Privacy notice

1. Controller

The controller and full contact details are shown under “Contact & provider details”. InCarUpgrades is the trading name of that seller.

2. Data we process

We process only data needed for the relevant order and secure operation of the shop.

• Contact and billing data such as name, email, address, country and optional company name.
• Order, product, price, tax, payment-status and Mollie reference data. We do not store full card details.
• Vehicle and system data such as brand, navigation family, map version and full VIN. The full VIN is requested only after confirmed payment on a protected, non-indexable page.
• Support messages, delivery status and limited security logs. The VIN is not placed in URLs, analytics events, payment metadata or email subject lines.

3. Purposes and legal bases

We process order, payment and vehicle data to perform the contract, including compatibility review, digital delivery, support, refunds and invoicing. Records required by tax and commercial law are processed to comply with legal obligations. Limited security logs are processed for our legitimate interests in preventing abuse, diagnosing errors and reconciling payments. Optional analytics or marketing technologies are enabled only with consent.

4. Recipients and processors

Data is shared only with parties that need it: Mollie for payments; hosting, email, database and private-storage providers for shop operations; and the technical supplier for vehicle-specific review and delivery. Advisers or authorities receive data only where legally required.

• Only vehicle data needed for the specific review and delivery is sent to the technical supplier.
• The final supplier identity, processing location and contractual safeguards must be confirmed in the internal processor register before public launch.

5. Transfers outside the EEA

We prefer processing inside the European Economic Area. If a provider processes data outside the EEA, we rely on an approved adequacy basis or appropriate safeguards such as the EU Standard Contractual Clauses. The exact supplier route must be confirmed before public launch.

6. Retention

Invoice and tax records are generally retained for seven years. The full VIN is encrypted and deleted after the currently configured period of no more than 90 days following completion, cancellation or refund, unless a specific dispute or legal obligation requires longer retention. Support and security data is kept only as long as needed for its purpose.

7. Your rights

You may request access, correction, erasure, restriction and portability, and object where processing is based on legitimate interests. Consent can be withdrawn for the future at any time. You may also complain to the Dutch Autoriteit Persoonsgegevens or the competent authority in your country of residence.

8. Security and changes

We separate payment, vehicle input, compatibility and fulfilment states, restrict access and encrypt sensitive vehicle data. This notice is updated when providers or processing change, with material changes published under a new effective date.