MotoCockpit Privacy and Cookie Policy
Version: 1.0
Text date: 25 September 2026
1. Controller and scope of this policy
1.1. Who is responsible for your data
The operator of the MotoCockpit online store and the controller of personal data processed for the purposes described in this policy is GaVitech s. r. o., with its registered office at Tichá 2054/119, 932 01 Veľký Meder, Slovak Republic, company registration number (IČO) 57434191, tax identification number (DIČ) 2122732810, VAT identification number SK2122732810, registered in the Commercial Register of the District Court Trnava, Section Sro, entry 61967/T (“we” or “GaVitech”).
For privacy matters, contact us at info@motocockpit.com or write to our registered office above. You do not need to use a special form or have a customer account to exercise your rights.
1.2. What this policy covers
This combined document describes the processing of personal data of visitors, buyers, delivery recipients, business customers’ contact persons and people who contact us or subscribe to marketing messages. It covers MotoCockpit, including the motocockpit.com online store, sales of physical goods in the EU, order handling, communications, audience measurement, marketing, and cookies and similar technologies.
The main legal framework is Regulation (EU) 2016/679 (“GDPR”), the applicable provisions of Slovak Act No. 18/2018 Coll. on Personal Data Protection and Act No. 452/2021 Coll. on Electronic Communications. Other mandatory rules applicable to particular processing remain unaffected.
This policy provides information; it is not blanket consent to processing. Accepting the Terms and Conditions, making a purchase or reading this policy does not amount to consent to marketing or optional tracking.
1.3. Language
The Slovak and English versions have the same content. The language displayed in the online store follows its domain; motocockpit.com is in English. The availability of a Slovak translation does not itself mean that a separate Slovak store is already operating. Your rights are not limited by the language in which you read this policy.
2. The data we obtain and its sources
2.1. Data provided when shopping and communicating
Depending on the service used, we process your name, email address, telephone number, billing and delivery address, country, and, for business purchases, business name and registration or tax details; cart and order contents, payment and delivery method, selected pickup point, notes and correspondence. For a complaint or withdrawal, we process information needed to identify the purchase, the problem reported, relevant supporting documents and, where needed, a bank account for the refund. When sending photographs or attachments, include only information needed to handle the matter.
Sending messages and fulfilling orders also produces records of sending, delivery, payment or refunds and a history of handling requests. Shopping does not require a user account; a customer record for a purchase does not itself register an account or subscribe you to a newsletter.
If we publish your customer review, name or photograph with your separate consent, we process the content and attribution only within the scope you agreed to. Sending a message to customer support does not itself authorise its publication.
2.2. Technical and usage data
When you visit and use the store, we may process your IP address, browser and device information, the time and technical details of requests, a session identifier and security records. With permitted measurement and marketing, we also process pseudonymous identifiers, pages visited and events such as viewing a product, adding it to the cart or making a purchase, the source of the visit and campaign data. Sections 7 and 8 explain the scope and conditions of optional measurement.
Pseudonymised or hashed data may remain personal data if it can be linked to an individual or their activity. We treat data as anonymous only where identifying an individual is no longer reasonably possible. Technical security processing does not itself authorise advertising profiling.
As you fill in checkout, information needed to prepare and complete the order you request may be processed before you finally submit it. Simply typing an email address is not consent to adding it to a marketing list or sending an advertising reminder about an unfinished purchase.
2.3. Data from other sources
We mainly obtain data from you. If the buyer names another person as the delivery recipient or a company contact, we receive that person’s identification and contact details from the buyer. The buyer should provide this policy to that person; this does not replace our own GDPR transparency obligations. Where we do not obtain data directly from the individual, we provide the required information within one month, at the first communication or at the first disclosure, whichever occurs first, unless a statutory exception applies.
Payment services and banks provide payment or refund status and references; carriers provide delivery, pickup point and cash-on-delivery information. We may use the relevant public register or VIES system to verify business and tax details. Marketing services provide message delivery information and, only under the conditions in Section 7, measurement results.
If you provide another person's details, provide only information you are entitled to share for that purpose and only to the extent needed. We do not automatically add a different delivery recipient to marketing lists.
2.4. Required and optional data
Information marked as required in the order process is needed to enter into and perform the contract, deliver the goods and meet legal obligations. Without the necessary details, we may be unable to fulfil the order or the requested delivery method. For other requests, we need at least enough information to respond and identify the matter concerned. We do not require unnecessary information.
Notes and marketing choices are optional. Refusing newsletters, optional analytics or personalised advertising does not prevent you from shopping. We do not require health data or other special categories of personal data, and you should not ask us to store them in order notes.
3. Purposes and legal bases for processing
3.1. Purpose-specific processing
We process personal data to the extent needed for a specific purpose. The legal basis depends on whether you browse our shop, prepare an order, make a purchase, contact us or use optional features. We do not ask for consent to processing that is necessary to fulfil your order or meet a legal obligation.
3.2. Purposes and legal bases
We apply the following purposes and legal bases under Article 6(1) GDPR:
| Purpose | Main data processed | Legal basis |
|---|---|---|
| Preparing an order at your request and entering into and performing the sales contract | Basket contents, selected products and variants, name, contact details, billing and delivery details, order information and related correspondence | Performance of a contract and steps taken at your request before entering into it — point (b). |
| Delivering the order and resolving delivery issues | Recipient's name, delivery address or collection point, contact details needed for delivery, shipment details and status | Performance of a contract — point (b), where you are a party to it. For lawfully obtained necessary data about a different recipient, our and the purchaser's legitimate interest in delivering the ordered goods to the correct person — point (f), while respecting the recipient's rights. |
| Receiving, verifying and refunding payments | Order, amount, currency, selected payment method, transaction reference and status, and information needed for any refund | Performance of a contract — point (b); compliance with a legal obligation for legally required payment and tax records — point (c). |
| Issuing documents, keeping accounts and complying with tax obligations | Identification and billing details, delivery and payment information, ordered items, prices, taxes and, where relevant, business and tax identifiers | Compliance with a legal obligation — point (c), particularly under Slovak accounting and value added tax legislation. |
| Withdrawal from the contract, complaints, liability for defects and handling consumer requests | Order identification, contact details, description of the issue, necessary photographs or other evidence, correspondence, returned goods and refunds | Performance of a contract — point (b), and compliance with the relevant legal obligations towards consumers — point (c). |
| Legally required product safety notices and action | Information needed to identify the affected product and customer, contact details and records of the action taken | Compliance with a legal obligation — point (c). These messages are not used as marketing. |
| Answering questions and providing customer support | Name and contact details, message content and information needed to respond | Performance of a contract or steps taken at your request before entering into it — point (b); for other ordinary enquiries, our legitimate interest in responding and providing support — point (f). |
| Communicating with contact persons of business customers and business partners | Name, role, work contact details and business correspondence | Our legitimate interest in communicating with the organisation represented and managing the business relationship — point (f). Where the individual is personally a party to the contract, point (b) applies to the necessary contractual data. |
| Operational security, protection against misuse and fraud, and detecting and resolving technical incidents | Necessary technical and security records, IP address or a reduced form of it, event time, browser and device information, and relevant request or transaction details | Our legitimate interest in protecting the shop, customers, payments and availability of services — point (f). We do not use data under this security purpose for advertising tracking. |
| Establishing, exercising and defending legal claims | Necessary contractual, payment, delivery and communication records and evidence relating to the particular claim | Our legitimate interest in protecting our rights and resolving disputes — point (f); point (c) where retention or disclosure is required by law. |
| Optional measurement of shop usage and improvement of its content through analytics technologies, including Google Analytics | Online identifiers, device and browser information, pages visited and website events to the extent allowed by your choice | Your consent — point (a). Rules for cookies and similar technologies are set out in section 8. |
| Optional advertising measurement, creation of advertising audiences and personalised advertising through advertising technologies, including Meta Pixel | Online identifiers and information about visits and relevant website events to the extent allowed by your choice | Your consent — point (a). Details are set out in sections 7 and 8. |
| Sending newsletters and other marketing emails to which you have subscribed | Email address, information you voluntarily provide when subscribing, and subscription and unsubscription records | Your consent — point (a). Refusing or withdrawing consent does not affect your ability to shop. |
| Publishing a customer review, name or photograph | Review content and attribution or photograph within the separately agreed scope | Your separate consent to publication — point (a). Without it, we do not use customer communications for this purpose. |
| Recording consents, withdrawals and objections | Scope and wording of the relevant choice, time, method and information needed to demonstrate that choice and comply with a prohibition on further messages | Compliance with the legal obligation to demonstrate and respect the relevant choice — point (c); also point (f) for evidence necessary to defend a particular claim. |
3.3. Legitimate interests
Where we rely on legitimate interests, we assess the necessity of processing and its impact on your rights. We use only data proportionate to the purpose. You may object to this processing under the conditions set out in section 9. Optional analytics, advertising tracking and newsletter subscriptions require the relevant separate choice; permission for them is not part of mandatory acceptance of the terms and conditions.
3.4. Necessary information
Information marked as required when ordering is needed to enter into or perform the contract or to issue a legally required document. Without it, we may be unable to accept, deliver or properly invoice your order. When you contact us, we need at least the information necessary to respond and handle your request. You may leave optional fields and marketing choices uncompleted.
3.5. Multiple purposes
Where we use the same information for several purposes, each purpose has its own legal basis and retention period. Withdrawing marketing consent therefore stops the relevant marketing processing but does not affect, for example, our duty to retain a legally required invoice. Before any further processing for a new purpose, we will provide the necessary information and ensure an appropriate legal basis.
4. Who receives personal data
4.1. Recipients’ roles
Authorised personnel of GaVitech s. r. o. have access to personal data to the extent needed for their duties. We disclose data to the providers listed below only for the relevant purpose and to the extent necessary. A processor handles data on our behalf under our instructions and an agreement under Article 28 GDPR. An independent controller is responsible for its own purposes and means of processing. Joint controllers allocate their responsibilities under Article 26 GDPR; this does not limit your rights.
4.2. Our infrastructure and email
We operate the online shop, its core database and our email mailboxes on GaVitech s. r. o.'s own infrastructure in Slovakia. We also use Amazon Simple Email Service (Amazon SES) to send emails. The location of our own infrastructure in Slovakia does not mean that all processing by external providers takes place exclusively in Slovakia or the European Economic Area (EEA).
4.3. Service providers
Depending on the service used, the payment or delivery method selected and your consents, recipients may include:
| Recipient and service | Purpose and data involved | Role and further information |
|---|---|---|
| Amazon Web Services EMEA SARL, Luxembourg – Amazon SES | Sending emails; the recipient's email address, name where applicable, message and attachment contents, and technical sending, delivery or non-delivery data. | Processor for the content and data we provide for sending. AWS data protection information. |
| Stripe Payments Europe, Limited, Ireland; for the relevant financial services, also Stripe Technology Europe, Limited, Ireland – Stripe | If you choose a payment processed through Stripe: identification and contact details, order details, amount, currency and payment result. You enter payment card details in the provider's payment interface; we do not store the full card number or its security code. | Depending on the operation, a processor or independent controller, particularly for its own payment-services obligations and fraud prevention. Stripe Privacy Policy, Stripe contracting entities. |
| SuperFaktura, s.r.o., Slovakia – SuperFaktúra | If a document is issued or managed through SuperFaktúra: name or business name, billing and, where applicable, delivery address, contact and tax details, order items, amounts and payment details. | Processor when managing our customer and accounting documents. SuperFaktúra data protection information. |
| GLS General Logistics Systems Slovakia s.r.o.; Packeta Slovakia s. r. o.; Slovenská pošta, a.s. – Slovakia | We provide the carrier handling your parcel with the recipient's name, delivery address or collection point, contact and parcel details and, for cash on delivery, the necessary collection-amount details. | Generally independent controllers when providing postal and transport services. They may involve partner delivery providers depending on the destination country. GLS, Packeta, Slovenská pošta. |
| MailerLite Limited, Ireland – MailerLite | Managing subscriptions and sending marketing messages on the basis of the relevant consent: email address, name where applicable, selected preferences, consent and unsubscribe records. Individual opening and click tracking is governed by paragraph 7.4. | Processor when managing our lists and campaigns. Privacy Policy, data processing terms. |
| Google Ireland Limited, Ireland – Google Analytics | With analytics consent: visit, device, traffic-source and shop-usage data, pseudonymous identifiers and events described in paragraph 7.5. | Processor when providing basic analytics on our behalf under the applicable service terms. Google data processing terms, Analytics data protection information. |
| Meta Platforms Ireland Limited, Ireland – Meta Pixel | With marketing-tracking consent: visit and purchase events, device and network-connection information and advertising identifiers for campaign measurement and personalised advertising under paragraph 7.6. | Joint controllers for the relevant collection and transmission of data; Meta is an independent controller for subsequent processing for its own purposes. Meta Privacy Policy, Controller Addendum. |
| Cloudflare, Inc., United States – network and security services | If communications with our website are routed through Cloudflare, it processes data needed to transmit and protect requests, such as the IP address, browser details, requested address and request time, and potentially content transmitted through its network. | Processor when handling customer traffic and the relevant logs on our behalf. Cloudflare Privacy Policy, data processing terms. |
4.4. Joint controllership with Meta
For Meta Pixel, we are responsible for deciding to use the tool on our website, explaining its use and obtaining the relevant consent before data is collected and transmitted. The allocation of responsibilities with Meta is governed by the addendum linked in the table. Meta handles processing within its systems under that addendum and its Privacy Policy. Joint controllership does not automatically extend to all subsequent processing by Meta. You may exercise rights concerning the joint processing against either us or Meta; we will help identify the relevant processing and handle your request within our responsibilities.
4.5. Other recipients
We may also disclose necessary data to accountants, auditors, legal advisers, banks and insurers where needed for accounting, payment, insurance claims or the establishment, exercise or defence of legal claims. Their role depends on the task performed. We disclose data to public authorities where required by law or a binding request from a competent authority. Access is limited to data needed for the specific purpose and is subject to the applicable confidentiality and data protection obligations.
4.6. Subprocessors and information
Processors may use subprocessors in accordance with Article 28 GDPR and the agreed terms. You can obtain information about the specific recipients of your data, their roles and the applicable safeguards by contacting info@motocockpit.com. Links to providers' policies supplement this notice and do not remove our responsibility for our own processing.
5. Transfers outside the EEA
5.1. Processing outside the EEA
Use of the international providers listed above may involve processing outside the EEA, particularly in the United States. A transfer may include storage, technical processing or remote access for support. A contractual provider's establishment in Europe does not by itself rule out access by its group or subprocessors from third countries. This may particularly concern AWS, Stripe, Google, Meta, MailerLite and Cloudflare, depending on the service used and the entities involved.
5.2. Adequacy decisions
We transfer data on the basis of a European Commission adequacy decision under Article 45 GDPR where a valid decision covers the relevant country, recipient and processing. For transfers to the United States, the EU–US Data Privacy Framework may be used only where the particular US recipient has a valid certification and the transfer falls within its scope. Membership of an international corporate group does not itself provide this safeguard. European Commission information on EU–US transfers.
5.3. Appropriate safeguards
Where a transfer is not covered by an adequacy decision, we put appropriate safeguards in place under Article 46 GDPR, particularly the European Commission's standard contractual clauses. We also assess the conditions and risks of the transfer and the need for supplementary technical and organisational measures, such as access restrictions, encryption or pseudonymisation. A transfer must not take place or continue if the required protection cannot be ensured. European Commission information on standard contractual clauses.
5.4. Information and copies of safeguards
You may contact info@motocockpit.com for information about the specific countries and recipients, the transfer mechanism and a copy of the relevant safeguards. When providing documents, we may protect trade secrets and other people's rights, but this must not prevent you from obtaining the information needed to understand how your data is protected.
5.5. Relationship with consent
Consent to analytics or marketing does not authorise a transfer without the necessary legal mechanism. Refusing these optional purposes does not prevent you from buying; necessary processing for your selected payment, delivery or communications follows the relevant purpose and legal basis described in this notice.
5.6. Transfer safeguards by provider
The following overview gives more specific information about transfers connected with the services in paragraph 4.3. The countries listed may involve storage or remote access for operations and support; this does not mean that every recipient on a provider's list receives every customer's data. Use of the DPF is always subject to paragraph 5.2. SCCs means the standard contractual clauses under European Commission Decision (EU) 2021/914.
| Provider | Countries and recipients outside the EEA | Specific transfer framework |
|---|---|---|
| AWS – Amazon SES | May include the United States and the Amazon Web Services companies involved; other locations depend on the service, region and support used. AWS companies, subprocessors and countries. | Section 12 of the AWS DPA incorporates controller-to-processor SCCs and also addresses onward transfers; section 12.3 recognises an alternative recognised mechanism where it covers the transfer. |
| Google Analytics | Particularly the United States, including Google LLC; other countries may be involved in support. Google subprocessors by service and country. | Google uses the DPF for the relevant US transfers. Transfers not covered by adequacy or the relevant alternative mechanism are subject to SCCs under Appendix 3A, paragraph 7 of Google's data processing terms, including onward transfers from Google to its subprocessors. |
| Meta Pixel | The United States, particularly Meta Platforms, Inc.; other processing locations are described in Meta's international processing information and its advertising subprocessors list. | Meta identifies the DPF as its mechanism for transfers of business-tools data to the United States. If the conditions for using it are not met, a transfer must not continue without another valid safeguard under paragraph 5.3. Further contractual rules appear in Meta's Data Transfer Addendum. |
| MailerLite | Potential processing in the United States where MailerLite, Inc. is involved. Hosting within the EEA does not rule out other access. Annex 4 to the DPA lists subprocessors and their locations. | Section 13 and Annex 3 of MailerLite's DPA provide SCCs for the relevant transfers to countries without adequacy; section 13.3 addresses SCCs when subprocessors in such countries are involved. |
| Stripe | The United States, including Stripe, LLC, and other countries depending on the payment service and support used. Stripe service providers, subprocessors and affiliates. | Sections 2–4 of Stripe's Data Transfers Addendum give the DPF precedence for the relevant US transfers; the addendum also contains SCCs for the applicable controller or processor role where the DPF does not apply. |
| Cloudflare | The United States, including Cloudflare, Inc., and other countries depending on the network service and support involved. Cloudflare subprocessors and group companies with their countries. | Section 6 of Cloudflare's DPA provides for the DPF for covered US transfers and SCCs for other relevant transfers. It provides for SCCs to apply if certification ceases to be valid; module 2 applies where we act as controller. |
The data involved and purpose of each service are set out in paragraph 4.3. You can obtain information about a particular transfer of your data and a copy of the relevant safeguards as described in paragraph 5.4. Providers' lists may change; an update does not itself authorise a new purpose or a transfer without the required protection.
6. How long we keep data
6.1. Retention by purpose
We keep data only for as long as needed for the particular purpose. We distinguish between information needed to fulfil an order, legally required documents, evidence relating to specific claims and optional marketing or analytics data. A duty to retain a document does not mean we keep all information about your website use for the same period.
6.2. Retention periods and rules
We apply the following periods and rules:
| Data or purpose | Retention period or how it is determined |
|---|---|
| Accounting documents and relevant accounting records; issued and received invoices | Ten years following the year to which they relate, under the applicable Slovak accounting and tax legislation. For example, a document relating to 2026 is normally retained until the end of 2036. |
| Order, payment and delivery information | While the order is being processed and fulfilled. Afterwards, we keep only information needed to meet document retention obligations, deal with contractual rights or establish and defend claims, as described in the relevant rows of this table. |
| Defect complaints, withdrawal, other complaints and related evidence | While the particular matter is being handled and then, to the extent necessary, for the period in which related claims may be brought or defended. We take account of applicable periods of liability for defects and limitation periods, any extension, interruption or suspension, and ongoing proceedings. The general civil limitation period under Slovak law is normally three years from the day when the right could first be exercised; this is not a universal period starting on the purchase date or a restriction on customers' longer rights in other countries. |
| Ordinary enquiries and customer support | Until the enquiry and related correspondence are concluded. We then keep only the part needed as a contractual record, to fulfil a legal obligation or as evidence of a specific claim, for the relevant period described in this section. |
| Contact details of representatives of business customers and business partners | During the relevant business relationship and while the contact is needed to resolve an outstanding matter. We correct contact details when notified of a change and remove outdated details, except for necessary historical correspondence retained for another lawful reason described here. |
| Unfinished orders, baskets and information needed to resume a requested shopping step | During the relevant session or until the end of the period for which you requested saving or resumption. When that purpose ends, we delete the information or retain separately only the part needed for another specific reason described in this section. Merely starting an order does not trigger ten years of accounting retention. |
| Security and technical records | Ordinary technical and security logs for no more than 30 days from creation. Technical checkout-protection records for no more than 30 days after the relevant verification record expires. Information needed as evidence of a specific incident is retained separately while it is investigated and for the relevant period for bringing or defending claims described in this section. |
| Identifiable user and event data in Google Analytics | We use the 14-month retention setting without resetting the period when a user becomes active again. Google removes data after the configured period through its regular monthly deletion cycle. This setting concerns user and event data, not cookie lifetimes or all aggregate reports. Outputs that are truly anonymous and do not allow a person to be identified are not personal data. |
| Our own analytics, campaign attribution and individual marketing-email tracking | We retain identifiable records for no more than 14 months from the relevant event, or less if you withdraw the relevant consent or the purpose ends sooner. We then erase or irreversibly anonymise those records; only necessary evidence of your choice is retained separately as described in this section. For data that Meta already processes for its own purposes as an independent controller, its rules linked in Clause 4.3 and your rights under Section 9 also apply. |
| Data used to send newsletters and marketing reminders | Until you withdraw consent or the relevant mailing ends. For a reminder about a particular purchase, also until its purpose ends when that purchase process is completed or closed. When regularly reviewing the list, we also assess whether continued retention of an inactive contact remains necessary in light of the original subscription and remove contacts that are no longer needed. |
| Published customer review, name or photograph | For the publication period covered by your consent, ending no later than withdrawal or earlier removal of the content. Necessary evidence of consent is retained separately under the following rules. |
| Proof of direct marketing consent and confirmation of its withdrawal | We retain proof of consent and confirmation of its withdrawal on a durable medium for at least four years from withdrawal under section 116 of Slovak Act No. 452/2021. After that period, we retain them only where, and to the extent, necessary to meet another specific legal obligation or resolve an ongoing claim. We do not use this evidence to continue sending marketing. |
| A minimal record prohibiting marketing contact | For as long as needed to respect your unsubscription or objection and prevent unauthorised reintroduction of the contact. We keep only the necessary identifier and suppression information, separately from the active marketing database, and regularly review whether retention remains necessary. |
| Cookies, similar technologies and evidence of other consents, including publication of a review | Device storage periods are set out in Section 8. We retain minimal evidence of a choice while it is valid and for no more than three years after its withdrawal, expiry or replacement by a new choice, to demonstrate lawfulness and protect related rights. This does not mean retaining the entire browsing history. The specific statutory rule for direct marketing evidence above takes precedence where it applies; particular ongoing claims are governed by Clause 6.3. |
6.3. Extended retention of specific evidence
An ongoing dispute, inspection or binding legal duty may require specific evidence to be retained for longer. In that case, we limit retention to information needed for the particular matter and delete it once the reason for further retention ends. This does not extend all periods for the entire customer record.
6.4. Erasure and backups
When the relevant period ends, we erase the data or irreversibly anonymise it. Each ordinary protected backup is retired no later than 90 days after its creation. After data is erased from active systems, remaining backup copies are therefore removed within no more than 90 days; until then, they are not used for ordinary business or marketing purposes. Specific evidence under Clause 6.3 is retained separately, without extending the retention of the entire backup. If a backup is restored, we reapply relevant deletions and restrictions. Independent controllers, such as payment service providers, determine retention periods for their own lawful processing in their privacy information.
7. Marketing, analytics and profiling
7.1. Separate choices
Marketing consent is voluntary and separate from accepting the terms and conditions and from processing needed to handle your order. Newsletters, analytics tracking, advertising tracking and individual tracking of behaviour in marketing emails have distinct purposes; consent to one does not automatically mean consent to the others. Entering your email address at checkout or making a purchase does not subscribe you to marketing. Consent-based processing takes place under Article 6(1)(a) GDPR; when storing or reading information on your device, we also follow the rules in section 8.
7.2. Order-related messages
We send order confirmations, payment and delivery information, invoices, replies to your requests and necessary security or product notices on the relevant contractual or legal basis. These messages do not depend on a newsletter subscription. Unsubscribing from marketing does not stop communications needed to complete an order, fulfil a legal obligation or handle your request.
7.3. Newsletters and shopping reminders
If you separately subscribe to our newsletter, we process your email address, name where provided, and interests or preferences you select to send MotoCockpit news and offers. We also keep the record needed to demonstrate consent and respect an unsubscribe request. Marketing reminders about an unfinished purchase are sent only on the basis of separate consent covering those reminders; entering contact details or saving a cart is not sufficient. The scope and retention periods are set out in section 6.
7.4. Tracking activity in emails
We track an individual's opening of a marketing message or clicks on its links only after separate, informed and voluntary consent to that tracking. This may use a unique image in the message or an identified link and associate the opening or click and its time with a particular subscriber and campaign. Its purpose is to assess interest in the content and campaign effectiveness. Consent to receive messages does not itself include this tracking, and refusing tracking does not prevent you from subscribing. Technical sending, delivery or non-delivery records needed to operate the email service are assessed separately from this measurement of interest.
7.5. Analytics
We activate Google Analytics and our own traffic tracking that is not necessary for the shop to function only after your analytics consent. We process, in particular, pages visited, product views, add-to-cart and purchase events, visit times and sources, device and browser information and pseudonymous identifiers. The purpose is to understand how the shop is used and improve its content and functionality. We do not send your name, email address, telephone number, full delivery address, private-message content or access tokens in analytics events. A pseudonymous identifier or hash may still be personal data. Retention periods are set out in section 6; you can change your consent as described in section 8.
7.6. Meta Pixel and advertising audiences
We use Meta Pixel only after consent to marketing tracking. It can record events such as visits to a page or product, adding an item to the cart and purchases, together with the relevant identifiers, device information and purchase value or currency. This data is used to measure advertising effectiveness and build advertising audiences so that relevant MotoCockpit offers can be shown to you on Meta services. Meta may associate it with information it holds about a user of its services; we may not know that association. This assessment of interests may constitute profiling. Sending an email address, telephone number or their hashes for advanced matching or to create an audience from a customer list requires separate information and the relevant separate consent; providing these details for a purchase is not sufficient. Hashing contact details does not anonymise them.
7.7. Unsubscribing and withdrawing consent
You can unsubscribe from newsletters and marketing reminders at any time, free of charge, through the unsubscribe link in the relevant message or by contacting info@motocockpit.com. Change your consent to analytics and advertising technologies in the cookie settings described in section 8; withdraw consent to individual marketing-email tracking through the available preference settings or the contact above. Withdrawal does not affect the lawfulness of earlier processing, but stops further processing on that basis. You may object to direct marketing, including related profiling, at any time; we will then stop processing your data for that purpose. We may retain the minimum unsubscribe record needed to respect your choice.
7.8. Automated decision-making
MotoCockpit does not use the marketing and analytics data described above to make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR. Personalising advertising does not decide whether your order is accepted or determine your statutory rights. We use technical checks to protect the website and payments; the payment service provider may perform its own legal and security checks under its policies. If you have a concern about order handling or an action being technically blocked, contact us and we will investigate.
8. Cookies and similar technologies
8.1. What these technologies mean
Cookies are small text files that a website stores in your browser and may read later. Browser storage, such as sessionStorage, or measurement code, such as a pixel, may serve a similar function. Some technologies support the operation and security of a purchase; others measure visits or advertising performance. These rules also cover comparable technologies that do not store a file called a cookie.
A cookie may be stored under a MotoCockpit domain even though data obtained through it is sent to an analytics or advertising provider. Storage under our domain or the use of a pseudonymous identifier does not, by itself, mean that no personal data is being processed.
8.2. Necessary and optional purposes
Without consent, we use storage of or access to information only where it is necessary to transmit a communication or provide a service you have explicitly requested. This includes securing forms, maintaining your shopping cart and purchase in progress, and remembering your cookie choices. We do not use these technologies for advertising profiling.
Analytics and marketing technologies are optional and switched off by default. We activate them only after you have given prior consent for the relevant purpose. This covers our own optional visitor measurement, Google Analytics, Meta Pixel and the corresponding attribution of visits or purchases to campaigns. Before that consent, we do not initiate analytics or advertising requests to these providers, including measurement requests that do not use cookies. The associated processing of personal data for these optional purposes is based on consent under Article 6(1)(a) GDPR.
8.3. How to choose your settings
On your first visit, or when we do not have a valid saved choice, you can accept all optional technologies, reject them all, or allow analytics and marketing separately. Accepting and rejecting are equally easy to access. Optional categories are not preselected, and refusal does not prevent normal browsing or shopping.
Consent requires a clear, active confirmation of your choice. Continuing to browse, scrolling, closing the notice or accepting the Terms and Conditions does not constitute consent to optional tracking. If you do not give consent, the optional purposes remain switched off.
8.4. Cookie overview
The table sets out cookie names or name patterns, purposes and the longest configured lifetimes. The part marked {channelId} identifies the relevant language/domain version of the store; for Google, <id> distinguishes the particular measurement configuration. A cookie is used only when the condition in the table is met.
| Name | Who uses it and why | When it is used | Maximum lifetime |
|---|---|---|---|
motocockpit-session |
MotoCockpit: identifying the working session, maintaining the cart and related purchase steps. | Necessary operation of the store. | 2 hours; renewed during use. |
XSRF-TOKEN |
MotoCockpit: protecting forms and requests against misuse. | Necessary security. | 2 hours; renewed during use. |
sf_cookie_consent_{channelId} |
MotoCockpit: remembering acceptance, rejection or selection of individual purposes. | After you save your choice; necessary to respect that choice. | 180 days after saving or changing the choice. |
_ga |
Google Analytics: distinguishing visitors using a browser identifier and producing statistics about use of the store. | Only after analytics consent. | Up to 2 years. |
_ga_<id> |
Google Analytics: maintaining analytics session state and related statistics. | Only after analytics consent. | Up to 2 years. |
_fbp |
Meta Pixel: distinguishing the browser for advertising measurement and the marketing purposes described in Section 7. | Only after marketing consent. | Up to 90 days. |
_fbc |
Meta Pixel: attributing a visit or purchase to a click on a Meta advertisement. | Only after marketing consent and where the visit includes the relevant click identifier. | Up to 90 days. |
sf_attribution_first_{channelId} |
MotoCockpit: remembering the first permitted visit source or campaign. | Analytics data only after analytics consent; advertising identifiers and marketing use only after marketing consent. | Up to 180 days. |
sf_attribution_current_{channelId} |
MotoCockpit: remembering the current permitted visit source or campaign. | Analytics data only after analytics consent; advertising identifiers and marketing use only after marketing consent. | Up to 180 days. |
Optional cookies may be renewed during further permitted use, within the stated maximum period measured from their last setting. Renewing a cookie does not renew or extend your consent. If your choice expires or you withdraw it, we do not continue using optional cookies without new consent. Browser settings may shorten their actual lifetime.
A cookie's lifetime is different from the retention period for data that has already been lawfully collected. Its subsequent retention is governed by the rules in this privacy notice and your rights under Section 9.
8.5. What analytics and marketing record
After analytics consent, we evaluate matters such as pages and products viewed, the source of a visit, cart interactions and the purchase process. The purpose is to understand use of the store and improve its content and operation. Our own measurement and Google Analytics may use browser or session identifiers and technical information about the device and events on the website. We do not send contact-message content, free-text order notes, passwords or access tokens for analytics measurement.
After marketing consent, we use Meta Pixel and marketing source attribution to measure advertising performance, connect an advertisement click with a subsequent visit or purchase, and carry out the marketing described in Section 7. Meta may associate events and identifiers with information it holds about a user of its services. Analytics consent alone does not authorise this marketing processing. Recipients, their roles and the rules for any transfers outside the EEA are described in the other parts of this privacy notice.
8.6. Temporary storage during a purchase
While a purchase is in progress, we use sessionStorage with a name beginning storefront.checkout. to retain form information and selected options temporarily, so that you do not have to enter them repeatedly during the same purchase. It may contain contact, billing and delivery information you have entered in the form. Without consent, its use is limited to what is necessary for the purchase process you requested; it is not used for advertising tracking.
SessionStorage belongs to the session of a particular browser tab. It normally ends when the tab is closed, although a browser's session-restoration features may preserve the data. You can remove information in this storage by clearing the website's data in your browser. This local copy is separate from information already sent to our server through the actions described in this notice; clearing it does not delete an order or other records lawfully retained.
8.7. MailerLite and other selected features
Accepting marketing cookies does not subscribe you to emails through MailerLite. Subscription, unsubscription and any separate consent to individual tracking of email opens or clicks are governed by Section 7. We do not activate individual measurement of a recipient's activity in emails without the relevant separate consent. Subscribing to emails does not, by itself, authorise analytics or marketing tracking when you visit the store.
If you choose a feature provided by an external provider, such as payment or selection of a collection point, we make information about that provider, its technologies, purposes and lifetimes available before they are used. Without consent, only technologies necessary for the feature you requested may be used. Selecting a payment method, delivery method or email subscription does not authorise additional analytics or marketing tracking. We apply the same approach to an external form or other optional embedded content; its necessary operation and optional measurement are assessed separately.
8.8. Changing your choice and withdrawing consent
You can change your choice or withdraw consent at any time, free of charge, through the “Nastavenia cookies” / “Cookie settings” link in the website footer. Withdrawal is as easy as giving consent. When you save a refusal for a category, we stop its further use and remove the corresponding optional cookies to the extent that we can control them. We do not restore consent without a new active choice from you.
We remember your choice for no more than 180 days. If a purpose or the technologies used change materially, we ask for new consent before applying that change on the basis of consent. Your choice relates to the relevant browser and domain; you may need to make it again on another device or domain, or after clearing website data.
Withdrawal does not affect the lawfulness of processing before withdrawal. It does not require you to cancel an order or customer-service communication and does not restrict your rights under Section 9. Google or Meta account settings may offer additional controls over their services; they do not replace the choice on our website.
8.9. Browser settings
You can view, delete or block cookies or website data through your browser. Blocking necessary technologies may prevent the cart, form security or order completion from working correctly. Rejecting optional analytics or marketing through our settings does not restrict these basic features.
Deleting cookies alone may not stop measurement code that is already running or delete information held by providers. To withdraw consent, also use the settings described in Clause 8.8; Section 9 applies to your other rights concerning personal data already collected.
9. Your rights and complaints
9.1. How to exercise your rights
You can exercise your rights by contacting GaVitech s. r. o. at info@motocockpit.com or writing to Tichá 2054/119, 932 01 Veľký Meder, Slovak Republic. Simply explain what you are requesting and provide the information needed to identify the relevant processing. You do not need to use a particular form or have a customer account.
9.2. Overview of rights
Subject to the conditions of the GDPR, you have the following rights in particular:
- Access: find out whether we process your personal data and obtain access, information about the processing and a copy of the data.
- Rectification: ask for inaccurate data to be corrected and incomplete data to be completed.
- Erasure: ask for data to be deleted, for example where it is no longer needed or is processed unlawfully. Erasure does not apply to the extent that continued processing is necessary to meet a legal obligation or establish, exercise or defend legal claims.
- Restriction of processing: request restriction in the circumstances set out in the GDPR, for example while the accuracy of data or the merits of an objection are being checked.
- Portability: for automated processing based on consent or a contract, receive the data you provided to us in a structured, commonly used and machine-readable format and transmit it to another controller; where technically feasible, request direct transmission.
- Protection against solely automated decision-making: not be subject to a decision based solely on automated processing, including profiling, that has legal or similarly significant effects, except where permitted by the GDPR and subject to the required safeguards. Where the GDPR requires it, you may request human intervention, express your point of view and contest the decision.
9.3. Right to object
Where we process data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation. We will then stop that processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or grounds for establishing, exercising or defending legal claims. You may object to processing for direct marketing at any time without giving a reason; we will no longer use the data for that purpose. This also covers profiling related to direct marketing.
9.4. Withdrawing consent
You may withdraw any consent at any time. You can unsubscribe through the link in every marketing email or write to info@motocockpit.com. You can change consent for cookies and similar technologies through the permanently available cookie settings on the website. Withdrawal is as easy as giving consent and does not affect the lawfulness of processing before withdrawal. We will provide demonstrable confirmation of withdrawal of direct marketing consent within 30 days; this period does not mean we continue marketing until then.
9.5. Response times and fees
We will inform you of the action taken on your request without undue delay and no later than one month after receiving it. Where necessary because of the complexity or number of requests, this period may be extended by a further two months; we will explain the extension and reasons within the first month. If we do not act on a request, we will explain why and inform you of complaint and judicial remedies. Requests are handled free of charge; only where a request is manifestly unfounded or excessive, particularly because it is repetitive, may we charge a reasonable fee or refuse to act under the GDPR, and we must demonstrate why the request has that character.
9.6. Verifying identity
Where we have reasonable doubts about a requester's identity, we may ask for additional information necessary to verify it. We request only proportionate information; exercising a right is not automatically conditional on sending a copy of an identity document.
9.7. Supervisory authority
If you believe that processing infringes your rights, you may lodge a complaint with a supervisory authority, particularly in the Member State of your habitual residence, place of work or the alleged infringement. In Slovakia, this is:
Office for Personal Data Protection of the Slovak Republic
Úrad na ochranu osobných údajov Slovenskej republiky
Galvaniho Business Centrum II
Galvaniho 7/B
821 04 Bratislava
Slovak Republic
Authority contact details and information · Submitting a request to initiate personal data protection proceedings
9.8. Judicial protection
Contacting us first is not a general condition for lodging a complaint with a supervisory authority. Your right to a judicial remedy is unaffected.
10. Security and particular situations
10.1. Protecting data
We take technical and organisational measures appropriate to the risks, including restricting access by job role, protecting data transmission and system access, maintaining backups and responding to security incidents. Authorised personnel are bound by confidentiality. No internet transmission can be described as entirely risk-free; we assess personal data breaches and notify the supervisory authority and affected individuals where the GDPR requires it.
When paying by card, you enter full card details on the payment provider’s payment page. Our order database is not used to store the complete card number or CVC/CVV security code. Do not email us these details, passwords or payment authorisation codes.
10.2. Children
The store and its marketing are not specifically directed at children. If we rely on consent for an information society service offered directly to a child, we comply with the applicable age threshold and parental authorisation rules; in Slovakia, the threshold under Article 8 GDPR and the relevant national provisions is 16. If you believe a child has supplied data without the necessary authorisation, contact us using the details in Clause 1.1.
10.3. Third-party links and products
An ordinary link to another website does not itself mean that we share your order contents with it. When you follow the link, the operator of that service also processes data under its own rules. External content embedded directly in our store is assessed separately under Section 8.
This policy describes processing connected with the store. Buying a display, sensor or other product does not automatically give us access to data about its use, the vehicle’s location or the manufacturer’s application. If a particular product or accompanying application processes such data, the relevant controller and processing information must be identified for that service. Your statutory rights concerning data generated by a connected product remain unaffected.
11. Changes to this policy
We update this policy when processing or legal requirements change and publish the date of the new version. We provide appropriate notice of material changes. Before using data for another purpose, we provide the required information and establish the relevant legal basis. Where fresh consent is required, we request it separately; another visit to the website or silence does not replace it.
The current version is available through the store’s privacy and cookie link. You can request a copy or an explanation at info@motocockpit.com.