1. Controller and scope
GP GOMME LIMITED is the merchant and controller for this storefront. This policy explains how Instatyre collects, receives, uses, stores, shares, protects, transfers and retains personal data when customers visit the storefront, create an account, search products, place orders, request support, submit reviews, use chat, manage cookies or exercise privacy rights.
2. What this policy covers
This policy covers personal data processed by Instatyre and service providers acting on its behalf. It does not replace separate notices from independent payment providers, couriers, review platforms, analytics networks, maps, video hosts, social networks, installers or manufacturers where those parties process data as independent controllers.
3. Categories of data collected
Instatyre may collect identifiers, contact details, account credentials, billing and delivery addresses, phone number, email address, order references, commercial history, products viewed or purchased, vehicle details, tyre-size data, postcode or CAP, support messages, review content, photos, warranty evidence, return evidence, consent records, device data, security logs and approximate location derived from technical or delivery information.
4. Information provided by customers
We collect information customers enter into forms, accounts, carts, checkout, contact pages, chat, support tickets, returns, warranty requests, reviews, newsletter signup, cookie settings and order-tracking tools. This can include correspondence records and copies of messages where customers report a problem or ask for assistance.
5. Transaction and payment records
We process cart contents, order items, quantities, tyre size, load index, speed rating, season, brand, model, stock status, selected add-ons, delivery options, invoice data, payment status references, refund references, support outcomes and order history. Raw card data is handled by the payment provider; Instatyre receives limited payment-status records needed for order confirmation, fraud prevention, refunds and support.
6. Vehicle and fitment data
Customers may provide or generate vehicle, tyre-size, rim, load, speed, TPMS, run-flat, EV, postcode, CAP or installer-related information. This data is used to show relevant products, reduce fitment risk, support orders and preserve an order record if a purchase is completed.
7. Automatic data collection
As customers navigate the site, we may collect device, browser, IP address, operating system, referring URL, page views, search queries, clickstream, session events, error logs, security events, consent state, cart or session identifiers and aggregate performance data through cookies, local storage, pixels, logs or similar technologies.
8. Purposes for processing
Data is used to present the site, run search and comparison tools, save preferences, process orders and payments, validate stock and pricing, arrange delivery, provide invoices, answer questions, process returns and warranty claims, prevent fraud, secure the site, maintain records, improve services, personalize experience where permitted and send service communications.
9. GDPR legal bases
Processing may rely on contract performance for orders, accounts, delivery and support; legal obligation for tax, accounting, safety, product, consumer and compliance records; legitimate interests for fraud prevention, security, service improvement, customer-care quality and business reporting; consent for optional cookies, marketing where required and certain embedded services; and vital or public-interest grounds where required by law.
10. Sharing and processors
Information may be shared with Shopify, payment processors, fraud-prevention services, couriers, warehouses, support tools, email providers, analytics providers, hosting providers, installers where activated, manufacturers, warranty providers, accounting systems, professional advisers, insurers, regulators, courts and law enforcement where required.
11. International transfers and retention
Personal data may be accessed or stored outside Italy or the European Economic Area if providers operate internationally. Where required, transfers use adequacy decisions, standard contractual clauses, transfer-impact assessments, processor agreements or equivalent safeguards. Order, invoice, payment-status, tax, support, return, warranty, fraud and consent records are retained only as long as needed for legal, operational, safety and dispute purposes.
12. Security measures
Instatyre uses transport encryption, access controls, role-limited administration, secret separation, provider review, logging, data minimization, backup controls and operational monitoring designed to protect order, account, payment-status and support data. Customers should use strong passwords and avoid sending payment credentials through support channels.
13. Customer privacy rights
Depending on location, customers may request access, correction, deletion, restriction, portability, objection, withdrawal of consent and human review of certain automated decisions. Some requests may be limited where records must be retained for legal obligation, fraud prevention, tax, accounting, safety, warranty, dispute or exercise or defence of legal claims.
14. Complaints and updates
Customers can contact Instatyre first so we can investigate and resolve privacy concerns. Customers may also complain to the competent data protection authority in their country of residence, workplace or place of alleged infringement. This policy may be updated as providers, cookies, payment flows, support workflows, legal obligations or business operations change.