Privacy policy

1. Data controller

Personal data is collected by TakeOver Motorsport, an EURL (single-member limited liability company) with a share capital of €1, registration number 938 752 342.

The data controller can be contacted as follows:

• By post at: 60 rue François Ier, 75008 Paris, France;
• By email: contact@takeovermotorsport.com.

2. Data processed

The personal data collected in the course of our activity is as follows:

• Account: email address, hashed (encrypted) password, role, email verification and login dates. After a first order without an existing account, the site automatically creates an account linked to the email address and then asks you to set a password.
• Security: session and CSRF identifiers, IP address, user agent, login attempts and logs necessary to protect the service.
• Order: email, billing details, phone number, content and amount of the order, payment reference and status.
• Payment: Stripe technical identifiers, any invoice link and payment status. Card data is entered through Stripe and is not stored by the application.
• Cart: products, variants, quantities and display information stored locally in your browser.
• Cookie preferences: mechanism version, analytics choice and decision and expiry dates stored locally.
• Analytics, only after consent: pages viewed without search parameters or fragments, technical information, and session recordings (clicks, scrolling, navigation; form fields masked) sent to the Umami application.

3. Purposes

The collection and processing of this data serve the following purposes:

• Account creation and management, cart, order, payment, delivery and after-sales service: pre-contractual measures and performance of the contract;
• Invoicing, accounting and retention of mandatory records: legal obligations;
• Authentication, abuse prevention, CSRF, security and defense of rights: legitimate interest in protecting the service and its Users;
• Verification, security and order-tracking emails: performance of the service or legitimate interest;
• Optional Umami analytics and session recordings: the user's consent, which can be withdrawn at any time.

No data is resold.

4. Legal basis

Data processing is based on:

• performance of the sales contract;
• legal obligations;
• consent where required.

5. Recipients and identified processors

Access to data must be limited to authorized persons. The repository shows the following providers and data flows (their contractual entities and regions still need to be confirmed):

• Stripe: creation of customers and payment sessions, payment processing and invoicing.
• TakeOver internal SMTP server: sending of transactional account, security and order emails.
• VPS host: hosting of the site and databases; identity, country and sub-processors to be completed.
• Self-hosted Umami: optional analytics and session recordings in a separate database; configuration and retention period to be completed.
• Shopify CDN: delivery of certain product images; no Shopify account will be used and no Shopify order will be placed through the site.

6. Transfers outside the European Economic Area

The Site mainly uses processors located in the EEA (European Economic Area) or processors storing data in the EEA. Where this is not possible, the data controller will verify the entities, hosting regions and contracts used so as to ensure appropriate protection of the personal data transferred.

7. Data retention period

The data collected is retained for a maximum of six months. If the version or the purposes change, consent will be requested again from the user.

8. User rights

Under the General Data Protection Regulation (GDPR), the User has the following rights:

• Right of access, rectification and erasure of data (Articles 15, 16 and 17 of the GDPR);
• Right to restriction of processing (Article 18 of the GDPR);
• Right to data portability (Article 20 of the GDPR): the user may request a copy of their personal data;
• Right to object (Article 21 of the GDPR);
• Withdrawal of consent: the user may withdraw their consent at any time via "Manage my cookies", without affecting the lawfulness of prior processing of the data;
• Right to lodge a complaint with a supervisory authority (Article 77 of the GDPR): the user may lodge a complaint with the CNIL (Commission nationale de l'informatique et des libertés), at the following address: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or via the website www.cnil.fr.

The user may contact the data controller directly, at the following email address, to exercise their rights: contact@takeovermotorsport.com

9. Security

The Site uses:

• HTTPS;
• encrypted communications;
• restricted access to data.

The Site notably implements hashed passwords, protected sessions, CSRF protection, cookies, origin checks, attempt limits and security headers. However, no system eliminates all risk.

10. Cookies and local storage

Strictly necessary items work without consent, namely: authentication session, CSRF security token, local cart and local storage of the cookie choice. Refusing them would prevent login, security or the requested functions.

Umami is treated as optional: the tracker, the session recorder and their requests are only loaded after the User's consent. Refusal does not degrade browsing, the account, the cart or ordering. URL parameters and fragments are excluded from analytics, and sensitive account, authentication and payment paths are neither tracked nor recorded.

"Accept all" and "Refuse all" are available at the same level on the site. Optional purposes are disabled by default; closing or ignoring the cookie center never constitutes consent.

11. Changes to the Privacy Policy

This Privacy Policy complies with the following provisions:

• Regulation (EU) 2016/679 (GDPR);
• Directive 2002/58/EC, Article 5(3);
• French Data Protection Act, Article 82;
• CNIL guidelines and cookie recommendation;
• EDPB Guidelines 05/2020 on consent.

The data controller reserves the right to amend this Privacy Policy at any time in order to ensure its compliance with applicable law for the Site's Users.

Any changes shall not affect orders previously placed on the Site, which remain subject to the Privacy Policy in force at the time of the order and as accepted by the User when confirming it.

The User is invited to review this Privacy Policy each time they use the Site's services, without the need to be formally notified.

This privacy policy was issued on 01/10/2026.