Get 10% OFF Your First Build
Privacy policy
Effective date: 28 April 2026 Last updated: 28 April 2026
This Privacy Policy describes how DSTurbo Dawid Sowa, trading as PTT Performance Turbo Technology, with its registered office at Cegielniana 4b, 44-200 Rybnik, Poland, tax identification number NIP 6423112413 (“we“, “us“, “our“, the “Controller“), collects, uses, stores, and shares your personal data when you visit, register at, or make a purchase through our website https://performanceturbo.eu (the “Site“), or otherwise interact with us.
We take your privacy seriously. This Policy is written in plain English; if you have any questions, contact us at contact@performanceturbo.eu.
1. Controller and contact
The data controller is:
DSTurbo Dawid Sowa Cegielniana 4b, 44-200 Rybnik, Poland NIP: 6423112413 | REGON: 360986953 Email: contact@performanceturbo.eu Phone: +48 515 336 528
We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 of the GDPR. Our privacy inbox contact@performanceturbo.eu is the single point of contact for all data-protection matters.
2. What personal data we collect
2.1. Information you give us
| Category | Examples | When |
|---|---|---|
| Identity & contact | First and last name, company name (B2B), billing address, shipping address, email, phone number | Account registration, checkout, contact form |
| Account credentials | Username, password (stored hashed), account preferences | Registration |
| Order data | Products ordered, quantities, prices, order history, invoices, vehicle information you provide for Built-to-Order turbos (make, model, engine code, VIN if you choose to share it, existing modifications) | Checkout, order processing |
| Payment data | Card type, last 4 digits, expiry (we do not store full card numbers — full card data is handled by Stripe) | Checkout |
| Communications | Content of emails, chat messages, call recordings (if we introduce calls), review text, warranty claims, photos/videos you send for warranty or technical support | When you contact us |
| Marketing preferences | Consent to email and (future) SMS marketing, language/region preferences | Newsletter sign-up, account settings |
2.2. Information we collect automatically
| Category | Examples | How |
|---|---|---|
| Device & browsing | IP address, approximate location (country/city level), device type, operating system, browser, screen resolution, language, referring URL, pages viewed, time on page, clickstream | Server logs, analytics cookies |
| Cookies & similar | See our Cookie Policy for a full list (session, preference, analytics, advertising, security) | Cookies, pixels, local storage |
| Tracking identifiers | Google Analytics client ID, Meta Pixel cookie ID, advertising IDs | GA4, Meta Pixel, other tags |
2.3. Information we receive from third parties
| Source | Data |
|---|---|
| Stripe | Transaction status, risk scores, fraud signals, chargeback notifications |
| Couriers (DPD, DHL, UPS, local Polish courier) | Delivery status, tracking events, returned-parcel notifications |
| Social media (Meta, Instagram, Facebook) | If you interact with our pages/ads: anonymised aggregate insights; if you contact us via Messenger: conversation content |
| Fraud-prevention services | Risk scoring, sanctions-list screening (legal obligation) |
We do not buy marketing lists, nor do we receive personal data from data brokers.
3. Why we use your data and the legal basis (GDPR Article 6)
| Purpose | Legal basis |
|---|---|
| Processing your Order, manufacturing Built-to-Order Products, shipping, providing after-sales service | Performance of a contract (Art. 6(1)(b) GDPR) |
| Processing payments, preventing fraud, managing chargebacks | Performance of a contract + Legitimate interest (Art. 6(1)(b) and (f)) |
| Issuing VAT invoices, keeping accounting records, tax reporting | Legal obligation (Art. 6(1)(c)) – Polish Accounting Act; retention up to 5 years from end of fiscal year |
| Responding to your inquiries and complaints | Performance of a contract or steps at your request (Art. 6(1)(b)) |
| Sending transactional emails (order confirmation, shipping updates, warranty registration) | Performance of a contract (Art. 6(1)(b)) |
| Sending marketing emails and (future) SMS | Your consent (Art. 6(1)(a)); also – for our existing customers – legitimate interest for very limited post-sale follow-ups under the “soft opt-in” rules where applicable, always with easy opt-out |
| Analytics and improving the Site (Google Analytics 4, Meta Pixel, heatmaps, etc.) | Your consent via our cookie banner |
| Personalised advertising (Meta/Google/other) | Your consent via our cookie banner |
| Security, preventing abuse, protecting our network | Legitimate interest (Art. 6(1)(f)) |
| Defending or exercising legal claims | Legitimate interest (Art. 6(1)(f)) |
| Complying with sanctions screening (to avoid shipping to sanctioned jurisdictions) | Legal obligation (Art. 6(1)(c)) |
You can withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. To withdraw consent, use the unsubscribe link in any marketing email, the cookie banner, the “do not sell/share” link, or email us at contact@performanceturbo.eu.
4. Who we share your data with
We share personal data only with categories of recipients listed below, only to the extent necessary, and only under written agreements containing the required safeguards.
4.1. Processors acting on our behalf
| Processor | Purpose | Location |
|---|---|---|
| HOSTING PROVIDER: home.pl | Website and email hosting | Poland |
| Stripe Payments Europe Ltd. (EU) / Stripe Inc. (global) | Payment processing, fraud prevention | Ireland / United States |
| Google Ireland Ltd. (Google Analytics 4, Google Ads, Google Merchant Center) | Analytics, advertising, product feed | Ireland / United States |
| Google Search Console | SEO diagnostics (only aggregated, non-personal data) | United States |
| Meta Platforms Ireland Ltd. (Meta Pixel, Facebook Ads, Instagram) | Advertising, audience measurement | Ireland / United States |
| [EMAIL MARKETING PROVIDER – e.g., FluentCRM (self-hosted) / Klaviyo / Omnisend] | Newsletter sending, segmentation | [Poland / United States] |
| Accountancy firm and tax advisors | Bookkeeping, tax filing | Poland |
4.2. Couriers and logistics
DPD Polska, DHL Express, UPS, FedEx, and any courier selected by you at checkout. Shared data: recipient name, full shipping address, phone number, email (for tracking notifications), weight and dimensions of the parcel.
4.3. Public authorities
- Polish tax authorities (Krajowa Administracja Skarbowa)
- Customs authorities of destination countries (on the shipping label and customs declaration)
- Law-enforcement or regulatory authorities, only where compelled by a valid legal demand
4.4. Third parties in a business transaction
If we ever merge with, sell, or transfer any part of our business, personal data may be transferred to the acquiring party, subject to this Privacy Policy remaining in force.
4.5. What we do NOT do
- We do not sell your personal data.
- We do not share your personal data for cross-context behavioural advertising by third parties.
- We do not run third-party advertising or retargeting pixels on the Site (no Meta Pixel, no Google Ads, no TikTok Pixel, etc.).
- We do not engage in automated decision-making or profiling that produces legal effects or similarly significantly affects you.
5. International transfers
Some of our processors are located outside the European Economic Area (EEA), primarily in the United States.
Where we transfer your personal data outside the EEA, we rely on one of the following legal transfer mechanisms under the GDPR:
- Adequacy decision of the European Commission (e.g., transfers to the US under the EU-US Data Privacy Framework, where the recipient is certified);
- Standard Contractual Clauses (SCCs) adopted by the European Commission on 4 June 2021, combined with supplementary technical and organisational measures where appropriate;
- Your explicit consent, where consent is a valid basis under Article 49 GDPR (limited cases).
You can ask us for a copy of the safeguards that apply to a specific transfer by writing to contact@performanceturbo.eu.
6. How long we keep your data
| Data | Retention |
|---|---|
| Customer account data (registered users) | For the life of the account + up to 3 years after your last activity (or until you close the account), unless a longer legal retention applies |
| Order, invoice, and accounting data | 5 years from end of the fiscal year (Polish Accounting Act) |
| Warranty records | Warranty period + 2 years |
| Email marketing list | Until you unsubscribe (or 3 years of inactivity, whichever is earlier) |
| SMS marketing list (once launched) | Until you opt out |
| Complaint / reclamation records | 3 years after the complaint is closed |
| Website server logs | Up to 12 months |
| Analytics data (GA4) | Up to 14 months, then automatically deleted |
| Cookie consent logs | Up to 13 months |
| Chargeback / dispute evidence | Duration of dispute + 3 years |
After these periods, we securely delete or anonymise the data, except where longer retention is required by law.
7. Your rights – GDPR (EU/EEA), UK GDPR, and Swiss FADP
You have the following rights in respect of your personal data. We will respond within one month of your verified request (up to three months for complex requests, with explanation):
| Right | What it means |
|---|---|
| Access (Art. 15) | A copy of the personal data we hold about you |
| Rectification (Art. 16) | Correction of inaccurate or incomplete data |
| Erasure / “right to be forgotten” (Art. 17) | Deletion of data where a legal basis applies |
| Restriction (Art. 18) | Pause of processing in defined circumstances |
| Data portability (Art. 20) | Your data in a structured, machine-readable format, transferred to you or another controller |
| Objection (Art. 21) | Objection to processing based on legitimate interest or for direct marketing |
| Withdraw consent (Art. 7(3)) | Withdrawal of consent for processing based on consent |
| Not to be subject to solely automated decisions (Art. 22) | We don’t do this; if we ever do, you will have rights to human review |
| Lodge a complaint | With the Polish supervisory authority (Urząd Ochrony Danych Osobowych — UODO, ul. Stawki 2, 00-193 Warsaw, https://uodo.gov.pl) or with the authority in your habitual residence |
How to exercise: email contact@performanceturbo.eu. from the address associated with your account, or use the contact form on our Site. We may ask for proof of identity for security.
8. Your rights – California (CCPA / CPRA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA“).
8.1. Categories collected, sources, purposes, and disclosures
See sections 2, 3 and 4 of this Policy – these describe, for California purposes:
- the categories of personal information collected (Cal. Civ. Code §1798.100(a)(1));
- sources from which it is collected (§1798.100(a)(2));
- business and commercial purposes (§1798.100(a)(3));
- categories of third parties to whom personal information is disclosed (§1798.100(a)(4)).
8.2. Sale/sharing of personal information
We do not sell personal information for monetary consideration.
We do not share personal information for cross-context behavioural advertising (within the meaning of the CCPA). We do not run advertising pixels or third-party ad networks on the Site. The only third-party tools we use that touch visitor data are operational analytics (currently Microsoft Clarity, Google Analytics 4 planned), and these only after you give consent through our cookie banner; they are not used for ad targeting.
If we ever introduce sale/sharing in the future, we will (i) update this Policy, (ii) require fresh, granular consent through our banner, and (iii) provide a “Do Not Sell or Share My Personal Information” link in our footer. We will continue to honour the Global Privacy Control (GPC) signal as a valid opt-out signal at all times.
8.3. Your California rights
| Right | Details |
|---|---|
| Know what personal information we collect, use, disclose, and sell/share | Submit a request at contact@performanceturbo.eu |
| Delete personal information we hold | Same |
| Correct inaccurate personal information | Same |
| Opt out of sale/sharing | Footer link + GPC |
| Limit use of sensitive personal information | We do not use sensitive PI beyond what is strictly necessary to provide our services |
| Non-discrimination | We will not charge you different prices or deny service because you exercise your rights |
8.4. Authorised agents
You may designate an authorised agent to submit requests on your behalf. We will verify the agent’s authorisation via signed permission and confirm your identity directly.
9. Your rights – other jurisdictions
| Jurisdiction | Law | Summary |
|---|---|---|
| United Kingdom | UK GDPR & Data Protection Act 2018 | Same rights as EU GDPR. Supervisory authority: Information Commissioner’s Office (ICO), ico.org.uk |
| Canada | PIPEDA + provincial laws (e.g., Quebec Law 25) | Right to access, correct, withdraw consent. Complaints: Office of the Privacy Commissioner of Canada, priv.gc.ca |
| Brazil | LGPD | Rights of access, correction, portability, erasure, anonymisation, information on sharing. Authority: ANPD, gov.br/anpd |
| Japan | APPI | Right to disclosure, correction, suspension of use, deletion. |
| Australia | Privacy Act 1988 | Access and correction; complaints to OAIC, oaic.gov.au |
| Singapore | PDPA | Access and correction; withdrawal of consent. |
| South Korea | PIPA | Access, correction, deletion, suspension. |
Residents of these jurisdictions can exercise their rights by emailing contact@performanceturbo.eu.
10. Cookies and similar technologies
See our separate Cookie Policy for full details. In short, we use:
- Strictly necessary cookies (no consent needed) – session, cart, security
- Preference cookies (with consent) – language, currency
- Analytics cookies (with consent)- Microsoft Clarity (active); Google Analytics 4 (planned)
- Marketing/advertising cookies – none currently used
You manage your choices through the cookie banner on first visit and via the persistent “Cookie Preferences” link in our footer.
11. Security
We implement reasonable technical and organisational measures to protect personal data, including:
- HTTPS/TLS encryption for all Site traffic;
- hashed password storage;
- PCI-DSS-compliant payment processing via Stripe (we never see your full card number);
- role-based access controls and principle of least privilege;
- regular backups and software updates;
- secure development practices and vetted plugins/themes for our WordPress/WooCommerce stack;
- sanctions-list and fraud screening at checkout.
No system is 100% secure. If we become aware of a personal-data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay and in accordance with Article 34 GDPR (and similar obligations under other laws).
12. Children
The Site is not directed to children. We do not knowingly collect personal data from anyone under 16 years of age (or the applicable digital-consent age in your country, e.g., 13 in the US under COPPA). If you believe we may have inadvertently collected data from a child, please contact contact@performanceturbo.eu and we will delete it.
13. Profile, reviews, and user-generated content
If you post a review, comment, or other content on our Site (or on our social-media pages), the content – together with the username or name you provide – will be publicly visible. Do not include sensitive data in public content.
Reviews are governed by our Acceptable Use & Website Terms of Use and, where applicable, by Regulation (EU) 2019/2161 on consumer protection.
14. Links to third-party sites
Our Site may link to third-party websites (for example, social media, courier tracking pages, or informational content). Their privacy practices are governed by their own policies. We are not responsible for content or practices on third-party sites.
15. Changes to this Policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top indicates when the policy was last changed. If changes are material, we will notify you by email (if we have your email), via a banner on the Site, or through both. Continued use of the Site after the effective date constitutes acceptance of the updated Policy.
16. Contact & complaints
For any privacy question, request, or complaint:
Email: contact@performanceturbo.eu Post: DSTurbo Dawid Sowa, Cegielniana 4b, 44-200 Rybnik, Poland
If you are not satisfied with our response, you may lodge a complaint with:
- Poland: Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa – https://uodo.gov.pl
- Your local data-protection authority if you reside elsewhere.
Ready to talk about your turbo?
Rebuilds, hybrid upgrades, performance units - we're here to help.