PRIVACY POLICY
Last updated: October 30, 2026
The protection of your personal data is important to us. This Privacy Policy explains which personal data we process when you visit our website www.pogea-racing.com or use our services, the purposes for which such processing takes place, and the rights available to you.
I. DATA CONTROLLER
POGEA RACING GmbH
Ernst-Zimmermann-Str. 17
88045 Friedrichshafen
Germany
Phone: +49 7541 9817890
Email: info@pogea-racing.com
POGEA RACING GmbH is the data controller within the meaning of Article 4(7) of the General Data Protection Regulation (GDPR).
II. GENERAL PRINCIPLES OF DATA PROCESSING
We process personal data exclusively in accordance with applicable legal provisions, particularly the GDPR, the German Federal Data Protection Act (BDSG), and the German Telecommunications Digital Services Data Protection Act (TDDDG).
Depending on the specific processing activity, personal data is processed on the following legal bases:
Article 6(1)(a) GDPR, where you have given your consent.
Article 6(1)(b) GDPR, where processing is necessary for the performance of a contract or to take steps prior to entering into a contract.
Article 6(1)(c) GDPR, where processing is necessary to comply with legal obligations.
Article 6(1)(f) GDPR, where processing is necessary for legitimate interests that are not overridden by your interests or fundamental rights.
Personal data is retained only for as long as necessary for the respective purpose or as required by statutory retention obligations.
III. ACCESSING OUR WEBSITE AND SERVER LOGS
When you access our website, technically necessary connection data may be processed automatically. This may include:
IP address
Date and time of access
Requested URL
Browser type and version
Operating system
Referrer URL
HTTP status code
Amount of data transferred
Technical error and security information
This processing is carried out to provide our website, ensure its functionality, analyze technical errors, and protect against unauthorized access and attacks.
The legal basis is Article 6(1)(f) GDPR.
The data is deleted or anonymized as soon as it is no longer required for these purposes, unless statutory obligations or legitimate reasons justify longer retention.
IV. WEBSITE OPERATION WITH SHOPIFY
Our website is operated using the Shopify platform.
The provider for the European region is Shopify International Limited, Ireland. Other companies within the Shopify Group and contracted service providers may also be involved in the technical operation of the platform.
Shopify provides functions including website management, technical content delivery, security, and, where applicable, the processing of customer inquiries and orders.
In this context, technical usage data, device information, IP addresses, and, where relevant, contact details, customer information, and order data may be processed.
Depending on the purpose, processing is based on Article 6(1)(b) or Article 6(1)(f) GDPR, or on compliance with legal obligations pursuant to Article 6(1)(c) GDPR.
Where Shopify processes personal data on our behalf, the relevant data protection agreements apply. Where Shopify processes data for its own purposes, Shopify's own privacy information also applies.
Further information: Shopify Privacy Policy
V. CONTACTING US
If you contact us by email, telephone, or contact form, we process the information you provide, particularly your name, contact details, and the content of your message.
This processing is carried out to handle your inquiry, communicate with you, and, where applicable, prepare or perform a contract.
The legal bases are Article 6(1)(b) GDPR for contractual or pre-contractual matters and Article 6(1)(f) GDPR for other business inquiries.
Your data is deleted once the purpose of processing no longer applies and no statutory retention obligations or legitimate reasons require further storage.
Data is disclosed only where necessary to handle your inquiry, where legally required, or where otherwise permitted by law.
VI. PRODUCT INQUIRIES, CONFIGURATORS, AND ORDERS
When you use our product offerings, vehicle configurators, or request or order goods and services, we may process the following information:
Name and contact details
Billing and shipping address
Vehicle manufacturer, vehicle model, and technical vehicle data
Requested products and services
Order, invoice, and payment information
Communication and transaction records
Processing is carried out to prepare quotations, assess technical requirements, perform contracts, provide customer support, and comply with legal obligations.
The legal bases are Article 6(1)(b) and Article 6(1)(c) GDPR.
Where necessary to fulfill an order, personal data may be transferred to payment service providers, shipping companies, technical service providers, or contractual partners involved in the transaction.
Such disclosures are limited to what is necessary and legally permissible.
VII. NEWSLETTERS AND MARKETING COMMUNICATIONS
If you subscribe to our newsletter, we process your email address and any additional information you voluntarily provide to send you information about POGEA RACING products, services, and news.
Newsletter communications are generally sent on the basis of your consent pursuant to Article 6(1)(a) GDPR. This does not affect marketing communications to existing customers where permitted by law.
Where a subscription confirmation procedure is used, the time of registration and confirmation, together with relevant technical information, may be stored as evidence of consent.
You may unsubscribe at any time using the unsubscribe link or by contacting info@pogea-racing.com.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
VIII. COOKIES AND SIMILAR TECHNOLOGIES
Our website uses cookies and, where applicable, similar storage technologies to provide technical functionality and store user preferences.
Strictly necessary storage and access operations may take place without consent in accordance with Section 25(2) TDDDG.
For other storage and access operations, we obtain your prior consent where legally required under Section 25(1) TDDDG.
Any associated processing of personal data is governed by the applicable legal bases under the GDPR.
According to the information currently published on our website, we do not use statistics or marketing technologies requiring consent, nor do we use external media for tracking purposes.
Further information is available in our Cookie Policy.
Where technologies requiring consent are used, you can manage your preferences through the "Cookie Settings" function on our website and withdraw your consent at any time with effect for the future.
IX. CLOUDFLARE TURNSTILE
Cloudflare Turnstile may be used to protect our website, particularly our contact forms, against automated access, spam, and misuse.
The provider is Cloudflare Inc., USA.
During security verification, information such as your IP address, technical device and browser information, and other data required to detect misuse may be processed.
Where processing is necessary to prevent abusive access, it is based on Article 6(1)(f) GDPR.
Where the specific technical implementation requires consent for accessing information stored on your device, such consent will be obtained in accordance with Section 25 TDDDG.
Any transfer of personal data to the United States must comply with the requirements of Articles 44 et seq. GDPR.
Further information: Cloudflare Privacy Policy
X. CONTENT DELIVERY NETWORKS
Content Delivery Networks (CDNs), particularly jsDelivr, may be used to deliver website content efficiently and securely.
The provider of jsDelivr is Prospect One Sp. z o.o., Poland.
When corresponding files are retrieved, technical connection data, particularly your IP address, the time of access, and browser information, may be transmitted to the servers involved.
This processing serves to ensure the fast, reliable, and secure delivery of our website.
The legal basis is Article 6(1)(f) GDPR.
Further information: jsDelivr Privacy Policy
XI. EXTERNAL MEDIA AND SOCIAL NETWORKS
Our website contains links to external platforms, particularly Instagram, Facebook, and YouTube.
Simply visiting our website does not generally result in the automatic transfer of data to the respective platform operators through ordinary external hyperlinks.
Only when you click the corresponding link do you leave our website. The respective platform operator is then responsible for the subsequent processing of personal data in accordance with its privacy policy.
If we embed external videos or other content directly into our website in the future, we will provide the necessary data protection information and, where required, obtain your prior consent.
XII. RECIPIENTS OF PERSONAL DATA
Personal data is disclosed only where legally permissible and necessary for the respective purpose.
Potential recipients include the following categories:
Hosting and IT service providers
Platform and software providers
Communication service providers
Payment and shipping service providers
Tax advisors and legal advisors
Authorities and public bodies where legally required
Contractually engaged service providers and business partners
Where service providers process personal data on our behalf, the necessary agreements are concluded in accordance with Article 28 GDPR.
XIII. INTERNATIONAL DATA TRANSFERS
The use of international technology providers may involve transferring personal data to countries outside the European Union or the European Economic Area.
Such transfers take place only in compliance with Articles 44 et seq. GDPR.
Applicable safeguards may include adequacy decisions issued by the European Commission, including the EU-US Data Privacy Framework for appropriately certified US companies, or suitable safeguards such as the European Commission's Standard Contractual Clauses.
Additional protective measures are implemented where necessary.
Information about the safeguards applied in individual cases may be requested at info@pogea-racing.com.
XIV. DATA RETENTION AND DELETION
We retain personal data only for as long as necessary to fulfill the respective processing purposes.
Where statutory retention obligations apply, particularly under commercial and tax legislation, data is retained for the legally prescribed period.
Once the processing purpose no longer applies and statutory retention periods have expired, the relevant data is deleted or anonymized unless another lawful basis justifies continued processing.
XV. DATA SECURITY
We implement appropriate technical and organizational measures in accordance with Article 32 GDPR to protect personal data against loss, unauthorized access, manipulation, and unlawful disclosure.
These measures particularly include encrypted data transmission using HTTPS or TLS.
Our security measures are regularly reviewed and adapted to technological developments and existing risks.
XVI. YOUR RIGHTS
Subject to the applicable legal requirements, you have the following rights:
Right of Access under Article 15 GDPR: You may request information about the processing of your personal data.
Right to Rectification under Article 16 GDPR: You may request the correction of inaccurate data or the completion of incomplete data.
Right to Erasure under Article 17 GDPR: You may request the deletion of your personal data unless statutory exceptions apply.
Right to Restriction of Processing under Article 18 GDPR: You may request restriction of processing under the conditions provided by law.
Right to Data Portability under Article 20 GDPR: You may request the transfer of certain personal data in a structured, commonly used, and machine-readable format.
Right to Object under Article 21 GDPR: You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. You have the right to object to direct marketing at any time.
Right to Withdraw Consent under Article 7(3) GDPR: You may withdraw any consent previously given at any time with effect for the future.
To exercise your rights, please contact info@pogea-racing.com.
XVII. RIGHT TO LODGE A COMPLAINT
Under Article 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates applicable data protection laws.
The supervisory authority particularly responsible for our registered office is:
The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg)
Website: https://www.baden-wuerttemberg.datenschutz.de
XVIII. AUTOMATED DECISION-MAKING
To the best of our current knowledge, we do not use solely automated decision-making within the website functions described in this Privacy Policy that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR.
XIX. UPDATES TO THIS PRIVACY POLICY
We reserve the right to update this Privacy Policy if legal requirements, technical functions, or the processing of personal data change.
The version currently published on our website shall apply.