Privacy Policy

The controller of your personal data is:

R2A group, MB · Company Registration No.: 306168417 · VAT No.: LT100015494513

Registered Office: Pramonės pr. 6-113, LT-51267 Kaunas, Lithuania

Email: info@toyotaworldwide.eu · Telephone: +370 639 51234 · Website: https://www.toyotaworldwide.eu

For questions concerning this Privacy Policy or the processing of personal data, please contact us using the details above.

This Privacy Policy applies whenever you:

• visit our Website
• browse our product catalogue
• create a customer account
• place an Order
• request compatibility verification using a VIN or other vehicle information
• contact our customer support
• subscribe to newsletters or marketing communications (where applicable)
• participate in promotions or surveys (where applicable)
• submit warranty or return requests
• otherwise interact with our services.

This Privacy Policy applies to both Consumers (B2C) and Business Customers (B2B) to the extent personal data are processed.

We process personal data in accordance with applicable legislation, including but not limited to:

• Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR)
• the Lithuanian Law on Legal Protection of Personal Data, where applicable
• the EU ePrivacy rules and applicable national legislation concerning electronic communications and cookies
• other applicable European Union and Lithuanian legislation.

We process personal data in accordance with the following principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. We collect only the personal data reasonably necessary for the purposes described in this Privacy Policy.

5.1 Identification Data: first name, last name, company name, company registration number, VAT identification number (where applicable).

5.2 Contact Data: email address, telephone number, billing address, delivery address, country, postal code.

5.3 Order Data: ordered Products, quantities, prices, invoices, payment status, discounts, delivery method, shipping information.

5.4 Account Data: username, encrypted password, order history, saved addresses, communication preferences. Passwords are stored using appropriate cryptographic protection and are never stored in plain text.

5.5 Vehicle Information: VIN, vehicle make, model, model year, engine code, transmission information, production date, OE numbers, photographs and technical information voluntarily supplied. Vehicle information may constitute personal data where it can reasonably be linked to an identifiable individual.

5.6 Communication Data: emails, chat messages, telephone call information where applicable, attachments, warranty documentation, return requests, complaint correspondence.

5.7 Technical Data: IP address, browser type and version, operating system, language settings, device type, date and time of access, referring pages, pages visited, session information, approximate geographic location derived from your IP address.

5.8 Payment Information: processed through secure third-party payment providers. We do not store complete payment card numbers or card security codes. We may receive payment confirmation, transaction identifier, payment status, partial card information (where provided by the payment processor) and payer name.

We process personal data only where there is a legitimate and lawful purpose. Purposes include:

• processing Orders
• supplying Products
• arranging deliveries
• providing customer support
• responding to enquiries
• performing VIN compatibility reviews
• processing returns
• handling warranty claims
• issuing invoices
• complying with accounting obligations
• preventing fraud
• improving Website security
• improving customer service
• complying with legal obligations
• protecting our legal rights.

We do not sell personal data.

7.1 Performance of a Contract — where necessary to accept Orders, process payments, arrange shipment, provide customer support, administer returns and fulfil warranty obligations.

7.2 Compliance with Legal Obligations — accounting, tax, anti-fraud, consumer protection, court orders, regulatory requests.

7.3 Legitimate Interests — preventing fraud, improving Website security, protecting legal claims, maintaining customer records, improving our products and services, responding to complaints, ensuring business continuity, preventing misuse of the Website.

7.4 Consent — where required by law (marketing communications, optional cookies, promotional newsletters). You may withdraw consent at any time; withdrawal does not affect processing carried out before withdrawal.

Certain personal data are necessary in order for us to conclude a sales contract, process payment, deliver Products, issue invoices and provide warranty services. Failure to provide mandatory information may prevent us from accepting or fulfilling your Order. Providing optional information is voluntary.

You are responsible for ensuring the personal data you provide are accurate, complete and up to date. We are not responsible for delays, failed deliveries or incorrect compatibility assessments resulting from inaccurate information provided by you.

Our Website is intended for adults. We do not knowingly collect personal data from children under the age of sixteen (16). If we become aware that personal data relating to a child have been collected without appropriate legal basis, we will take reasonable steps to delete such information.

We do not make decisions producing legal or similarly significant effects based solely on automated processing within the meaning of Article 22 GDPR. Certain automated systems may be used for fraud prevention, order validation or Website security, with meaningful human oversight where appropriate.

To process Orders securely, the Seller cooperates with trusted payment service providers. Depending on the payment method selected, personal data may be shared only to the extent necessary for payment processing. The Seller does not collect or store full payment card numbers or card verification values (CVV/CVC).

Stripe: where Customers choose Stripe, payment-related personal data are processed by Stripe in accordance with its own Privacy Policy. Transferred information may include Customer name, billing address, email address, payment amount, currency, transaction identifier and fraud prevention information. More at https://stripe.com/privacy.

PayPal: where Customers choose PayPal, information is processed by PayPal in accordance with its Privacy Statement. More at https://www.paypal.com/privacy.

Bank Transfers: we process information necessary to identify the payment, reconcile invoices, fulfil accounting obligations and prevent fraud.

Personal data contained within invoices and accounting records are processed to comply with legal obligations under accounting and tax legislation. Such information may include Customer name, company information, VAT number, billing address, transaction history, invoices and payment confirmations. Accounting documentation is retained for the period required by applicable legislation.

To deliver Products we share only the information necessary with logistics providers and authorised suppliers: recipient name, delivery address, telephone number, email address, shipment reference and Order number. Delivery partners process personal data only for the purpose of transporting Products and associated customer service.

The Seller operates primarily through a dropshipping fulfilment model. Accordingly, certain personal data may be shared with authorised manufacturers, distributors or fulfilment partners strictly to the extent necessary to prepare Products, dispatch shipments, fulfil Orders and process warranty claims or authorised returns. Such partners receive only the information necessary to perform the relevant services.

Where a Customer requests assistance selecting Products using a VIN, we process the information provided solely for the purpose of assessing Product compatibility and responding to the request. Information processed may include VIN, vehicle make, model, engine type, production year, transmission information, factory options, photographs and technical documentation supplied by the Customer.

VIN information is processed only for legitimate business purposes connected with Product selection, Order fulfilment, warranty administration or dispute resolution. Where necessary, VIN information may be shared with authorised suppliers or manufacturers to verify compatibility.

We process communications sent by Customers in order to respond to enquiries, provide technical assistance, administer Orders, process returns, process warranty claims, improve customer service and establish legal claims where necessary.

Where a Customer creates an account, personal data are processed to authenticate access, maintain order history, store delivery addresses, facilitate repeat purchases and improve customer experience. Customers are responsible for maintaining the confidentiality of their login credentials.

The Seller has a legitimate interest in preventing fraudulent transactions. Personal data may be processed for payment verification, identity verification, unusual transaction detection, prevention of chargeback fraud and Website security. Fraud prevention measures include appropriate human oversight where necessary.

Personal data are processed to answer questions, provide technical assistance, investigate complaints, administer returns, coordinate warranty claims and improve service quality. Customer service interactions may be retained where necessary for quality assurance, legal compliance or defence of legal claims.

Where permitted by applicable law and, where required, based on your consent, we may send newsletters, promotional offers, product updates and service announcements. You may unsubscribe at any time by using the unsubscribe link contained in marketing emails or by contacting us at info@toyotaworldwide.eu. Withdrawal of marketing consent does not affect communications necessary for Order fulfilment.

Our Website uses cookies and similar technologies. Some cookies are strictly necessary for Website functionality. Other cookies may be used only with your consent where required by applicable law. Detailed information is available in our separate Cookie Policy.

Depending on the purpose of processing, personal data may be disclosed to payment service providers, banks, authorised logistics companies, manufacturers, authorised OEM distributors, IT service providers, website hosting providers, accounting service providers, legal advisers, auditors and public authorities where legally required. Recipients receive only the personal data necessary for their specific functions.

Where third parties process personal data on our behalf, they act under appropriate contractual arrangements designed to protect personal data in accordance with GDPR. We require processors to process data only on documented instructions, implement appropriate security measures, ensure confidentiality, assist with GDPR compliance and delete or return data where appropriate after services conclude.

Some service providers may process personal data outside the European Economic Area (EEA). Where such transfers occur, appropriate safeguards are implemented in accordance with Chapter V GDPR, which may include European Commission adequacy decisions, Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms recognised by GDPR. We take reasonable steps to ensure that international transfers provide an adequate level of protection.

Personal data are retained only for as long as necessary for the purposes described in this Privacy Policy or as required by law. Examples include:

• Customer Account Data — retained until the account is deleted or becomes inactive, subject to legal obligations.
• Order Information — retained for the period necessary to fulfil contractual obligations and comply with accounting and tax legislation.
• Warranty Documentation — retained for the duration of applicable statutory limitation periods and warranty administration.
• Customer Service Communications — retained for as long as reasonably necessary to respond to enquiries, resolve disputes and defend legal claims.
• Technical Logs — retained for security, fraud prevention and system administration purposes for an appropriate period.

Where retention is no longer necessary, personal data are securely deleted or anonymised.

We implement appropriate technical and organisational measures designed to protect personal data against accidental loss, unauthorised access, unauthorised disclosure, alteration, destruction and unlawful processing. Security measures may include encrypted communications (HTTPS/TLS), access controls, authentication mechanisms, network security, monitoring systems, secure backup procedures and staff confidentiality obligations. Although we strive to protect personal data using commercially reasonable security measures, no method of electronic transmission or storage can be guaranteed to be completely secure.

23.1 Right of Access — confirmation of whether we process your personal data and access to the categories of personal data, purposes of processing, recipients, envisaged retention period, source of the data and information regarding automated decision-making. You may also request a copy of your personal data.

23.2 Right to Rectification — correction of inaccurate or incomplete personal data.

23.3 Right to Erasure — deletion where data are no longer necessary, consent is withdrawn, an objection is successful, data have been processed unlawfully or deletion is required by law. This right is not absolute; we may retain information required by accounting, tax, warranty, legal claims or fraud prevention obligations.

23.4 Right to Restrict Processing — where accuracy is contested, processing is unlawful but deletion is opposed, we no longer require the data but you require them for legal claims, or you have objected pending verification of legitimate interests.

23.5 Right to Data Portability — where processing is based on consent or contract and carried out by automated means, in a structured, commonly used and machine-readable format; where technically feasible, direct transmission to another controller.

23.6 Right to Object — to processing based upon legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms or where processing is necessary for legal claims.

23.7 Right to Withdraw Consent — at any time where processing relies upon consent. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

23.8 Marketing Communications — you may object at any time to the processing of personal data for direct marketing purposes.

To exercise your data protection rights, please contact us at info@toyotaworldwide.eu. To protect your personal data, we may request reasonable information to verify your identity before responding to certain requests. Requests are handled free of charge unless they are manifestly unfounded, excessive or repetitive as permitted by applicable law.

We will respond to requests concerning personal data without undue delay and, in any event, within one month of receipt. Where requests are particularly complex or numerous, this period may be extended by up to two additional months as permitted by Article 12 GDPR. If an extension is necessary, we will inform you within the initial one-month period.

If you believe that your personal data have been processed in violation of applicable data protection legislation, we encourage you to contact us first so that we may attempt to resolve your concerns. You also have the right to lodge a complaint with the competent supervisory authority.

For processing carried out by R2A group, MB, the competent supervisory authority is generally the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija – VDAI), L. Sapiegos g. 17, LT-10312 Vilnius, Lithuania, https://vdai.lrv.lt.

You may also have the right to lodge a complaint with the supervisory authority in the EU Member State of your habitual residence, place of work or the place of the alleged infringement, where applicable.

The Seller maintains procedures designed to detect, assess and respond to personal data security incidents. Where required by applicable law, personal data breaches will be reported to the competent supervisory authority and, where necessary, to affected individuals.

Our Website may contain links to third-party websites. We are not responsible for the privacy practices or content of websites operated by third parties. Customers are encouraged to review the privacy policies of such websites before providing personal data.

In the event of a merger, acquisition, corporate restructuring, sale of assets or similar transaction, personal data may be transferred to the successor entity where permitted by applicable law. Any successor shall remain bound by applicable data protection obligations.

The Seller may amend this Privacy Policy from time to time. The most recent version will always be published on the Website. Material changes affecting the processing of personal data may be communicated by appropriate means where required by applicable law.

This Privacy Policy should be read together with the Terms & Conditions of Sale, Return & Refund Policy, Shipping Policy, Warranty Policy (where applicable) and Cookie Policy. In the event of inconsistency regarding the processing of personal data, this Privacy Policy shall prevail unless mandatory legislation provides otherwise.

For all questions relating to this Privacy Policy or personal data processing, please contact R2A group, MB · Registration No. 306168417 · VAT No. LT100015494513 · Pramonės pr. 6-113, LT-51267 Kaunas, Lithuania · Email: info@toyotaworldwide.eu · Telephone: +370 639 51234 · Website: https://www.toyotaworldwide.eu.

This Privacy Policy becomes effective on the date published on the Website and remains in force until amended or replaced by a newer version. It shall be interpreted in accordance with Regulation (EU) 2016/679 (GDPR), applicable Lithuanian legislation and other applicable European Union data protection legislation. Where mandatory legislation grants greater protection than this Privacy Policy, the mandatory legislation shall prevail.

By using the Website, creating an account, submitting personal data, requesting VIN compatibility assistance or placing an Order, you acknowledge that you have read and understood this Privacy Policy. Where consent is required by applicable law, such consent will be requested separately and may be withdrawn at any time.