Privacy policy

Privacy Policy

1. General information

The protection of your personal data is important to us. In this privacy policy we inform you about which personal data we process when you visit our website, place orders in our online shop and contact us.

Personal data is any data that can be used to identify you personally, for example name, address, email address, telephone number, IP address or order data.

The processing of personal data is carried out on the basis of the General Data Protection Regulation, in particular pursuant to Art. 6 GDPR. Pursuant to Art. 13 GDPR, data subjects must be informed, among other things, about the controller, the purposes and legal bases of the processing, the recipients, the storage period and their rights.

2. Controller

The controller responsible for data processing on this website is:

PitFuel UG (haftungsbeschränkt)
Tannenstraße 7, 84030 Ergolding
Germany

Represented by:
Maximilian Franz, Managing Director / David Trinkberger, Managing Director

Email: support@pitfuel.de

3. Hosting and shop system Shopify

Our website and online shop are operated via Shopify.

The provider is:

Shopify International Limited
2nd Floor, 1–2 Victoria Buildings
Haddington Road
Dublin 4, D04 XN32
Ireland

Shopify processes data generated when you visit our website and place orders in our online shop. This may include, in particular, IP address, device information, browser data, usage data, order data, payment information, contact details and delivery addresses.

The processing is carried out to operate our online shop, to display our website, to process orders, to handle payments, for fraud prevention and for technical security.

The legal bases are Art. 6 (1) (b) GDPR insofar as the processing is necessary for the performance of the contract, Art. 6 (1) (f) GDPR based on our legitimate interest in a secure and functional online shop, and where applicable Art. 6 (1) (a) GDPR insofar as consent is required.

4. Collection and processing when visiting our website

When you access our website, technical data is processed automatically. This includes in particular:

  • IP address
  • Date and time of access
  • Browser type and browser version
  • Operating system used
  • Referrer URL
  • Pages visited
  • Amount of data transferred
  • Device information

This data is technically necessary to deliver the website correctly, to ensure stability and security and to prevent misuse.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in the secure and technically error-free operation of our website.

5. Orders in the online shop

When you place an order in our online shop, we process the data required to process your order. This includes in particular:

  • First and last name
  • Billing address
  • Delivery address
  • Email address
  • Telephone number, if provided
  • Order information
  • Payment information
  • Shipping information

We process this data for the performance of the contract, for payment processing, for delivery of the goods, for communication about your order and to comply with statutory retention obligations.

The legal bases are Art. 6 (1) (b) GDPR for the performance of the contract and Art. 6 (1) (c) GDPR for compliance with legal obligations, in particular retention obligations under tax and commercial law.

6. Payment providers

We use external payment service providers to process payments. Depending on your selection at checkout, data may be transmitted to the respective payment provider.

Depending on your selection at checkout, the following payment providers may be used:

  • PayPal
  • Credit card providers
  • Shopify Payments (incl. Apple Pay, Google Pay)

The data transmitted may include name, billing address, email address, order amount, payment data and transaction data.

The processing is carried out for payment processing and performance of the contract pursuant to Art. 6 (1) (b) GDPR and on the basis of our legitimate interest in secure and efficient payment processing pursuant to Art. 6 (1) (f) GDPR.

7. Shipping service providers

To deliver your order, we pass on the data required for this to the respective shipping service provider. This includes in particular:

  • Name
  • Delivery address
  • Email address, if applicable
  • Telephone number, if applicable
  • Shipment information

The data is passed on insofar as this is necessary for the delivery of the ordered goods.

The legal basis is Art. 6 (1) (b) GDPR.

If we pass on your email address or telephone number to the shipping service provider so that you receive shipment tracking or a delivery notification, this is done, depending on the specific arrangement, on the basis of your consent pursuant to Art. 6 (1) (a) GDPR or our legitimate interest pursuant to Art. 6 (1) (f) GDPR.

Shipping service provider:
DPD

8. Contacting us

If you contact us by email, contact form or in any other way, we process the data you provide to handle your request.

This may include:

  • Name
  • Email address
  • Content of your message
  • Order number, if applicable
  • Further voluntary information, if applicable

The legal basis is Art. 6 (1) (b) GDPR if your request is related to a contract or an order. In all other cases, the processing is carried out on the basis of Art. 6 (1) (f) GDPR, as we have a legitimate interest in handling requests.

9. Customer account

If a customer account can be created in our shop, we process the data required for this, for example name, email address, address and order history.

The processing is carried out to provide the customer account and to simplify the handling of future orders.

The legal basis is Art. 6 (1) (b) GDPR.

You can have your customer account deleted at any time, provided that no statutory retention obligations prevent this.

10. Newsletter

If you sign up for our newsletter, we use your email address to regularly send you information about PitFuel, products, promotions and news.

Registration only takes place with your consent. The legal basis is Art. 6 (1) (a) GDPR.

You can withdraw your consent at any time, for example via the unsubscribe link in the newsletter or by sending us a message.

Newsletter provider:
Brevo (Sendinblue GmbH)

11. Cookies and similar technologies

Our website uses cookies and similar technologies. Cookies are small text files that are stored on your device.

We use technically necessary cookies so that the website and shop function. These include, for example, shopping cart functions, login functions, security settings and checkout processes.

The legal basis for technically necessary cookies is Art. 6 (1) (f) GDPR. Our legitimate interest lies in operating a functional online shop.

If we use non-essential cookies in the future, in particular for analysis or marketing, we will first obtain your consent pursuant to Art. 6 (1) (a) GDPR via a cookie banner. You can change your settings there at any time.

12. Analysis and marketing tools

We currently do not use any analysis or marketing tracking tools that go beyond technically necessary functions.

Should we use such tools in the future, this will only take place with your prior consent pursuant to Art. 6 (1) (a) GDPR. We will update this privacy policy accordingly.

13. Social media

We maintain profiles on social networks, for example Instagram, TikTok or Facebook.

When you visit our social media profiles or interact with us there, personal data may be processed by the respective platform operator. The privacy policies of the respective platform additionally apply to this data processing.

We process data that you provide to us via social media, for example messages, comments or profile information, insofar as this is necessary to handle your request or interaction.

The legal basis is Art. 6 (1) (f) GDPR.

14. Disclosure of data

We only disclose personal data if this is necessary for the performance of the contract, there is a legal obligation, you have consented or we have a legitimate interest.

Recipients may include in particular:

  • Shopify as the shop system
  • Payment service providers
  • Shipping service providers
  • Tax advisor
  • Accounting software, e.g. Lexware
  • IT service providers
  • Hosting and cloud providers
  • Authorities, where legally required

15. Storage period

We only store personal data for as long as is necessary for the respective purposes or as long as statutory retention obligations exist.

Order and invoice data is generally stored for the statutory periods due to tax and commercial law requirements.

We only store contact requests for as long as is necessary to process them, provided that no statutory retention obligations prevent this.

Personal data must in principle be deleted as soon as the purpose of the processing has been achieved and no statutory retention periods exist anymore.

16. Your rights

Within the framework of the statutory requirements, you have the following rights:

  • Right to information about your stored data
  • Right to rectification of incorrect data
  • Right to erasure of your data
  • Right to restriction of processing
  • Right to data portability
  • Right to object to certain processing
  • Right to withdraw consent given
  • Right to lodge a complaint with a data protection supervisory authority

If you wish to exercise one of your rights, you can contact us at any time:

support@pitfuel.de

17. Withdrawal of consent

If you have given us consent to process your data, you can withdraw this consent at any time with effect for the future.

The lawfulness of the processing up to the point of withdrawal remains unaffected.

18. Right to object

If we process personal data on the basis of Art. 6 (1) (f) GDPR, you have the right to object to this processing at any time for reasons arising from your particular situation.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing or the processing serves to assert, exercise or defend legal claims.

19. Data security

We use technical and organizational measures to protect your data against loss, misuse, unauthorized access and alteration.

Our website uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the browser's address bar begins with "https://".

20. Changes to this privacy policy

We reserve the right to adapt this privacy policy if legal requirements, our website, the services used or internal processes change.

Last updated: July 2026