Privacy Policy

This Privacy Policy explains how personal data of users and customers is collected, used, stored and protected when they use the website https://dd-tuning.com/ (the “Website” or the “Online Store”).

This Privacy Policy has been prepared in accordance with the principles of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR”), as well as other applicable data protection and privacy laws, where relevant.

The Website is intended for customers in Europe and other countries worldwide. Depending on the customer’s country of residence, additional local data protection rules may apply.

The controller of personal data is DDTuning Int. OÜ, registered address: Jõe tn 3-304, Kesklinna linnaosa, Tallinn, Harju maakond, 10151, Estonia, registry code: 17605210 (the “Controller”).

Contact: [email protected]
Phone: +380 66 840 00 15

For any questions related to the processing of personal data, the user may contact the Controller:

by e-mail: \1;
using the contact details indicated on the Website;
in writing at the Controller’s registered address.

2. Categories of Personal Data Processed

The Controller may process the following categories of personal data of users and customers:

first name and last name;
telephone number;
e-mail address;
delivery address;
billing address, where applicable;
data required for issuing invoices, tax documents, customs documents or accounting documents, where applicable;
data relating to placed orders, payments, delivery, returns, complaints and warranty claims;
content of correspondence with the Controller via contact form, e-mail, telephone, messengers or other communication channels;
technical data related to the use of the Website, such as IP address, cookie identifiers, browser data, device data, source of access to the Website and information about the user’s activity on the Website.

Providing personal data is voluntary. However, in certain cases, failure to provide personal data may make it impossible to place or fulfil an order, deliver products, process payment, handle a return or complaint, respond to a user’s request, issue legally required documents or comply with the Controller’s legal obligations.

3. Purposes and Legal Bases for Processing Personal Data

Personal data of users and customers is processed for the following purposes and on the following legal bases:

Purpose of processing	Legal basis
Placing, confirming and fulfilling orders, including payment processing, delivery organisation and communication with the customer regarding the order	Article 6(1)(b) GDPR — processing is necessary for the performance of a contract or to take steps at the request of the data subject before entering into a contract
Creating and managing a customer account, if this functionality is available on the Website	Article 6(1)(b) GDPR — processing is necessary for the performance of a contract for the provision of an electronic service
Handling requests sent via contact form, e-mail, telephone, messengers or other communication channels	Article 6(1)(f) GDPR — the Controller’s legitimate interest in communicating with users and responding to received requests
Handling returns, complaints, warranty claims and other requests related to orders or products	Article 6(1)(b) GDPR, where processing is related to the performance of a contract, and Article 6(1)(f) GDPR — the Controller’s legitimate interest in handling requests and protecting its rights
Complying with legal obligations of the Controller, including tax, accounting, reporting, customs, consumer protection and document retention obligations	Article 6(1)(c) GDPR — processing is necessary for compliance with a legal obligation to which the Controller is subject
Keeping commercial, accounting, tax and customs documentation	Article 6(1)(c) GDPR and Article 6(1)(f) GDPR — the Controller’s legitimate interest in keeping documentation required for audits, inspections or defence against possible claims
Sending informational, service and transactional messages related to an order or use of the Website	Article 6(1)(b) GDPR, where the communication is related to the performance of a contract, or Article 6(1)(f) GDPR — the Controller’s legitimate interest in providing customer service
Sending newsletters, commercial offers, promotions and marketing communications, if the user has given consent	Article 6(1)(a) GDPR — consent of the data subject
Direct marketing of the Controller’s own products and services, where permitted by applicable law	Article 6(1)(f) GDPR — the Controller’s legitimate interest in promoting its own products and services
Analytics, statistics, improvement of the Website, prevention of abuse and ensuring Website security	Article 6(1)(f) GDPR — the Controller’s legitimate interest in analysing, improving and protecting the Website; where consent is required, Article 6(1)(a) GDPR
Use of cookies and similar technologies for analytics, advertising or marketing purposes	Article 6(1)(a) GDPR, where the user’s consent is required, or Article 6(1)(f) GDPR, where processing is based on the Controller’s legitimate interest and is permitted by applicable law

4. International Orders, Delivery and Customs

Because the Website may accept orders from different countries, including countries within and outside the European Economic Area, personal data may be processed for the purposes of international delivery, customs clearance, import/export documentation, tax documentation and communication with logistics providers.

For international orders, the Controller may need to share certain personal data with courier companies, postal operators, customs brokers, customs authorities, payment providers and other entities involved in the fulfilment, delivery or documentation of the order.

5. Commercial Communications and Marketing

The Controller may use the user’s personal data to send newsletters, special offers, promotions, commercial communications and marketing messages only where the user has given consent or where another legal basis permitted by applicable law exists.

The user may object to receiving marketing communications or withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

6. Recipients of Personal Data

Personal data may be disclosed to third parties only to the extent necessary to achieve the purposes indicated in this Privacy Policy.

Recipients of personal data may include, in particular:

courier, postal and logistics companies responsible for delivering orders;
customs brokers, customs authorities and other entities involved in international shipment or customs clearance, where applicable;
payment service providers, banks and other payment operators;
providers of hosting, server infrastructure, technical support and IT security services;
providers of e-commerce platforms, CRM systems, order management systems and customer support tools;
providers of e-mail, SMS, messenger, transactional notification and commercial communication services;
providers of analytics, advertising and marketing tools, where such tools are used on the Website;
accountants, auditors, lawyers, tax advisers and other professional advisers of the Controller;
public authorities, courts, supervisory authorities, tax authorities, customs authorities or other authorised entities, where disclosure of data is required by law.

The Controller does not sell users’ personal data to third parties.

7. International Data Transfers

The Controller aims, where possible, to process personal data within the European Economic Area. However, because the Website may serve customers internationally and may use global service providers, personal data may in some cases be transferred to countries outside the European Economic Area.

Such transfers may occur in particular in connection with the use of hosting services, analytics tools, advertising tools, communication systems, payment providers, logistics services, technical support tools or other IT services.

Where personal data is transferred outside the European Economic Area, the Controller applies mechanisms provided for under the GDPR, including adequacy decisions of the European Commission, standard contractual clauses or other appropriate safeguards, where required by applicable law.

8. Retention Period of Personal Data

Personal data is retained for the period necessary to fulfil the purposes for which it was collected and thereafter for the period required by law or necessary to protect the rights and legitimate interests of the Controller.

In particular:

data related to orders is retained for the period necessary to perform the contract, deliver products, handle returns, complaints, warranty claims and possible legal claims;
data included in accounting, tax, customs and administrative documents is retained for the period required by applicable law;
data processed on the basis of consent is retained until the consent is withdrawn, unless further retention is required by law or necessary to protect the Controller’s rights;
data processed on the basis of the Controller’s legitimate interest is retained until a justified objection is raised or until the relevant legitimate interest ceases to exist;
data related to correspondence is retained for the period necessary to handle the request and protect against possible claims;
technical data, cookies and analytics data are retained in accordance with the settings of the tools used, the user’s browser or the consent management platform.

9. Rights of the Data Subject

The data subject has the rights provided under the GDPR and applicable data protection laws, in particular:

the right to obtain information about the processing of personal data;
the right of access to personal data;
the right to receive a copy of personal data;
the right to rectification of inaccurate or incomplete data;
the right to erasure of data in the cases provided by applicable law;
the right to restriction of processing;
the right to data portability, where processing is based on consent or contract and is carried out by automated means;
the right to object to processing where processing is based on the Controller’s legitimate interest;
the right to withdraw consent at any time, where processing is based on consent;
the right to lodge a complaint with a competent data protection supervisory authority.

To exercise these rights, the user may contact the Controller using the contact details indicated in this Privacy Policy or on the Website.

The Controller may request additional information necessary to confirm the identity of the person making the request, where this is necessary to process the request safely and correctly.

10. Right to Lodge a Complaint with a Supervisory Authority

If the user believes that the processing of their personal data violates the GDPR or other applicable data protection laws, the user has the right to lodge a complaint with a competent data protection supervisory authority.

For users located in the European Union or the European Economic Area, this may be the supervisory authority in the country of the user’s habitual residence, place of work or place of the alleged infringement.

For users located in the United Kingdom, this may be the Information Commissioner’s Office (ICO) or another competent authority under applicable UK data protection law.

11. Cookies and Similar Technologies

The Website uses cookies and similar technologies to ensure the proper operation of the Website, save user preferences, perform analytics and statistics, improve functionality, ensure security and, where applicable, conduct marketing and advertising activities.

Cookies may be:

necessary cookies — essential for the correct operation of the Website;
functional cookies — used to remember user settings and preferences;
analytics cookies — used to analyse traffic and user behaviour on the Website;
marketing or advertising cookies — used to display relevant advertisements and measure the effectiveness of advertising campaigns.

Where applicable law requires consent for the use of certain cookies or similar technologies, such technologies are used only after the user’s consent has been obtained.

The user may manage cookies through browser settings and, where this functionality is available on the Website, through the cookie consent management panel. Restricting or disabling certain cookies may affect the operation of some sections or functions of the Website.

12. Analytics and Advertising Tools

The Controller may use analytics, statistics, advertising and marketing tools to analyse the operation of the Website, improve user experience, evaluate campaign effectiveness and present more relevant offers.

Such tools may collect technical data and information about the user’s activity on the Website, such as visited pages, clicks, source of access to the Website, device type, browser data, approximate location and cookie identifiers.

If data processed through such tools constitutes personal data, it is processed in accordance with this Privacy Policy and applicable data protection laws.

13. Security of Personal Data

The Controller applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, alteration, disclosure or unlawful use.

Security measures are determined taking into account the nature of the data processed, the purposes of processing, possible risks and the requirements of applicable data protection laws.

14. Automated Decision-Making and Profiling

The Controller does not use users’ personal data to make decisions based solely on automated processing that would produce legal effects concerning the user or similarly significantly affect the user.

The Controller may use elements of profiling for analytics or marketing purposes if the tools used allow Website content or advertising materials to be adapted to the user’s interests. Such profiling does not produce legal effects concerning the user.

15. Links to External Websites

The Website may contain links to external websites, services or platforms. The Controller is not responsible for the privacy policies, content or data processing practices of such external resources. Users are advised to review the privacy policies of those third parties before using their services.

16. Changes to this Privacy Policy

The Controller reserves the right to modify this Privacy Policy in the event of changes in legislation, Website functionality, services used, methods of processing personal data or internal procedures of the Controller.

The current version of the Privacy Policy is published on the Website.

17. Contact Information

For any questions related to the processing of personal data, the user may contact the Controller using the contact details indicated in this Privacy Policy or on the Website.

Last updated: 8 July 2026