Privacy Policy

1. Controller

Email: contact@elitecarsng.com
Support: support@elitecarsng.com

2. Hosting through OpenAI / ChatGPT Sites

This website is hosted through ChatGPT Sites / OpenAI Sites. Technically necessary data may be processed to deliver the site, maintain security and operate the hosting infrastructure. This may include IP address, access time, requested page or file, browser and device information, referrer, transferred data volume and security or error logs.

The legal basis for necessary hosting and security processing is Article 6(1)(f) GDPR. Where processing is necessary for a contract or steps before entering a contract, Article 6(1)(b) GDPR may also apply. OpenAI may use subprocessors and process data outside the EEA subject to applicable safeguards.

More information: ChatGPT Sites Terms and Data Processing Addendum.

3. Email contact

If you contact EliteCarsNG by email, we process the information you provide, including your email address, name where provided, message and technical metadata needed to send and receive email. Communication is handled through Zoho Mail. More information is available in Zoho’s privacy policy.

The legal basis is Article 6(1)(b) GDPR for purchases, support and pre-contractual steps; otherwise Article 6(1)(f) GDPR applies. Data is retained as long as necessary for the inquiry, statutory retention duties or legal claims.

4. Purchases through Gumroad

This website links to Gumroad, the external merchant of record, for checkout, payment, applicable tax handling and digital delivery. After leaving this website, Gumroad’s terms, privacy policy and checkout rules apply. EliteCarsNG may receive order data needed for fulfilment, support, fraud prevention, accounting and legal obligations.

5. Forms, Brevo, Formspree and abuse prevention

Free-pack and creator-email registrations are processed through Brevo after double opt-in. We process the email address, signup source, lead magnet and consent record to send the requested download and occasional ECNG creator emails. The legal basis is Article 6(1)(a) GDPR. Consent can be withdrawn at any time through the unsubscribe link in every marketing email. ECNG does not sell or rent this mailing list and does not disclose it to third parties for their own advertising. More information: Brevo Privacy Policy.

Affiliate applications and website support requests are transmitted through Formspree. Depending on the form, we process contact details, channel and audience information, product or order context, BeamNG version, message content and consent records. During the technical transition, free-pack requests may also be received through Formspree for manual fulfilment. Affiliate and support processing is based on Article 6(1)(b) GDPR where it concerns a contract or pre-contractual steps; otherwise Article 6(1)(f) GDPR applies. More information: Formspree Privacy Policy.

Public forms are protected against automated abuse through Cloudflare Turnstile and server-side rate limiting. Turnstile may process technical connection, browser and interaction data to distinguish legitimate submissions from automated traffic. It is used only for security and form availability on the basis of Article 6(1)(f) GDPR and, where access to the device is technically necessary, Section 25(2) No. 2 TDDDG. More information: Cloudflare Privacy Policy.

6. YouTube and TikTok video embeds

Product and social pages may contain local previews for YouTube Shorts or TikTok videos. No external video player is loaded when the page first opens. Only after you actively press play is the selected player requested from YouTube’s privacy-enhanced domain or TikTok. The respective provider may then receive technical data such as your IP address, browser and device information, the page containing the player and your interaction with the video. Its own privacy rules apply to that connection.

The selected player is loaded only at your request to provide the video under Article 6(1)(f) GDPR and, where storage or access on your device requires it, Section 25(2) No. 2 TDDDG. The original post remains available on the relevant platform.

7. Social media links

This site contains ordinary links to YouTube, TikTok and Facebook. No social feed is loaded automatically. When you follow a link, the respective platform processes data under its own privacy policy.

8. Cookies, local settings, consent and Google Analytics

The selected light or dark appearance and the analytics decision are stored locally on your device so the site can remember those settings. This strictly necessary local storage is used under Section 25(2) No. 2 TDDDG.

ChatGPT Sites records basic traffic metrics for deployed sites. With your consent, this website also uses Google Analytics 4 to understand page visits and interactions such as product views, Gumroad outbound clicks, social or video actions and form completions. Analytics is disabled by default and its external script is not loaded until you select “Accept analytics”. Advertising storage, Google Signals and personalised advertising remain disabled.

If accepted, Google Analytics may set first-party cookies including _ga and _ga_*. Campaign parameters such as UTM source, medium, campaign and content, the landing path and initial referrer may be retained in session storage for attribution during the current browser session. The configured analytics cookie lifetime is up to twelve months. Your consent choice is stored locally for up to six months. Analytics processing is based on Article 6(1)(a) GDPR and Section 25(1) TDDDG. More information: Google Privacy Policy.

You can withdraw or change your decision at any time using “Privacy settings” in the footer. Rejecting analytics does not prevent use of the shop. This site does not use advertising pixels, remarketing tags or user accounts, and it does not report a purchase unless an external checkout system supplies that information.

9. Recipients and international transfers

Where necessary, data may be processed by OpenAI / ChatGPT Sites and subprocessors, Brevo for double-opt-in email delivery, Cloudflare for form abuse protection, Google Ireland Limited for consented Analytics and selected YouTube playback, TikTok for selected video playback, Formspree for forms, Zoho Mail, Gumroad, professional advisers and public authorities where legally required. Some providers may process data outside the EEA under applicable transfer safeguards.

10. Retention and your rights

Personal data is retained only as long as necessary for the relevant purpose, security, statutory retention duties or legal claims. Subject to legal requirements, you have rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent. You may also lodge a complaint with a supervisory authority. As the business is operated from Hesse, the competent authority is the Hessian Commissioner for Data Protection and Freedom of Information (HBDI), Wilhelmstraße 7, 65185 Wiesbaden, Germany.

11. Changes

This policy may be updated when the website, providers, legal requirements or processing activities change.