Legal
Privacy notice
This notice supplements the privacy policy of the main site with what happens only here: the file upload, the processing, payment and email delivery. This is a convenience translation; the German version prevails.
Controller
Keven Harder, HRT Performance,
Ulmer Tal 6, 89160 Dornstadt, Germany
Email: hrt.performance.ulm@gmail.com ·
Phone: +49 160 92821962
No analytics, no tracking
This shop embeds no third-party fonts or scripts and uses no analytics, advertising or tracking services. That is why there is no consent banner. You only leave this server when you move to the payment page — we point that out during checkout.
Exactly one cookie is set, and only if you switch the language in the
top right corner: lang stores for one year whether you want
to see the site in German or English. It contains only “de” or “en”,
allows no recognition of you whatsoever, and is strictly necessary for
the service you expressly requested (§ 25(2) no. 2 TDDDG) — no consent is
required for it. You can delete it in your browser at any time; the
language then follows your browser setting again.
Without a choice of yours, the language shown is derived from the language setting your browser transmits and — where the server provides this information — from the country of your IP address. This evaluation is not stored.
Server logs
The server is operated in a data centre of IONOS SE in Germany. Each access logs technically necessary data: IP address, time, requested address, amount of data transferred, status code and the browser identification transmitted. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). These logs are deleted or truncated after seven days at the latest.
The ECU file you upload
The service requires you to upload a file read from your control unit. This file contains your vehicle identification number (VIN) and is therefore personal data as soon as it can be attributed to you.
- Purpose: checking suitability and producing your output file.
- Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
- Retention: the uploaded file is deleted automatically after 14 days, the generated output file when the download link expires after 7 days.
- Disclosure: none. The file is processed exclusively on our server.
Customer key and sales record
What is stored permanently is a customer key — an identifier derived from your file that is unique to your vehicle — together with the product, the time and, if supplied, your email address.
- Purpose: proof of purchase, releasing updates for your vehicle free of charge, and meeting commercial and tax retention obligations.
- Legal basis: Art. 6(1)(b) and (c) GDPR.
- Retention: until the statutory retention periods expire.
The customer key contains no plain-text VIN, but it can be attributed to your vehicle and is therefore treated as personal data.
Payment processing (Stripe)
Payment is handled by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland. When you move to the payment page we transmit the product name, the amount, the order reference, your customer key and — if supplied — your email address.
On the payment page you also enter your billing address with Stripe and — only if you buy as a business — your VAT ID. Stripe uses this to create the invoice you receive by email; we keep it as required by tax law (Art. 6(1)(c) GDPR).
Your payment details (card number, bank details) are entered exclusively with Stripe; they never reach our server. From Stripe we only receive the information whether the payment succeeded. The legal basis is performance of a contract (Art. 6(1)(b) GDPR). A transfer to the USA may take place; Stripe bases this on standard contractual clauses. Privacy information: stripe.com/privacy.
Email address and delivery
Providing an email address is voluntary. If you do, we use it exclusively for the confirmation containing the download link, for questions about this order and to check that it really is you when you request a later free update — never for advertising. Delivery runs through the mail server of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. The legal basis is performance of a contract (Art. 6(1)(b) GDPR).
Recorded consent
As evidence we store, with the order, the time at which you accepted the terms and consented to performance beginning immediately. Legal basis: Art. 6(1)(c) GDPR.
Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21 GDPR). Simply contact us at the address given above.
You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.
Version: 2026