Privacy Policy

1. Who is responsible for your data

This website (the "Website") is operated by CTE (the "Operator", "we", "us" or "our"). The Operator is the controller of the personal data processed through the Website within the meaning of Article 4(7) of Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR"). As the controller, the Operator determines the purposes and means of the processing described in this policy.

You can reach us about anything relating to your personal data at info@cte.ooo.

2. Scope of this policy

This policy explains how we collect, use, store, disclose and otherwise process personal data when you visit the Website, browse our catalogue of cars and carbon fibre parts, use the search and cart functions, or contact us through the channels linked from the Website (WhatsApp, Telegram, telephone or e-mail). It applies to all visitors regardless of where they are located, and it is written to meet the transparency requirements of Articles 12–14 GDPR, the ePrivacy Directive (2002/58/EC) as implemented in the EU Member States, and the UK GDPR where applicable.

Any sale of a car or a part is concluded through direct communication with us. Personal data exchanged in that context (for example, delivery details or payment arrangements) is processed in accordance with this policy and with any additional information we give you at that time.

3. Definitions

Personal data — any information relating to an identified or identifiable natural person (Article 4(1) GDPR), including online identifiers such as cookie IDs and IP addresses.
Processing — any operation performed on personal data, such as collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, combination, restriction, erasure or destruction (Article 4(2) GDPR).
Controller — the person or body that determines the purposes and means of processing.
Processor — a person or body that processes personal data on behalf of the controller.
Data subject or you — the natural person the personal data relates to.

4. Personal data we process

We process the following categories of personal data:

Category	What it includes	Source
Technical and device data	IP address; approximate country derived from the IP address; browser type and version; operating system and version; device type (desktop, phone, tablet); user-agent string; referring URL.	Your browser, automatically
Usage and interaction data	Pages viewed and the time of each view; entry (landing) page; links and buttons clicked, including clicks on WhatsApp, Telegram, phone and e-mail links; search queries entered on the Website and the number of results; scroll depth; time the page was actively displayed; technical error messages raised by the page in your browser; requests for pages that do not exist.	Your browser, automatically
Online identifiers	Randomly generated visitor and visit identifiers stored in cookies (see section 7), which let us recognise that several page views belong to the same visit or the same browser.	Generated by the Website
Marketing attribution data	Campaign parameters contained in the link you used to reach the Website (utm_source, utm_medium, utm_campaign, utm_term, utm_content).	The link you followed
Preferences and cart data	Your chosen display currency; products, configurations and quantities you add to the cart.	You
Communication data	Your name, username, phone number, e-mail address, messages, attachments and any other information you choose to send us through WhatsApp, Telegram, phone or e-mail, together with the date and time of the communication.	You
Transaction data	Where you purchase a car or a part: the items ordered, prices, delivery address, invoicing details and correspondence relating to the order.	You

We do not ask for, and ask you not to send us, special categories of personal data within the meaning of Article 9 GDPR (for example health data or data revealing political opinions or religious beliefs).

Providing personal data is neither a statutory nor a contractual requirement for browsing the Website. Technical data is, however, necessarily transmitted by your browser for the Website to be displayed. If you want to buy from us, we need your contact and delivery details to process the order; without them we cannot complete the sale.

5. Purposes and legal bases

We process personal data only where one of the legal bases in Article 6(1) GDPR applies:

Purpose	Data used	Legal basis
Delivering the Website, keeping it technically available, secure and free of abuse (including rate limiting and detecting malicious requests)	Technical data, usage data	Art. 6(1)(f) — our legitimate interest in operating a secure, functional website
Providing the cart and remembering your currency choice	Preferences and cart data, session cookie	Art. 6(1)(b) — steps taken at your request before entering into a contract; Art. 6(1)(f) for the currency preference
Traffic analytics: measuring visits, new and returning visitors, popular pages, products and cars, search terms, engagement and technical errors, in order to improve the catalogue, the search function and the Website	Technical data, usage data, online identifiers	Art. 6(1)(a) — your consent where required for storing identifiers on your device (Art. 5(3) ePrivacy Directive); otherwise Art. 6(1)(f) — our legitimate interest in understanding and improving our service
Measuring which marketing channels and campaigns bring visitors	Marketing attribution data, online identifiers	Art. 6(1)(a) where consent is required; otherwise Art. 6(1)(f)
Answering your enquiries and communicating with you	Communication data	Art. 6(1)(b) where the enquiry relates to a purchase; otherwise Art. 6(1)(f) — our legitimate interest in responding to people who contact us
Concluding and performing sales contracts, arranging delivery and installation	Communication data, transaction data	Art. 6(1)(b) — performance of a contract
Accounting, tax and other record-keeping obligations	Transaction data	Art. 6(1)(c) — compliance with a legal obligation
Establishing, exercising or defending legal claims; responding to lawful requests from authorities	All categories, as necessary	Art. 6(1)(c) and Art. 6(1)(f) — our legitimate interest in protecting our rights

Where we rely on legitimate interests, we have balanced those interests against your interests, rights and freedoms. You can obtain information about that balancing test by contacting us, and you may object to such processing at any time (see section 12).

6. How the operator uses data

As controller, the Operator decides at its own discretion how the personal data collected through the Website is organised, stored, analysed, combined and used, which tools and service providers are engaged for that purpose, and how long data is kept within the limits set out in section 10 — always within the purposes and legal bases described in section 5 and in compliance with applicable data protection law.

In particular, the Operator may, without further notice to you:

combine usage data from several visits made from the same browser to understand how visitors use the Website over time;
aggregate, analyse and create statistics and reports from the data, including per page, product, car, brand, country, device, browser and marketing channel;
use the data to improve the Website, its content, its catalogue, its search results and its presentation;
anonymise or pseudonymise the data; data that has been anonymised so that it no longer relates to an identifiable person is not personal data and may be used for any purpose and kept indefinitely;
engage processors (such as hosting and infrastructure providers) to process data on its behalf, bound by a contract under Article 28 GDPR;
further process data for a purpose other than the one it was collected for, where the new purpose is compatible with the original one in accordance with Article 6(4) GDPR.

We will not use your personal data for a new purpose that is not compatible with the purposes above without first informing you and, where required, obtaining your consent. We do not sell personal data, and we do not use it to build advertising profiles for third parties.

7. Cookies and similar technologies

Cookies are small text files stored on your device by your browser. The Website uses only first-party cookies set by our own domain. We do not use third-party advertising or tracking cookies.

Cookie	Purpose	Type	Duration
`connect.sid`	Keeps the contents of your cart once you add an item; keeps an administrator signed in	Strictly necessary	30 days, renewed on each visit
`cp_currency`	Remembers your chosen display currency (USD or EUR)	Functional	1 year
`cp_sid`	Identifies a single visit, so page views within it can be grouped together for analytics	Analytics	30 minutes, renewed on each page view
`cp_vid`	Identifies your browser across visits, so a returning visitor can be distinguished from a new one	Analytics	1 year
`cp_utm`	Remembers the marketing campaign you arrived from	Analytics	30 days

Strictly necessary cookies are exempt from consent under Article 5(3) of the ePrivacy Directive. Where the law applicable to you requires consent for the other cookies, we set them only on the basis of that consent, which you can withdraw at any time. You can also block or delete cookies through your browser settings; if you block strictly necessary cookies, the cart will not work.

8. Recipients of personal data

Within the Operator, access to personal data is limited to the people who need it for the purposes above. Personal data may be disclosed to the following categories of recipients:

Hosting, infrastructure and IT service providers that host the Website and its database and act as our processors under Article 28 GDPR.
WhatsApp Ireland Limited / Meta Platforms and Telegram Messenger Inc., if you choose to contact us through those services. They process your data as independent controllers under their own terms and privacy policies.
Logistics, delivery, installation and payment partners, to the extent necessary to perform a purchase you make.
Professional advisers (lawyers, accountants, auditors) bound by confidentiality.
Public authorities, courts and law enforcement, where we are legally required to disclose data or where disclosure is necessary to establish, exercise or defend legal claims.
A successor or acquirer, in the event of a merger, acquisition, restructuring or sale of all or part of the Website or the Operator's business, subject to this policy.

9. International data transfers

Some of the recipients above may be located, or process data, outside the European Economic Area, including in countries whose laws do not provide the same level of protection as the GDPR. Where personal data is transferred outside the EEA, we ensure that the transfer is covered by an adequacy decision of the European Commission (Article 45 GDPR, including the EU–U.S. Data Privacy Framework for certified recipients), by Standard Contractual Clauses adopted by the European Commission (Article 46(2)(c) GDPR), or by another safeguard or derogation permitted under Chapter V GDPR, such as the transfer being necessary to perform a contract with you (Article 49(1)(b) GDPR). You can request a copy of the relevant safeguards by contacting us.

10. How long we keep data

We keep personal data only for as long as necessary for the purposes it was collected for:

Analytics data (visits, page views, clicks, searches, device and technical data, identifiers): up to 26 months from collection, after which it is deleted or anonymised.
Server security logs: up to 90 days, unless needed longer to investigate an incident.
Cart and session data: until the session expires (30 days after your last visit).
Communication data: for as long as needed to handle your enquiry, and up to 3 years afterwards to answer follow-up questions and defend legal claims.
Transaction data: for the period required by applicable commercial and tax law (typically 6 to 10 years).

Where a retention period ends but a legal obligation or a pending legal claim requires further storage, we restrict the processing of that data to that purpose.

11. Security

We implement appropriate technical and organisational measures under Article 32 GDPR to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These include encrypted connections (HTTPS), restricted and password-protected administrative access, HTTP-only cookies, security headers and a content security policy, and limiting access to those who need it. No transmission over the internet is completely secure, however, and we cannot guarantee absolute security. Where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required, you, in accordance with Articles 33 and 34 GDPR.

12. Your rights

Under the GDPR you have the following rights, subject to the conditions set out in the law:

Right of access (Art. 15) — to obtain confirmation of whether we process your personal data and a copy of it.
Right to rectification (Art. 16) — to have inaccurate data corrected or incomplete data completed.
Right to erasure (Art. 17) — to have your data deleted, for example where it is no longer needed or you withdraw your consent.
Right to restriction of processing (Art. 18).
Right to data portability (Art. 20) — to receive data you provided to us in a structured, commonly used, machine-readable format.
Right to object (Art. 21) — to object at any time, on grounds relating to your particular situation, to processing based on legitimate interests. Where we process data for direct marketing, you may object at any time without giving reasons.
Right to withdraw consent (Art. 7(3)) — at any time, without affecting the lawfulness of processing carried out before the withdrawal.
Right to lodge a complaint (Art. 77) with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement. A list of EU supervisory authorities is available from the European Data Protection Board.

To exercise any of these rights, contact us at info@cte.ooo. Because analytics data is linked to a random cookie identifier rather than to your name, we may ask you to provide that identifier or other information so we can find your data and verify that the request comes from you. We will respond without undue delay and in any event within one month, which may be extended by two further months where necessary given the complexity and number of requests. Exercising your rights is free of charge, unless requests are manifestly unfounded or excessive.

13. Automated decision-making

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR.

14. Children

The Website is not directed at children under the age of 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us and we will delete it.

15. Third-party websites and services

The Website contains links to third-party websites and services, including WhatsApp and Telegram. We are not responsible for the privacy practices of those third parties. Once you leave the Website, their own privacy policies apply, and we recommend reading them.

16. Changes to this policy

We may update this policy from time to time to reflect changes in the law, in our processing activities or in the Website. The current version is always available on this page, with its effective date shown at the top. Where changes are material, we will draw attention to them on the Website and, where required by law, ask for your consent.

17. Contact

For any questions about this policy or about how we process your personal data, or to exercise your rights, please contact:

CTE
E-mail: info@cte.ooo

18. Credits

The 3D car on the home page is based on “Free Lamborghini Revuelto” by ALIEEEN, licensed under CC BY 4.0. It has been modified: badges removed, materials adjusted and the model compressed for the web.

Lamborghini and Revuelto are trademarks of their respective owner. The Website is not affiliated with or endorsed by any car manufacturer; brand and model names are used only to describe the cars and parts offered.