1. Controller and contact details
VAG Performance Parts, trading as VAG Performance Parts, VAG Performance Chip, CORE Performance Parts and CORE Development, is the controller for the processing we carry out for our own purposes as described in this policy. Our address is Brouwersstraat 32 L, 2984 AR Ridderkerk, Nederland. Our Dutch Chamber of Commerce registration number is 83032339. Our VAT identification number is NL003766331B35.
For privacy questions or to exercise your rights, contact info@vag-performance-parts.com. Please identify the website, order, account or communication concerned. Do not send a copy of an identity document unless we specifically request one.
2. People and activities covered
This VPP edition applies to vag-performance-parts.com and its shop, accounts, forms, technical information and customer service. It is based on the joint privacy policy for our three websites. The activities of the other trading names are distinguished below; not all processing takes place in the parts webshop.
At VAG Performance Parts, the policy covers visitors, customers, business contacts and suppliers. We process information for vehicle and engine selection, My Garage, saved configurations, technical enquiries, shopping carts, orders, payment, delivery, returns, warranty and support.
VAG Performance Chip provides services through vag-performance-chip.nl including quotations, appointments, MY VPC, calculations, diagnostics, installation, maintenance and tuning. Additional vehicle, workshop and software information may be needed only when you use those services. CORE Performance Parts and CORE Development use core-performance-parts.com for activities including business information, dealer applications, dealer accounts, B2B orders and any software or dealer modules. Visiting VPP does not mean we create a record for all these activities.
3. Our role with dealers and other service providers
An independent dealer or workshop is normally responsible for the information it collects from its own customers and for its own services. Where CORE provides the technology for a dealer website, webshop or module, CORE may process information on that dealer’s behalf, solely under its instructions and the agreed processing arrangements.
We remain a controller for our own administration, security, invoicing, relationship management and legal obligations. A technical connection does not automatically make VPP or CORE the seller or contracting party for an independent dealer’s customer.
4. Information we process
We limit information to what is needed for the activity concerned. Depending on your use, this may include:
- Identification and contact: name, company name, address, email, telephone number and business contact; business applications may also require company registration and VAT details.
- Account and security: account ID, roles, securely stored password information, sign-ins and relevant technical security logs.
- Orders: order and invoice numbers, billing and delivery addresses, package contents, manufacturer part numbers, selected options, quantities, prices, payment references and payment status. Full card details are not stored in our webshop administration.
- Vehicle and technical information: selected vehicle, engine family, engine code, relevant specifications and modifications; a registration number or VIN only if you provide it or it is needed for a requested check. Workshop or ECU/TCU files are relevant only when you purchase a related service.
- Service: enquiries, correspondence, appointments, return reasons, defect reports, photographs of parts and packaging, and the progress of a service request.
- Digital services: necessary technical information, cookie preferences and any questions or calculations entered. Optional AI, dealer or software features involve this processing only when the feature is actually used.
Avoid unnecessary personal information in free text or photographs. We do not request special-category information such as health or biometric data, or information about criminal convictions.
5. Purposes and legal bases
We use personal information for a specified purpose and on an appropriate legal basis:
- Preparing or performing a contract: handling a requested quotation, account, configuration, order, payment, delivery, technical support, return or warranty request.
- Legal obligations: including tax administration, invoices, product safety and valid requests from competent authorities.
- Legitimate interests: securing our services, preventing abuse and fraud, investigating problems, maintaining quality and reliability, managing business relationships and handling legal claims.
- Consent: features, communications or cookies that require consent, including any non-essential tracking we may activate. Consent must be specific and freely given.
For legitimate interests, we assess necessity, proportionality and your interests and rights. Technical selection and checking support appropriate and safe delivery, rather than an advertising profile. Email marketing requires consent or a lawful existing-customer exception for our own similar products or services, with a straightforward opt-out. Placing an order is not general consent to marketing.
6. Required and optional information
We cannot process an order without the necessary contact, delivery and payment information. Without sufficient technical information, we cannot responsibly carry out a requested application check. We explain which information is necessary; other information is optional.
You may withdraw consent through the relevant setting or our privacy contact. Withdrawal is not retrospective and does not affect processing that remains necessary on another valid basis, such as retaining an invoice.
7. Sources of information
You usually provide the information yourself. We may also receive information from your organisation, a dealer or workshop you have instructed, our payment and shipping partners, a supplier fulfilling an order, and relevant public registers such as a VAT register.
A vehicle or component data source is used only for an appropriate check or a feature you have requested. We do not buy consumer lists for advertising profiles. Where information is not obtained directly from you, we provide the legally required information, including the source and purpose.
8. Sharing information
We do not sell or rent your personal information. Only information needed for the task concerned may be shared with:
- Hosting, database, backup, email and security service providers.
- Payment service providers, banks, accountants and administration providers.
- Carriers, fulfilment partners and suppliers processing or directly delivering your order.
- Manufacturers or suppliers handling a technical enquiry, warranty investigation, traceability or safety notice.
- A dealer or installer you have involved, and advisers or competent authorities where necessary and lawful.
For direct delivery, the selected supplier receives the necessary name, any company name, delivery address and order information. This may include the engine family, engine code, manufacturer part numbers and package components. The transfer serves fulfilment of your order and does not authorise supplier marketing.
We make appropriate agreements with processors covering instructions, confidentiality, security and any sub-processors. Some organisations, such as banks, payment providers or independent carriers, may act as separate controllers for their own statutory tasks.
9. Processing outside the EEA
Where appropriate, we favour processing within the European Economic Area. If a service provider processes personal information outside the EEA, we ensure a valid transfer mechanism, such as an adequacy decision or approved standard contractual clauses with additional safeguards where necessary.
This is not general consent to international transfers. You may ask which safeguards apply to a particular service and how to obtain a copy.
10. Technical tools, calculations and AI
Where an AI-assisted feature is offered, that is made clear when you use it. Questions, answers and relevant context may be used only for the stated purpose. A calculation depends on the engine, hardware, fuel and other assumptions entered; it does not automatically constitute a binding quotation, diagnosis or power guarantee.
Personal information is not used to make decisions with legal or similarly significant effects solely through automated decision-making. You may request human review of a security restriction or an outcome you dispute.
We do not use identifiable customer questions for model training without a separate, express choice. Do not provide passwords, identity documents or other secrets through such features. Standalone AI conversations follow the retention period below; information that becomes a necessary part of a service or order record follows that record’s retention period.
11. Cookies and anonymous usage counts
The parts webshop uses essential cookies for security, sessions, sign-in, shopping carts, checkout and remembering settings you select. The active vehicle selection may be remembered for up to 30 days. A normal web session has an inactivity period of approximately two hours; security and sign-in features may have their own necessary duration. Your cookie preference is stored for up to 180 days unless you change or delete it sooner.
VPP may also count anonymous daily totals. This counter does not set an analytics cookie or store an IP address, session ID, unique visitor ID, referring website, free-text search or personal browsing profile. Only exactly recognised catalogue numbers, engine codes and brands may be counted as catalogue references. There is no connection to your account, order or payment.
Anonymous counting is enabled by default. You can disable it in the cookie settings. A previous refusal of analytics is honoured; Do Not Track and Global Privacy Control also disable counting. Daily totals are used in reports for up to 400 days; older totals are cleaned up on the next permitted count.
Hosting and security logs and our necessary business administration are separate from anonymous counting. The new counter does not store free-text searches or session hashes. Historical search logs from an older shop version are separate from the new counter and are no longer used in search reports.
Permitted page requests are counted only as daily totals without a link to an individual. There is no unique visitor ID and no connection between browsing and an account, order or payment. These counts are not unique visitors or conversion rates. Business reports separately use necessary order, stock, purchasing and returns records. Access is restricted to authorised staff.
This counter does not activate external advertising trackers or identifiable analytics. If we later add optional features, tracking or marketing cookies that require consent, they will be off beforehand and we will request separate consent. Refusal or withdrawal must not prevent ordinary use of the shop. You can change your choice through Cookie settings in the footer of every page.
12. Retention periods
We retain information no longer than required for its purpose, a legal obligation or a specific claim. The following periods form our retention policy; an ongoing dispute, safety issue or legal requirement may make longer retention necessary:
- Sessions and shopping carts: for the session or up to 30 days, unless you deliberately save a configuration in your account.
- Account and My Garage: while the account is active. After 24 months of inactivity, we assess whether retention is still needed. You may request deletion earlier.
- Contact, quotation or application without a contract: normally up to two years after the last relevant contact. Rejected dealer applications: up to twelve months.
- Tax records and issued invoices: normally seven years after the end of the financial year; records subject to the OSS scheme’s ten-year requirement are kept for ten years.
- Workshop, vehicle and software records for the relevant services: normally seven years after the last assignment.
- Return, warranty and complaint records, including necessary photographs: normally five years after closure, longer where a legal duty, product safety or dispute requires it.
- Business dealer relationship: during the relationship; administrative records normally for seven years afterwards. Access is revoked when no longer needed.
- Standalone AI conversations: up to 90 days, unless necessary information is included in an order or service record.
- Technical and security logs: normally up to twelve months. Relevant incident records: up to five years or as long as proceedings require.
- Cookie choice: up to 180 days. Any subsequently permitted identifiable analytics: up to 180 days, unless another lawful period is explained beforehand. Anonymous VPP daily totals follow the reporting period stated above.
- Marketing information: until an opt-out or the legal basis ends. Minimal evidence of consent or an opt-out may be needed for up to five years.
- Privacy requests: up to five years as evidence of handling. Any necessary identity verification material is deleted once verification is complete, unless a legal duty requires otherwise.
Deleting an account does not automatically erase information that must be retained separately. Access to retained records is restricted; retention does not justify renewed marketing use.
13. Security
We take appropriate technical and organisational measures, taking account of the information and the risks. These include access restrictions, secure connections, careful management of accounts and permissions, backups, logging and safeguards against abuse. Additional authentication measures are used where appropriate.
No system is entirely without risk. If you suspect a security incident, contact us and do not disclose sensitive information through a public channel. We assess incidents and report personal data breaches where legally required.
14. Your privacy rights
Subject to the GDPR’s conditions, you may request access, rectification, erasure, restriction of processing or portability. You may object to processing based on legitimate interests. You may always object to direct marketing. You can withdraw consent at any time.
Send your request to info@vag-performance-parts.com. We may ask for reasonable additional information to establish your identity. If a copy of an identity document proves necessary, we explain how to obscure unnecessary details such as a citizen service number, photograph and machine-readable zone.
We normally respond within one month. For complex or multiple requests, the period may be extended by up to two further months; we explain the reason within the first month. Requests are normally free of charge. Statutory exceptions apply to manifestly unfounded or excessive requests. A legal retention duty may prevent complete erasure; we explain this where applicable.
15. Complaints
You are welcome to raise a privacy complaint with us first at info@vag-performance-parts.com so that we can respond. This is not a condition for contacting a supervisory authority. You may complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the competent authority in the EU country where you live, work or where the possible infringement occurred.
16. Children
Our services are not specifically directed at children. To enter into a contract, you must have legal capacity or valid permission from a parent or legal representative. If we discover that information is being processed without the required legal basis, we take appropriate action.
17. Communications and other platforms
If you choose to contact us through social media or an external communication platform, that platform processes information under its own policy. Do not share unnecessary information there. We use relevant communication only to respond to and handle your enquiry and its related record.
18. Changes and language
This VPP edition applies from 14 September 2026. Changes are published on this page with an identifiable edition. Where necessary, we give additional notice of significant changes and request fresh consent when required by law.
The English version is a translation of the same VPP policy. In the event of differences in interpretation, the Dutch text prevails to the extent that this does not prejudice mandatory legal protection.
Google Analytics — addendum 27 October 2026
Alongside the separate anonymous VPP daily totals, we offer Google Analytics to measure visits and usage of the public shop. The legal basis is your consent. Without consent, the Google tag is not loaded. Refusing does not prevent use of the shop. Withdraw consent through Cookie settings in the footer of every page.
When enabled, Google receives information about public pages visited, browser, device and cookie identifiers. Google also receives your IP address for the connection; this is therefore separate from anonymous VPP daily counts. Google Ireland Limited and its service providers process this information under the Google Analytics terms. Processing may take place outside the European Economic Area; applicable transfer safeguards follow from the arrangements with Google.
Our integration disables advertising personalisation and Google Signals and does not send account IDs, names, email addresses, addresses or order information. Administration, accounts, sign-in, contact forms, cart and checkout are not measured by this integration. Our page measurement removes query parameters and fragments from the measured page URL.
The _ga and _ga_* cookies recognise visits after consent. We limit their lifetime to the remaining consent period, up to 180 days. Withdrawal removes accessible Google Analytics cookies for this domain and stops new measurement. Retention of data already sent to Google is configured separately in the Analytics property; deleting cookies does not automatically delete earlier data at Google. For questions and your privacy rights, contact info@vag-performance-parts.com.