Privacy policy

This translation is for information; the German version is binding.

Last updated: 29.10.2026

This privacy policy explains which personal data we process when you use our online shop at www.yamaha-online-shop.de, what we use it for and what rights you have.

1. Controller

Motorrad-Henkel, Inh. Tony Henkel
Hauptstraße 2c
98529 Suhl
Germany
Phone: +49 3681 720356
Fax: +49 3681 723258
Email: info@motorrad-henkel.de

2. Summary

  • We process your data mainly to handle orders, enquiries and your customer account.
  • We load statistics and marketing services (Google Analytics, Google Ads) as well as maps and videos only if you have consented in the cookie banner. You can change your choice at any time via the “Cookie settings” link at the bottom of every page.
  • We protect our forms against spam and abuse with Google reCAPTCHA. This is done without consent, based on our legitimate interest; you can object (section 12).
  • We load fonts from our own server, not from Google.

3. Legal bases, storage period, recipients and third countries

Legal bases. We process personal data on the basis of

  • your consent (Art. 6(1)(a) GDPR),
  • a contract with you or pre-contractual measures (Art. 6(1)(b) GDPR),
  • a legal obligation (Art. 6(1)(c) GDPR), or
  • our legitimate interests (Art. 6(1)(f) GDPR).

Storing information on your device and reading it is additionally governed by Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG). The sections below name the specific legal basis in each case.

Storage period. We delete personal data as soon as it is no longer needed for the respective purpose. Statutory retention obligations take precedence: we keep accounting records such as invoices for eight years, books and annual financial statements for ten years, and other tax-relevant documents and business letters for six years (Section 147(3) AO and, where applicable, Section 257 HGB). During that time we use the data only to meet these obligations.

Recipients. Some service providers process data on our behalf and according to our instructions (processors, Art. 28 GDPR). Others, such as payment and shipping providers, process data under their own responsibility. We name them in the respective sections.

Third countries. Some providers, in particular Google, Stripe and Mapbox, may transfer data to the USA. For companies certified under the EU-US Data Privacy Framework, an adequacy decision of the European Commission applies (Art. 45 GDPR, Implementing Decision (EU) 2023/1795). Otherwise the providers rely on EU standard contractual clauses (Art. 46(2)(c) GDPR).

4. Shop platform and hosting

Our online shop runs on the MotoStax shop platform, operated by

Momentax Development, Maximilian Heller
Zum Bahnhof 36
99331 Geratal
Germany

Momentax operates the shop on our behalf as a processor (Art. 28 GDPR).

The servers are provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, as a further processor. They are located in data centres in Nuremberg and Falkenstein (Germany). The encrypted backups and the server we use to monitor operations (Falkenstein) are located there as well.

5. Visiting the website and server log files

Each time you visit our website, the server automatically processes data transmitted by your browser:

  • IP address
  • date and time of access
  • requested address (URL) and host name
  • referrer URL (the page visited before)
  • browser and operating system
  • amount of data transferred and status code

Purpose: delivering the website, security and stability, defending against attacks, error analysis. We also analyse the logs on our monitoring server to detect faults.
Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is secure and fault-free operation.
Storage period: 30 days, after which the logs are deleted automatically.

The connection to our shop is encrypted throughout with TLS.

6. Cookies and similar technologies

We store information on your device (cookies and browser storage such as “localStorage”) or read it from there. Without your consent, we do so only where strictly necessary for the shop to provide the functions you request (Section 25(2) No. 2 TDDDG). Everything else is used only with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).

Necessary storage

Name Purpose Storage period
motostax.cart.sessionId, motostax.cart.discountCode (localStorage) cart and promotional code entered until you empty the cart or clear your browser data
motostax.customer.token (localStorage) login to the customer account until you log out
motostax.favorites (localStorage) wish list until you empty the wish list or clear your browser data
lang (localStorage), ms_lang (cookie) selected language ms_lang: 1 year
motostax.consent (localStorage) your choice in the cookie banner until you change your choice
__stripe_mid, __stripe_sid (Stripe cookies, checkout only) fraud prevention for payments 1 year and 30 minutes respectively

Services requiring consent

In the cookie banner you can allow the following categories individually:

  • Statistics: the shop's own statistics (section 13) and Google Analytics 4 (section 14)
  • Marketing: Google Ads (section 15)
  • External content: map view by Mapbox and YouTube videos (section 16)

Without your consent, these services are not loaded. You can withdraw or change your consent at any time with effect for the future via the “Cookie settings” link at the bottom of every page.

Proof of your consent

To be able to prove your consent (Art. 7(1) GDPR), we store for each decision: a random visitor ID, the categories chosen, date and time, the version and text of the banner, your shortened IP address (the last segment is removed) and the browser identifier. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR. We keep these records for three years after the end of the year in which you changed or withdrew your decision.

7. Customer account

If you create a customer account, we store your name, email address, password (encrypted only), addresses and orders. This lets you order faster, view your orders and register returns.

Legal basis: Art. 6(1)(b) GDPR.
Storage period: until you have your account deleted; statutory retention obligations for completed orders remain unaffected.

Change of shop system. This shop replaces our previous online shop. For anyone who had a customer account there or ordered as a guest, we have transferred name, email address and addresses as a customer account. We transferred a password only if it was stored securely encrypted; otherwise you set a new one via “Forgot password”. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to continue the existing customer relationship and to keep supporting earlier orders. You can object to the transfer at any time and request deletion.

8. Orders

For your order we process your name, address, email address, phone number and company where provided, the items ordered, shipping and payment method, and payment information.

Purpose: concluding and performing the contract, shipping or collection, invoicing, customer service.
Legal basis: Art. 6(1)(b) GDPR; for retention Art. 6(1)(c) GDPR.
Storage period: until the end of the statutory retention periods (section 3).

We also evaluate orders and enquiries for our sales statistics, without reference to your browsing behaviour (Art. 6(1)(f) GDPR; our interest is managing our business). This evaluation stays with us.

Payment

Stripe. Payments by credit card, Apple Pay and Google Pay, and the processing of Klarna and Amazon Pay, are handled by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. You enter your card details directly into Stripe's payment form; we do not receive them in full. For this, Stripe receives your name, email address, billing address, amount and order number, as well as device and connection data for fraud prevention. Stripe processes some of the data under its own responsibility, for example to meet regulatory obligations and to prevent fraud, and may transfer it to Stripe, Inc. in the USA (EU-US Data Privacy Framework). Privacy notice: stripe.com/privacy.

PayPal. Payments with PayPal are also processed via Stripe. If you pay with PayPal, you are redirected to PayPal. The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg, which processes the data under its own responsibility and may also carry out an identity and credit check. Privacy notice: paypal.com/de/legalhub/privacy-full.

Klarna. If you pay with Klarna, we transmit via Stripe your name, address, email address, phone number where provided and details of the order to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Klarna processes the data under its own responsibility and checks your identity and creditworthiness, where applicable using credit agencies; depending on the result, Klarna offers you certain payment options or not (automated decision by Klarna). We do not carry out any credit checks ourselves. Privacy notice: klarna.com/de/datenschutz.

Amazon Pay. If you pay with Amazon Pay, you are redirected to Amazon and confirm the payment with your Amazon account. For this, Amazon receives details of the payment (amount, order number, merchant). The provider is Amazon Payments Europe S.C.A., 38 Avenue John F. Kennedy, L-1855 Luxembourg, which processes the data under its own responsibility. Privacy notice: pay.amazon.eu/help/3BBUMQW3YAJKD6A.

Apple Pay and Google Pay. With these payment methods, Apple or Google additionally process your payment data under their own privacy terms.

Prepayment and payment on site. For prepayment, our bank gives us the details of your transfer (name, IBAN, amount, reference). For payment on site, you pay in our shop.

The legal basis for payment processing is Art. 6(1)(b) GDPR, and for fraud prevention Art. 6(1)(f) GDPR (our interest and that of the payment providers in preventing payment defaults and abuse).

Shipping and collection

For parcel shipping we pass your name and delivery address to DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany. Vehicles are delivered by a transport company we commission; for this we transmit your name, delivery address and phone number so that the delivery date can be agreed. We pass your email address to shipping providers only if you have agreed to this. For deliveries to countries outside the European Union, the shipping provider and the customs authorities additionally receive the details required for customs clearance (recipient, contents and value of the parcel). For collection, we inform you by email as soon as your order is ready.
Legal basis: Art. 6(1)(b) GDPR; for the customs details Art. 6(1)(c) GDPR; for passing on the email address Art. 6(1)(a) GDPR.

Returns and withdrawal

If you register a return or declare your withdrawal via “Withdraw from contract”, we process your name, email address, the order and the details you provide, and send you an acknowledgement of receipt. For returns from Germany we create a return label via DHL Paket GmbH; DHL receives your name and address for this.
Legal basis: Art. 6(1)(b) GDPR; for the withdrawal function and the acknowledgement Art. 6(1)(c) GDPR in conjunction with Section 356a BGB.
Storage period: as for orders (section 3).

Tax advice

We pass invoices and accounting records to our tax advisers to the extent required by law (Art. 6(1)(c) GDPR).

9. Emails from the shop

We send order confirmations, shipping and collection notices, confirmation and password emails and the newsletter from the address shop@yamaha-online-shop.de via the mail server of All-Inkl.com – Neue Medien Münnich, Inh. René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. All-Inkl is our processor (Art. 28 GDPR); your replies to these emails are received there as well.
Legal basis: depending on the email, Art. 6(1)(b), (c) or (a) GDPR.

10. Contact and enquiries

If you contact us by email, phone, fax or letter, or send a product enquiry, a test-ride request or an application for a B2B customer account via the product page, we process your details (for example name, email address, phone number, message, the item concerned, and for B2B applications also company details such as company name, address and VAT ID) to handle your enquiry. You receive a confirmation by email.

Legal basis: Art. 6(1)(b) GDPR if your enquiry aims at a contract; otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries).
Storage period: we delete the details once your enquiry has been dealt with conclusively, unless a contract results from it or retention obligations apply. We store the data of an activated B2B account for the duration of the business relationship.

11. Newsletter

If you subscribe to our newsletter, we first send you an email with a confirmation link (double opt-in). We add you to the mailing list only after you confirm. We store your email address, language, the time of subscription and confirmation, the consent text and your shortened IP address as proof.

The newsletter is sent via our own mail server at All-Inkl (section 9); we do not use an external newsletter service. We do not measure opens or clicks.

Legal basis: Art. 6(1)(a) GDPR; for the proof Art. 6(1)(c) in conjunction with Art. 7(1) GDPR.
Unsubscribing: at any time via the link in every newsletter email or by message to us. After you unsubscribe, we no longer send you the newsletter; we keep the proof of your earlier consent for three years.

12. Spam protection with Google reCAPTCHA

To protect our forms against automated entries (bots), spam and abuse, for example mass password guessing or sending unwanted emails via our forms, we use Google reCAPTCHA v3. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Protected forms: reCAPTCHA may be enabled for the following forms: customer account login, registration, “Forgot password”, resending the confirmation email, newsletter subscription, test-ride request, product enquiry, application for a B2B customer account and return registration. We do not protect placing the order with reCAPTCHA. We point out reCAPTCHA below every protected form. The “Withdraw from contract” function is never protected by reCAPTCHA.

How it works and which data: The reCAPTCHA script is only loaded when you use a protected form. It assesses from your behaviour whether the entry comes from a human. For this, in particular your IP address, information about your browser, device, screen and language settings, the page visited, date and time, and your interactions with the page (for example mouse and keyboard input) are transmitted to Google. Google may store or read cookies or similar technologies on your device. Google returns a score to us; we reject forms with a very low score.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is protecting our shop, our customer accounts and our customers against automated abuse. We do not ask for consent for this. Where information is stored on or read from your device, we rely on Section 25(2) No. 2 TDDDG, because protection against automated abuse is strictly necessary to process the form you submit securely.

Third country: Google may transfer the data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).

Objection: You may object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We then cannot accept a protected form; in that case please email or call us and we will deal with your request directly.

More information: Google privacy policy and Google terms of service.

13. The shop's own statistics

If you consent to the “Statistics” category, our own statistics record how our shop is used. For this we store a random visitor ID (motostax.visitor) and a session ID (motostax.session) in your browser and record which pages you visit, what you search for, which items you view and add to the cart, which page or campaign brought you to us (referrer, campaign parameters such as “utm” and click IDs such as “gclid”) and whether this leads to an order or enquiry.

The data is stored exclusively on our platform (section 4) and is not passed on to third parties. We use it to improve our range, our search and our advertising.

Legal basis: your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).
Storage period: 14 months.

14. Google Analytics 4

If you consent to the “Statistics” category, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics records how you use our shop, for example pages visited, time spent, searches, items viewed and orders (order number, items, value of goods), as well as information about your device, browser and approximate location. For this the cookies _ga and _ga_<ID> are set (storage period 2 years each).

Google Analytics 4 does not store your full IP address; it is used only to derive your approximate location. Google processes the data on our behalf (processing under Art. 28 GDPR) and may transfer it to Google LLC in the USA (EU-US Data Privacy Framework). The analytics data is deleted after 14 months.

Legal basis: your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). No Google script is loaded before you consent.

15. Google Ads

If you consent to the “Marketing” category, we use Google Ads by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland:

  • Conversion tracking: If you came to us via a Google ad, Google and we learn whether you subsequently placed an order or sent an enquiry (order number, value of goods). This is how we measure the success of our ads. For this the cookie _gcl_au is set (storage period 90 days).
  • Enhanced conversions: When you place an order, we transmit your email address to Google in hashed, i.e. irreversibly encrypted, form so that Google can attribute the order to an ad even if you use different devices.
  • Personalised advertising: Google may use the information that you have visited our shop to show you our ads on other websites and on Google (remarketing).

All of this happens only with your consent to the “Marketing” category. Google processes this data under its own responsibility and may combine it with data from your Google account; the data may be transferred to Google LLC in the USA (EU-US Data Privacy Framework). Privacy notice: policies.google.com/privacy.

Legal basis: your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).

16. External content: map and videos

We load the map view and videos only when you click “Load map” or “Load video”. With “Always allow” you can permit this content permanently; this corresponds to the “External content” category in the cookie banner.

Mapbox. Our map view is provided by Mapbox, Inc., Washington, D.C., USA. When the map loads, your IP address, information about your browser and device, the page visited and the map section displayed are transmitted to Mapbox. Mapbox is certified under the EU-US Data Privacy Framework and, according to its own information, deletes IP addresses after 30 days. Privacy notice: mapbox.com/legal/privacy.

YouTube. On vehicle product pages we embed videos from YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, in privacy-enhanced mode (youtube-nocookie.com). Once loaded, YouTube receives your IP address, the page visited and information about your device and browser, and may store cookies and similar technologies on your device; if you are logged in to Google, YouTube may associate the video with your account. The data may be transferred to Google LLC in the USA (EU-US Data Privacy Framework).

Legal basis: your consent by clicking or via “Always allow” (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw it at any time via “Cookie settings”.

17. Fonts

All fonts are stored on our own server. No connection to Google Fonts or other font providers is established when you visit our pages.

18. Your rights

You have the right to

  • access the data we store about you (Art. 15 GDPR),
  • rectification of inaccurate data (Art. 16 GDPR),
  • erasure (Art. 17 GDPR),
  • restriction of processing (Art. 18 GDPR),
  • data portability (Art. 20 GDPR), and
  • withdraw consent with effect for the future (Art. 7(3) GDPR), for cookies and similar technologies via “Cookie settings”.

Simply contact us using the details in section 1.

Right to object (Art. 21 GDPR): Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. You may object to processing for direct marketing purposes at any time without giving reasons.

Right to lodge a complaint: You may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Thüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheit (TLfDI)
Häßlerstraße 8, 99096 Erfurt, Germany
Phone: +49 361 57 3112900
Email: poststelle@datenschutz.thueringen.de

19. Obligation to provide data, automated decisions

For an order or a customer account we need the details marked as mandatory; without them we cannot conclude the contract. All other details are voluntary.

We ourselves do not make any solely automated decisions within the meaning of Art. 22 GDPR. When you pay with Klarna, Klarna decides automatically on the payment options offered (section 8).

20. Changes

We update this privacy policy when our shop, the services we use or the legal situation change. The version published here applies.