Privacy Policy

The controller within the meaning of data protection laws, in particular the EU General Data Protection Regulation (GDPR), is: Project Camper GmbH, Victoriaring 13, 22143 Hamburg, Germany, email: contact@project-camper.fr (see our legal notice).

Your rights as a data subject

You can exercise the following rights at any time by emailing contact@project-camper.fr or by contacting our data protection contact (contact details at the end of this page):

• information about your data stored by us and its processing (Art. 15 GDPR),
• rectification of inaccurate personal data (Art. 16 GDPR),
• erasure of your data stored by us (Art. 17 GDPR),
• restriction of processing, in particular where we are not yet permitted to erase your data due to legal obligations (Art. 18 GDPR),
• objection to the processing of your data (Art. 21 GDPR, see the box below) and
• data portability, insofar as you have consented to the data processing or have concluded a contract with us (Art. 20 GDPR).

You also have the right to set out instructions regarding the storage, erasure and disclosure of your personal data after your death (Article 85 of the French Data Protection Act No. 78-17 of 6 January 1978).

If you have given us your consent, you can withdraw it at any time with effect for the future. This does not affect the lawfulness of the processing carried out before the withdrawal.

You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence. In France, the competent authority is the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr. The supervisory authority responsible for our company is Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (Hamburg Commissioner for Data Protection and Freedom of Information), Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany, datenschutz-hamburg.de.

Providing the data marked as mandatory when ordering is necessary to conclude and perform the contract; without it we cannot process your order. Providing any other data is optional. We do not use solely automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

Purposes of data processing by the controller and third parties

We process your personal data only for the purposes stated in this privacy policy. Your personal data will not be transferred to third parties for purposes other than those stated. We only pass on your personal data to third parties if:

• you have given your express consent to this,
• the processing is necessary for the performance of a contract with you,
• the processing is necessary for compliance with a legal obligation,
• the processing is necessary to safeguard legitimate interests and there is no reason to assume that you have an overriding interest worthy of protection in your data not being passed on.

Service providers who process data on our behalf (processors within the meaning of Art. 28 GDPR) are contractually bound and may only use the data in accordance with our instructions.

Visiting our website and log files

When you visit our website, your browser automatically transmits data that our server stores in log files: IP address, date and time of access, page or file requested, referring website, browser type and version, operating system and amount of data transferred.

This data is processed to deliver the website, to ensure system security and stability and to detect and analyse abuse and attacks. The legal basis is our legitimate interest in these purposes (Art. 6(1)(f) GDPR). We do not use this data to create profiles. Log files are deleted as soon as they are no longer required for these purposes, unless a security incident requires longer retention for evidence purposes.

To deliver images and static files (e.g. stylesheets, scripts) quickly, we use the Amazon CloudFront content delivery network of Amazon Web Services EMEA SARL (address below), which processes your IP address for this purpose. CloudFront answers your request from the server closest to you; processing on servers outside the European Union therefore cannot be ruled out. Amazon.com Inc. is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission exists.

Hosting and email delivery

Our website and our internal systems (shop, order and enquiry management) are hosted by Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg, on servers located in the European Union (Frankfurt am Main, Germany). The emails we send you and the emails you send us are transmitted via Amazon Simple Email Service (Amazon SES) of the same provider. The provider processes the data on our behalf under a data processing agreement (Art. 28 GDPR). A transfer to Amazon.com Inc. in the USA cannot be ruled out; Amazon.com Inc. is certified under the EU-US Data Privacy Framework.

Orders, payment and delivery

When you place an order, we process the data required to conclude and perform the contract (name, billing and delivery address, email address, telephone number, details of your vehicle, order and payment data) on the basis of Art. 6(1)(b) GDPR.

Payment: for payment, we pass the required data (name, email address, amount, order number) to our payment service provider Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands. Depending on the payment method you choose, payment data is also processed by the respective provider, for example, for PayPal payments, by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, or, for card payments, by the card schemes and the issuing bank. These providers act as independent controllers; their own privacy policies apply.

Delivery: for delivery, we pass your name and delivery address and, so that DHL can notify you about your parcel, your email address to the carrier DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany (Art. 6(1)(b) and (f) GDPR). We do not pass your telephone number to DHL.

Order-related emails: we send you the emails required to perform the contract: acknowledgement of receipt of your order, payment link, payment reminders, payment confirmation, updates on production and shipping, invoice and a personal link to the tracking page of your order (Art. 6(1)(b) GDPR). The tracking link is only valid for a limited period.

Partner discount codes: if you use a partner's discount code (e.g. from a content creator), we check where your visit came from (referring website, app type) to prevent misuse of these codes. The legal basis is our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR). This information is not used for any other purpose.

Customer account: if you have a customer account, we process the data stored in it (name, email address, addresses, order history) so that you can access your orders (Art. 6(1)(b) GDPR). You can ask us to delete your account at any time by emailing contact@project-camper.fr; order data subject to statutory retention obligations is then kept until that period expires.

Retention period: we keep order data for as long as necessary to perform the contract and to handle any claims under the legal guarantees. Invoices and accounting records are then kept for eight years, accounting books for ten years and commercial correspondence for six years in accordance with Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO) (Art. 6(1)(c) GDPR).

Contact and handling of your enquiries

If you contact us by email or via the contact form, we process the data you provide (name, email address, subject, message and, where applicable, order number) in order to answer your enquiry. A valid email address is required so that we can reply; providing any other data is optional. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or order, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).

Messages you send us by email or via the contact form are received via Amazon SES (see “Hosting and email delivery”) and stored in our internal enquiry management system. To handle enquiries written in French or English promptly, the message content is automatically translated, summarised and categorised, and suggested replies are generated; order data relevant to your enquiry may be taken into account. For this we use the Azure OpenAI Service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, acting as our processor (Art. 28 GDPR) on the basis of the Microsoft Products and Services Data Protection Addendum (DPA). The data is processed exclusively in data centres located in the European Union. Microsoft does not use the submitted data to train AI models; it may store it temporarily, also within the European Union, to detect abuse. Suggested replies are always reviewed by a member of our team before they are sent; no automated decision within the meaning of Art. 22 GDPR is made.

Retention period: enquiries that are not related to an order are deleted 12 months after the last activity once the enquiry has been closed. Correspondence relating to an order is kept for six years as commercial correspondence (Section 257 of the German Commercial Code, HGB). Messages identified as spam or placed in quarantine are deleted after 30 days. These periods also apply to the translations, summaries and suggested replies stored with the enquiry.

Protection of the contact form (Google reCAPTCHA): to protect the contact form and the enquiry form on our FAQ page against abuse and automated submissions, we use the Google reCAPTCHA service (version 3) of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). reCAPTCHA is not loaded when you open the page, but only when you start filling in one of these forms (first click or first entry in a field). It then analyses usage behaviour on the page (e.g. IP address, browser and device information, mouse movements, time spent) to distinguish humans from automated programs and transmits this data to Google. Google may then set the _GRECAPTCHA cookie and, if you are logged in to a Google account, read the cookies of that account (e.g. NID, SID, HSID). The legal basis is our legitimate interest in protecting our forms against abuse (Art. 6(1)(f) GDPR). A transfer to Google LLC in the USA cannot be ruled out; Google LLC is certified under the EU-US Data Privacy Framework. If you do not wish to use reCAPTCHA, you can email us directly at contact@project-camper.fr. Further information can be found in Google’s privacy policy.

Use of Google Analytics 4

If you have consented to the “Analytics” category via our cookie banner, this website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics helps us understand how our website is used so that we can improve our range and usability. In particular, the following are processed: pages viewed and time spent, where the visit came from (e.g. referring website), information about your device and browser, your approximate location (derived from the IP address; according to Google, Google Analytics 4 does not store IP addresses) and orders in our shop (order number, order value, items ordered). For this purpose, cookies containing a randomly generated ID are stored on your device (_ga and _ga_<ID>, retention period up to 2 years).

The legal basis is your consent (Art. 6(1)(a) GDPR and Article 82 of the French Data Protection Act No. 78-17 of 6 January 1978). Without your consent, Google Analytics is not loaded and no data is transmitted to Google.

We use Google’s Consent Mode. If you additionally accept the “Marketing” category, we allow Google to use Google Analytics data for advertising purposes: setting advertising cookies (e.g. _gcl_au), sharing usage data with Google for advertising purposes (conversion measurement) and personalised advertising. In this case, Google processes this data partly under its own responsibility. Without consent to the “Marketing” category, these features remain disabled.

Google processes the analytics data on our behalf on the basis of a data processing agreement. A transfer to Google LLC in the USA cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission exists. The event data stored in Google Analytics is deleted automatically after the retention period set there.

Your consent is voluntary and can be withdrawn at any time with effect for the future: open the Cookie settings (also in the footer of every page) and deactivate the “Analytics” category. The Google Analytics cookies are then deleted. You can also delete or block cookies in your browser settings or install the browser add-on to deactivate Google Analytics. Further information can be found in Google’s privacy policy.

Managing your cookie consent

On your first visit, a banner allows you to accept or reject all non-essential cookies with equal ease, or to customise your choices by category. Cookies that are strictly necessary for the operation of the website do not require consent. Your choice (acceptance or refusal) is stored for six months; after that, the banner is shown to you again. You can change your choice at any time via the “Cookie settings” link in the footer of every page.

To be able to prove your consent or refusal, we store your choice together with the date and time, IP address, browser used, the page concerned and, where applicable, your customer number or email address (Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR). This information is deleted once it is no longer needed to prove consent.

Cookies used

The full, up-to-date list of the cookies and similar technologies we use (name, purpose, duration, provider), sorted by category, is available in the Cookie settings (“Cookie details” link in each category). Cookies in the “Necessary” category are used in particular for the shopping cart and checkout, form security (form_key), the session (PHPSESSID), caching and storing your cookie choice (pr-cookie-consent). Google Analytics cookies (_ga, _ga_<ID>) are only set with your consent to the “Analytics” category.

Changes to our privacy policy

We reserve the right to amend this privacy policy so that it always complies with current legal requirements or to implement changes to our services in the privacy policy, e.g. when introducing new services. The new privacy policy will then apply to your next visit.

Questions about data protection

If you have any questions about data protection or wish to exercise your rights, you can email us at contact@project-camper.fr or contact the person named below directly. The controller is Project Camper GmbH (see the beginning of this page).

Data protection contact: Jan Richter, jan@project-camper.de