PRIVACY FOR CART AND ORDER REQUESTS.

1. Controller

Order requests are not enabled yet.

Contact: must be configured completely before activation

Personal-data submission remains technically blocked until these mandatory details are configured. A complete legal notice and final legal review are separately required before public release.

2. Local cart

The cart stores only part slugs and quantities in this browser's local storage. Names, email addresses, vehicle details, payment data and addresses are not stored there.

This storage provides the cart explicitly requested by the user. It remains local until positions or browser data are deleted. There is no disclosure and no tracking.

3. Order request

Name, email address, vehicle reference, an optional fitment note, selected parts and quantities are collected. Delivery address and payment data are not collected at this stage.

The purpose is to review part and fitment and prepare a possible quotation. The legal basis is GDPR Art. 6(1)(b), pre-contractual measures requested by the data subject. Acknowledging this notice is not marketing consent.

4. Protection and access

Contact details and vehicle reference are encrypted server-side using AES-256-GCM. Search indexes and abuse controls contain only non-reversible HMAC/hash values. Access is limited to authorised roles in the protected VEKTOR16 portal.

No payment data is stored, no automated individual decisions are made, and data is not used for advertising or profiling. Error logs do not contain form contents.

5. Recipients and hosting

Processing takes place on the server infrastructure operated for SEKTOR 16. Where hosting or IT service providers could technically access data, they may process it only under appropriate processor terms. Data is not disclosed for advertising.

Activation must wait until processor arrangements, server location and any third-country context have been documented and named specifically in the final notice.

6. Retention

Requests are automatically and completely deleted after the configured period. Technically, 30 to no more than 365 days are permitted; the intended period is 180 days. If a contract is later formed, necessary records must move into a separate, legally reviewed order system with its own retention rules.

7. Rights

Subject to the GDPR, data subjects have rights including access, rectification, erasure, restriction and portability. They also have the right to lodge a complaint with a competent supervisory authority.

A proportionate identity check may be required. Privacy requests should be sent to the controller contact shown above.

8. No purchase contract

The order request is non-binding and creates no payment obligation. Total price, shipping costs, delivery conditions, fitment, withdrawal information and other consumer information must be supplied separately and completely before any later binding contract.