Privacy policy

Last updated: 8 October 2026

1. Who we are

Eamon Bishop & Sons Limited, trading as Rebel Performance (“we”, “us”), is responsible for the personal data described in this policy. Our business address is Bishop Motors, Newry Road, Dundalk, Co. Louth, A91 TY77, Ireland.

This policy covers our online shop, website enquiries and expo offer signups. We handle personal data under the EU General Data Protection Regulation (GDPR), the Irish Data Protection Act 2018 and applicable electronic communications rules.

For privacy questions, requests or marketing opt-outs, email info@rebelperformance.ie, call +353 42 933 8312, or write to the address above.

2. What we collect and why

We collect information you provide and the limited technical information needed to operate and protect the website. We use it for the following purposes:

• Orders, delivery, accounts and returns: your name, contact details, billing/delivery addresses, order contents, payment status and relevant correspondence. We use this to fulfil our contract with you, take steps you request before a purchase, and meet accounting and other legal obligations. Shopify, payment providers and delivery providers supply information needed to process and support your order.
• Enquiries and product advice: your name, email, message and any phone number, vehicle or order information you choose to provide. Our basis is taking steps towards or performing a contract where your enquiry concerns a purchase; otherwise it is our legitimate interest in answering questions and providing customer support.
• Expo offer requests: your name, email, the campaign, whether you arrived through the kiosk link, submission time and your email preferences. When you submit the form to request the offer, you consent to us using those details to send that offer and handle related correspondence. We also keep the version of the privacy/consent wording and any optional marketing consent.
• Optional product news and offers: your name, email and consent record. We use these for further email marketing only if you opt in. Our basis is consent.
• Website analytics: with your analytics consent, Rybbit helps us understand page visits, referring pages, outbound-link clicks and the use of our site. It receives technical request/device information and visited URLs, including URL parameters, and uses a browser visitor identifier. Analytics consent is separate from email marketing consent.
• Website operation and security: basket identifiers, IP addresses, request/browser information, error records and limited abuse-prevention identifiers. Our legitimate interests are keeping the shop working, preventing fraud and spam, investigating faults and protecting customers and systems.
• Legal and administrative matters: information needed to meet legal duties, respond to lawful requests, or establish, exercise or defend legal claims. We rely on the relevant legal obligation or our legitimate interest in managing and protecting the business.

Required form fields are marked. Without the information needed for an order or enquiry, we may be unable to fulfil it or reply. Optional marketing consent is not required to buy a product, get help or receive the expo offer you requested. Please do not put payment-card details or unnecessary sensitive information in enquiry forms.

Payments are handled through Shopify checkout and the payment provider you select. Our website enquiry form and expo signup do not collect your card number.

3. Expo emails and marketing choices

Requesting the expo offer allows us to email you about that offer. The separate, unticked marketing checkbox is your choice about receiving future Rebel Performance product news and offers. We do not treat a purchase, an enquiry or an expo offer request as permission for unrelated marketing.

You can withdraw consent at any time using the unsubscribe method in a marketing email or by emailing us. We will stop the relevant marketing. Withdrawal does not affect the lawfulness of earlier use of your data, and we may still send messages needed to handle an order or a request you have made.

We keep a limited record of an opt-out where needed to ensure your address is not added back to a mailing list.

4. Who receives information

Access is limited to the people and providers who need the information for the purposes above. These include:

• Shopify: the shop platform, basket, checkout, customer accounts and order administration.
• Railway: hosting the website and storing expo submissions.
• Postmark: delivering website emails and recording delivery results.
• Rybbit analytics hosted at analytics.podium.dev: measuring website use with your permission, with access limited to authorised website support providers.
• Payment providers, couriers and fulfilment suppliers: the information required for your selected payment, delivery, return or related service.
• Authorised support providers and professional advisers: for website support, accounting, legal advice and resolving claims, where necessary.
• Public authorities: where disclosure is legally required or justified by a lawful request.

We do not sell your personal data. Providers processing data on our behalf must act under appropriate contractual instructions and safeguards. Some providers, including payment services and some Shopify services, also act as independent controllers for purposes described in their own privacy notices.

Links to social networks and other websites take you to services with their own privacy practices. The links themselves do not subscribe you to our marketing.

5. International processing

Our providers may process information outside Ireland and the European Economic Area, including in the United States and Canada. Postmark's email infrastructure includes US processing; Shopify and Railway use international infrastructure and support arrangements.

Where required, transfers are protected by a relevant European Commission adequacy decision or approved safeguards, such as Standard Contractual Clauses. Shopify also uses approved Binding Corporate Rules for relevant transfers within its group. You can ask us for information about the safeguards relevant to your data and a copy, subject to necessary protection of confidential information.

6. How long we keep information

We keep personal data only for as long as needed for its purpose, taking account of legal duties, outstanding requests and disputes. The criteria are:

• Accounting and transaction records: normally six years after the relevant accounting/tax period, or longer where an investigation or unresolved legal claim requires it.
• Enquiries and support: for as long as needed to answer and close the enquiry. Records needed for an order, warranty issue or legal claim follow the relevant record's retention period.
• Expo offer requests: until the requested offer and related follow-up have been completed, unless you separately opted into further marketing or the information is needed for an ongoing order or complaint.
• Marketing: while your consent remains valid and the contact is relevant, until you withdraw consent or the record is removed. We keep only the limited opt-out evidence needed to prevent further unwanted marketing.
• Analytics, security and email delivery records: for the period needed to understand website use, investigate failures or abuse, and meet the relevant provider's retention settings. Information needed for a specific incident or legal claim may be kept until that matter is resolved.

You can contact us about deletion or the retention period relevant to your data. These criteria also apply to working exports and copies. Backup copies are removed through the applicable backup cycle and are not reused for marketing.

7. Cookies and similar technologies

The shop uses a first-party basket cookie called rebel_shopify_cart when you create or update a basket. It links your browser to your Shopify basket and lasts up to 30 days from its last update, unless you delete it sooner. Deleting or blocking it can prevent your basket from being remembered.

Shopify checkout, account sign-in and payment services may use additional cookies and security technologies. Relevant information and any required choices are provided on those services. Our expo form does not save your name or email in browser storage.

Rybbit's script uses local storage for a visitor identifier named rybbit-visitor-id; the script does not set an automatic expiry for that identifier. It remains until the site's browser storage is cleared, you reject analytics, or you next visit after your consent choice expires. Its current settings track page visits, URL parameters and outbound links; session replay and form-interaction tracking are disabled.

Non-essential analytics runs only after you choose “Accept analytics”. You can withdraw it using the “Privacy choices” button on our website and choosing “Reject analytics”. We store your choice in a first-party cookie called rebel_analytics_choice for up to 180 days. Rejecting analytics stops further tracking on the current page by reloading it and removes the visitor identifier from this browser. The expo email checkbox does not control analytics. You can also delete cookies and local storage through your browser settings.

8. Security and automated decisions

We use appropriate technical and organisational measures, including encrypted website connections and access restrictions. No system can provide an absolute security guarantee. Only provide information needed for your enquiry or purchase.

Rebel Performance does not use your expo signup or enquiry data to make decisions that have legal or similarly significant effects on you based solely on automated processing. Payment providers may carry out their own fraud, identity or credit checks under their notices. Contact us if you need human help with an order issue.

9. Your rights

Depending on the circumstances, you can ask to access your personal data, correct it, delete it, restrict its use, or receive a portable copy. You can object to processing based on legitimate interests and object to direct marketing at any time. Where we rely on consent, you can withdraw it at any time.

Contact info@rebelperformance.ie. We may request proportionate information to verify your identity. We normally respond within one month. If a permitted extension is necessary because a request is complex or there are several requests, we will explain within that month; an extension can be up to two further months.

You can complain to Ireland's Data Protection Commission, or another competent supervisory authority. You do not need to contact us first to exercise that right.

10. Changes to this policy

We will update the date above when this policy changes. We will bring material changes to your attention where appropriate and seek fresh consent where required before using information for a new purpose.