Your online shop for used car parts

Version: November 2025

1. Controller and Scope

The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) and other data protection laws is:

HighLine Autoteile GmbH
Römeräcker 4
76351, Linkenheim-Hochstetten
Germany

Commercial Register: HRB 723338, Amtsgericht Mannheim
Phone: +49 7247 9851030
Email: ebay@highline-autoteile.de

This privacy policy explains the nature, scope, and purpose of the processing of personal data (hereinafter referred to as "Data") within our online shop and its related websites, features, and content.

2. Data Protection Officer

We have not appointed a data protection officer as we are not legally required to do so.

3. General Principles of Data Processing

a) Legal Bases for Processing
We process your data in compliance with the relevant data protection regulations. Processing is lawful if one of the following conditions is met:

• Consent (Art. 6(1)(a) GDPR): You have given your consent to the processing of your data for one or more specific purposes (e.g., for receiving our newsletter or for analysis cookies).
• Performance of a Contract (Art. 6(1)(b) GDPR): Processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract.
• Legal Obligation (Art. 6(1)(c) GDPR): Processing is necessary for compliance with a legal obligation to which we are subject (e.g., statutory retention obligations under commercial or tax law).
• Legitimate Interests (Art. 6(1)(f) GDPR): Processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms.

b) Data Storage Duration
We store your personal data only for as long as it is necessary for the respective purposes. After the purpose has been fulfilled, your data will be deleted or blocked, provided that there are no statutory retention obligations (e.g., 6 years for business letters under § 257 HGB and 10 years for accounting records under § 147 AO) to the contrary.

4. Your Rights as a Data Subject

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR): You have the right to request information about your personal data processed by us.
• Right to rectification (Art. 16 GDPR): You have the right to demand the immediate correction of incorrect or completion of your personal data stored by us.
• Right to erasure (Art. 17 GDPR): You have the right to request the deletion of your personal data stored with us, unless processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims.
• Right to restriction of processing (Art. 18 GDPR): You have the right to request the restriction of the processing of your personal data.
• Right to data portability (Art. 20 GDPR): You have the right to receive your personal data, which you have provided to us, in a structured, commonly used, and machine-readable format or to request its transmission to another controller.
• Right to withdraw consent (Art. 7(3) GDPR): You have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
• Right to lodge a complaint (Art. 77 GDPR): You have the right to lodge a complaint with a supervisory authority. You can usually contact the supervisory authority of your habitual residence, your place of work, or our company headquarters.

Right to Object (Art. 21 GDPR)
If your personal data is processed on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR, you have the right to object to the processing of your personal data at any time on grounds relating to your particular situation. We will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.

5. Data Processing When Visiting Our Website (Server Log Files)

When you access our website, our hosting provider automatically collects and stores information in server log files. This includes:

• Browser type and version
• Operating system used
• Referrer URL (the previously visited page)
• Hostname of the accessing computer (IP address)
• Time of the server request

This data is processed on the basis of our legitimate interest (Art. 6(1)(f) GDPR) in ensuring the security and stability of our website. The data is stored for a maximum of 7 days and then deleted. It is not merged with other data sources.

6. Cookies and Consent Management

Our website uses cookies. Cookies are small text files that are stored on your device. We distinguish between technically necessary cookies, which are essential for the basic functions of the website, and other cookies (e.g., for marketing or analysis).

The use of technically necessary cookies is based on our legitimate interest in providing a functional website (Art. 6(1)(f) GDPR, § 25(2) TTDSG).

For all other cookies and similar technologies, we require your prior consent in accordance with Art. 6(1)(a) GDPR and § 25(1) TTDSG. We obtain this consent via a consent banner when you first visit our website. You can change or withdraw your consent at any time through our consent management tool.

7. Data Processing for Contract Fulfillment

a) Orders and Customer Account
When you place an order or create a customer account, we process the data you provide (e.g., name, address, email, payment information) for the purpose of initiating, executing, and processing the contract. This includes processing for delivery, invoicing, and handling warranty claims. The legal basis is the performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR). We store the contract text (T&Cs and your order data) in our system.

b) Transfer to Shipping Providers
For the purpose of delivering your ordered goods, we work with shipping service providers (e.g., DHL, DPD) and freight forwarders. We transfer the necessary data (name, address, and possibly email address or phone number for delivery coordination) to these providers. This transfer is necessary for the performance of the contract (Art. 6(1)(b) GDPR).

c) Transfer to Payment Service Providers
Depending on the payment method you choose, we transfer your payment data to the respective payment service provider (e.g., PayPal, credit card companies, banks) for the processing of payments. These providers may also process your data as independent controllers. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

d) Fraud Prevention
In certain cases, we may process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR) to prevent fraud and protect our business from financial loss. This may involve checking for unusual transaction patterns.

8. Contacting Us

If you contact us via email or a contact form, the data you provide will be processed to handle your inquiry. The legal basis is your consent (Art. 6(1)(a) GDPR) or, if the inquiry relates to a contract, Art. 6(1)(b) GDPR. Your data will be deleted once your request has been fully processed.

9. Email Newsletter

If you subscribe to our newsletter, we will use your email address to send you regular updates about our products and promotions. The legal basis for this is your explicit consent (Art. 6(1)(a) GDPR). We use a double-opt-in procedure for registration. You can unsubscribe at any time via the link in the newsletter or by sending us a message. The lawfulness of the data processing that has already taken place remains unaffected by the revocation.

10. Use of Audiovisual and Social Media

We may embed content from third-party platforms such as YouTube on our website. When you visit a page with embedded content, your IP address and other technical data are transmitted to the provider of that content (e.g., Google LLC in the USA). This may also involve the setting of cookies by the third-party provider. This data processing only takes place with your prior consent (Art. 6(1)(a) GDPR, § 25(1) TTDSG), which you can grant via our consent banner. Please refer to section 14 regarding data transfers to third countries.

11. Web Analysis and Marketing Tools

Subject to your explicit consent, we may use tools for web analysis and marketing purposes on our website. These tools help us understand user behavior, optimize our website, and display relevant advertising. For this purpose, data such as your IP address, device information, and interactions with our website may be processed by us and the respective tool providers. The legal basis for this processing is your consent (Art. 6(1)(a) GDPR, § 25(1) TTDSG), which you provide via our consent banner and can withdraw at any time. Further details about the specific tools used are provided in our consent management tool.

12. Customer-Provided Content

If you provide us with content (e.g., images or texts) for the fulfillment of an order (e.g., for identifying a specific car part), we will process this content exclusively for this purpose. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). This data will be deleted after the purpose has been fulfilled and any statutory retention periods have expired.

13. Data Processing on Third-Party Platforms (e.g., eBay)

If you purchase our products through a third-party platform such as eBay, we process the personal data transmitted to us by the platform operator (e.g., name, delivery address, email address, transaction details) for the purpose of fulfilling the contract in accordance with Art. 6(1)(b) GDPR. The respective platform operator is also a separate controller for data processing on their platform. For more information on data processing by the platform operator, please refer to their privacy policy.

14. Data Transfers to Third Countries

If we process data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) or if this occurs in the context of using third-party services or disclosing/transferring data to third parties, this will only be done to fulfill our (pre)contractual obligations, on the basis of your consent, due to a legal obligation, or on the basis of our legitimate interests. Subject to legal or contractual permissions, we process or have the data processed in a third country only if the special conditions of Art. 44 et seq. GDPR are met. This means, for example, that the processing is carried out on the basis of special guarantees, such as an adequacy decision by the European Commission (e.g., for the USA through the 'EU-U.S. Data Privacy Framework') or by using standard contractual clauses (SCCs) approved by the European Commission.

15. Data Processing for Dispute Resolution

We are obligated to participate in dispute resolution proceedings before a consumer arbitration board (Universalschlichtungsstelle des Bundes). In the event of a dispute, we will transfer the necessary data (e.g., your name, contact details, and case-related information) to this board to carry out the proceedings. This processing is based on our legal obligation (Art. 6(1)(c) GDPR in conjunction with the German Consumer Dispute Resolution Act - VSBG).

16. Supervisory Authority

The competent data protection supervisory authority for our company is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Postfach 10 29 32, 70025 Stuttgart (Mailing Address)
Königstraße 10a, 70173 Stuttgart (Office Address)
Germany
Email: poststelle@lfdi.bwl.de