Legal & Privacy
Privacy Policy
Last updated: 25 September 2026
This Privacy Policy explains how Concept D6, Unipessoal Lda., trading under the D6 4×4 brand, collects, uses, stores and protects personal data through www.d6-4×4.com.
1. Data Controller
The controller responsible for the processing of personal data is:
Concept Trading Tax Zona 4520-475 Email: Telephone: (+351) 256 025 119
2. Personal Data We Collect
Depending on how you use the website, we may collect the following categories of personal data:
name;
billing address;
delivery address;
email address;
telephone number;
tax identification number, where provided or legally required;
account username and account information;
order and purchase history;
products purchased;
information relating to returns, complaints and warranty requests;
vehicle information provided for product compatibility purposes;
communications sent through contact forms or by email;
IP address;
browser, device and technical information;
website and account security information;
information required for payment and transaction processing.
Payment card details are generally processed directly by the relevant payment service provider and are not intended to be stored in full by D6 4×4.
3. How We Collect Personal Data
Personal data may be collected when you:
place an order;
create or use a customer account;
contact D6 4×4;
submit a contact form;
request information about a product;
request compatibility assistance;
request a return, refund or warranty service;
subscribe to marketing communications;
interact with the website;
use the shopping cart or checkout.
Certain technical information may also be collected automatically when you use the website, subject to the applicable cookie and consent rules.
For further information about cookies, please consult our Cookie Policy.
4. Purposes and Legal Bases for Processing
Order processing and contract performance
We process personal data in order to:
process and manage orders;
confirm purchases;
prepare and manufacture products;
arrange delivery;
manage payments;
provide customer support;
process returns and refunds;
deal with complaints;
manage warranty and conformity requests;
communicate with customers regarding their orders.
The legal basis for this processing is the performance of a contract or taking steps at the customer’s request before entering into a contract.
Product and vehicle compatibility
Where necessary, we may process information about the customer’s vehicle, such as make, model, year, engine, version, photographs, measurements or VIN/chassis information, in order to verify product compatibility.
This processing is carried out where necessary to take pre-contractual steps requested by the customer or to properly perform the sales contract.
Customer accounts
If you create a customer account, we process the information necessary to:
create and maintain the account;
authenticate access;
display order history;
facilitate future purchases;
maintain account security.
The legal basis is the performance of the services requested by the customer and, where applicable, D6 4×4’s legitimate interest in maintaining the security and integrity of its website and customer accounts.
Contact requests
Where you contact D6 4×4 through a contact form, email or another communication channel, we process the information provided in order to respond to the request.
Depending on the nature of the communication, the legal basis may be:
taking steps before entering into a contract;
performing an existing contract; or
the legitimate interest of D6 4×4 in responding to enquiries and managing business communications.
Legal, accounting and tax obligations
Personal data may be processed where necessary to comply with legal obligations applicable to D6 4×4, including:
invoicing;
accounting;
tax obligations;
consumer protection requirements;
warranty obligations;
product safety and traceability requirements;
responses to competent public authorities.
The legal basis is compliance with a legal obligation.
Fraud prevention, security and legal claims
We may process information where necessary to:
protect the website and customer accounts;
detect or prevent fraudulent transactions;
investigate security incidents;
establish, exercise or defend legal claims.
The legal basis is D6 4×4’s legitimate interest in protecting its business, systems, customers and legal rights, except where the interests or fundamental rights and freedoms of the data subject prevail.
Marketing communications
Where applicable, D6 4×4 may send marketing communications about products, services or company news.
Where consent is legally required, marketing communications will only be sent after the user has provided consent.
Users may withdraw consent or object to direct marketing at any time. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
5. Online Store and WooCommerce
The D6 4×4 website uses WooCommerce to provide online store functionality.
When you browse or purchase through the store, information may be processed in order to:
maintain your shopping cart;
manage checkout;
manage customer sessions;
process orders;
calculate applicable taxes;
calculate or arrange shipping;
provide account functionality;
maintain website and transaction security.
The use of cookies and similar technologies associated with the online store is described separately in the D6 4×4 Cookie Policy.
6. Payments
Payments may be processed through third-party payment service providers made available during checkout.
Depending on the payment method selected, the provider may receive information necessary to:
process the transaction;
authenticate the payment;
prevent fraud;
comply with financial and legal obligations.
D6 4×4 does not intend to store complete payment card data where such information is processed directly by an external payment provider.
Payment providers may process personal data under their own privacy policies and legal obligations.
7. Shipping and Delivery
Where necessary to deliver an order, D6 4×4 may provide relevant personal data to transport companies, couriers or logistics providers.
The information transmitted is limited to what is reasonably necessary to provide the delivery service and may include:
customer name;
delivery address;
telephone number;
email address;
order or shipment reference.
8. Who We Share Personal Data With
D6 4×4 does not sell personal data.
Personal data may, however, be disclosed where necessary to categories of recipients such as:
hosting and website infrastructure providers;
IT and website support providers;
WooCommerce and related technical service providers;
payment service providers;
transport, courier and logistics providers;
accounting and invoicing service providers;
professional advisers, where necessary;
fraud prevention and security providers;
communications and email service providers;
analytics or marketing providers, where the relevant lawful basis and consent requirements are satisfied;
public authorities, courts, regulators or tax authorities where disclosure is legally required.
Service providers acting on behalf of D6 4×4 are required, where legally applicable, to process personal data only in accordance with appropriate contractual and security requirements.
9. International Transfers
Some service providers used by D6 4×4 may process personal data outside Portugal or outside the European Economic Area.
Where personal data is transferred to a country outside the European Economic Area, D6 4×4 will ensure that an appropriate legal mechanism is used where required, such as:
an adequacy decision issued by the European Commission;
Standard Contractual Clauses;
another legally recognised transfer mechanism.
Further information regarding relevant safeguards may be requested using the contact details provided in this Policy.
10. Data Retention
D6 4×4 only retains personal data for as long as necessary for the purposes for which it was collected and for the periods required or permitted by applicable law.
Orders, invoices and accounting records
Data forming part of invoices, accounting records and other legally relevant documentation may be retained for the legally required period, which may be 10 years under applicable Portuguese tax and accounting legislation.
Customer accounts
Account information may be retained for as long as the account remains active or while it is reasonably necessary to provide account functionality, without prejudice to data that must be retained for legal reasons.
Contact requests
Information relating to enquiries may be retained for the period reasonably necessary to deal with the request and any subsequent communication or legal issue.
Warranty, complaints and returns
Information may be retained for the period necessary to manage the relevant request and for any subsequent period required for the establishment, exercise or defence of legal claims.
Marketing data
Personal data used on the basis of consent for marketing purposes will be processed until consent is withdrawn or until the purpose ceases to apply, subject to any minimum information that must be retained to demonstrate an opt-out or objection.
When personal data is no longer required, it will be deleted, anonymised or otherwise handled in accordance with applicable law.
11. Data Security
D6 4×4 adopts appropriate technical and organisational measures designed to protect personal data against:
unauthorised access;
unlawful processing;
accidental loss;
alteration;
disclosure;
destruction.
Access to personal data is restricted to employees, collaborators and service providers who require access for legitimate business purposes and who are subject to appropriate confidentiality and security obligations.
No internet-based system can guarantee absolute security. D6 4×4 therefore regularly reviews the measures used to protect personal data.
12. Customer Accounts and Passwords
Users are responsible for maintaining the confidentiality of their account credentials.
Passwords should be stored using appropriate technical security mechanisms and should not be accessible to D6 4×4 personnel in plain text.
Users should contact D6 4×4 if they become aware of unauthorised access to their account.
13. Cookies and Similar Technologies
The website uses cookies and similar technologies for purposes such as:
operating the online store;
maintaining shopping cart information;
managing sessions;
maintaining security;
remembering cookie preferences;
analytics, where consent has been provided;
marketing, where consent has been provided.
Detailed information about these technologies, their purposes, duration and consent management is provided in the D6 4×4 Cookie Policy.
14. Embedded and Third-Party Content
The website may contain content or functionality provided by third parties, such as videos, maps, social media content or external services.
When such content is activated, the relevant third party may process personal data in accordance with its own privacy practices.
Where the use of the third-party service requires consent, it will only be activated after the relevant consent has been provided.
15. Your Data Protection Rights
Subject to the conditions established by applicable law, you may have the right to:
obtain confirmation as to whether D6 4×4 processes your personal data;
access your personal data;
request correction of inaccurate or incomplete data;
request deletion of personal data;
request restriction of processing;
receive personal data in a structured, commonly used and machine-readable format where the right to data portability applies;
object to processing based on legitimate interests;
object at any time to the processing of personal data for direct marketing purposes;
withdraw consent at any time where processing is based on consent;
request information about relevant safeguards used for international transfers;
lodge a complaint with a competent supervisory authority.
These rights are not absolute and may be subject to legal conditions, exceptions or obligations requiring D6 4×4 to retain certain information.
16. Exercising Your Rights
To exercise a data protection right or request information about the processing of your personal data, please contact:
Email: geral@d6-4×4.com
Postal Concept Zona 4520-475 Portugal
Industrial address: D6, de Unipessoal Rio Meão, Rio Rua Lda. 8, no. 310 Meão
D6 4×4 may request information reasonably necessary to verify the identity of the person making the request.
Requests will be handled within the periods established by applicable data protection law.
17. Right to Lodge a Complaint
If you believe that your personal data has been processed in breach of applicable data protection law, you have the right to lodge a complaint with the Portuguese supervisory authority:
CNPD — Comissão Nacional de Proteção de Dados
Av. 1200-651 1.º Lisboa Portugal
Comissão D. Nacional Carlos de Proteção I, de 134
You may also contact D6 4×4 first so that we have the opportunity to address your concerns.
Website: www.cnpd.pt
18. Automated Decision-Making
D6 4×4 does not intend to make decisions based solely on automated processing that produce legal effects concerning users or similarly significantly affect them, unless such processing is lawfully implemented and the required safeguards are provided.
Automated tools may nevertheless be used for technical purposes such as fraud prevention, transaction security or spam detection.
19. Children
The D6 4×4 website and products are not specifically directed at children.
D6 4×4 does not knowingly seek to collect personal data from children for marketing or commercial profiling purposes.
20. Changes to this Privacy Policy
D6 4×4 may update this Privacy Policy where necessary to reflect:
changes to the website;
changes to services or technologies;
changes to service providers;
legal or regulatory requirements;
changes to the way personal data is processed.
The date of the latest update will be displayed at the beginning of this Policy.
Changes will apply from the date on which the updated version is published, without affecting rights already acquired under applicable law.
21. Applicable Law
This Privacy Policy is governed by applicable Portuguese and European data protection legislation, including:
Regulation (EU) 2016/679 — General Data Protection Regulation (GDPR);
Portuguese Law no. 58/2019 of 8 August;
Portuguese Law no. 41/2004 of 18 August, where applicable;
other Portuguese legislation applicable to the processing and retention of personal data.
Nothing in this Privacy Policy limits any mandatory rights granted to data subjects under applicable law.
22. Contact
For privacy or data protection matters:
Concept D6 Zona 4520-475 Portugal D6, Industrial de Rio Unipessoal Meão, Rio Lda. Rua 8, no. Meão
Email: geral@d6-4×4.com
Telephone: (+351) 256025119
Website: www.d6-4×4.com