GDPR Compliance
How Golf Cart Lab meets EU Regulation 2016/679 and the UK GDPR: our lawful bases, the rights you can exercise, and exactly how to use them.
Golf Cart Lab publishes free technical reference material and sells golf cart parts. You can read every guide here anonymously, and we run no advertising of any kind. Where you place an order we hold the order record described below, and nothing beyond what we need to fulfil it. This page sets out how the small amount of personal data we do process is handled under the General Data Protection Regulation, and how a reader in the EEA, the UK or Switzerland exercises their rights over it.
01. Scope
This statement applies to golfcartlab.com and to visitors located in the European Economic Area, the United Kingdom and Switzerland. It sits alongside our Privacy Policy, which describes our data practices for all readers. Where the two documents overlap, this page adds the GDPR specific detail rather than replacing anything.
02. Data controller
The data controller for golfcartlab.com is Golf Cart Lab LLC, a registered US company, which publishes golf cart technical references and sells aftermarket golf cart parts. All controller correspondence, including subject access and erasure requests, goes to support@golfcartlab.com.
Golf Cart Lab is not a public authority, does not carry out large scale monitoring of data subjects, and does not process special category data at scale, so we are not required to appoint a Data Protection Officer under Article 37. Data protection matters are handled directly by the site operator at the address above, and we respond to every request ourselves.
03. Personal data we process
- Order data. If you buy from us: your name, email address, billing address, shipping address, phone number and the items you ordered. We do not receive or store your card number, which goes directly to Stripe.
- Technical data. IP address, browser type, operating system, referring page and pages viewed, recorded in server logs and aggregated statistics.
- Correspondence data. Your email address, name and message content when you write to us.
- Comment data. Name, email address, comment text, IP address and user agent when you post a comment on a guide.
- Cookie and advertising identifiers. Identifiers set by our advertising partner where you have consented to non essential cookies.
We do not process special categories of personal data under Article 9, we do not process criminal offence data under Article 10, and we do not require an account or any registration to read the site.
04. Lawful bases for processing
Every processing activity on this site maps to one of the lawful bases in Article 6:
| Purpose | Data | Lawful basis |
|---|---|---|
| Serving the site securely | IP address, request logs | Legitimate interests, Art. 6(1)(f): keeping the site available and protected from abuse |
| Answering your email | Email address, message content | Legitimate interests, Art. 6(1)(f), or steps at your request, Art. 6(1)(b) |
| Publishing and moderating comments | Name, email, comment, IP | Consent, Art. 6(1)(a), given when you submit the comment |
| Aggregate traffic statistics | Truncated IP, page views, referrer | Legitimate interests, Art. 6(1)(f): understanding which guides are useful |
| Advertising cookies and personalised ads | Cookie identifiers, IP, ad interactions | Consent, Art. 6(1)(a), collected through the cookie notice |
| Meeting legal obligations | Whatever a valid legal request requires | Legal obligation, Art. 6(1)(c) |
Where we rely on legitimate interests, we have carried out a balancing assessment and hold only the minimum data needed for the purpose. You can object to that processing at any time using the details in section 07.
05. Consent and cookies
Non essential cookies, which on this site means analytics and advertising cookies, are set only after you give consent through the cookie notice. Strictly necessary cookies, which keep the site secure and functional, are set without consent as permitted by the ePrivacy rules.
- Consent is requested before any advertising or analytics cookie is written.
- Refusing is as easy as accepting, and refusing does not restrict access to any guide, chart or calculator on this site.
- You can withdraw consent at any time through the cookie notice or by clearing cookies in your browser, and withdrawal does not affect processing carried out before you withdrew.
- Our advertising partner is required to operate under Google’s EU user consent policy, which governs how consent signals are passed to advertising vendors.
06. Your rights under the GDPR
As a data subject you have the following rights, and we will honour every one of them:
- Access, Art. 15. Confirmation of whether we process your data and a copy of it.
- Rectification, Art. 16. Correction of inaccurate or incomplete data.
- Erasure, Art. 17. Deletion of your data where there is no overriding reason to keep it.
- Restriction, Art. 18. A freeze on processing while a dispute about accuracy or legitimate interests is resolved.
- Portability, Art. 20. A copy of data you provided to us in a structured, commonly used, machine readable format.
- Objection, Art. 21. The right to object to processing based on legitimate interests, and an absolute right to object to direct marketing.
- Withdrawal of consent, Art. 7(3). The right to withdraw consent at any time, as easily as it was given.
- Complaint, Art. 77. The right to lodge a complaint with your national supervisory authority.
07. Making a request
Email support@golfcartlab.com with “GDPR request” in the subject line, tell us which right you want to exercise, and give us enough detail to find your data, for example the email address you used to contact us or the name on a comment.
We respond within one month of receipt, as required by Article 12(3). If a request is unusually complex we may extend that by up to two further months, and if we do, we will tell you why inside the first month. Requests are free unless they are manifestly unfounded or excessive.
Where we cannot identify you from the information provided, we may ask for verification before acting, so that we never disclose one person’s data to another. We ask only for what is strictly necessary to confirm identity.
08. Processors we use
We use a small number of processors, each under its own data processing agreement, and none of them is authorised to use your data for their own purposes beyond what is stated below:
| Processor | Role | Data |
|---|---|---|
| Hostinger | Hosting and content delivery | Server logs, IP address |
| Automattic | Aggregate statistics and comment spam filtering | Truncated IP, page views, comment metadata |
| Stripe | Payment processing for orders | Card and billing details entered at checkout |
| Fulfilment and logistics providers | Picking, packing and shipping your order | Name, shipping address, phone, items ordered |
09. International transfers
Some of our processors are established in the United States, so personal data may be transferred outside the EEA and the UK. Those transfers are covered by the European Commission’s Standard Contractual Clauses, by the UK International Data Transfer Addendum where the UK GDPR applies, or by the processor’s certification under the EU US Data Privacy Framework, together with the technical measures described in our Privacy Policy. You can request a copy of the relevant safeguard at any time.
10. Retention
We apply data minimisation as a default and keep nothing longer than we need:
- Server logs: up to 30 days.
- Order records: seven years, as tax and accounting law requires.
- Email correspondence: up to 24 months, then deleted.
- Comments: for as long as the comment stays published, and deleted on request.
- Statistics: aggregate form only, with no re-identification of individuals.
11. Automated decision making
Golf Cart Lab makes no automated decisions that produce legal effects or similarly significant effects on you, as described in Article 22. The calculators on this site process only the values you type in and produce an estimate for you to read. The only profiling connected to this site is advertising personalisation carried out by our advertising partner, which happens solely where you have consented and which you can switch off at any time through the cookie notice or through Google Ads Settings.
12. Breach notification
If a personal data breach occurs and it is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, in line with Article 33. Where the breach is likely to result in a high risk to you, we will also notify affected individuals directly and describe what happened, what data was involved and what we are doing about it, in line with Article 34.
13. Complaints
If you are unhappy with how we have handled your data or your request, please contact us first so we can put it right. You also have the right to complain directly to a supervisory authority in the country where you live or work. EEA residents can find their national authority through the European Data Protection Board members list. UK residents can complain to the Information Commissioner’s Office.
14. Contact
Questions about this statement, our lawful bases, our processors or a request you have already sent are all handled at the same address, by our team.
Access, correction or erasure in one email
Put “GDPR request” in the subject line. We reply within one month, at no charge, as required by Article 12.
support@golfcartlab.comGolf Cart Lab // GDPR Compliance // Last updated July 2026