This policy explains what personal data Hoku Racing MB collects when you use hokuracing.com, why we collect it, who we share it with and what rights you have. It is written to meet Articles 13 and 14 of the EU General Data Protection Regulation (GDPR).
1. Who we are
The controller of your personal data is:
- Hoku Racing MB
- Company code 306205367
- VAT code LT100015806217
- Kaunas, Lithuania
- Email: info@hokuracing.com
- Phone: +370 644 62322
We have not appointed a Data Protection Officer, as we are not required to. Data protection questions go to the email address above.
2. What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Name, email, phone, delivery and billing address, company name and VAT code for business buyers | To take and fulfil your order, issue the invoice, arrange delivery and handle returns | Performance of a contract (Art. 6(1)(b)); legal obligation for accounting records (Art. 6(1)(c)) |
| Vehicle make, model, year and modification you enter in the fitment finder | To show wheels that fit your car and to check fitment before we ship | Performance of a contract, and our legitimate interest in preventing wrong-fitment returns (Art. 6(1)(f)) |
| Order history, invoices, payment status | Accounting, warranty handling, dispute resolution | Legal obligation; legitimate interest |
| Account email and password (hashed, never stored in readable form) | To let you sign in, see your orders and keep a wishlist | Performance of a contract |
| Messages you send through the contact form | To answer you | Legitimate interest in responding to enquiries |
| Newsletter email address | To send product and restock news | Consent (Art. 6(1)(a)) — withdrawable at any time |
| Analytics data: pages viewed, approximate location from a truncated IP, referring site, device and browser type | To understand which pages are used and where visitors come from, so we know what to improve | Consent (Art. 6(1)(a)) — collected only if you allow it in the cookie banner, and withdrawable at any time |
| Advertising data: pages and products viewed, passed to Meta with an identifier for your browser | To measure whether our Facebook and Instagram advertising works, and to show our ads to people who looked at our wheels | Consent (Art. 6(1)(a)) — a separate switch from analytics, off unless you turn it on, withdrawable at any time |
| IP address and server log entries | Security, fraud prevention, diagnosing faults | Legitimate interest in keeping the shop working and secure |
We do not collect special category data, we do not profile you automatically in a way that has legal effects, and we do not sell your data to anyone.
3. Card details
We never see or store your full card number. Card data is entered on the payment provider's own hosted page and stays with them. We receive only the payment result, the last digits and the payer's email.
4. Who we share data with
We share only what each recipient needs to do its job:
- Stripe Payments Europe, Ltd. (Ireland) — card payments and Klarna instalments.
- PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) — PayPal payments.
- DPD and UPS — delivery. They receive your name, address and phone so the parcel can be handed over.
- Google Ireland Limited — Google Workspace, which hosts our email. Correspondence with us passes through it. Separately, Google Analytics 4, but only for visitors who allowed analytics cookies; nothing is sent to it otherwise.
- Hetzner Online GmbH — hosting. Our server is in Helsinki, Finland; data stays in the EU.
- eBay — only if you bought from us through eBay, in which case the order data comes to us from them.
- Meta Platforms Ireland Limited — the Meta Pixel, but only for visitors who switched marketing on. Meta is a controller in its own right for what the pixel sends, not merely our processor.
- Our accountant, and public authorities where the law requires it.
All of these act as processors under written terms, or as independent controllers for their own regulated activity (payment providers).
5. Transfers outside the EU
Our hosting, email and payment processing are handled inside the European Economic Area. Where a provider's group companies process data outside the EEA, they do so under the European Commission's Standard Contractual Clauses.
Two exceptions are worth naming plainly. First, our pages load typefaces from Google Fonts, which means your browser contacts a Google server and Google sees your IP address; this happens whatever your cookie choices are. A content blocker will stop it, and the site remains fully usable.
Second, if you switch marketing on, the Meta Pixel may transfer data to Meta in the United States under the EU–US Data Privacy Framework, and Meta may combine it with the profile it already holds if you have a Facebook or Instagram account. That is why it is a separate opt-in and why declining it changes nothing about browsing or buying.
6. Analytics and advertising, and how to say no
We use Google Analytics 4 to count visits and see which pages are read. It runs only if you allow it: until you press Allow, the Google Analytics script is not downloaded at all and no request reaches Google. Declining costs you nothing — every part of the shop works the same.
We have not enabled Google Signals, advertising features, or sharing with Google Ads. IP addresses are truncated before storage, and we do not attempt to identify individuals from analytics data.
The Meta Pixel works the same way and is a separate switch: nothing is downloaded and no request reaches Meta unless you turn marketing on. We do not require it to sell you anything.
You can change either answer at any time using Cookie settings at the bottom of any page. The full cookie list is in our Cookie Policy.
7. How long we keep it
- Orders, invoices and accounting records — 10 years from the end of the financial year, as Lithuanian accounting law requires.
- Account data — while your account exists. Ask us and we will delete it, except for the order records we must keep.
- Contact form messages — 2 years.
- Newsletter — until you unsubscribe.
- Analytics data — 14 months in Google Analytics, then deleted automatically.
- Advertising data — retained by Meta under its own policies; we hold no copy.
- Server logs — up to 8 weeks.
8. Your rights
You can ask us to: give you a copy of your data; correct it; delete it; restrict how we use it; transfer it to another provider; or stop processing based on legitimate interest. Where we rely on consent, you can withdraw it at any time — that does not affect what we did before you withdrew it.
Write to info@hokuracing.com. We answer within one month. There is no charge unless a request is excessive or repetitive.
If you are not satisfied with how we handled it, you may complain to the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, L. Sapiegos g. 17, Vilnius, vdai.lrv.lt) or to the supervisory authority in your own country of residence.
9. Is providing data required?
For an order, yes — without a name, address and contact details we cannot ship anything or issue a valid invoice. The newsletter and your vehicle details in the fitment finder are voluntary.
10. Changes
If we change this policy we update the date shown at the top of the page. Material changes affecting existing customers will also be sent by email.