Privacy Policy

Last updated: February 20, 2026

This Privacy Policy explains how the M-Sport group of companies ("we", "us", "our") collects, uses, and protects your personal data when you place an order or interact with our services. We are the data controller for the purposes of the EU General Data Protection Regulation (GDPR).

Your data controller is determined by your market:

Croatia — Field SIM sport d.o.o., Korzo 11, 51000 Rijeka (OIB: 63676784627)
Slovenia — IBS TRADE d.o.o., Na zelenici 4, 3000 Celje (VAT: SI19872682)
Cyprus — M-Sport Equipment Ltd, Eleftherias 77, Shop No. 1, 7102 Aradippou (VAT: CY10442302Y)

These entities operate as joint controllers under GDPR Art. 26 and share a common data processing infrastructure. For any privacy request, you may contact any entity and it will be handled by the responsible controller.

1. Data We Collect

When you complete an order, we collect:

Identity data: Full name
Contact data: Email address, phone number
Delivery data: Shipping address
Transaction data: Order details, payment method, payment references
Consent records: Timestamps of when you accepted our terms and any marketing preferences

2. Legal Basis for Processing

We process your data on the following legal bases:

Contract performance (Art. 6(1)(b) GDPR): Processing your order, delivering goods, handling returns and refunds
Legitimate interests (Art. 6(1)(f) GDPR): Fraud prevention, improving our services
Consent (Art. 6(1)(a) GDPR): Marketing communications — only if you opt in
Legal obligation (Art. 6(1)(c) GDPR): Tax and accounting records

3. How We Use Your Data

To process and fulfill your order
To send order confirmations and delivery updates
To process payments via our payment provider (Stripe)
To send promotional offers (only with your explicit consent)
To comply with legal and tax obligations

4. Data Sharing

We share your data with:

Stripe: Payment processing (Stripe acts as an independent data controller for payment data)
Delivery partners: To ship your order
Supabase: Database hosting (EU region, data processed within the EU)

We do not sell your personal data to third parties.

5. Data Retention

Order data: Retained for 7 years for tax/accounting compliance
Marketing consent: Until you withdraw consent
Consent records: Retained as long as legally required to demonstrate compliance

6. Your Rights

Under the GDPR, you have the right to:

Access your personal data
Rectify inaccurate data
Erase your data (subject to legal retention requirements)
Restrict processing
Data portability — receive your data in a structured format
Object to processing based on legitimate interests
Withdraw consent for marketing at any time

To exercise any of these rights, contact us at info@m-sportsolutions.com.

7. Marketing Communications

We only send marketing emails if you have given explicit consent. You can withdraw your consent at any time by clicking the unsubscribe link in any marketing email or by contacting us. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

8. Security

We implement appropriate technical and organizational measures to protect your data, including encrypted connections (TLS), access controls, and regular security reviews. Payment data is handled directly by Stripe and never stored on our servers.

9. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. For Cyprus, this is the Office of the Commissioner for Personal Data Protection. You may also lodge a complaint with the supervisory authority in your country of residence.

10. Contact

For any privacy-related questions or requests, contact us at: info@m-sportsolutions.com