited, and the time of your visit, and can associate this data with your Pinterest account. Pinterest processes this data on its own responsibility. We have no influence over the data collection or further processing by Pinterest. We only have access to conversion reports and the event history.

To set directly on Pinterest which types of ads are displayed to you within Pinterest, you can visit the page set up by Pinterest and edit your personalization settings there. These settings are platform-independent;d.h. they apply to all devices, such as desktop computers or mobile devices.You can alsoaboutads.info youronlinechoices.comoptaboutads.infoyouronlinechoices.comout of cookies used for audience measurement and advertising purposes via the Network Advertising Initiative’s opt-out page, as well as the U.S. websiteaboutads.infoor the European websiteyouronlinechoices.com.

For more information on data processing by Pinterest, please see the Pinterest Advertising Policies. In addition, you can find general information about the display of Pinterest ads in the Ad Data Policy.

The legal basis for the use of the Pinterest Pixel is your consent, based on Section 25(1), Sentence 1 of the TDDDG for the storage of and access to information on end devices, as well as Article 6(1), sentence 1, letter a of the GDPR for the processing of your data. You provide your consent via our cookie banner. Please note that Pinterest is a U.S.-based company. Pinterest uses the so-called Standard Contractual Clauses as the basis for data processing outside the EU. For more information, see: https://policy.pinterest.com/de/privacy-policy#section-residents-of-the-eea

5.13. Snapchat Conversion Tracking
Our website uses the Snapchat Pixel, an analytics tool provided by Snap Inc., 2772 Donald Douglas Loop N, Danta Monica (HQ), CA, USA (“Snapchat”). The Snapchat Pixel allows us to track the behavior of users who have arrived at our website via Snapchat ads. This allows us to measure the effectiveness of our advertising campaigns, track conversions, and better tailor our ads to your interests. The Snapchat Pixel is a JavaScript code that transmits the following data to Snapchat:

· HTTP header information (u.a.IP address, web browser information, page location, document, website URL, and web browser user agent, as well as the date and time of use),

· pixel-specific data; this includes the pixel ID and your hashed email address (this data is used to link events to a specific Snapchat advertising account and attribute them to a Snapchat user),

· additional information about visits to our websites, as well as standard and custom data events,

· orders placed (purchases made),

· completion of registrations and purchases,

· items added to the shopping cart, and

· viewing of product information.

The aforementioned data processing applies only to users who have a Snapchat account. If an email address can be linked to a Snapchat user, Snapchat assigns that user to a target group (“Custom Audience”) based on the rules we have established, provided those rules are applicable. We use the information obtained in this way to display our advertising content on Snapchat.

Please note that it cannot be ruled out that Snapchat may process the data in question for its own purposes and under its own responsibility, and in doing so may combine this information with data already available to Snapchat, such as user profiles (if available).

The legal basis for our use of the Snapchat pixel is your consent, based on Section 25(1), Sentence 1 of the TDDDG for the storage of and access to information in terminal equipment, as well as Article 6(1), Sentence 1(a) of the GDPR for the processing of your data. You can provide your consent via our cookie banner.

You also have the option to object to data collection by the Snapchat pixel by adjusting the privacy settings in your Snapchat account or disabling cookies. For more information and to learn about the privacy settings available for advertising purposes, please refer to Snapchat’s Privacy Policy, which https://support.snapchat.com/en-US/a/advertising-preferencescan be found athttps://support.snapchat.com/en-US/a/advertising-preferences[link]https://support.snapchat.com/en-US/a/advertising-preferences .

Please note that Snapchat is a U.S.-based company. Pinterest uses the so-called Standard Contractual Clauses as the basis for data processing outside the EU. For more information, see: https://www.snap.com/terms/standard-contractual-clauses?lang=en-US

6. Links to Other Websites
Our website contains links to other websites, such asz.B . the CarreraClub website or social media platforms (Facebook or Meta, YouTube, Instagram).These websites are operated partly by us and partly by third parties. If you follow the links, information may therefore be transmitted to these third parties in the latter case. For information on the purpose and scope of data collection by third-party websites, as well as the further processing and use of your data there, and your related rights and options for protecting your privacy, please refer to the respective privacy policies of the operators.

7. Data
Transfer We will only disclose your personal data to third parties or other recipients if this is necessary to provide services, if you have given your consent, if there is a legal obligation to do so, or if the disclosure is permitted on another legal basis. Data is disclosed, for example, to the respective payment or shipping service provider, service providers for marketing services (z.B. email marketing), technical service providers, or—in the event of a corporate transaction—to prospective buyers, etc. Where necessary, we have entered into data processing agreements with the recipients of your data in accordance with Article 28 of the GDPR.

If you choose a payment method offered through the payment service provider Shopify Payments, payment processing is handled by the technical service provider Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, to whom we will disclose the information you provided during the ordering process, along with the details of your order (name, address, account number, bank routing number, credit card number if applicable, invoice amount, currency, and transaction number).Your data will be shared exclusively for the purpose of processing payments with Stripe Payments Europe Ltd. and only to the extent necessary for this purpose. For more information on Shopify Payments’ privacy policy, please visit the following website:https://www.shopify.com/legal/privacy. Information regarding Stripe Payments Europe Ltd.’s privacy policy can be found here:https://stripe.com/de/privacy

Please also note the separate privacy policies of the payment methods you have selected.

Klarna: You have the option to use the payment options offered by Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden (hereinafter “Klarna”). Payment is then made to Klarna. Use of the “Invoice” and “Direct Debit/Instant Transfer” payment methods requires a positive credit check.If you wish to use Klarna, your data will be forwarded to Klarna as part of the purchase initiation and fulfillment of the sales contract for the purpose of address and credit checks. Depending on the results of the credit check, not all payment methods may be available to you. Please note that we have no control over this. You can find more information and Klarna’s Terms of Use here. Klarna’s Privacy Policy can be found here.

PayPal:https://www.paypal.com/de/webapps/mpp/ua/privacy-fullWhen paying via PayPal, credit card via PayPal, direct debit via PayPal, or—if offered—“Purchase on Account” or “Installment Payment” via PayPal, we will forward your payment data to PayPal (Europe)S.a.r.l. et Cie,S.C.A. 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter “PayPal”). This transfer is made in accordance with Art. 6(1)(b) of the GDPR and only to the extent necessary for payment processing.PayPal reserves the right to conduct a credit check for the following payment methods: credit card via PayPal, direct debit via PayPal, or—if offered—“purchase on account” or “installment payment” via PayPal. For this purpose, your payment data may be shared with credit bureaus in accordance with Article 6(1)(f) of the GDPR, based on PayPal’s legitimate interest in determining your creditworthiness. PayPal uses the result of the credit check—which reflects the statistical probability of default—to determine whether to make the respective payment method available. The credit report may contain probability values (so-called “score values”). To the extent that score values are included in the credit report, they are based on a scientifically recognized mathematical-statistical method. The calculation of the score values includes, among other things but not exclusively, address data. For further information regarding data protection—including details on the credit reporting agencies used—please refer to PayPal’s Privacy Policy:https://www.paypal.com/de/webapps/mpp/ua/privacy-fullYou may object to this processing of your data at any time by sending a message to PayPal. However, PayPal may still be entitled to process your personal data if this is necessary for the contractual processing of payments.

VISA:www.visaeurope.com

MasterCard:https://www.mastercard.de/de-de.html

8. Social Media Presence
8.1. Data Processing by Carreraand
Legal Basis Our social media presence (Facebook or Meta, X, TikTok, YouTube, LinkedIn, Xing, and Instagram) serve the purpose of Carrerainforming you about Carreraas well as new developments, services, and products from us. Depending on the offerings of the respective providers, you havez.B. the option to engage in various interactions (commenting, recommending, etc.)z.B.in connection with our social media presence. User interaction is an important factor for us in conducting targeted marketing. This allows usz.B. to determine which posts are most frequently read. We therefore also use the statistics compiled by the providers in this regard for our own purposes. To the extent that we process users’ personal data in this context, the legal basis for this is Article 6(1)(f) of the GDPR. Our legitimate interest in this regard consists, in particular, of providing targeted information and advertising. You will be informed separately by the providers regarding the legal basis on which they process your data for their own purposes.

8.2. Joint
ResponsibilityIn certain cases,


we are jointly responsible with the social media providers for the processing of your personal data. In this case, you may generally exercise your rights (see Section 12) against bothagainst both us and the social media provider. However, the social media provider is the first point of contact.

We have entered into an agreement with Meta regarding joint responsibility for the processing of personal data. This applies to the processing of so-called “Insights data.” This refers to page statistics, particularly regarding interactions by Facebook users. Details about Insights data can be found here:https://www.facebook.com/business/pages/manage#page_insights. You can view our agreement with Meta at the following link:www.facebook.com/legal/terms/page_controller_addendum. Please note that Meta is a U.S.-based company. Meta is an active participant in theU.S.EUU.S. Data Privacy Framework, which ensures the secure transfer of personal data to the U.S. Further information can be found here:https://www.dataprivacyframework.gov/list

We have entered into an agreement with LinkedIn Ireland regarding so-calledWe have also entered into a joint responsibility agreement regarding “Page Insights.” Through Page Insights, LinkedIn Ireland does not provide us with any personal data about you, but only aggregated data. We are unable to draw conclusions about individual users based on the information provided by Page Insights. You can view details about Page Insights and our agreement with LinkedIn Ireland at the following link:https://legal.linkedin.com/pages-joint-controller-addendum. Please note that LinkedIn Ireland may also process your data outside the EU/EEA. LinkedIn Corporation is an active participant in the EU-U.S.U.S. Data Privacy Framework, which ensures the secure transfer of personal data to the United States. For more information, click here:https://www.dataprivacyframework.gov/list.

We use the analytics features of “TikTok Insights.” Through TikTok Insights, we receive an aggregated analysis of visitor behavior on our profile.For example, we may collect data such as likes, video shares, and the age and gender of visitors. We use this analysis via TikTok Insights to improve our profile, our reach, and our audience reach. To the extent that the data you provide to us via TikTok is processed exclusively by TikTok, TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland (“TikTok Ireland”), TikTok Information Technologies UK Limited, WeWork, 125 Kingsway, London, WC2B 6NH (“TikTok UK”) are also data controllers. When we process data jointly with TikTok, we have also entered into a joint controller agreement with TikTok. For details, see:https://ads.tiktok.com/i18n/official/policy/jurisdiction-specific-terms, Part B 1, Sections 3 and 4). A summary of the key provisions of this agreement can be found at:https://www.tiktok.com/legal/page/global/information-about-tiktok-analytics/en.

With regard to the retention period for the data we process from you for our own purposes, please refer to our explanation in Section 10. In all other respects, please refer to the privacy policies of the respective social media provider.

9. Data Transfer to Countries Outside the EU
To the extent necessary for our purposes, we may also transfer your data to recipients outside the EU if you have given your consent, if there is a legal obligation to do so, or if the data transfer is permitted on another legal basis. For example, your data is also transferred as part of data processing to recipients based in the United States. An adequate level of data protection isU.S. ensuredthrough the adoption of the new so-called EU Standard Contractual Clauses and/or the service provider’s participation in the EUU.S. Data Privacy Frameworkin the U.S.U.S. An overview of the participants in the EU-U.S.You can find the Data Privacy Framework here:https://www.dataprivacyframework.gov/s/participant-search

10. Period for Which Personal Data Is Stored/Criteria for Determining the Duration
: We generally store your personal data for as long as is necessary for the aforementioned processing purposes, provided that, in the event of an objection, Carrerathere are no compelling legitimate grounds on our part Carrerathat override your interests, Carreraor, in the event of a withdrawal of consent, there is no other legal basis for data processing. Please also refer to the information in the cookie banner.

In certain cases,z.B. however, where a statutory retention obligation applies, your personal data will not be deleted immediately but will first be blocked.

11.Security Measures to Protect Your Personal Data
: We protect your data from unauthorized access, loss, or destruction through technical and organizational measures. Our security measures are continuously improved in line with technological developments. Our employees and all persons involved in data processing are obligated to comply with data protection laws and to treat personal data confidentially. Our employees have received appropriate training.

To protect our users’ personal data, we use a secure online transmission method known as “Secure Socket Layer” (SSL) transmission. You can recognize this by the “s” appended to the address component http:// (“https://”) or by a green, closed padlock icon. Clicking on the icon will provide you with information about the SSL certificate being used. The appearance of the icon depends on the version of your browser. SSL encryption ensures that your data is transmitted securely and in its entirety.

12. Provider and Data Protection Officer
: Within the framework of legal requirements Carrera

, you Carreragenerally have Carrerathe right to

: confirmation as to whether personal data concerning you Carrerais being processed by Carreraus Carrera;
information about this data and the circumstances of its processing;
rectification, if this data is inaccurate;
deletion, provided there is no justification for the processing and no obligation to retain the data (any longer),
restriction of processing in specific cases defined by law,
and the right to object in the event of data processing based on Article 6(1), sentence 1, letter f. GDPR and
the transfer of your personal data—to the extent you have provided it—to you or a third party in a structured, commonly used, and machine-readable format.

To the extent that the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time, with the result that the processing of your personal data will no longer be permitted in the future. However, this does not affect the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal.

Please direct your specific request in writing or by email—including clear identification of your identity—to our Data Protection Officer:

krupna LEGAL

email:datenschutz@carrera-toys.com
To the extent that we process your data under joint responsibilityi.S.d. pursuant to Art.26 GDPR, if we process data with third parties, the third party is primarily responsible for ensuring that all data subjects’ rights are upheld. However, you are still free to exercise your rights directly with us.

Finally, we would like todsb@dsb.gv.atinform you of your right to file a complaint with the supervisory authority (Austrian Data Protection Authority, Barichgasse 40-42, 1030 Viennadsb@dsb.gv.at)

13. No Automated Individual Decision-Making
We do not use your personal data for automated individual decision-making.

14. Changes to the Privacy Policy
New legal requirements, business decisions, or technical developments may require changes to our Privacy Policy. The Privacy Policy will then be updated accordingly. You can always find the most recent version on our website.

Effective as of January 14, 2024

General Terms and Conditions (Carrera Club)
I. Scope of Application and Amendments to the General Terms and
Conditions1. These Terms and Conditions apply to all goods and services provided by

Carrera Toys GmbH
, Rennbahn Allee 1
5, 412 Puch bei Salzburg

, AUSTRIA, Managing Director: Stefan Krings
, Phone: +43 662 889 21333
, Fax
: +4366288921510Email
:shop@carrera-toys.com

(hereinafterCarrera “we”), which Carreraare provided to customers (hereinafter “Customer/Club Member”) in connection with the CarreraClub, as well as for the use of the Club area on our website.

2. Club members as defined in these Terms and Conditions are consumers within the meaning of Section 13 of the German Civil Code (BGB). A club member is considered a consumer to the extent that the purpose of the ordered goods and services cannot be attributed predominantly to their commercial or self-employed professional activity.
3. Carrerareserves the right to amend these General Terms and Conditions in the event of changing market conditions, changes in the legal landscape, or rulings by the highest courts, even during the term of an existing contractual relationship. The club member will be notified of planned changes via email at least six (6) weeks before the changes take effect. This email will highlight the changes to the existing contractual provisions and, where necessary, provide additional explanations. The club member may object to the changes to the General Terms and Conditions within six (6) weeks of receiving the aforementioned email. If the club member does not object to the changes or does not do so within the specified time frame, their consent to the amended General Terms and Conditions is deemed to have been given, and the changes are deemed to have been effectively agreed upon. The club member will be separately notified of this legal consequence in connection with the planned changes.

II. Purchase/Term of Club Membership
1. CarreraA club membership is required to use the CarreraClub. The customer may Carreraselect an appropriate club membership in the online store Carrera . The ordering process is governed by Section 3 of the online store’s Terms and Conditions. Notwithstanding Section 5 of the online store’s Terms and Conditions, however, the customer may only use the following payment methods to pay the price of the club membership: credit card, Klarna, as well as gift and promotional vouchers.
2. The contract for club membership (hereinafter “Club Membership”) is initially concluded for a term of twelve (12) months. Thereafter, the Club Membership is automatically renewed for an indefinite period.
3. Club membership may be canceled at any time during the first year of membership by clicking the cancellation button on the website, in which case the club membership will end upon the expiration of the twelve (12) months. If the club membership has been extended indefinitely, the club member may cancel at any time with one (1) month’s notice.
4. CarreraThe club may cancel the club membership via email to the club member under the same notice periods as specified in the preceding section.
5. If club membership ends, the member account and club benefits (see Section III) can no longer be used.

III. Scope of Club
Membership Benefits1. Club membership includesu.a.The following benefits, features, and advantages for club members:

· Use of the club
area· Access to exclusive products and special models for club members in the online
store· Discounts in the online store
· The club’s own
newsletter· Annual club event

2. The exclusive special models for the CarreraClub are released (subject to availability) once a year and can Carrerabe ordered through the online store Carrera . To purchase a special model, you must be a Club member at the time of the model’s release. Unless otherwise specified in these Terms and Conditions, the provisions of the online store’s Terms and Conditions apply to the ordering process and the purchase of special models as well as other exclusive products for club members.

3. If a club member receives price discounts for the online store in the form of promotional coupons, the provisions in Section 6 et seq. of the online store’s General Terms and Conditions apply to the redemption of these coupons—unless otherwise specified on the promotional coupon itself.

IV. Price of Club
Membership1. The price of club membership is Carrera listed on the website Carreraand includes the applicable statutory sales tax.
2. When purchasing club membership, the customer may choose between annual and monthly billing. The term of the club membership as specified in Section II.2 remains unaffected by this.
3. Carrera reserves the right to make price changes (including both price reductions and price increases) thatu.a. may resultfromu.a. changes in labor and material costs, taxes, and increased expenses for product improvements. Increases in the aforementioned costs will lead to a price increase only if they are not offset by cost reductions in another area. The same applies, mutatis mutandis Carrera , to a price reduction. Carrera The Club will schedule price changes so that cost reductions are reflected in prices to at least the same extent as cost increases. Price changes will Carrera be communicated to the club member in writing three (3) weeks before the price change takes effect. In the event of a price change, the club member has the right to terminate their club membership in writing without notice as of the effective date of the change. The club member will be informed of this right as part of the notification of the price change. In all other respects, Section 315 of the German Civil Code (BGB) remains unaffected.

V. Terms of Use for the Club Area
To use the club area, you must create a member account. With regard to the processing of personal data in connection with the member account Carrera , please Carrerarefer to the Privacy Policy Carrera. Once registration as a club member is complete, the club member will have access to the club area via our website. The following Terms of Use apply to the use of the club area.

1. Access/Availability/Changes to Features
1.1 Carrerawill endeavor to keep the club area available without interruption. However, there is no guarantee of this.
1.2 The establishment and availability of the data connection are not part of club membership. The club member therefore bears sole responsibility for the selection and functionality of their data connection, including the transmission channels. has Carrerano influence over connection costs Carrera.
1.3 Carrerais entitled, without prejudice to the assertion of any other rights, to deny the club member access to the club area at any time and to suspend the member’s access in accordance with Section V.7 if the club member violates the Terms of Use.
1.4 Carrerais entitled to make changes to the Club Area if this is necessary to adapt to a new technical environment, an increased number of users, to improve usability, or for other important operational reasons.

2. Scope

of Services

The following features, in particular, are available when using the Club Area:

· Communication with other club members in the forum via chat, images, and videos
· Product reviews, etc.

3. Basic Obligations of the Club Member

II.

1.
2.
3.

3.1 The club member is obligated to use the club area in accordance with this section. V and in accordance with applicable law.

3.2 When using a password, appropriate security measures must be taken. For example, a password should be at least 8 characters long and, whenever possible, consist of a combination of uppercase and lowercase letters, numbers, and special characters. In this regardz.B. ,trivial passwords such as “ABC” or keyboard sequences ( z.B. “qwert” or “asdfgh”), all types of names (such as those of friends, acquaintances, colleagues, family members, or pets), city and building names, comic book characters, car brands, license plate numbers, terms, dates of birth, phone numbers, common abbreviations, etc.

3.3 The club member is obligated to provide truthful information during registration and in their member account and to keep this information up to date at all times.If any of the provided information changes during the term of use, the club member shall update it immediately in the personal settings of the member account.

3.4 Login credentials must be kept strictly confidential. If, however, the password has been disclosed—for example, to allow third parties to access certain data in an emergency—the password must be changed immediately. Furthermore Carrera, the club must Carrerabe notified immediately as soon as there are indications of an impending or actual instance of password misuse, in order to arrange for access to be blocked and a new password to be set. For your own protection, you are prohibited from reusing passwords that have already been used.

4. Prohibited Actions

4.

4.1 Club members agree not to offer, post, distribute, or engage in any activities or content while using the club area that violate legal prohibitions, public decency, the rights of third parties, and/or the regulations listed below.

4.2 Prohibited activities and content include, in particular:

· those in the realm of “erotica” or “pornography”;

· services that violate regulations designed to prevent illegal employment, such as the Act to Combat Illegal Employment and Illegal Work (SchwarzArbG), the Youth Protection Act, or data protection regulations;

· the offering or advertising of services that are not in accordance with the spirit and purpose of the club area or that Carrera have not Carrerabeen coordinated with Carreraand approved by the club in advance Carrera.

4.3 Club members are also prohibited from the following actions:

· the distribution of viruses, Trojan horses, and other malicious files;
· gaining access—for themselves or another person—to data not intended for them and that is specifically secured against unauthorized access by bypassing the security measures, and/or using such data;
· sending junk or spam emails as well as chain letters;
· distributing suggestive, offensive, sexually explicit, obscene, or defamatory content or communication, as well as content or communication that is likely to promote or support racism, fanaticism, hatred, physical violence, or unlawful acts (whether explicitly or implicitly);
· harassing other club members z.B. by repeatedly contacting them personally without or in spite of their response , z.B . as well as promoting or Encouraging such harassment;
· asking other club members to disclose passwords or personal data for commercial, illegal, or unlawful purposes;
· distributing and/or publicly reproducing content available in the Club Area, unless expressly permitted by the respective copyright holder or expressly intended in accordance with the purpose and function of the Club Area.

4.4 Club members are also prohibited from any action that is likely to interfere with the smooth operation of the Club Area, in particular placing an excessive load on the network systems.

4.5 Should a Club Member become aware of any illegal, abusive, or otherwise unauthorized use of the Club Area—or any use that violates the terms of use—the Club Member is obligated Carreratocontact [contact information] Carrera. Carrerawill then review the matter and, if necessary, take appropriate action.

4.6 If there is suspicion of unlawful or criminal acts Carrera, the CarreraClub is Carreraauthorized—and, if necessary, also obligated—to investigate the Club member’s activities and, if necessary, take appropriate legal action. This may also include referring the matter to the public prosecutor’s office.

5. Content Provided by Club Members5

.

5.1 The club member is fully responsible for the content they post. Carreradoes not review the content for completeness, accuracy, legality, timeliness, quality, or suitability for a specific purpose.

5.2 The club member agrees not to make any content publicly available within the club area that constitutes a violation of competition law or a violation of applicable professional regulations, or that infringes the rights of third parties—such as trademark rights, copyrights and related rights, title protection rights, or personal rights; and to make publicly available only such content for which the club member has the exclusive right of use or is otherwise authorized ( z.B. through a license or permission from the rights holder).

5.3 Carrerareserves the right to in the event of a report of possible legal violations caused by the club member or in the event of evidence suggesting a legal violation, to temporarily remove the specific infringing content from the profile and subsequently investigate the factual and legal situation regarding regarding the alleged violation (notice-and-takedown procedure). The club member shall cooperate Carrerafully during the investigation Carrera to enable the matter to be resolved as promptly as possible. Carrera However, in doing so, it will take the club member’s legitimate interests into account and choose the least restrictive measure to address the infringement.

5.4 In the event of obvious and serious infringements Carrera , the Carrera company is Carreraentitled to immediately and permanently remove the infringing content from the club member’s profile. CarreraThe Club Member will be informed of the implementation of such measures.

6. Right

of Use6.

6.1 The club member is granted a non-exclusive (simple), non-sublicensable, and non-transferable right to use the club area, limited to the term of the respective contractual relationship. The Club Area may be used exclusively within the scope of functionality provided for in these Terms of Use.

6.2 In particular, Club Members are not permitted to grant access to the Club Area to third parties, whether for a fee or free of charge, or to otherwise exploit the Club Area commercially. Finally, no rights to the Club Area may be rented, leased, or otherwise transferred.

6.3 The Club Member is entitled to access and view the content available within the Club Area online exclusively for personal purposes while using the Club Area. Any further editing, whether in whole or in part, presentation, public display, publication, or distribution of content is not permitted for the club member, unless such use is expressly permitted under these Terms of Use or is intentionally enabled by a specific feature within the club area (z.B. via a download button).

7. Suspension

I.

1.
2.
3.
4.
5.
6.
7.

7.1 Carrerais entitled to temporarily or permanently suspend the club member’s profile, to the extent and as soon as there are concrete indications of a violation of the prohibitions and content restrictions set forth in Sections V.4 and V.5 and/or applicable legal provisions and/or these Terms of Use. When deciding on a suspension Carrera , the club member’s legitimate interests will Carrera be given due consideration.

7.2 CarreraThe club will notify the club member in advance of any intended suspension via email, stating the reason, and will give the club member the opportunity to comment on the matter. After receiving the club member’s response Carrera, the club will make Carrerathe final decision regarding any suspension and notify the club member of the outcome via email.

7.3 In the event of a temporary suspension only Carrera, the club member’s profile will Carrerabe restored after the expiration of a necessary and reasonable suspension period, and the club member will be notified of this via email.

7.4 In the event of a permanent suspension, reactivation of the profile is not possible. Club members who have been permanently suspended are permanently barred from using the club area and may not re-register.

VI. Right of Withdrawal Regarding Club Membership
: Consumers generally have a statutory right of withdrawal when entering into a distance sale, as Carreradescribed below in accordance with the statutory model.

With

drawal

PolicyRight of

WithdrawalYou have the right to withdraw from this contract within fourteen days without giving any reason.

VII.
Liability1. Liability Carrerafor damages of any kind is excluded. This exclusion does not apply to claims for damages by the club member arising from injury to life, limb, or health, or from a breach of material contractual obligations (cardinal obligations), nor does it apply to liability for other damages Carreraresulting from an intentional or grossly negligent breach of duty by the club Carrera, its legal representatives, Carreraor vicarious agents. Essential contractual obligations are all obligations whose fulfillment is essential for the proper performance of the contract and on whose compliance the club member regularly relies and is entitled to rely.

2. In cases of negligent breach (simple negligence) of material contractual obligations Carrera, the CarreraClub is liable Carreraonly for foreseeable damages typical for this type of contract, unless the club member’s claims for damages arise from injury to life, body, or health.

3. The provisions of the Product Liability Act remain unaffected. Liability under a warranty also remains unaffected.

VIII. Data Protection
1. It is in line with the quality standards of Carrerato handle the personal data of club members responsibly. CarreraTherefore, the personal data processed in connection with registration as a club member and the use of the available services is Carreracollected, stored, and processed by [ CarreraCompany Name] only to the extent necessary to provide the services in accordance with their intended use and to the extent permitted by law or required by statutory provisions. Carrerawill treat personal data confidentially and in accordance with the provisions of applicable data protection law and will not disclose it to third parties. Details can be found in the Privacy Policy (see website).

2. Please note that you are solely responsible for the content of your communications. In this context, please always observe the applicable legal provisions, particularly with regard to the processing of special categories of personal data, as well as violations of the confidentiality of speech under Section 201 of the German Criminal Code (StGB) and of private secrets under Section 203 of the German Criminal Code (StGB).

3. The club member is aware that the content posted in the forum is accessible to other authorized club members.

IX. Dispute
Resolution 1. The European Commission provides a platform for the online resolution of consumer disputes, which can be accessed via the following link:http://ec.europa.eu/consumers/odr/

2. Our email address is:carreraclub@carrera-toys.com

3. Carrerais neither obligated nor willing to participate in dispute resolution proceedings before a consumer arbitration board.

X. Final
Provisions: Contracts between Carreraand the club member are governed by the laws of the Federal Republic of Germany, to the exclusion of the United Nations Convention on Contracts for the International Sale of Goods. However, this choice of law does not deprive the club member of the protection afforded by the mandatory provisions of the law of the country in which he or she has his or her habitual residence.

Effective: March 2023

Privacy Policy <tc>Carrera</tc> <tc>Hybrid</tc> App

Privacy Policy
: In the following, we, d.h. Carrera Toys GmbH (hereinafter referred to as “we”Carrera or “us”), inform d.h . Carrera Carrerayou about the nature, scope, and purpose of the collection and use of your personal data in connection with the Carrera Hybridapp (hereinafter referred to as the “App”). Personal data refers to any information relating to an identified or identifiable natural person. This includes, in particular, your name, address, and email address.

1. Data Controller and Data
Protection OfficerThe data
controller for the App and the data controller within the meaning of data protection law is

CarreraToys GmbH, Renn
bahn Allee 1
5,
41
2 Puch/Salzburg


, Austria. Managing


Director: Stefan KringsPhone

: +43 662 88921-0Email

:shop@carrera-revell.com
Data Protection Officer:

krupna LEGAL

E-mail: datenschutz@carrera-toys.com
2.Data Processing and Purpose
: Depending on the specific use of the app, personal data is processed for the purposes listed below. Unless otherwise specified, the legal basis for data processing is Article 6(1), first sentence, letter b of the GDPR.

2.1. Downloading the App

: When you download the app, the necessary information is transmitted to the respective app store,d.h. including, in particular, your account’s username, email address, and customer number; the time of the download; payment information; and individual device codes. We have no influence over this data collection and are not responsible for it. We process this provided data to the extent necessary for downloading the app to your device. We do not store this data beyond that.

2.2.Device and Connection Data:

When your device connects to our server, your device and connection data are processed. This includes your IP address, the date and time of the request, device identification numbers (UDID and similar device numbers), and other device information (operating system and version, manufacturer and model, IMEI, IMSI, mobile phone number, MAC address). The connection data is not used to draw conclusions about the user’s identity or combined with data from other sources; rather, it is used to identify your device, improve the app, and troubleshoot issues. The legal basis is Article 6(1)(f) of the GDPR. After each session or use of the app, the data is anonymized by truncating the IP address at the domain level.

2.3. Initial Registration

To use the app, you must first register. To register for the first time, you must enter your email address, username, and password (hereinafter referred to as “login credentials”), accept the Terms and Conditions, and you will then receive a confirmation link via email. Once you click the link in the email, the registration process is complete. A password must be at least 8 characters long and should ideally consist of a combination of uppercase and lowercase letters, numbers, and special characters. Common words such as “ABC” or keyboard sequences (z.B. “qwert” or “asdfgh”), all types of names (z.B. of friends, colleagues, family members, pets), names of cities and buildings, comic book characters, car brands, license plate numbers, terms, dates of birth, phone numbers, common abbreviations, etc.

Your login credentials must be kept strictly confidential. For your own protection, you must not reuse passwords that have already been used.

In addition, we store your IP address and the time of registration as part of the initial registration process. This is necessary to ensure the security of our IT systems. The legal basis for processing your data in this case is Article 6(1), first sentence, letter f of the GDPR.

Information that is absolutely necessary for using the app is marked as required. Failure to provide this information means that you will not be able to complete the registration process or use the app.

2.4. Login Credentials—Regular

LoginTo log in to the app in the future after successful initial registration (Section 2.3), you will generally need to enter your login credentials. Your login credentials are transmitted to the server in encrypted form and cannot be viewed by third parties. You don't have to re-enter your login information every time you use the app. Instead, your login credentials are temporarily stored on your device using a refresh token. However, to prevent unauthorized use of the app by third parties, we recommend that you log out after use and re-enter your login credentials each time you use the app.

2.5. App Usage and Functionality

The following features are available to you when using the app:

Adding drivers, vehicles, and routes
List of races (especially times and routes)
Performance measurement

Within the app, you have the optionz.B. to name drivers individually. It is not necessary to use real names when using the app.

To establish a connection between the app and the vehicle, the app requires your approval/authorization for the Bluetooth function on your device. You will be prompted to do so within the app.

The legal basis for data processing—insofar as you are asked for permission—is your consent pursuant to Art. 6(1)(a) of the GDPR. You are not required to give your consent. However, if you do not give your consent, you will not be able to use the app’s full functionality. You can revoke or grant your consent at any time in the future via your device’s settings.

All other processing of your data is based on Article 6(1), first sentence, (f) of the GDPR.

2.6. Authorization for Location

Services

: For the app to function fully, it requires your authorization to access the location services on your device. The so-called The Location Access Service is required for a data-based Bluetooth connection. The legal basis for data processing is therefore your consent pursuant to Art. 6(1), sentence 1, subparagraph (a) of the GDPR. You are not required to give your consent. However, if you do not give your consent, you will not be able to use the app’s full functionality. You can revoke or grant your consent at any time in the future via your device’s settings.

2.7. Crash Reports/Error Messages

If you consent to the transmission of a crash report following a system crash of the app or another technical error, the relevant information will be transmitted in anonymized form to the app’s developers for the purpose of analysis.

3. Links to Other Websites
: The app may contain links to social networks (Facebook or Meta, YouTube). These websites are operated by third parties. If you follow the links, information may therefore be transmitted to these third parties. For information on the purpose and scope of data collection by third-party websites, as well as the further processing and use of your data on those sites, and your related rights and privacy settings, please refer to the respective privacy policies of the operators.

4. Recipients/Categories of Recipients of Your Data
We will only disclose your personal data to third parties or other recipients if this is necessary for the provision of services, if you have given your consent, if there is a legal obligation to do so, or if the disclosure of data is permitted on another legal basis. Where necessary, we have entered into data processing agreements with the recipients of your data in accordance with Article 28 of the GDPR. In accordance with this policy, we use, for example, the hosting services of Amazon Web Services Inc., EMEA SARL, 38 avenue John F. Kennedy, L-1855, Luxembourg, which operates a data center in Frankfurt am Main.

We disclose your data to government agencies only to the extent required by law or based on an official order or court decision.

Furthermore, in accordance with the aforementioned provisions, your personal data is or may be transferred to the following recipients or categories of recipients:

Companies within the corporate group of Carrera in its current or future form (a corporate group consists of a controlling company and its subsidiaries; see Art. 4(19) of the GDPR).
Business partners, sales partners, etc.
Employees and independent contractors
Service providers (z.B .IT service providers,
corporate buyers or prospective buyers
, and/or
investors; where applicable
, government agencies or other public authorities.

5. Data Transfer to Countries Outside the EU
As a general rule, we do not transfer your data to recipients outside the EU. However, if it is necessary for our purposes, we will transfer your data only if it is ensured that the recipient of the data guarantees an adequate level of data protection and no other legitimate interests preclude the data transfer.

6. Retention Period for Personal Data/Criteria for Determining the Duration
: Your personal data will be Carrerastored for Carreraas long as necessary for the aforementioned processing purposes, provided that Carrera, in the event of an objection, there are no compelling legitimate grounds for Carreraprocessing Carrerathat override your interests, Carreraor, in the event of a withdrawal of consent, there is no other legal basis for data processing. In certain cases,z.B. however,z.B. where a statutory retention obligation applies, your personal data will not be deleted immediately but will first be blocked.

7. Security Measures to Protect Your Personal
DataWe protect your data from unauthorized access, loss, or destruction through technical and organizational measures. Our security measures are continuously improved in line with technological developments.In this context, however, it is important that you actively manage updates to ensure that the software on your devices is always up to date. If you z.B. are using outdated versions of iOS or Android, certain security measures related to the app may not be guaranteed.

8. Your Rights

Within the framework of legal requirements Carrera

, you Carrera generally have Carrerathe right to

confirmation as to whether personal data concerning you Carrerais being processed by Carrera,
information about this data and the circumstances of the processing,
correction if this data is inaccurate,
erasure if there is no justification for the processing and no obligation to retain the data (any longer),
restriction of processing in specific cases defined by law, and
the right to object in the event of data processing based on Art.Article 6(1)(f) of the GDPR and
the transfer of your personal data—to the extent that you have provided it—to you or a third party in a structured, commonly used, and machine-readable format.
To the extent that the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time, with the result that the processing of your personal data will no longer be permitted in the future. However, this does not affect the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal. Please refer to the settings on your device for more information.

Please submit your specific request in writing or by email, ensuring that you can be clearly identified, to:

CarreraToys GmbH
, Rennbahn Allee 1
5, 41
2 Puch/Salzburg
, Austria

. Email

:datenschutz@carrera-toys.com
Finally, we would like todsb@dsb.gv.atinform you of your right to file a complaint with the supervisory authority (Austrian Data Protection Authority, Wickenburggasse 8, 1080 Viennadsb@dsb.gv.at).

9. No Automated Individual Decision-
Making We do not use your personal data for automated individual decision-making.

10. Changes to the Privacy
PolicyNew legal requirements, business decisions, or technical developments may necessitate changes to our Privacy Policy. The Privacy Policy will then be updated accordingly. You can always find the current version in the app.

Privacy Policy: <tc>Carrera</tc> Race Management App

In the following provisions, we, d.h. Carrera Toys GmbH, informd.h . Carrerayou about the nature, scope, and purposes of the collection and use of your personal data in connection with the CarreraRace Management app (hereinafter: “Race App”). Personal data refers to any information relating to an identified or identifiable natural person. This includes, in particular, your name and your email address.

1. Provider and Data Protection OfficerThe
provider
of the Race App and the data controller within the meaning of data protection law is

CarreraToys GmbH

Carrera, Renn
bahn Allee 1, 5412
Puch/Salzburg,
Austria

. Managing


Director: Stefan Krings
. Tel.: +43 (0) 662 88921-0
Email:shop@carrera-toys.com
CarreraYou can contact the data protection officer of CarreraToys GmbH at

Email:datenschutz@carrera-toys.com
CarreraToys GmbH
, Rennbahn Allee
1, 541
2 Puch/Salzburg

2.Data Processing and Purpose
: Depending on the specific use of the Race App, personal data is processed for the purposes specified below. Unless otherwise stated, the legal basis for data processing is Article 6(1), first sentence, letter b of the GDPR.

2.1. Downloading the Race App
When you download the Race App, the necessary information is transmitted to the respective app store,d.h . including, in particular, your account username, email address, and customer number; the time of the download; payment information; and your device’s unique identifier. We have no control over this data collection and are not responsible for it. We process this provided data to the extent necessary for downloading the Race App onto your device. It is not stored beyond that.

2.2. Device and Connection
Data
: When your device establishes a connection with our server, your device and connection data are processed. This includes your IP address, the date and time of the request, device identifiers (UDID and similar device numbers), and other device information (operating system and version, manufacturer and model, IMEI, IMSI, mobile phone number, and MAC address). Connection data is not used to identify the user personally or combined with data from other sources; rather, it is used to identify your device, improve the RC MicroHD app, and troubleshoot issues. The legal basis is Article 6(1)(f) of the GDPR.

2.3. Features of the RC MicroHD App and Data
ProcessingWhen using the Race App, the following features are available to you in particular:

• Creating drivers, vehicles
, and tracks
• Organizing championships (including Training and Qualification)
• List of the fastest
races• Performance measurement

After entering the above data and before the race begins:

• Adjust speed, fuel, and brakes

Within the Race app, you canz.B. name eachz.B. driver individually and assign a photo to them. As part of these features, you can access the photo album stored on your device or—after individually granting permission for the camera function—take a new photo.

To establish a connection between the Race App and the vehicle, the Race App requires your permission to access your device’s Bluetooth function. You will be prompted accordingly within the Race App. The legal basis for data processing—insofar as you are asked for authorization—is your consent pursuant to Art. 6(1)(a) of the GDPR. You are not required to provide your consent.However, if you do not give your consent, you will not be able to take full advantage of the Race app’s features. You can revoke or grant your consent at any time in the future through your device’s settings. The processing of your data in other respects is based on Article 6(1)(f) of the GDPR.

2.4. Authorization for Location
Services
For the app to function fully, it requires your authorization to access your device’s location services. The so-called Location Access Service is required for a data-based Bluetooth connection. The legal basis for data processing is therefore your consent pursuant to Article 6(1)(a) of the GDPR. You are not required to give your consent. However, if you do not give your consent, you will not be able to use the app’s full functionality. You can revoke or grant your consent at any time in the future through your device’s settings.

3. Links to Other Websites
The Race app contains links to social media platforms (Facebook, YouTube). These websites are operated by third parties. If you follow these links, information may be transmitted to these third parties. For information on the purpose and scope of data collection by third-party websites, as well as the further processing and use of your data on those sites, and your related rights and privacy settings, please refer to the respective privacy policies of the operators.

4. Data
Transfer Your personal data will only be transferred to third parties or other recipients if there is legal authorization to do so or if you have given your prior consent. Where necessary, we have entered into data processing agreements with the recipients of your data in accordance with Article 28 of the GDPR. We disclose your data to government agencies only to the extent required by law or pursuant to an official order or court decision.

5. Data Transfer to Countries Outside the EU
We generally do not transfer your data to recipients outside the EU. However, should it be necessary for our purposes, we will transfer your data only if it is ensured that the recipient of the data guarantees an adequate level of data protection and no other legitimate interests oppose the data transfer.

6. Retention Period for Personal Data/Criteria for Determining the
Retention Period
: Your personal data will be Carrerastored by Carrera Toys GmbH for as long as necessary to fulfill the aforementioned purposes of processing, provided that, in the event of an objection, there are no compelling legitimate grounds on the part of CarreraToys GmbH that would prevent this, or, in the event of a withdrawal of consent, there is no other legal basis for data processing. In certain cases,z.B . however, z.B. where a statutory retention obligation applies, your personal data will not be deleted immediately but will first be blocked.

7. Data
Security We protect your data from unauthorized access, loss, or destruction through technical and organizational measures. Our security measures are continuously improved in line with technological developments.In this context, however, it is important that you actively manage updates yourself to ensure that the software on your devices is always up to date. If youz.B. are using outdated versions of iOS or Android, some security measures related to the RC MicroHD app may not be guaranteed.

8.Your Rights
: Within the framework of legal requirements Carrera

Carrera, you Carreragenerally have Carrerathe following rights with respect to CarreraToys GmbH:

• Confirmation as to whether personal data concerning you Carrerais being processed by CarreraToys GmbH;
• Access to this data and information regarding the circumstances of its processing;
• Rectification, if this data is inaccurate;
• erasure, provided there is no justification for the processing and no obligation to retain the data (any longer),
• restriction of processing in specific cases prescribed by law,
• objection in the event of data processing based on Article 6(1)(f) of the GDPR, and
• the right to have your personal data—to the extent you have provided it—transferred to you or a third party in a structured, commonly used, and machine-readable format.

To the extent that the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time, with the result that the processing of your personal data will no longer be permitted going forward. However, this does not affect the lawfulness of the processing carried out on the basis of your consent up until the time of withdrawal. Please check the settings on your device. Please submit your specific request in writing or by email, including clear identification of yourself, to:

Email:datenschutz@carrera-toys.com
CarreraToys GmbH

, Rennbahn Allee 1

5, 41

2 Puch/Salzburg

dsb@dsb.gv.at. Finally, we would like todsb@dsb.gv.atinform you of your right to file a complaint with the supervisory authority (Austrian Data Protection Authority, Wickenburggasse 8, 1080 Viennadsb@dsb.gv.at).

9. No Automated Individual Decision-Making
We do not use your personal data for automated individual decision-making.

10. Changes to the Privacy Policy
New legal requirements, business decisions, or technological developments may require changes to our Privacy Policy. The Privacy Policy will then be updated accordingly.

Privacy Policy: <tc>Carrera</tc> <tc>GO!!!</tc> Plus App

In the following provisions, we, d.h. Carrera Toys GmbH, inform d.h . Carrera you about the nature, scope, and purposes of the collection and use of your personal data in connection with the Carrera Go!!! Plus app (hereinafter: “Carrera Go!!! app”). Personal data refers to any information relating to an identified or identifiable natural person. This includes, in particular, your name and your email address.

1. Provider and Data Protection OfficerThe
provider
of GO!!!the GO!!!Plus App and the data controller within the meaning of data protection law is

CarreraToys GmbH

Carrera, Renn
bahn Allee 1, 5412
Puch/Salzburg,


Austria. Managing


Director: Stefan Krings
. Tel.: +43 (0) 662 88921-0
Email:shop@carrera-toys.com
Carrera You can contact the data protection officer of Carrera Toys GmbH at

Email: datenschutz@carrera-toys.com
CarreraToys GmbH
, Rennbahn Allee
1, 541
2 Puch/Salzburg

2. Data Processing and Purpose
: Depending on the specific use of GO!!!the GO!!!Plus App, personal data is processed for the purposes specified below. Unless otherwise stated, the legal basis for data processing is Article 6(1), first sentence, letter b of the GDPR.

2.1. Downloading the Carrera GO!!! App
When you download the RC MicroHD app, the necessary information is transmitted to the respective app store,d.h. specifically your account’s username, email address, and customer number; the time of the download; payment information; and your device’s unique identifier. We have no control over this data collection and are not responsible for it. We process this provided data to the extent necessary for downloading the RC MicroHD app onto your device. It is not stored beyond that.

2.2.Device and Connection
Data
Carrera GO!!! : When you download the Carrera GO!!!Plus App, the necessary information is transmitted to the respective app store, d.h . specifically your account’s username, email address, and customer number, the time of the download, payment information, and a unique device identifier. We have no control over this data collection and are not responsible for it. We process this provided data to the extent Carrera Go necessary for downloading the Carrera Go !!! Plus App onto your device. It is not stored beyond that.

2.3.Features of the Carrera GO!!!Plus App and Data
Processing
Carrera GO!!!: When using the Carrera GO!!!Plus App, the following features are available to you:

• Adding drivers
•
Chase
mode
• Training
• Lap races

Within the Carrera GO!!!Plus App, you canz.B. name drivers individually. To establish a connection between the Carrera Go!!! app and the vehicle Carrera Go, the Carrera Go !!! app requires Carrera Goyour permission to access the Bluetooth function on your device. You will be GO!!!prompted accordingly in the GO!!!Plus app. The legal basis for data processing—insofar as you are asked for authorization—is your consent pursuant to Art. 6(1)(a) of the GDPR. You are not obligated to give your consent.However, if you do not give your consent, you will GO!!!not be able to GO!!! take full advantage of the GO!!!Plus App’s features GO!!! . You can revoke or grant your consent at any time in the future through your device’s settings. The processing of your data in other respects is based on Article 6(1)(f) of the GDPR.

2.4. Authorization for Location
Services
: For the app to function fully, it requires your authorization to access your device’s location services. The so-called Location Access Service is required for a data-based Bluetooth connection. The legal basis for data processing is therefore your consent pursuant to Article 6(1), first sentence, letter a of the GDPR. You are not obligated to give your consent. However, if you do not grant your consent, you will not be able to use the app’s full functionality. You can revoke or grant your consent at any time for the future in your device’s settings.

3. Data
Transfer Your personal data will only be transferred to third parties or other recipients if there is legal authorization to do so or if you have given your prior consent. Where necessary, we have entered into data processing agreements with the recipients of your data in accordance with Article 28 of the GDPR. We disclose your data to government agencies only to the extent required by law or pursuant to an official order or court decision.

4. Data Transfer to Countries Outside the EU
We generally do not transfer your data to recipients outside the EU. However, if it is necessary for our purposes, we will only transfer your data if we can ensure that the recipient of the data guarantees an adequate level of data protection and there are no other legitimate interests that would preclude the data transfer.

5. Duration for Which Personal Data Is Stored/Criteria for Determining the Duration
: Your personal data will be Carrerastored by CarreraToys GmbH for as long as necessary for the aforementioned processing purposes, provided that, in the event of an objection, there are no compelling legitimate grounds on the part of CarreraToys GmbH that would prevent this, or, in the event of a withdrawal of consent, there is no other legal basis for data processing. In certain cases,z.B. however,z.B. where a statutory retention obligation applies, your personal data will not be deleted immediately but will first be blocked.

6.Data
Security: We protect your data from unauthorized access, loss, or destruction through technical and organizational measures. Our security measures are continuously improved in line with technological advancements. In this context, however, it is important that you actively manage updates yourself to ensure that the software on your devices is always up to date. If youz.B. are using outdated versions of iOS or Android, some security measures related to the Carrera Go!!! Plus app may Carrera Gonot be guaranteed.

7.Your Rights
: Within the framework of legal requirements Carrera

Carrera, you Carreragenerally have Carrerathe following rights with respect to CarreraToys GmbH

: • Confirmation as to whether personal data concerning you Carrerais being processed by CarreraToys GmbH;
• Access to this data and information regarding the circumstances of its processing;
• Rectification, if this data is inaccurate;
• erasure, provided there is no justification for the processing and no obligation to retain the data (any longer),
• restriction of processing in specific cases prescribed by law,
• objection in the event of data processing based on Article 6(1)(f) of the GDPR, and
• the right to have your personal data—to the extent you have provided it—transferred to you or a third party in a structured, commonly used, and machine-readable format.

To the extent that the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time, with the result that the processing of your personal data will no longer be permitted going forward. However, this does not affect the lawfulness of the processing carried out on the basis of your consent up until the time of withdrawal. Please check the settings on your device. Please submit your specific request in writing or by email, including clear identification of yourself, to:

Email:datenschutz@carrera-toys.com
CarreraToys GmbH

, Rennbahn Allee 1

5, 41

2 Puch/Salzburg

dsb@dsb.gv.at. Finally, we would like todsb@dsb.gv.atinform you of your right to file a complaint with the supervisory authority (Austrian Data Protection Authority, Wickenburggasse 8, 1080 Viennadsb@dsb.gv.at).

8. No Automated Individual Decision-Making
We do not use your personal data for automated individual decision-making.

9. Changes to the Privacy Policy
New legal requirements, business decisions, or technological developments may require changes to our Privacy Policy. The Privacy Policy will then be updated accordingly.

Privacy Policy: <tc>Carrera</tc> RC App

In the following provisions, we, d.h. Carrera Toys GmbH, informd.h . Carrerayou about the nature, scope, and purposes of the collection and use of your personal data in connection with Carrerathe CarreraRC app (hereinafter: “RC app”). Personal data refers to any information relating to an identified or identifiable natural person. This includes, in particular, your name and your email address.

1. Provider and Data Protection OfficerThe
provider
of the RC App and the data controller within the meaning of data protection law is

CarreraToys GmbH

Carrera, Renn
bahn Allee 1, 5412
Puch/Salzburg


, Austria. Managing


Director: Stefan Krings
. Tel.: +43 (0) 662 88921-0
Email:shop@carrera-toys.com
CarreraYou can contact the data protection officer of CarreraToys GmbH at

Email: datenschutz@carrera-toys.com
CarreraToys GmbH
Rennbahn Allee 1
5412 Puch/Salzburg

2.Data Processing and Purpose
: Depending on the specific use of the RC app, personal data is processed for the purposes specified below. Unless otherwise stated, the legal basis for data processing is Article 6(1), first sentence, letter b of the GDPR.

2.1. Downloading the RC
App:
When you download the RC App, the information required for the download is transmitted to the respective app store,d.h. specifically your account’s username, email address, and customer number, the time of the download, payment information, and your device’s unique identifier. We have no control over this data collection and are not responsible for it. We process this provided data to the extent necessary for downloading the RC app onto your device. It is not stored beyond that.

2.2. Device and Connection
Data
: When your device establishes a connection with our server, your device and connection data are processed. This includes your IP address, the date and time of the request, device identifiers (UDID and similar device numbers), and other device information (operating system and version, manufacturer and model, IMEI, IMSI, mobile phone number, and MAC address). Connection data is not used to identify the user personally or combined with data from other sources; rather, it is used to identify your device, improve the RC MicroHD app, and troubleshoot issues. The legal basis is Article 6(1)(f) of the GDPR.

2.3. RC App Features and Data
Processing When using the RC app, the following features are available to you:

• Setting up a local network between your mobile phone and the
quadcopter• Streaming real-time images (videoand photos) to the app
• Saving videoand photos from the stream to the app or a local image/video folder

To establish a connection between the RC app and the vehicle, the RC app requires your permission to access your device’s Wi-Fi function. You will be prompted accordingly within the RC app. The legal basis for data processing—insofar as you are asked for authorization—is your consent pursuant to Art. 6(1)(a) of the GDPR. You are not obligated to give your consent. However, if you do not grant your consent, you will not be able to use the full functionality of the RC app.You can revoke or grant your consent at any time for the future in your device's settings. Other processing of your data is based on Article 6(1)(f) of the GDPR.

3. Link to the Online Store
This RC app contains a link to the CarreraToys GmbH online store Carrera. Please note the separate privacy policy of the online store in this regard.

4. Data
Transfer Your personal data will only be transferred to third parties or other recipients if there is legal authorization to do so or if you have given your prior consent. Where necessary, we have entered into data processing agreements with the recipients of your data in accordance with Article 28 of the GDPR. We will only disclose your data to government agencies in accordance with legal obligations or pursuant to an official order or court decision.

5. Data Transfer to Countries Outside the EU
: We generally do not transfer your data to recipients outside the EU. However, if it is necessary for our purposes, we will transfer your data only if it is ensured that the recipient of the data guarantees an adequate level of data protection and no other legitimate interests preclude the data transfer.

6. Duration of Personal Data Storage/Criteria for Determining the Duration
Carrera: Your personal data will be Carrerastored by Carrera Toys GmbH for as long as necessary for the aforementioned processing purposes, provided that, in the event of an objection, there are no compelling legitimate grounds on the part of CarreraToys GmbH that would prevent such processing, or, in the event of a withdrawal of consent, there is no other legal basis for the data processing. In certain cases,z.B . However, if there is a legal retention requirement, your personal data will not be deleted immediately but will first be blocked.

7. Data
Security We protect your data from unauthorized access, loss, or destruction through technical and organizational measures. Our security measures are continuously improved in line with technological developments. In this context, however, it is important that you actively manage updates yourself to ensure that the software on your devices is always up to date. If youz.B. are using outdated versions of iOS or Android, some security measures related to the RC MicroHD app may not be guaranteed.

8. Your Rights
: Within the framework of legal requirements Carrera

Carrera, you Carreragenerally have Carrerathe following rights with respect to CarreraToys GmbH

: • Confirmation as to whether personal data concerning you Carrerais being processed by CarreraToys GmbH;
• Access to this data and information regarding the circumstances of its processing;
• Rectification, if this data is inaccurate;
• erasure, provided there is no justification for the processing and no obligation to retain the data (any longer),
• restriction of processing in specific cases prescribed by law,
• objection in the event of data processing based on Article 6(1)(f) of the GDPR, and
• the right to have your personal data—to the extent you have provided it—transferred to you or a third party in a structured, commonly used, and machine-readable format.

To the extent that the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time, with the result that the processing of your personal data will no longer be permitted going forward. However, this does not affect the lawfulness of the processing carried out on the basis of your consent up until the time of withdrawal. Please check the settings on your device. Please submit your specific request in writing or by email, including clear identification of yourself, to:

Email:datenschutz@carrera-toys.com
CarreraToys GmbH

Rennbahn Allee 1

541

2 Puch/Salzburg

Finally, we would like todsb@dsb.gv.atinform you of your right to file a complaint with the supervisory authority (Austrian Data Protection Authority, Wickenburggasse 8, 1080 Viennadsb@dsb.gv.at).

9. No Automated Individual Decision-Making
We do not use your personal data for automated individual decision-making.

10. Changes to the Privacy Policy
New legal requirements, business decisions, or technological developments may require changes to our Privacy Policy. The Privacy Policy will then be updated accordingly.

Privacy Policy: <tc>Carrera</tc> RC FPV App

In the following provisions, we, d.h. Carrera Toys GmbH, informd.h . Carrerayou about the nature, scope, and purposes of the collection and use of your personal data in connection with the CarreraRC FPV app (hereinafter: “RC FPV app”). Personal data refers to any information relating to an identified or identifiable natural person. This includes, in particular, your name and your email address.

1. Provider and Data Protection OfficerThe
provider
of the RC FPV app and the data controller within the meaning of data protection law is

CarreraToys GmbH

Carrera, Renn
bahn Allee 1, 5412
Puch/Salzburg
,

Austria. Managing


Director: Stefan Krings
. Tel.: +43 (0) 662 88921-0
Email:shop@carrera-toys.com
CarreraYou can contact the data protection officer at CarreraToys GmbH via

email:datenschutz@carrera-toys.com
CarreraToys GmbH
Rennbahn Allee 1
5412 Puch/Salzburg

2.Data Processing and Purpose
: Depending on the specific use of the RC FPV app, personal data is processed for the purposes specified below. Unless otherwise stated, the legal basis for data processing is Article 6(1), first sentence, letter b of the GDPR.

2.1. Downloading the RC FPV
App
When you download the RC FPV App, the information required for the download is transmitted to the respective app store,d.h . specifically your account’s username, email address, and customer number, the time of the download, payment information, and your device’s unique identifier. We have no control over this data collection and are not responsible for it. We process this provided data to the extent necessary for downloading the RC FPV app onto your device. It is not stored beyond that.

2.2.Device and Connection
Data
: When your device establishes a connection with our server, your device and connection data are processed. This includes your IP address, the date and time of the request, device identifiers (UDID and similar device numbers), and other device information (operating system and version, manufacturer and model, IMEI, IMSI, mobile phone number, and MAC address). Connection data is not used to identify the user personally or combined with data from other sources; rather, it is used to identify your device, improve the RC MicroHD app, and troubleshoot issues. The legal basis is Article 6(1)(f) of the GDPR.

2.3. Features of the RC FPV App and Data
ProcessingWhen using the RC FPV app, the following features are available to you in particular:

• Setting up a local network between your smartphone and the quadcopter
• Streaming real-time images (videoand photos) to the app
• Special display mode for use with 3D glasses, where the smartphone serves as the display device
• Saving videoand photos from the stream to the app or a local image/video folder

To establish a connection between the RC FPV app and the vehicle, the RC FPV app requires your permission to access your device’s Wi-Fi functionality. You will be prompted accordingly in the RC FPV app. The legal basis for data processing—insofar as you are asked for authorization—is your consent pursuant to Art. 6(1)(a) of the GDPR. You are not obligated to give your consent.However, if you do not give your consent, you will not be able to take full advantage of the RC FPV app’s features. You can revoke or grant your consent at any time in the future through your device’s settings.

Other processing of your data is based on Article 6(1)(f) of the GDPR.

3. Link to
the Online Store
This RC FPV app contains a link to the CarreraToys GmbH online store Carrera. Please refer to the online store’s separate privacy policy.

4. Data
Transfer Your personal data will only be transferred to third parties or other recipients if there is legal authorization to do so or if you have given your prior consent. Where necessary, we have entered into data processing agreements with the recipients of your data in accordance with Article 28 of the GDPR. We disclose your data to government agencies only to the extent required by law or pursuant to an official order or court decision.

5. Data Transfer to Countries Outside the EU
We generally do not transfer your data to recipients outside the EU. However, if it is necessary for our purposes, we will transfer your data only if it is ensured that the recipient of the data guarantees an adequate level of data protection and no other legitimate interests preclude the data transfer.

6.Retention Period for PersonalData/Criteria for Determining the
Retention Period
Carrera: Your personal data will be Carrerastored by Carrera Toys GmbH for as long as is necessary for the aforementioned purposes of processing, provided that, in the event of an objection, there are no compelling legitimate grounds on the part of CarreraToys GmbH that would prevent this, or, in the event of a withdrawal of consent, there is no other legal basis for data processing. In certain cases, z.B. however, z.B. where a statutory retention obligation applies, your personal data will not be deleted immediately but will first be blocked.

7. Data
Security We protect your data from unauthorized access, loss, or destruction through technical and organizational measures. Our security measures are continuously improved in line with technological developments. In this context, however, it is important that you actively manage updates yourself to ensure that the software on your devices is always up to date. If youz.B. are using outdated versions of iOS or Android, some security measures related to the RC MicroHD app may not be guaranteed.

8.Your Rights
: Within the framework of legal requirements Carrera

Carrera, you Carreragenerally have Carrerathe following rights with respect to CarreraToys GmbH:

• Confirmation as to whether personal data concerning you Carrerais being processed by CarreraToys GmbH;
• Access to this data and information regarding the circumstances of its processing;
• Rectification, if this data is inaccurate;
• erasure, provided there is no justification for the processing and no obligation to retain the data (any longer),
• restriction of processing in specific cases prescribed by law,
• objection in the event of data processing based on Article 6(1)(f) of the GDPR, and
• the right to have your personal data—to the extent you have provided it—transferred to you or a third party in a structured, commonly used, and machine-readable format.

To the extent that the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time, with the result that the processing of your personal data will no longer be permitted going forward. However, this does not affect the lawfulness of the processing carried out on the basis of your consent up until the time of withdrawal. Please check the settings on your device. Please submit your specific request in writing or by email, including clear identification of yourself, to:

Email:datenschutz@carrera-toys.com
CarreraToys GmbH

, Rennbahn Allee 1

5, 412 Puch/Salzburg

dsb@dsb.gv.at. Finally, we would like todsb@dsb.gv.atinform you of your right to file a complaint with the supervisory authority (Austrian Data Protection Authority, Wickenburggasse 8, 1080 Viennadsb@dsb.gv.at).

9. No Automated Individual Decision-Making
We do not use your personal data for automated individual decision-making.

10. Changes to the Privacy Policy
New legal requirements, business decisions, or technological developments may require changes to our Privacy Policy. The Privacy Policy will then be updated accordingly.