Developed and installed in Germany — shipping DE / AT / CH in 2–3 business days

Custom Tesla
DE EN

Privacy Policy

Controller

The controller responsible for the processing of personal data on this website is:

Custom Tesla UG (haftungsbeschränkt)
Neudorfer Str. 1
79541 Lörrach
Germany
Phone: +49 7621 586734‑0
Email: hello@custom-tesla.com

We have not appointed a data protection officer, as the requirements under Section 38 of the German Federal Data Protection Act (BDSG) do not apply to us.

Purposes and Legal Bases

We process personal data to process orders and respond to inquiries (Art. 6(1)(b) GDPR), to comply with legal obligations — such as retention requirements under commercial and tax law (Art. 6(1)(c) GDPR), based on your consent where you have given one (Art. 6(1)(a) GDPR), and to ensure the secure operation of this website (Art. 6(1)(f) GDPR).

Visiting This Website

Each time you visit, our hosting provider processes access data: IP address, timestamp, address accessed, amount of data transferred, browser and operating system. This is technically necessary for delivery and serves to detect and prevent faults and attacks. This data is not merged with any other data.

The website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, on servers located in Germany. A data processing agreement is in place.

Cookies

We use only strictly necessary cookies: one for your session (so that your cart and language settings are retained), one to associate your cart over a 30-day period, and one to protect against form abuse. These do not require consent (Section 25(2) No. 2 of the German Telecommunications and Telemedia Data Protection Act, TDDDG). We do not use advertising or analytics cookies, and there is no consent banner, as there is nothing to consent to.

No Customer Account

You can order without registering. We create a record for your order so that we can process it and answer any questions about it — no password-protected account is created in the process.

Order and Contract Processing

To process an order, we process your email address, your name, your billing address and, if different, your delivery address, the items ordered, the amount, the payment method chosen and, for business customers, the VAT identification number. Without this information, we cannot fulfill the contract.

Customer Records

For orders, enquiries and commissioned work we keep a customer record with your contact details, addresses, vehicles and the history of our cooperation. It serves to handle your enquiries and orders (Art. 6(1)(b) GDPR) and allows us to follow our customer relationship (Art. 6(1)(f) GDPR). The data is stored on servers in Germany.

Who We Share Data With

We only share what is necessary for the respective purpose. The following recipients are involved:

  • Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands — payment processing. The amount, currency and order number are transmitted; you enter your payment details directly with Mollie, and we never see them. Legal basis: Art. 6(1)(b) GDPR.

  • Haufe-Lexware GmbH & Co. KG, Freiburg, Germany — quotes, invoicing and accounting. Legal basis: Art. 6(1)(b) and (c) GDPR. A data processing agreement is in place.

  • DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn — shipping. Name, delivery address, company name if applicable and your phone number are transmitted so that the carrier can contact you if there is a problem with the delivery; for shipments outside the EU, customs information about the items and your email address for customs clearance are also transmitted. Legal basis: Art. 6(1)(b) GDPR. Beyond that, we only pass your email address on to DHL if you have consented to parcel notificationsat checkout; DHL will then inform you by email about the delivery time. Legal basis: Art. 6(1)(a) GDPR. Consent is voluntary and can be withdrawn at any time with effect for the future, for example by emailing us.

  • Mailgun Technologies (sent via servers within the European Union) — email delivery for order confirmations, returns and the newsletter. The recipient's address and the content of the message are transmitted. Open and click tracking is disabled. Legal basis: Art. 6(1)(b) or (a) GDPR, as applicable.

  • HeiGIT gGmbH (OpenRouteService), Heidelberg — calculation of distances and travel times to the place of work. Only the postal code, city and country are transmitted. Legal basis: Art. 6(1)(b) GDPR.

  • Microsoft Ireland Operations Limited, Dublin, Ireland — email and calendar (Microsoft 365). Legal basis: Art. 6(1)(b) or (f) GDPR. A data processing agreement is in place. Access from the USA cannot be ruled out; the transfer is based on the adequacy decision for the EU-US Data Privacy Framework or on Standard Contractual Clauses under Art. 46(2)(c) GDPR.

  • sipgate GmbH, Düsseldorf, Germany — telephony. We note who called us when and what it was about; calls are not recorded. Legal basis: Art. 6(1)(b) or (f) GDPR. A data processing agreement is in place.

  • European Commission — verification of the VAT identification number via the VIES procedure for orders from business customers. The VAT identification number is transmitted. Legal basis: Art. 6(1)(c) GDPR.

  • Backups — a service provider in the USA stores our backups, encrypted so that it cannot read them. The transfer relies on Standard Contractual Clauses under Art. 46(2)(c) GDPR. Legal basis: Art. 6(1)(f) GDPR.

Artificial Intelligence

We use AI language models for drafting replies and quotes, for scheduling, for converting voice messages into text and for translations. They decide nothing: an employee reviews every draft and sends it personally. The models are operated by service providers in the EU and the USA as processors; they may neither use the data for training nor store it permanently. Transfers to the USA are covered by Standard Contractual Clauses under Art. 46(2)(c) GDPR. Legal basis: Art. 6(1)(f) GDPR — we want to answer enquiries promptly and in your language — or Art. 6(1)(b) GDPR where an order is concerned.

Contact Form

If you contact us via the form, we process your name, email address, phone number if provided, and your message in order to respond to it (Art. 6(1)(b) or (f) GDPR).

Contact via WhatsApp and Email

We handle messages you send us via WhatsApp or email in our own system. We process your name, your phone number or email address, the content of the messages and any files you send in order to respond to your enquiry (Art. 6(1)(b) or (f) GDPR).

For WhatsApp we use the WhatsApp Business Platform of WhatsApp Ireland Limited, Dublin, Ireland. WhatsApp also processes messages on Meta servers in the USA. The transfer is based on the adequacy decision for the EU-US Data Privacy Framework. If you prefer not to use WhatsApp, you can also reach us by email or phone.

We send appointment confirmations and reminders via WhatsApp or email (Art. 6(1)(b) GDPR). Promotional messages, such as a request for a review, are only sent with your consent (Art. 6(1)(a) GDPR); you can withdraw it at any time, via WhatsApp for example by sending “Stop”.

Social Media

We maintain pages on Facebook and Instagram. We are jointly responsible with Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, for the processing of data on these platforms (Art. 26 GDPR). Meta provides us with anonymised statistics about our pages (Insights); we cannot identify individual visitors from them. Which data Meta processes is described in Meta's privacy policy. You can exercise your rights with us or directly with Meta. The legal basis for our part is Art. 6(1)(f) GDPR: we want to be reachable where our customers are.

Newsletter

The newsletter is only sent with your consent (Art. 6(1)(a) GDPR). We use a double opt-in procedure: after signing up, we send you an email with a confirmation link; only after confirming are you added to the list. We log the sign-up and confirmation in order to be able to demonstrate consent.

You can unsubscribe at any time — via the link at the bottom of every newsletter email, or via the unsubscribe button that Gmail, Outlook and web.de display next to the sender.

We measure how many times a newsletter was opened in total and how many times a link was clicked in total — never on a per-person basis. The tracking addresses contain no reference to any recipient, no IP addresses are stored, and no cookies are set. There is no individual open rate here.

Withdrawal and Returns

If you exercise a right of withdrawal or notify us of a return, we process the order information required for this purpose, as well as the reason, if you provide one (Art. 6(1)(b) and (c) GDPR).

Installation Records

For installations, we document the condition and work performed using photos and, where applicable, videos, as well as the vehicle identification number. These records are not made public and are accessible only internally. They serve as proof of the service provided and to handle any later warranty questions (Art. 6(1)(b) and (f) GDPR).

Retention Period

We retain personal data only for as long as necessary for the respective purpose. Order and invoice data are subject to statutory retention periods of up to ten years (Section 147 of the German Fiscal Code (AO), Section 257 of the German Commercial Code (HGB)). Newsletter data is retained until you withdraw your consent, and proof of consent is retained beyond that to defend against potential claims. Incomplete orders and their associated shopping carts are automatically cleared after a short period. We keep customer data and our correspondence for as long as the customer relationship exists; at your request we delete them unless a statutory retention obligation prevents this.

Your Rights

You have the right to access the personal data we hold about you (Art. 15 GDPR), to have inaccurate data corrected (Art. 16 GDPR), to have data erased (Art. 17 GDPR), to restrict processing (Art. 18 GDPR), to data portability (Art. 20 GDPR), and to object to processing based on legitimate interests (Art. 21 GDPR).

If you have given consent to a particular processing activity, you may withdraw that consent at any time with effect for the future (Art. 7(3) GDPR). This does not affect the lawfulness of processing carried out prior to the withdrawal.

For any of these matters, please contact hello@custom-tesla.com.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart.

No Automated Decision-Making

We do not use automated decision-making, including profiling, as defined in Art. 22 GDPR.

Last Updated

This privacy policy describes the current state of the procedures we use. If anything changes, we will update it accordingly. Last updated: October 2026.