Privacy policy
Privacy Policy
How Batterijen.net (trading as Carplaylux) collects, uses, shares, and protects your personal data — including vehicle identification numbers (VINs) and vehicle photos submitted by WhatsApp or email — under the GDPR (Regulation (EU) 2016/679) and the national implementing laws of the thirteen EU countries we serve.
Introduction and Scope
This Privacy Policy applies to personal data collected through carplaylux.com, our related social channels, and any other means by which you contact us — including our contact form, telephone, email, and WhatsApp Business messaging — regardless of which of the thirteen EU countries you are located in (Belgium, Czech Republic, France, Germany, Hungary, Italy, Croatia, Netherlands, Austria, Portugal, Slovakia, Slovenia, and Spain).
This Policy should be read alongside our Legal Notice, our Cookie Policy, and our Terms of Service. Where this Policy and any of those documents conflict on a data protection matter, this Privacy Policy governs.
Data Controller and Contact Details
We are legally required to identify ourselves clearly as the entity responsible for your personal data. The following are our official identity and contact details for all data protection purposes.
| Data Controller | Batterijen.net, trading as Carplaylux |
| Dutch KVK Number Chamber of Commerce Registration |
82259844 |
| VAT / BTW Number | NL003661115B65 |
| Registered Address | Oosterdiep 19 3313 TE Dordrecht The Netherlands |
| Privacy Contact Email | info@carplaylux.com |
| Customer Support Phone | +31 640 242 654 |
| Data Rights Requests | carplaylux.com/nl-nl/pages/privacy-opt-out-request-form |
| Data Protection Officer | We have not appointed a statutory Data Protection Officer under Article 37 GDPR, as our processing activities do not meet the mandatory-appointment thresholds (no large-scale systematic monitoring and no large-scale processing of special category data). All privacy enquiries and rights requests are handled by our team at the Privacy Contact Email above. |
Batterijen.net is the sole data controller for personal data processed through carplaylux.com. Where we use third-party processors (Section 7), those processors act only on our documented instructions and are contractually bound to GDPR-standard data processing terms.
Categories of Personal Data We Collect
We collect only the personal data reasonably necessary to sell and ship vehicle-specific automotive products, verify compatibility, process payments, and provide customer support. The table below sets out every category of personal data we collect and typical examples within each category.
| Identity & Contact Data | Full name, billing and shipping address, email address, telephone number |
| Payment Data | Payment method type, transaction reference numbers, billing address. We do not store full card numbers — these are handled directly by our payment processors (Section 7). |
| Vehicle & Compatibility Data | Vehicle Identification Number (VIN), vehicle make, model, and year, and photos of your vehicle or dashboard submitted for fitment verification |
| Order & Transaction History | Products purchased, order dates and values, order status, returns and warranty claims |
| Technical Data | IP address, browser type and version, device type, operating system, referring URLs, cookie and similar tracking identifiers |
| Communications Data | The content of messages you send us via our contact form, email, telephone, or WhatsApp Business — including any attachments such as photos |
| Marketing Preferences | Newsletter subscription status, marketing consent records, and communication preferences |
Purposes of Processing and Legal Basis
GDPR requires us to identify a specific legal basis for every purpose we process your personal data for. The table below sets out each processing purpose, the data categories involved, and the applicable legal basis under Article 6 GDPR.
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Processing and fulfilling your order | Identity & contact, payment, order data | Contract performance — Art. 6(1)(b) GDPR |
| Verifying vehicle compatibility (VIN & photos) before dispatch | Vehicle & compatibility data | Contract performance — Art. 6(1)(b); Legitimate interest in preventing incorrect shipments — Art. 6(1)(f) |
| Invoicing and statutory bookkeeping | Identity & contact, payment, order data | Legal obligation — Art. 6(1)(c) (Dutch tax law) |
| Customer support, complaints, and returns handling | Identity & contact, communications, order data | Contract performance — Art. 6(1)(b); Legitimate interest — Art. 6(1)(f) |
| Fraud prevention and payment security | Payment data, technical data | Legitimate interest — Art. 6(1)(f); Legal obligation under payment-scheme rules — Art. 6(1)(c) |
| Sending marketing emails and newsletters | Identity & contact, marketing preferences | Consent — Art. 6(1)(a) |
| Essential website functionality (cart, checkout, security cookies) | Technical data | Legitimate interest — Art. 6(1)(f) |
| Website analytics and performance measurement | Technical data | Consent — Art. 6(1)(a) |
| Interest-based advertising and retargeting (Google Ads, Meta Pixel) | Technical data | Consent — Art. 6(1)(a) |
| Responding to supervisory authorities and legal requests | Any category as required | Legal obligation — Art. 6(1)(c) |
VIN Numbers and Vehicle Photos Sent via WhatsApp or Email
Why we ask for it. Because our products are vehicle-specific, our team confirms your Vehicle Identification Number (VIN), make, model, and year — and, where helpful, a photo of your dashboard, headlight housing, or existing wiring — before releasing your order for fulfilment. This prevents you from receiving an incompatible part.
How you can send it. You may submit your VIN and vehicle photos through our WhatsApp Business number, by email to info@carplaylux.com, through our Contact page, or by uploading it during checkout where that option is offered. Providing this information is voluntary but may be required for us to confirm fitment and process your order.
Legal basis. We process your VIN and vehicle photos on the basis of contract performance (Article 6(1)(b) GDPR) and, where verification prevents a costly incorrect shipment, our legitimate interest (Article 6(1)(f) GDPR) in reducing returns and mis-shipments for both parties.
Retention. VINs and vehicle photos submitted for compatibility verification are retained for up to 24 months after your order is completed, to support any warranty claim, return, or compatibility dispute relating to that order. After this period, the images and VIN are permanently deleted from our systems unless a longer retention period is required to resolve an active dispute, respond to a legal claim, or comply with a statutory retention obligation (see Section 9).
Important to Know
- WhatsApp messages, including any photos you send, are stored on WhatsApp/Meta infrastructure as well as our own systems (see Section 8 on international transfers).
- We do not use vehicle photos for any purpose other than fitment verification, order support, and dispute resolution.
- A VIN alone does not identify you personally, but combined with your order it is treated as personal data under GDPR.
- You can ask us to delete a submitted photo or VIN at any time once your order is complete, using the contact details in Section 2.
Cookies and Tracking Technologies
Our website uses cookies and similar tracking technologies to operate the storefront, remember your preferences, measure site performance, and — where you consent — show you relevant advertising. This includes cookies placed by Shopify (essential), Google Analytics and Google Ads (analytics and advertising), and the Meta Pixel (advertising).
Non-essential cookies (analytics and advertising) are only set with your consent, collected through our cookie consent banner, and you can withdraw that consent at any time.
For a full list of the specific cookies we use, their duration, and how to manage your preferences, please see our dedicated Cookie Policy, which forms part of this Privacy Policy.
Who We Share Your Data With
We share personal data only with the categories of recipients below, and only to the extent necessary for the purpose stated. Each recipient acts either as an independent data controller for its own processing (for example, a payment processor's fraud-screening) or as our data processor acting on our instructions.
| Shopify, Inc. 151 O'Connor Street, Ottawa, Ontario K2P 2L8, Canada |
E-commerce platform, hosting, checkout, order management |
| Payment processors: Shopify Payments, PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg), Klarna Bank AB (publ) (Sweden), and the relevant card networks (Visa, Mastercard, American Express, Maestro, UnionPay) | Processing card payments, PayPal, and Klarna Buy-Now-Pay-Later transactions |
| Shipping carriers: DHL and UPS | Delivering your order and providing tracking information |
| WhatsApp Ireland Limited / Meta Platforms Ireland Limited | WhatsApp Business messaging used for VIN and vehicle-photo verification and customer support |
| Our email service provider | Sending transactional emails (order confirmations, shipping updates) and, with your consent, marketing newsletters |
| Google Ireland Limited | Google Analytics (site performance measurement) and Google Ads (advertising), both subject to your cookie consent |
| Meta Platforms Ireland Limited | Meta Pixel — interest-based advertising and retargeting on Facebook/Instagram, subject to your cookie consent |
| Professional advisors, tax authorities, and law enforcement | Only where necessary to comply with a legal obligation, exercise or defend legal claims, or as required by the Dutch tax authorities |
We do not sell your personal data to third parties, and we do not share your VIN, vehicle photos, or payment details with any recipient other than those listed above and any recipient you separately authorise.
International Data Transfers Outside the EU/EEA
Most of your personal data is processed within the European Union or European Economic Area. However, some of the processors listed in Section 7 are based outside the EU/EEA, or transfer data to group entities or servers located outside the EU/EEA (notably in the United States and Canada).
Where this occurs, we rely on one or more of the following safeguards recognised under Chapter V of the GDPR:
- Adequacy decisions — for transfers to countries the European Commission has recognised as providing an adequate level of data protection (for example, commercial organisations in Canada covered by PIPEDA, relevant to Shopify, Inc.).
- EU-U.S. Data Privacy Framework — for transfers to U.S. recipients certified under the Framework (relevant to certain Google and Meta group entities).
- Standard Contractual Clauses (SCCs) — the European Commission's approved contractual safeguards, used as a fallback or supplementary measure wherever an adequacy decision or certification does not fully cover a transfer.
You can request more information about the specific safeguard applied to a given transfer by contacting us using the details in Section 2.
Where Your Data May Travel
Canada — Shopify, Inc. platform infrastructure
United States — Google Ads/Analytics and Meta/WhatsApp servers (via their EU entities, subject to the safeguards above)
Payment processing, shipping, and order fulfilment data remain principally within the EU/EEA.
Data Retention Periods
We keep personal data only for as long as necessary for the purpose it was collected, or as required by law. The table below sets out our standard retention periods by data category.
| Order & Invoice Records | 7 years from the invoice date Dutch statutory bookkeeping obligation (Algemene wet inzake rijksbelastingen) |
| VIN & Vehicle Photos | Up to 24 months after order completion Warranty, returns, and compatibility-dispute support (Section 5) |
| Account Data | For as long as your account remains active, plus applicable legal minimums after closure Contract performance and legal obligation |
| Marketing Consent & Contact Data | Until you withdraw consent; suppression records are retained indefinitely to honour your opt-out Consent management |
| Customer Support Correspondence | 3 years from your last contact with us Legitimate interest in resolving and evidencing support history |
| Website Analytics & Cookie Data | As set out in our Cookie Policy (typically 13–26 months depending on the cookie) Consent |
| Payment Transaction Data | Retained by our payment processors per their own retention schedules; we retain only transaction references Legal obligation / contract performance |
Profiling and Automated Decision-Making
Ad retargeting. Where you consent to advertising cookies, we (through Google Ads and the Meta Pixel) use your browsing behaviour to build interest-based profiles for the purpose of showing you relevant advertising for our products on other websites and platforms, including remarketing to visitors who viewed a product but did not complete a purchase.
No solely-automated decisions with legal effect. Carplaylux does not use fully automated decision-making that produces legal or similarly significant effects concerning you (for example, we do not automatically decline or approve orders using an algorithm alone). Every order and support request is reviewed by a member of our team.
Third-party BNPL assessments. If you choose Klarna Buy-Now-Pay-Later at checkout, Klarna independently carries out its own automated affordability and fraud checks as a separate data controller for that purpose. This is governed by Klarna's own privacy policy, not by Carplaylux.
Your Data Protection Rights
Under the GDPR, you have the following rights in relation to your personal data. Some rights, such as erasure, may be limited where we have a legal obligation to retain certain records.
Right of Access
Request a copy of the personal data we hold about you.
Right to Rectification
Ask us to correct inaccurate or incomplete personal data.
Right to Erasure
Ask us to delete your personal data, subject to legal retention requirements such as invoice records (Section 9).
Right to Restriction
Ask us to pause specific processing while a related dispute is resolved.
Right to Data Portability
Receive your data in a structured, commonly-used, machine-readable format.
Right to Object
Object to processing based on legitimate interest, including direct marketing at any time.
Right to Withdraw Consent
Withdraw any consent you previously gave, at any time, without affecting past lawful processing.
Right to Lodge a Complaint
Complain to a data protection supervisory authority (Section 12) if you believe our processing infringes the GDPR.
How to exercise these rights. The quickest way is our Privacy Opt-Out & Data Rights Request page, where you can select the right you wish to exercise. You can also email us directly at info@carplaylux.com or call +31 640 242 654
We may ask you to verify your identity before completing certain requests. We respond within one month of verification, extendable by a further two months for complex requests, as permitted under the GDPR. Most requests are handled free of charge.
Supervisory Authorities
As our registered home authority, the Dutch Autoriteit Persoonsgegevens (AP) has primary regulatory oversight of Batterijen.net. However, you always have the right to lodge a complaint with the supervisory authority in your own country of habitual residence, place of work, or place of the alleged infringement — whichever is most convenient for you. The table below lists the authority for each of the thirteen countries we serve.
| Netherlands | Autoriteit Persoonsgegevens (AP) — our lead authority | autoriteitpersoonsgegevens.nl |
| Belgium | Gegevensbeschermingsautoriteit (APD/GBA) | gegevensbeschermingsautoriteit.be |
| Czech Republic | Úřad pro ochranu osobních údajů (ÚOOÚ) | uoou.cz |
| France | Commission Nationale de l'Informatique et des Libertés (CNIL) | cnil.fr |
| Germany | Your regional Landesdatenschutzbehörde, or the BfDI for federal matters | bfdi.bund.de |
| Hungary | Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) | naih.hu |
| Italy | Garante per la protezione dei dati personali | garanteprivacy.it |
| Croatia | Agencija za zaštitu osobnih podataka (AZOP) | azop.hr |
| Austria | Datenschutzbehörde | dsb.gv.at |
| Portugal | Comissão Nacional de Proteção de Dados (CNPD) | cnpd.pt |
| Slovakia | Úrad na ochranu osobných údajov Slovenskej republiky | dataprotection.gov.sk |
| Slovenia | Informacijski pooblaščenec | ip-rs.si |
| Spain | Agencia Española de Protección de Datos (AEPD) | aepd.es |
Children's Privacy
Our website and products are intended for adults. Carplaylux does not knowingly collect personal data from anyone under the age of 16. Our storefront is not directed at children, and purchasing a vehicle-modification product requires the legal capacity to enter into a contract.
If you believe a child under 16 has provided us with personal data, please contact us at info@carplaylux.com and we will take steps to delete that data promptly.
Data Security
We use technical and organisational measures appropriate to the risk to protect your personal data, including encrypted (TLS) connections across our storefront, PCI DSS-compliant payment processing handled by Shopify's checkout, restricted internal access to personal data on a need-to-know basis, and contractual data-processing obligations imposed on every processor in Section 7.
No method of transmission or storage is completely secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Dutch Autoriteit Persoonsgegevens and affected individuals in accordance with Articles 33 and 34 GDPR.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in applicable law, our business operations, or the third-party processors we use. We will not reduce your rights under this Policy without your consent where required by law.
Material changes. Where a change materially affects your rights — for example, a new category of data we collect or a new third-party recipient — we will notify registered customers by email at least 14 days before the change takes effect.
Current version. The version published at carplaylux.com/nl-nl/policies/privacy-policy is the version effective at the time of your visit.
Current Effective Date
24 August 2026
Reviewed at least annually and whenever there is a relevant change in law or business operations.
Batterijen.net · KVK 82259844
VAT NL003661115B65
Questions About Your Personal Data?
Our team responds to every privacy enquiry within 1 business day, Monday to Friday, 09:00–17:00 CET. You can also use our dedicated data rights request page to exercise any of your GDPR rights.
Last Updated & Effective: 24 August 2026 · This Privacy Policy applies to all personal data processed in connection with carplaylux.com and our related communication channels.
Carplaylux is the trading name of Batterijen.net · KVK 82259844 · VAT NL003661115B65 · Oosterdiep 19, 3313 TE Dordrecht, The Netherlands.