Your legal guarantee rights

EU notice: legal guarantee

LEGAL GUARANTEE. Minimum two-year legal guarantee protection for goods sold in the European Union. Consumers can claim their rights under the legal guarantee of conformity, for example if goods do not match the description or do not function as intended. Sellers are liable for any lack of conformity which existed when the goods were delivered, and which becomes apparent within the legal guarantee period. Sellers in such a situation are required to offer: free repair or free replacement; in some cases, a price reduction or full reimbursement. Some countries have a longer legal guarantee period. For second-hand goods, a shorter period may apply, but not less than one year. For more information on your rights in a specific country, scan the QR code or ask the seller: europa.eu/youreurope/guarantees. What to do if you receive non-conforming goods: 1. Contact the seller as soon as possible to report the issue. 2. Provide proof of purchase, such as a receipt, invoice, or bank statement. Sellers and producers may also offer commercial guarantees, which apply independently from the legal guarantee. For example, you may see this GARAN label representing a commercial guarantee of durability offered by the producer at no additional cost and covering the entire good.
europa.eu/youreurope/guaranteesMore information on the European Union's Your Europe portal

Warranty and your rights with us

DEEN
KTH Onlineshop

Privacy policy

1. Controller

KTH Parts GmbH
Am Tönniesberg 16, 30453 Hannover, Germany
Managing Director: Sascha Schöning
Phone: +49 (0)511 56968381 · E-mail: info@kthshop.de

This privacy policy applies to the KTH online shop and the online shop “BlackBoost Europe”, both operated by KTH Parts GmbH.

2. Hosting and server log files

Our online shops are operated on our own servers in data centres within the European Union (infrastructure: netcup GmbH, Karlsruhe, Germany, under a data processing agreement). When the pages are accessed, the web server automatically processes technical access data (IP address, date and time, page accessed, browser type) insofar as this is necessary to deliver the pages and to ensure stability and security (Art. 6(1)(f) GDPR). Log data is not merged with other data sources. Web server access logs are deleted after 14 days at the latest, error and system logs after 90 days at the latest. Login attempts to the customer account and the admin area (e-mail address, IP address, browser identifier, time) are stored for 90 days to prevent misuse.

To protect against attacks (e.g. automated login attempts, vulnerability scans) we use the security software CrowdSec. It analyses the access logs on our server and blocks suspicious IP addresses. If it detects an attack, it transmits the attacker’s IP address, the time and the type of attack to CrowdSec SAS, Paris, France, which compiles a shared blocklist from it; data of ordinary page visits is not transmitted. The legal basis is our legitimate interest in the security of our systems (Art. 6(1)(f), Art. 32 GDPR).

For backup purposes, a nightly backup copy of the server including the shop database is stored on Google Drive (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The backup is encrypted on our server before transfer; Google receives no key and cannot read the contents. Backups are deleted after 7 days. The legal basis is our legitimate interest in being able to restore data and our obligation to ensure data security (Art. 6(1)(f), Art. 32 GDPR); a data processing agreement with Google is in place (Art. 28 GDPR). A transfer to the USA cannot be ruled out; Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR), and EU standard contractual clauses apply in addition.

3. Cookies and local storage

We use only technically necessary cookies and comparable storage technologies (Section 25(2) TDDDG, Art. 6(1)(b) and (f) GDPR): session/login cookies for the customer account and the admin area, local storage of the shopping cart and wishlist in your browser, storage of your cookie settings and of your language and price-country selection. We do not use any analytics, statistics or marketing tools. The only content requiring consent is external media (YouTube videos, see section 12); they are only loaded after your consent via the cookie banner or a click on “Load video” (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change or withdraw your selection at any time via “Cookie settings” in the footer.

4. Location-based price display (geolocation)

To display the value added tax expected to apply in your country, we assign your IP address to a country when the page is accessed. This assignment takes place exclusively locally on our server using an offline database; your IP address is not transmitted to third parties for this purpose and is not stored (Art. 6(1)(f) GDPR — interest in transparent price presentation). You can change the display country manually in the footer at any time; the selection is stored in a cookie.

5. Customer account, orders and invoicing data

For orders and the use of the customer account, we process the data you provide (name, address, e-mail address, telephone number, VAT ID where applicable, order and payment data) for the performance of the contract (Art. 6(1)(b) GDPR). Passwords are stored exclusively in encrypted (hashed) form; stored payment configuration data is kept encrypted. To calculate shipping costs, the destination country, postcode, city and state (if any) are transmitted to our server while you enter them. Order and invoice data form part of our accounting records and of the records of supplies under the One-Stop-Shop scheme; we therefore retain them uniformly for ten years (Section 147(1), (3) AO, Section 14b UStG, Art. 63c VAT Implementing Regulation 282/2011, Section 22 UStG), commercial letters for six years (Section 257 HGB), in each case from the end of the calendar year (Art. 6(1)(c) GDPR). If you delete your customer account, the account, address book, cart and wishlist are deleted immediately; order and invoice data are restricted until these periods expire (Art. 17(3)(b), Art. 18 GDPR) and then anonymised automatically. Details of a withdrawal declared via the withdrawal function (name, contract details, e-mail address for the acknowledgement, time of receipt) are stored as proof for three years (Art. 6(1)(c) and (f) GDPR). Providing the data marked as mandatory is necessary for concluding the contract; without it we cannot process your order.

Gift cards: If you name a recipient when buying a gift card, we process the recipient’s name and e-mail address, your greeting text and the requested sending date in order to deliver the gift card (Art. 6(1)(b) and (f) GDPR). The recipient receives a reference to this privacy policy with the gift card. We store the data until the gift card expires and thereafter within the statutory retention periods.

6. Payment service providers

Payments by card, Apple Pay, Google Pay, PayPal, Klarna, Amazon Pay, Revolut Pay and bank transfer to a personal IBAN are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. For this purpose we transmit the order number, amount, e-mail address and – for bank transfers – your name; you enter the payment data itself directly on Stripe’s payment page (Art. 6(1)(b) GDPR). For bank transfers, Stripe creates a customer record with a personal IBAN through which your payment is assigned automatically. Stripe also processes data for fraud prevention and in the USA; the transfer is based on the EU-US Data Privacy Framework or standard contractual clauses (Art. 45, 46 GDPR).

For fraud prevention, Stripe uses its “Stripe Radar” service on the payment page to analyse device and connection data (e.g. IP address, browser and device information) and payment data and to assess the fraud risk of a payment. If the risk is high, Stripe may decline a payment; you can then choose another payment method or contact us. The legal basis is our and Stripe’s legitimate interest in protection against payment fraud (Art. 6(1)(f) GDPR).

Depending on the payment method chosen, the respective provider additionally receives the data required for the payment as an independent controller: PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg); Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden – for pay later and instalments Klarna may check your identity and creditworthiness in accordance with its own privacy policy; Amazon Payments Europe S.C.A. (Luxembourg). For purchase on account and prepayment to our account we process the payment data ourselves; incoming payments are matched using the payment reference.

6a. Verification of VAT IDs (VIES)

If business customers from another EU member state provide a VAT ID, we verify its validity via the VAT Information Exchange System (VIES) of the European Commission before accepting a tax-exempt intra-Community supply. The check at checkout transmits only the VAT ID. For a qualified confirmation we additionally verify the VAT ID together with the company name and address with the German Federal Central Tax Office (BZSt, Bonn). We store the result as proof (Art. 6(1)(c) GDPR in conjunction with Section 6a UStG, Section 17d UStDV, Section 18e UStG).

7. Shipping service providers, shipping costs and customs

For delivery, we transmit your name, delivery address, company (if any) and – where required for delivery or customs clearance – telephone number and e-mail address to the shipping company commissioned, currently Deutsche Post / DHL Paket GmbH (Bonn, Germany), and for freight items (complete exhaust systems and gearboxes) to the freight forwarder commissioned (Art. 6(1)(b) GDPR).

For deliveries outside the EU, the description of goods, value, customs tariff number and country of origin are additionally transmitted to the shipping company and the customs authorities of the country of destination. For countries without an adequacy decision of the European Commission, the transfer takes place because it is necessary for the performance of the contract concluded with you (Art. 49(1)(b) GDPR); a level of data protection comparable to the EU may not exist there.

8. Shipment tracking (17TRACK)

For shipment tracking in our shops, we register the tracking number of your delivery with the service 17TRACK (17TRACK Technology Limited, Hong Kong). Only the tracking number is transmitted — not your name, address or contact details. The legal basis is our legitimate interest in convenient shipment tracking (Art. 6(1)(f) GDPR). As the provider is located in a third country without an adequacy decision, we limit the transmission to this pseudonymous shipping data.

9. E-mail communication and newsletter

We send e-mails for the performance of the contract (acknowledgement of order receipt, order, payment and shipping confirmations, payment reminders, acknowledgement of a withdrawal) on the basis of Art. 6(1)(b) and (c) GDPR. Our mailboxes and e-mail delivery are hosted by ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, under a data processing agreement (Art. 28 GDPR); the servers are located in Germany.

Only with your express consent (Art. 6(1)(a) GDPR, Section 7(2) no. 2 UWG) do we send a one-time request to review the purchased items after delivery (optional checkbox at checkout), reminders about items left in your cart (setting in your customer account) and our newsletter with offers and product news (sign-up in the footer, double opt-in: you only receive it after confirming the link we send you). After you confirm the newsletter sign-up, we check on the basis of your e-mail address whether an order already exists and send new customers a one-time free-shipping code (Art. 6(1)(b) GDPR). For the sign-up we store your e-mail address, the time of sign-up and confirmation and, as proof of consent, a hashed (non-readable) form of your IP address and browser. We do not track whether you open the newsletter or click on links. Unconfirmed sign-ups are deleted after 30 days; after you unsubscribe we keep your e-mail address and the proof of consent for up to three years to defend against claims (Art. 6(1)(f) GDPR). Each of these e-mails contains an unsubscribe link; you can also withdraw your consent at any time by e-mail, and the cart reminder also in your customer account.

For deliveries outside Germany we store a proof of delivery after the parcel has been delivered (tracking number, tracking log with time and place of delivery, delivery address and, where available, a capture of the carrier’s public tracking page). It serves as evidence for tax obligations and the defence of claims (Art. 6(1)(c) and (f) GDPR in conjunction with Section 147 AO, Section 17b UStDV) and is deleted when the retention period expires.

10. Contact form and product reviews

For enquiries via the contact form, we process your details in order to handle the enquiry (Art. 6(1)(b) or (f) GDPR); we delete enquiries once they have been fully dealt with, at the latest after three years, unless a retention obligation applies. Reviews can be submitted via the personal link in the review request, as a logged-in customer or without a purchase; they are checked by us before publication (moderation). Reviews submitted via the link or by logged-in buyers of the item are marked “Verified purchase”; for this we match the review with your order. For reviews submitted via the link you receive a thank-you voucher regardless of the star rating. The review text, star rating and the display name you provide are published (Art. 6(1)(a) GDPR).

B2B application: If you apply for a business account (application form, in your account or when registering as a business), we process the company, contact person, contact and address details and the VAT ID to review the application (Art. 6(1)(b) GDPR). We check the VAT ID as described in section 6a (VIES, qualified with company name and address at the BZSt); we keep the result as evidence (Art. 6(1)(c) GDPR in conjunction with Section 18e of the German VAT Act). Rejected applications are deleted six months after the decision, undecided applications twelve months after receipt.

Dealer map: For the dealer search in the “BlackBoost Europe” shop, we determine the map coordinates from the dealers’ business address (street, postcode, city, country) via the Nominatim service of the OpenStreetMap Foundation (St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom; adequacy decision pursuant to Art. 45 GDPR). No data of shop visitors is transmitted (Art. 6(1)(b) and (f) GDPR).

11. Your rights

You have the right vis-à-vis us to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21, see below). You may withdraw any consent given at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority; the authority responsible for us is the Landesbeauftragte für den Datenschutz Niedersachsen (State Commissioner for Data Protection of Lower Saxony), Prinzenstraße 5, 30159 Hannover, Germany.

Right to object (Art. 21 GDPR): Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR, e.g. server log files, geolocation, shipment tracking, fraud prevention), you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds which override your interests, or the processing serves the establishment, exercise or defence of legal claims. An informal message to info@kthshop.de is sufficient.

12. External media: videos (YouTube)

Individual product descriptions contain videos (e.g. sound samples). They are only loaded when you click “Load video” or have allowed “External media” in the cookie banner; before that, no connection to Google is established. We embed the videos via the domain youtube-nocookie.com of Google Ireland Limited. When loading, your IP address is transmitted to Google, including to the USA; if you start the video, Google processes further data in accordance with its own privacy policy. The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can withdraw at any time via “Cookie settings”. The transfer to the USA is based on the EU-US Data Privacy Framework (Art. 45 GDPR).

13. Automated decision-making, changes

We do not make any automated decisions, including profiling, ourselves. For Stripe’s fraud check and Klarna’s identity and credit check, see section 6. We will amend this privacy policy as soon as the processing changes (e.g. when new services are introduced); the version published here at any given time applies.

Version: 2026-10-20