Privacy policy

Last updated: 18 September 2026

This privacy policy explains which personal data we process when you visit our online shop roughcountry.de and when you place an order, for what purposes and on what legal basis this takes place, and what rights you have.

1. Controller

Goeren Truck Shop e. K.
Owner: Yasar Gören
Hamburger Str. 3
21339 Lüneburg
Germany
Phone: +49 4131 242526
Email: vertrieb@truckshop.de

2. Hosting

Our online shop is operated on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in a data centre in Germany (Nuremberg). Hetzner processes the data generated when the shop is visited and used on our behalf (Art. 28 GDPR). The legal basis is our legitimate interest in the secure and reliable operation of the shop (Art. 6(1)(f) GDPR) and, where orders are concerned, the performance of the contract (Art. 6(1)(b) GDPR).

3. Server log files

Each time a page is accessed, our web server automatically stores the following data in log files: full IP address, date and time of access, requested address (URL), HTTP status code, amount of data transferred, the previously visited page (referrer) and browser and operating system (user agent).

We process this data to provide the shop technically, to detect errors, to fend off attacks and to evaluate the use of the shop in aggregated form (e.g. number of page views). The legal basis is Art. 6(1)(f) GDPR.

The log files are rotated daily and deleted after 7 days. In addition, we keep a compressed copy of the access logs for a maximum of 90 days; it is then deleted automatically. Web server error logs, which may also contain IP addresses, are deleted after 7 days.

4. Cookies and similar technologies

We only use technically necessary cookies and storage technologies:

Session cookie (“session-”): stores the shopping cart, login and checkout process; deleted at the end of the browser session.
Cookie “timezone”: stores your browser's time zone so that dates and times are displayed correctly; stored for 30 days.
Cookie “cookie-preference”: stores your choice in the cookie notice if you make a choice; stored for 30 days.
Local storage of your browser: technical caching of display elements (e.g. image galleries and cart display); no information about your person is stored.

The legal basis for storing and reading this information is Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG); for the subsequent processing, Art. 6(1)(b) and (f) GDPR. We currently do not use cookies for analytics or advertising purposes.

When product images are loaded from the Rough Country USA network (see section 13), the service provider used there, Cloudflare, may set a technically necessary cookie (“__cf_bm”) to fend off automated access; it is deleted after about 30 minutes.

You can open your settings at any time via the “Cookie settings” link in the footer of every page.

5. Customer account

You can create a customer account or order as a guest. For the customer account, we process salutation, first and last name, email address, password (stored only in encrypted form), address, phone number and, optionally, company and VAT identification number. When you register, the shop stores your IP address in shortened form. The purpose is to provide the account and to process orders (Art. 6(1)(b) GDPR). You can request the deletion of your customer account at any time by email to vertrieb@truckshop.de; data that we must retain for tax or commercial law reasons will be blocked until the retention periods expire. Guest accounts that are no longer used are removed automatically.

6. Orders

To process your order, we process your contact and address data, the items ordered, the selected shipping and payment method, payment information and your shortened IP address at the time of the order. The legal basis is Art. 6(1)(b) GDPR and, for retention, Art. 6(1)(c) GDPR.

For delivery, we pass your name and delivery address on to the respective shipping company: for parcel shipping to DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany, and for freight goods to the freight forwarder we commission. Where necessary for delivery, we also pass on your phone number.

We retain order and invoice data for up to 10 years in accordance with commercial and tax law (Section 147 AO, Section 257 HGB).

7. Payment

Payment in advance: If you pay by bank transfer, we receive from our bank the information necessary to allocate the payment (name of the account holder, amount, payment reference).

PayPal: If you pay via PayPal, we transmit the data required for the payment (name, address, email address, items ordered, amounts and order number) to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. If you use the PayPal checkout on product pages or in the shopping cart, PayPal transmits your name, email address and delivery address from your PayPal account to us. On product pages, in the shopping cart and during checkout, we load the PayPal buttons from PayPal servers; in doing so, your IP address is transmitted to PayPal. The legal basis is Art. 6(1)(b) GDPR and, for the integration of the buttons, Art. 6(1)(f) GDPR. PayPal also processes the data under its own responsibility; PayPal may transfer data to third countries. Further information: PayPal privacy statement.

8. Emails about orders, payment and customer account

We send you emails about your order (e.g. order receipt confirmation, receipt of payment, shipping, notice of a failed payment), about your customer account (e.g. password reset) as well as acknowledgements of receipt for contact requests and withdrawals. A copy of the order confirmation is sent to our sales mailbox. For sending emails and for our mailboxes, we use Microsoft 365 of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, as a processor. Processing by Microsoft Corporation in the USA cannot be ruled out; Microsoft is certified under the EU-US Data Privacy Framework. The legal basis is Art. 6(1)(b) and (f) GDPR.

9. Contact form, email and phone

If you contact us via the contact form, by email or by phone, we process your details (e.g. name, email address, phone number, message) in order to answer your request (Art. 6(1)(b) GDPR for contract-related requests, otherwise Art. 6(1)(f) GDPR). We delete the request once it has been dealt with and no retention obligations apply.

Spam protection: To protect against automated spam messages, we check form submissions with an invisible check field and a server-side check. For a maximum of 7 days, we store pseudonymised check values (including an encrypted hash value of your IP address, shortened for IPv6) and the result of the check; to detect duplicate messages, we store a hash value of the message for 24 hours. In addition, the shop limits the number of requests per IP address for a short time (rate limiting). The legal basis is Art. 6(1)(f) GDPR.

10. Online withdrawal function

If you declare a withdrawal via “Withdraw from contract”, we process your first name, last name, email address, order number and your optional comment. You receive an acknowledgement of receipt by email; a notification is sent to our sales mailbox. The legal basis is Art. 6(1)(c) GDPR in conjunction with Section 356a BGB.

11. Newsletter

In the footer of the shop, you can subscribe to our newsletter with your email address. We use the double opt-in procedure: you first receive an email with a confirmation link; the subscription only becomes effective once you have confirmed it. We store your email address, the subscription status and the time of subscription and confirmation in order to be able to prove your consent. The legal basis is your consent (Art. 6(1)(a) GDPR). We do not evaluate whether newsletters are opened or links in them are clicked. You can withdraw your consent at any time with effect for the future, e.g. by email to vertrieb@truckshop.de.

12. Videos and maps

YouTube: On some product pages, we embed videos from the YouTube service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The video and its preview image are only loaded when you click on the video; we use the enhanced privacy mode (youtube-nocookie.com). Only then is data, in particular your IP address, transmitted to Google; a transfer to the USA is possible. The legal basis is your consent given by clicking (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

Google Maps: On the showroom page, you can load a map from Google Maps (Google Ireland Limited). The map is only loaded after you click; in doing so, data, in particular your IP address, is transmitted to Google, and a transfer to the USA is possible. The legal basis is your consent given by clicking (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Links such as “Plan route” or “View on map” open Google Maps in a new window.

13. Images and documents from external servers

We load some images and documents directly from third-party servers. For technical reasons, your IP address is transmitted to the respective provider:

images via the content delivery network of Contentful (images.ctfassets.net), provider Contentful GmbH, Berlin, with processing also by Contentful Inc., USA;
images via media.roughcountry.com, provider Rough Country, LLC, USA, delivered via Cloudflare, Inc., USA;
installation instructions as PDF via Amazon Web Services (s3.amazonaws.com), Amazon Web Services, Inc., USA – only if you click the respective link.

The legal basis is our legitimate interest in a complete and faithful presentation of the products (Art. 6(1)(f) GDPR). A transfer to the USA is possible.

14. Reach measurement (Google Analytics)

We use Google Analytics 4, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It allows us to analyse how our shop is used: which pages are viewed, how visitors reach us, and which steps of the ordering process are completed. Orders and order values are transmitted as well.

Google Analytics is only loaded after you have given your consent in the cookie notice. Without your consent no data is transmitted to Google and no corresponding cookies are set. Your IP address is truncated before the analysis (IP anonymisation).

Cookies named „_ga“ and „_ga_*“ are set with a storage period of up to two years.

The legal basis for storing and reading information on your device is your consent under Section 25 (1) TDDDG, and for the subsequent processing Art. 6 (1) (a) GDPR. A transfer to the USA is possible; Google LLC is certified under the EU-US Data Privacy Framework.

You can withdraw your consent at any time via the „Cookie settings“ link in the footer of every page. The withdrawal takes effect for the future.

15. Meta Pixel (Facebook and Instagram)

We use the Meta Pixel, a service provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. It lets us measure whether a visit or an order in our shop results from an advertisement on Facebook or Instagram, and lets us show relevant ads to visitors of our shop on those platforms.

The pixel is only loaded after you have consented to the „Marketing“ group in the cookie notice. Without your consent no data is transmitted to Meta and no corresponding cookies are set.

The data transmitted includes in particular your IP address, information about your browser and device, and the pages you visit and events you trigger (for example viewing a product, adding it to the cart, or completing an order including the order value). A cookie named „_fbp“ is set with a storage period of up to 90 days; our own consent marker „rc-meta-pixel“ is stored for 180 days.

Meta also processes this data for its own purposes. For the collection and transmission to Meta we and Meta are joint controllers (Art. 26 GDPR); the agreement concluded for this purpose is available at facebook.com/legal/controller_addendum. Meta is solely responsible for any further processing.

The legal basis for storing and reading information on your device is your consent under Section 25 (1) TDDDG, and for the subsequent processing Art. 6 (1) (a) GDPR. A transfer to the USA is possible; Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework.

You can withdraw your consent at any time via the „Cookie settings“ link in the footer of every page. The withdrawal takes effect for the future.

16. Shopware

Our shop is based on the Shopware software of shopware AG, Ebbinghoff 10, 48624 Schöppingen, Germany. We have activated the transmission of usage data to shopware AG. This transmits data about the use of the shop software, including order data such as order number, amounts and times and, in pseudonymised form, customer number, town/city and shortened IP address; names, email addresses and street addresses are not transmitted. The purpose is the improvement of the software by the manufacturer. The legal basis is Art. 6(1)(f) GDPR.

17. Recipients and transfers to third countries

We only pass on personal data where this is described in this privacy policy, where it is necessary for the performance of the contract, where we are legally obliged to do so or where you have given your consent. Recipients are in particular: Hetzner Online GmbH (hosting), Microsoft Ireland Operations Limited (email), PayPal (payment), DHL Paket GmbH and freight forwarders (shipping), shopware AG (usage data), Contentful, Rough Country, LLC, Cloudflare and Amazon Web Services (images and documents) and – after your consent or your click – Google (Google Analytics, YouTube, Google Maps) and Meta Platforms Ireland Limited (Meta Pixel). Where data is transferred to the USA, this is done on the basis of the European Commission's adequacy decision on the EU-US Data Privacy Framework, where the recipient is certified, or on the basis of EU standard contractual clauses.

18. Storage period

We only store personal data for as long as is necessary for the purposes stated or as required by statutory retention obligations. The specific periods are stated in the individual sections. Regular backups of the shop are created daily and overwritten after about 8 days. We delete additional backups created before technical changes as soon as they are no longer needed. We retain data from our previous shop system only within the statutory retention periods and in blocked form.

19. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR).

Right to object: Where we process data on the basis of Art. 6(1)(f) GDPR, you can object to the processing at any time on grounds relating to your particular situation (Art. 21 GDPR).

To exercise your rights, please contact vertrieb@truckshop.de. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: Der Landesbeauftragte für den Datenschutz Niedersachsen (State Commissioner for Data Protection of Lower Saxony), Prinzenstraße 5, 30159 Hannover, Germany.

20. Obligation to provide data, no automated decision-making

To place an order, you must provide the information marked as mandatory; without it, we cannot conclude the contract. There is no automated decision-making including profiling within the meaning of Art. 22 GDPR.

FIND PARTS FOR YOUR VEHICLE