Privacy Policy

1. Data controller and definitions
1. 1.1 The data controller of Customers/Users of the Online Shop, also known as the Seller, is Top Racing Shop Sp. z o.o., tel. +1 (929) 640-0292, NIP 522-327-92-43, REGON 527048622.
2. 1.2 The data controller can be contacted at:
  1. 1.2.1 address for letters: Powstańców Śląskich 127, 01-355 Warszawa;
  2. 1.2.2 the e-mail address: info@topracingshop.com.
3. 1.3 User – a natural person entering the website/websites of the Online Shop or using the services or functionalities described in this Policy.
4. 1.4 Customer – a natural person having full legal capacity, a natural person who is a Consumer, a legal person or an organizational unit without legal personality, to which the Act grants legal capacity, which concludes a Distance Selling Agreement with the Seller.
5. 1.5 Online Shop – an Internet service run by the Seller, available at electronic addresses (websites): https://www.topracingshop.com through which the Customer/User may obtain information about the Goods and its availability and buy the Goods or order the service.
6. 1.6 Newsletter – information, including commercial information, from the Seller, sent to the Customer/User by electronic means; its receipt is voluntary and requires the consent of the Customer/User.
7. 1.7 Account – a set of data stored in the Online Shop and in the Seller's IT system concerning the Customer/User and orders placed by the Customer/User and the agreements concluded by the Customer/User, which enables the Customer/User to place orders and conclude agreements.
8. 1.8 GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
2. The purposes, legal basis and period of the processing
1. 2.1 In order to run the Online Shop and to perform the Distance Selling Agreement, the Seller processes:
  1. 2.1.1 data provided when placing an order or registering an Account: first name and surname, delivery address, e-mail address, phone number and, in the case of businesses, company name, address and tax identification number;
  2. 2.1.2 order data: purchase history, chosen delivery and payment method, returns and complaints;
  3. 2.1.3 information concerning the User's device, collected automatically: IP address, information contained in cookies or other similar technologies, session data, web browser data, device data, data concerning activity on the website, including on individual subpages;
  4. 2.1.4 the content of correspondence, when the Customer/User contacts us by e-mail, by phone or through the chat available on the website;
  5. 2.1.5 geolocation data, only if the User has consented to the service provider's access to geolocation.
2. 2.2 Some of this information does not contain identity data of the Users, but in combination with other information may constitute personal information. Therefore, the data controller extends full GDPR protection to it.
3. 2.3 Legal bases of the processing:
  1. 2.3.1 Article 6(1)(b) of the GDPR – processing necessary to perform the agreement: handling the order, payment, delivery, the Account, returns and complaints;
  2. 2.3.2 Article 6(1)(c) of the GDPR – legal obligations, in particular issuing and storing invoices and other accounting and tax duties;
  3. 2.3.3 Article 6(1)(f) of the GDPR – the legitimate interest of the data controller: IT security, prevention of fraud and abuse, error analysis, technical improvement of the Online Shop, own marketing, and the establishment, exercise or defence of legal claims;
  4. 2.3.4 Article 6(1)(a) of the GDPR – consent, where consent is collected, in particular for the Newsletter and for statistical or marketing cookies.
4. 2.4 Retention periods: order data are kept for the period required by tax and accounting law (as a rule 5 years counted from the end of the year in which the sales document was issued) and until the limitation of claims; Account data until the Account is deleted; data processed on the basis of consent until the consent is withdrawn; correspondence for up to 3 years from the closing of the case, unless a longer period is needed to defend claims; cookie data for the periods indicated in the cookie settings.
3. Marketing activities of the data controller
1. 3.1 The data controller may place marketing information about his/her Goods or services on the Online Shop’s website. Such content shall be displayed by the data controller in accordance with Article 6 section 1 letter f of the GDPR, in accordance with the legitimate interest pursued by the data controller, in publishing the content related to the services provided and the promotional content of the actions in which the data controller is involved. Where the applicable law requires consent, in particular for marketing cookies and for the Newsletter, such content is displayed or sent only after consent has been given.
4. Recipients of User’s data
1. 4.1 The data controller discloses personal data only to processors acting under data processing agreements, and only to the extent necessary to run the Online Shop and to perform the agreement. These include in particular: IAI S.A. (the IdoSell shop platform, including the IdoAccounts login service), courier companies delivering the parcels (in particular FedEx), online payment providers (including the IdoSell payment system and PayPal), and providers of analytics and advertising services (in particular Google Ireland Ltd. and Meta Platforms Ireland Ltd.).
2. 4.2 The amount of data transferred is limited to the necessary minimum. Data may also be disclosed to competent public authorities where the applicable law so requires.
5. Transfer of personal data to third countries
1. 5.1 In connection with international delivery and with the use of analytics and advertising services, some personal data may be transferred outside the European Economic Area, in particular to the United States. This concerns delivery data passed to the carrier for shipments outside the EEA, and data related to cookies and statistics processed by Google and Meta.
2. 5.2 Such transfers take place on the basis of the safeguards provided for in Chapter V of the GDPR, in particular an adequacy decision of the European Commission (the EU–US Data Privacy Framework) or standard contractual clauses pursuant to Article 46 of the GDPR.
6. Rights of the data subjects
1. 6.1 Rights for the data subjects
  1. 6.1.1 of access (Article 15 of the GDPR) - to obtain confirmation from the data controller, whether his or her personal data are being processed. If the data about a person is processed, he or she is entitled to access it and to obtain the following information: about the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom the personal data have been or will be disclosed, about the period of data storage or about the criteria used to determine that period, about the right to request rectification, erasure or restriction of processing of personal data and to object to such processing;
  2. 6.1.2 to obtain a copy of the data (Article 15 section 3 GDPR) - to obtain a copy of the data to be processed; the first copy being free of charge. For further copies the data controller may charge a reasonable fee based on administrative costs;
  3. 6.1.3 to rectification (Article 16 of the GDPR) - to request the rectification of inaccurate or to supplement incomplete data concerning him or her;
  4. 6.1.4 to erase the data (Article 17 of the GDPR) - to request the erasure of his/her personal data if the data controller has not a legal basis for their processing or the data are not necessary for the purposes of processing anymore;
  5. 6.1.5 to restriction of processing (Article 18 of the GDPR) - to request a restriction of processing of personal data when:
  6. 6.1.6 to data portability (Article 20 GDPR) - to receive the personal data concerning him or her, which he or she has provided to a data controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the data controller to which the personal data have been provided, where data are processed on the basis of the data subject's consent or on a contract with him/her and where data are processed by automated means;
  7. 6.1.7 to object (Article 21 of the GDPR) - to object to the processing of his/her personal data for the legitimate purposes of the controller, on grounds related to his/her specific situation, including profiling. In such case, the data controller shall assess the existence of important legitimate grounds for processing overriding the interests, rights and freedoms of data subjects or grounds for establishing, pursuing or defending claims. If according to the assessment the interests of the data subject will take precedence over the interests of the controller, the data controller shall be obliged to stop processing the data for these purposes;
  8. 6.1.8 to withdraw consent at any time and without giving any reason, but the processing of personal data carried out before withdrawal of consent will still remain lawful. Withdrawal of consent shall result in the data controller ceasing to process personal data for the purpose for which the consent was given.
2. 6.2 In order to exercise the aforementioned rights, the data subject should contact the data controller, using the contact details provided in section 1.2 and inform the data controller, which right and to what extent he/she wants to exercise it.
7. The President of the Personal Data Protection Office
1. 7.1 The data subject has the right to lodge a complaint with the supervisory authority, which in Poland is the President of the Personal Data Protection Office, with its seat in Warsaw, ul. Stawki 2, which can be contacted as follows:
2. 7.2 A data subject residing in another country of the European Economic Area may also lodge a complaint with the supervisory authority competent for his or her place of residence.
8. Data Protection Officer
1. 8.1 If a Data Protection Officer has been appointed, the data subject may contact him or her directly by e-mail or in writing to the address of the data controller given in section 1.2 of this Policy.
9. Changes to the privacy and cookie policy
1. 9.1 Privacy and Cookies Policy may be supplemented or updated according to the data controller's current needs in purpose to provide current and reliable information to Customers/Users. The current version is always published on this page.
10. Cookies
1. 10.1 The Online Shop performs the functions of obtaining information about Customers, Users and their behaviour in the following way by:
2. 10.2 Cookie files are IT data, in particular text files, which are stored in the Customer's/ User's final device and are designed to use the Online Shop’ s website. Cookies usually contain the name of the website from which they come from, the time of their storage on the final device and a unique number.
3. 10.3 Cookies which are strictly necessary to provide the service requested by the Customer/User (for example maintaining the session, the basket and the login) are used without consent. All other cookies, in particular statistical and marketing ones, are used only after the Customer/User has given prior consent by actively clicking the button "Close" in the cookie banner or by making an individual selection in the cookie settings. Closing the banner or continuing to browse the website without an active choice does not constitute consent.
4. 10.4 The consent, referred to in the previous point, may cover only selected categories of cookies. In such a case the Customer/User should use the option: "I DO NOT AGREE", available in the cookie banner. At the same time, the data controller notes that disabling cookies necessary for authentication, security and maintaining the Customer's/User's preferences may hinder, and in extreme cases may prevent, the use of the Online Shop.
5. 10.5 Consent may be withdrawn or changed at any time, with effect for the future, through the cookie settings available on the website or by deleting cookies in the web browser settings. Withdrawing consent is as easy as giving it.
6. 10.6 To manage the cookie settings, Customer/User should select web browser/system from the list below and follow the instructions: Chrome, Safari, Firefox, Edge, Opera, Android, Safari (iOS).
7. 10.7 The legal basis for the processing of data from strictly necessary cookies is the legitimate interest of the data controller (Article 6(1)(f) of the GDPR), consisting in providing high quality and secure services; for all other cookies the legal basis is the consent of the Customer/User (Article 6(1)(a) of the GDPR).
8. 10.8 The Online Shop uses two basic types of cookies: session cookies and persistent cookies. Session cookies are temporary files, which are stored in the User's final device until logging out, leaving the Online Shop or switching off the software (web browser). Persistent cookies are stored in a User's device for the time specified in the parameters of cookies or until their removal by the User.
9. 10.9 The cookies are used for the following purposes:
10. 10.10 Software for web browsing (web browser) usually by default allows for storing cookies in the User's final device. Customers/Users may change their settings in this area. The web browser allows to remove cookies. It is also possible to automatically block cookie files.
11. 10.11 Restrictions on the use of cookies may affect some of the functionalities available on the Online Shop's websites.
12. 10.12 Cookie files placed in the Customer’s/User's final device may also be used by the Online Shop’s advertisers and partners cooperating with the Online Shop, subject to the consent referred to in point 10.3.
13. 10.13 Cookies may be used by advertising networks, in particular the Google network, to display ads tailored to the way in which the Customer uses the Online Shop. In this purpose, they may retain information about the Customer's navigation path or the time of staying on a given website.
14. 10.14 We recommend that Customer/User should read these companies' privacy policies in purpose to understand the cookies’ usage in the statistics: Privacy Policy - Google.
15. 10.15 In terms of information on the Customer’s/ User's preferences collected by the Google's advertising network, the Customer/User can view and edit the information resulting from cookies using the tool: https://www.google.com/ads/preferences/.
16. 10.16 On the website of the Online Shop there are plug-ins, which can transfer the data of Customers/Users to the data collectors, such as e.g: .
17. 10.17 In purpose to correctly perform the Distance Selling Agreement, the data controller may make the Customer/User data available to courier entities. The currently available delivery methods in the Online Shop are: https://www.topracingshop.com/en/delivery.
18. 10.18 In purpose to correctly perform the Distance Selling Agreement, the data controller may make the Customer/User data available to Internet payment systems. The currently available methods of payment in the form of prepayment in the Online Shop are: https://www.topracingshop.com/en/payments.
11. Newsletter
1. 11.1 The Customer/User may give his/her consent to receive commercial information electronically by ticking the appropriate option in the registration form or at later date in the appropriate tab. In the case of such consent, the Customer/User shall receive information (Newsletter) of the Online Shop as well as other commercial information sent by the Seller to the Customer’s/User’s email address.
2. 11.2 The Customer/User may unsubscribe from the Newsletter at any time by unchecking the appropriate box on his/her Account page or by going to the form https://www.topracingshop.com/en/newsletter.html, clicking the appropriate link in the content of each Newsletter or through the Customer Service Office.
12. Account
1. 12.1 The Customer/User may not place in the Online Shop or provide the Seller with content, including opinions and other data of an illegal nature.
2. 12.2 The Customer/User gets access to the Account after registration.
3. 12.3 When registering, the Customer/User provides the account type or gender, name, surname, company name, NIP number, data for issuing a sales document, shipping data, e-mail address and choose a password. The Customer/User assures that the data provided by him/her in the registration form are correct. Registration requires that Customer/User read the Regulations carefully and mark on the registration form that he/she has read the Regulations and fully accepts all provisions.
4. 12.4 At the moment of granting the Customer/User access to the Account, an agreement for the provision of services by electronic means is concluded between the Seller and the Customer/User for an indefinite period of time. The Consumer may withdraw from this agreement on the terms specified in the Regulations.
5. 12.5 Registration of an Account on one of the websites of the Online Shop means at the same time registration allowing access to the other websites where the Online Shop is available.
6. 12.6 The Customer/User may terminate the agreement for the provision of services by electronic means at any time with immediate effect, informing the Seller about it by e-mail or in writing to the address of the data controller given in section 1.2 of this Policy.
7. 12.7 The Seller has the right to terminate the agreement for the provision of services concerning the Account in the event of: cessation or transfer of the Online Shop service to a third party, violation by the Customer/User of the law or provisions of the Regulations, as well as in the event of inactivity of the Customer/User for a period of 6 months. The agreement is terminated with seven days’ notice. The Seller may stipulate that re-registration of the Account shall require the Seller's permission.