Data protection

Privacy Policy

1. Controller

R-Trade GmbH
Twin Tower, Wienerbergstrasse 11/12A
1100 Vienna, Austria
VAT ID No.: ATU69660048
Email: support@upgrademycar.at
Website: www.upgrademycar.shop

2. General Information on Data Processing

As a matter of principle, we process personal data of our users only to the extent necessary to provide a functional website as well as our content and services. Personal data is processed on the basis of the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Austrian Data Protection Act (Datenschutzgesetz, DSG).

Legal bases for processing:

  • Art. 6(1)(a) GDPR (consent)
  • Art. 6(1)(b) GDPR (performance of a contract)
  • Art. 6(1)(c) GDPR (legal obligation)
  • Art. 6(1)(f) GDPR (legitimate interest)

3. Your Rights as a Data Subject

Under the GDPR and the Austrian DSG, you have the following rights:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure – "right to be forgotten" (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR)
  • Right to withdraw consent (Art. 7(3) GDPR)

To exercise your rights, please contact: support@upgrademycar.at

Right to lodge a complaint: You have the right to lodge a complaint with the Austrian data protection authority:
Österreichische Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40–42, 1030 Vienna
www.dsb.gv.at

4. Cookies

Our website uses cookies – small text files that are stored in your browser. We distinguish between:

  • Strictly necessary cookies: Essential for the operation of the shop (e.g. shopping cart, session). No consent required (§ 96 Abs. 3 TKG, Austrian Telecommunications Act).
  • Analytics and marketing cookies: Only active with your explicit consent given via the cookie banner.

You can delete or disable cookies in your browser settings at any time. Please note that this may limit the functionality of our website.

5. Shopify – Shop Platform

Our online shop is operated on the platform of Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland.

When you visit and use our shop, data (e.g. order data, contact data, payment data) is processed on Shopify's servers. Shopify acts as a processor pursuant to Art. 28 GDPR. A corresponding data processing agreement (DPA) has been concluded.

Data transfers to the USA take place on the basis of the EU-U.S. Data Privacy Framework (in force since July 2023) and the Standard Contractual Clauses of the European Commission.

Further information: https://www.shopify.com/legal/privacy

6. Shop Pay

For the checkout process, we offer Shop Pay, a service provided by Shopify International Limited (for the address, see Section 5). Shop Pay enables an accelerated payment process by storing payment and delivery data.

Processing is carried out for the performance of a contract (Art. 6(1)(b) GDPR). Stored data can be managed or deleted in the Shop Pay account at any time.

Further information: https://shop.app/legal/privacy

7. Google Tag Manager

We use Google Tag Manager provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The Tag Manager itself does not set any cookies and does not process any personal data – it serves solely to manage other tags. Data processing by the integrated services is governed by their own privacy policies (see Sections 8 and 9).

8. Google Analytics (GA4)

We use Google Analytics 4 (GA4) provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to analyse user behaviour on our website.

GA4 collects, among other things: IP address (anonymised), page views, time spent on the site, browser, operating system, approximate location, interactions.

Legal basis: Consent pursuant to Art. 6(1)(a) GDPR given via the cookie banner.

IP anonymisation: IP addresses are anonymised before they are stored.

Data transfer to the USA: On the basis of the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.

Objection: You can prevent data collection by GA4 by rejecting analytics cookies in the cookie banner or by installing the browser add-on: https://tools.google.com/dlpage/gaoptout

Google privacy policy: https://policies.google.com/privacy

9. Google Ads & Conversion Tracking

We use Google Ads and the conversion tracking of Google Ireland Limited. If you reach our website via a Google ad, a cookie is stored on your device which expires after 30 days and does not contain any personal data.

Legal basis: Consent pursuant to Art. 6(1)(a) GDPR.

Data transfer to the USA: On the basis of the EU-U.S. Data Privacy Framework.

Further information: https://policies.google.com/privacy

10. Meta Pixel (Facebook/Instagram)

We use the Meta Pixel provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The Meta Pixel makes it possible to track the behaviour of visitors after they have clicked on a Facebook or Instagram ad and to deliver advertisements in a targeted manner.

Data collected: IP address, browser information, page views, conversion events (e.g. purchases).

Legal basis: Consent pursuant to Art. 6(1)(a) GDPR given via the cookie banner.

Data transfer to the USA: Meta Platforms, Inc. (USA) is certified under the EU-U.S. Data Privacy Framework.

Objection: https://www.facebook.com/settings?tab=ads
General opt-out option: http://www.youronlinechoices.com/de/praferenzmanagement/

Meta privacy policy: https://www.facebook.com/privacy/policy

11. Klaviyo – Email Marketing

For our email newsletter and marketing automation, we use Klaviyo provided by Klaviyo, Inc., 125 Summer Street, Floor 6, Boston, MA 02111, USA.

If you subscribe to our newsletter or place an order, your email address and purchase data are transmitted to Klaviyo in order to send you relevant emails.

Legal basis:

  • Newsletter consent: Art. 6(1)(a) GDPR (double opt-in)
  • Transactional emails: Art. 6(1)(b) GDPR (performance of a contract)

Data transfer to the USA: Klaviyo is certified under the EU-U.S. Data Privacy Framework. In addition, Standard Contractual Clauses have been agreed.

Unsubscribing: Every email contains an unsubscribe link. Alternatively: support@upgrademycar.at

Klaviyo privacy policy: https://www.klaviyo.com/legal/privacy-notice

12. YouTube

YouTube videos may be embedded on our website. YouTube is a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Videos are embedded in privacy-enhanced mode – cookies are only set once the video is actively played.

Legal basis: Consent pursuant to Art. 6(1)(a) GDPR.

YouTube/Google privacy policy: https://policies.google.com/privacy

13. Order Data & Contract Processing

To process your order, we process the following data: name, delivery address, email address, telephone number, payment data, order details.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

Storage period: In accordance with the Austrian statutory retention obligation (§ 132 BAO, Austrian Federal Fiscal Code), order data is retained for 7 years.

14. Contacting Us

If you contact us by email or via the contact form, the information you provide will be stored for the purpose of processing your enquiry. Legal basis: Art. 6(1)(f) GDPR (legitimate interest). The data will be deleted once your enquiry has been fully processed, provided that no retention obligations apply.

15. Data Security

We use SSL/TLS encryption (recognisable by "https://" and the padlock symbol in the browser address bar) for all data transmissions. Technical and organisational measures (TOMs) pursuant to Art. 32 GDPR have been implemented.

16. Validity of this Privacy Policy

This privacy policy is currently valid and is as of June 2026. We reserve the right to amend this policy in the event of changes to the legal framework or to our data processing practices.