Privacy policy

This privacy policy explains how we handle personal data when you visit or buy from our shop at ldacoautomotivegmbh.myshopify.com. It is written for customers in the United Kingdom and describes how we meet our obligations under the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR"). It deals only with personal data: delivery costs and delivery times are set out in our Shipping Policy, and cancellation, returns and refunds in our Returns and Cancellation Policy.

Who is responsible for your data

Saunakontor is a trading brand of LDACO Automotive GmbH. The controller of your personal data is:

We are a German company and we sell to the United Kingdom from Germany. We do not have an office, branch or other establishment in the United Kingdom, and all data-protection enquiries are handled at the address above. We have not appointed a data protection officer; data-protection enquiries are dealt with by the management at that address.

You can reach our customer service Monday to Friday, 9:00-17:00 (CET), and we reply to customer-service messages within 24 hours. Requests about your data-protection rights are answered within the period set out under Your rights under the UK GDPR below.

What personal data we collect

Data you give us

• Name, delivery address and billing address
• Email address and telephone number
• Payment details, which you enter with the payment service for the method you choose (see below)
• The contents of your order, your order number and your order history
• Account details, if you open a customer account in the shop
• Anything you write to us in an email, a chat message in the shop, a contact-form message, or a return or cancellation request

Data collected automatically when you use the shop

• IP address, browser type, device and operating system
• Pages viewed, the date and time of access, and the page or search that brought you to us
• Technical information collected by the automated spam and bot check that the shop platform runs on forms such as the contact form and account sign-up, including your IP address and how you interact with the form
• Cookies and similar technologies, as set out in the cookie section below

Where your data comes from

Your data comes directly from you - from your order, from a customer account if you open one, from a marketing opt-in if you tick to receive news and offers by email, or from your enquiry - and from the technical record created when you load a page of the shop.

We also receive limited information back from the companies that help us fulfil the order: the payment services confirm whether a payment succeeded or failed, and DHL tells us the delivery status of your parcel. We do not buy personal data, and we do not build profiles from data bought elsewhere.

Why we use your data, and our lawful bases

Purpose	What this involves	Lawful basis under the UK GDPR
Processing and delivering your order	Taking the order, taking payment, passing your name, delivery address and contact details to DHL, sending order confirmations and the tracking link	Article 6(1)(b) - performance of our contract with you
Export and import formalities	Making the customs declarations needed to send your parcel from Germany to the United Kingdom, and giving DHL the details it needs to clear the parcel through UK customs and to collect the import VAT and any customs duty from you	Article 6(1)(c) - legal obligation under customs law; Article 6(1)(b) - contract
Cancellations, returns and refunds	Handling your 14-day cancellation right, issuing prepaid return labels, checking returned goods, refunding your original payment method	Article 6(1)(b) - contract; Article 6(1)(c) - legal obligation under the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 and the Consumer Rights Act 2015
Customer service	Answering questions by email, telephone and the chat in the shop, sorting out delivery problems, dealing with damaged or faulty goods	Article 6(1)(b) where it concerns your order; otherwise Article 6(1)(f) - our legitimate interest in answering you
Running the shop securely and preventing fraud	Keeping the shop technically available, protecting it from abuse and attack, running an automated spam and bot check on forms, screening orders for payment fraud	Article 6(1)(f) - our legitimate interest in a secure, working shop
Understanding how the shop is used	Statistics on which pages are viewed and which source visitors arrived from, so that we can improve the range and the shop	Article 6(1)(a) - your consent, given through the cookie banner
Advertising	Measuring which Google advert clicks lead to an order, and showing our products to you again on Google services (remarketing)	Article 6(1)(a) - your consent, given through the cookie banner
Marketing emails	Sending news and offers by email, if you have asked for them. Every message has an unsubscribe link, and Regulation 22 of PECR applies	Article 6(1)(a) - your consent, which you can withdraw at any time
Keeping business records	Invoices, contracts and accounting records	Article 6(1)(f) - our legitimate interest in meeting the accounting and retention duties that apply to us as a German company (section 147 of the German Fiscal Code (AO) and section 257 of the German Commercial Code (HGB)); Article 6(1)(c) where a UK obligation applies to a particular record

You do not have to give us personal data. However, the details asked for at checkout - your name, delivery and billing address, email address and payment details - are needed for us to enter into and carry out the contract with you and to complete the customs formalities. If you do not provide them, we cannot accept or deliver your order. Consent-based uses, such as statistics, advertising and marketing emails, are always optional, and refusing them has no effect on your order.

We do not sell your personal data. We do not run SMS or telephone marketing, and we do not pass your details to other retailers for their own marketing.

Who we share your data with

• DHL - your name, delivery address and, where you give them to us, your email address and telephone number, so that your order can be delivered and you can be notified about the delivery.
• Customs authorities, through DHL - because your order is dispatched from Germany, your name, address and a description and value of the goods are declared to the German export authorities and to UK customs. Parcels are sent on a delivery-duty-unpaid basis, so DHL will use your contact details to collect UK import VAT and any customs duty from you before or on delivery. Those charges are payable by you and are not included in the product price or in the free delivery.
• The payment service used for the payment method you choose at checkout - card payments (Visa, Mastercard) and the Apple Pay and Google Pay wallets are handled through the payment services connected to our checkout, and PayPal and Klarna handle payments made with them. Full payment details are collected directly by that service and are never stored by us. Each of these providers acts as its own controller for the payment it processes and applies its own privacy policy.
• Shopify International Limited - the platform that hosts and runs the shop, acting as our processor. See the next section.
• Google - where you have agreed to marketing cookies, for the advertising measurement and remarketing described in the cookie section.
• Our tax advisers and, where the law requires it, the tax authorities.

Where a company processes personal data on our behalf, there is a written contract in place under Article 28 UK GDPR that limits what it may do with that data.

Our shop platform

The shop is operated on the platform of:

Shopify processes personal data on our instructions in order to run the shop, the customer account, the chat, the checkout and the routing of payments, and it provides the built-in shop analytics described in the cookie section below. Shopify uses its own sub-processors, which may be located outside the United Kingdom and the European Economic Area; see the section on international transfers.

Cookies and similar technologies

Cookies are small text files stored on your device when you visit the shop. We use cookies and comparable technologies (such as local storage) to provide the shop technically and - where you consent - to measure how it is used and to advertise our products.

When you first open the shop, a consent banner tells you which categories are used. Under Regulation 6 of PECR we may only store or read information on your device with your consent, unless it is strictly necessary to provide the service you have asked for. Cookies that are not strictly necessary are therefore set only after you have agreed to them.

Strictly necessary cookies

These cookies are needed for the shop to work. Without them the basket, sign-in and checkout cannot be used. They are set without consent.

Purpose	Examples	Storage period
Basket and checkout	cart, cart_ts, cart_sig, checkout_token	up to 2 weeks
Session and account security	_secure_session_id, secure_customer_sig, keep_alive	session to 1 year
Storing your cookie choice	_tracking_consent, _cmp_a	1 year
Language and region	localization	1 year
Abuse and fraud prevention	_shopify_m, _shopify_tm, _shopify_tw	session to 1 year

These fall within the strictly necessary exemption in Regulation 6(4)(b) of PECR, so no consent is required to set them. The personal data in them is processed on the basis of Article 6(1)(f) UK GDPR (our legitimate interest in operating the shop securely and without faults).

Statistics cookies

With your consent, the shop platform records which pages are opened and which source brought you to us. We use this to improve the range and the shop itself.

Purpose	Examples	Storage period
Recognising returning visits	_shopify_y, _y	1 year
Session analysis	_shopify_s, _s	30 minutes
Source of the visit	_landing_page, _orig_referrer, _shopify_sa_t, _shopify_sa_p	up to 2 weeks

The lawful basis for storing and reading these cookies is Regulation 6 of PECR together with Article 6(1)(a) UK GDPR (your consent).

Marketing and advertising cookies

We advertise our products on Google. The advertising runs through the Google & YouTube channel in our shop, which places a Google tag on the site. With your consent, that tag sets cookies that let Google measure which advert clicks lead to an order and show our products to you again on Google services and on websites in Google's advertising network. That second use is commonly called remarketing.

Purpose	Examples	Storage period
Linking an advert click to an order (conversion measurement)	_gcl_au	up to 90 days
Remarketing and advert personalisation, set by Google's advertising domain	IDE (doubleclick.net)	up to 13 months
Advert settings and personalisation, set by Google's own domain	NID (google.com)	up to 6 months
Checking whether your browser accepts cookies	test_cookie (doubleclick.net)	15 minutes

Where you have agreed to marketing cookies, the Google tag also uses so-called enhanced conversions: order details such as your email address are converted into an irreversible code (hashed) in your browser before being sent to Google, so that Google can match an order to an advert click. Google does not receive those details from us in readable form. Google processes this data as described in its own privacy policy at policies.google.com/privacy.

These cookies are set only after you have agreed to marketing cookies in the consent banner. The lawful basis is Regulation 6 of PECR together with Article 6(1)(a) UK GDPR (your consent). If you do not consent, the advertising cookies are not set and you will still be able to use the whole shop.

Withdrawing your consent

You can withdraw or change your consent at any time with effect for the future - through the cookie banner in our shop, or by deleting the stored cookies in your browser. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

You can also block cookies generally in your browser settings, or have them deleted automatically when you close it. Please note that the checkout will not work without the strictly necessary cookies.

Third-party websites and links

Our website may contain links to websites operated by other companies. We are not responsible for their content or for how they handle personal data; that is a matter for the operator of the site you go to. Their privacy policies apply once you leave our shop.

Children's data

Our shop is not aimed at children, and our products are not intended for purchase by children. We do not knowingly collect personal data from children. Under section 9 of the Data Protection Act 2018, a child in the United Kingdom can consent to an online service from the age of 13; below that age, consent has to be given by a person with parental responsibility. We do not knowingly rely on the consent of a child below that age, and if we become aware that we hold personal data from a child, we delete it without delay. If you believe a child has given us personal data, please contact us at Kontakt@ldacoautomotive.de.

Security and how long we keep your data

Traffic between your browser and the shop is encrypted with TLS. Full payment details are entered with your payment service and never reach our systems. Access to order data is limited to the people who need it in order to run the shop and deal with your order.

We keep personal data only for as long as we need it for the purposes set out above:

Data	How long we keep it
Order, invoice and contract data	Up to 10 years. As a German company we have to keep these records under section 147 of the German Fiscal Code (AO) and section 257 of the German Commercial Code (HGB).
Customs and export documents	For as long as customs law requires us and our carrier to be able to produce them, and no longer than the period for the order records above.
Enquiries that do not lead to an order	Until the matter is closed and there is no further reason to keep the correspondence.
Marketing email data	Until you unsubscribe, together with a record of your consent and its withdrawal.
Cookie data	For the storage periods shown in the tables above.

Automated decision-making

We do not take decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Your payment provider may run its own automated checks before it approves a payment; that is done under its own privacy policy, and you can take it up with the provider directly.

Your rights under the UK GDPR

In relation to your personal data you have the right to:

• Access - ask for a copy of the personal data we hold about you (Article 15)
• Rectification - have inaccurate data corrected and incomplete data completed (Article 16)
• Erasure - ask us to delete your data where there is no longer a lawful reason to keep it (Article 17). We may have to keep order and invoice records for the retention period set out above
• Restriction - ask us to limit how we use your data while a question about it is resolved (Article 18)
• Data portability - receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another controller (Article 20)
• Object - object to processing we carry out on the basis of our legitimate interests (Article 21). You can object to direct marketing at any time, and we will stop
• Withdraw consent - withdraw any consent you have given, at any time and with effect for the future (Article 7(3)), without affecting the lawfulness of what was done beforehand

An informal message to Kontakt@ldacoautomotive.de is enough. We may need to confirm your identity before we act, so that we do not disclose your data to someone else. We answer within one month of receiving your request. If the request is complex, or if you have made several requests, we may extend that period by up to two further months and will tell you within the first month why. There is no charge, unless a request is manifestly unfounded or excessive.

Complaining to the Information Commissioner's Office

If you are unhappy with how we have handled your personal data, please tell us first so that we can put it right. You also have the right to complain to the UK supervisory authority:

Complaining to the ICO does not affect any other legal remedy available to you.

International transfers

Because we are established in Germany, your personal data leaves the United Kingdom when you order from us. We process order data in Germany, and the shop platform is provided under a contract with Shopify International Limited in Ireland. Germany and Ireland are in the European Economic Area, which the United Kingdom's adequacy regulations recognise as providing an adequate level of protection, so no additional safeguard is needed for those transfers.

Some of the companies described above may also process personal data outside the United Kingdom and the EEA - for example Shopify through its sub-processors, and Google in connection with the advertising described above. Where that happens, the transfer is made under the United Kingdom's adequacy regulations for the country concerned, under the ICO's International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses, or under another safeguard permitted by Chapter V of the UK GDPR. You can ask us for details of the safeguard used for a particular transfer.

Changes to this privacy policy

We update this privacy policy when our services or the law change. The version published at ldacoautomotivegmbh.myshopify.com is the one that applies. If we start using a new category of cookie or a new advertising tool, we will update this policy beforehand and ask for your consent.

Last updated: 4 September 2026.

Contact

For any question about data protection, write to Kontakt@ldacoautomotive.de or call +4939203990, Monday to Friday, 9:00-17:00 (CET).