Privacy Policy
Last updated: August 2026 (Version 2.0)
1. Introduction & Data Controller
The Parts Shop ("we", "us", or "our") operates as the data controller for personal information collected through our online marketplace and mobile applications. We are committed to protecting your privacy and handling your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Information We Collect
We collect personal information that you provide directly to us, as well as technical data generated during your use of the platform:
Account & Identity Data: Full name, email address, password (stored strictly as cryptographic hashes), and telephone number.
Postal & Verification Data: Physical street address, city, postcode, country, and proof of address/seller onboarding data.
Vehicle & Listing Data: Vehicle registration plates (DVLA lookup data), vehicle specifications, part serial/OEM numbers, listing photographs, and descriptions.
Transactional & Payment Records: Item details, negotiated prices, Buyer Protection Fees, payout transaction IDs, and 6-digit local pickup verification codes. (Note: Full credit/debit card details and bank account numbers are processed securely by Stripe and are never stored on our servers).
Platform Communications: Messages sent via our in-app direct chat portal and dispute negotiation threads.
3. How We Use Your Data & Lawful Bases
We process your personal information under the following lawful bases:
Contractual Necessity: To manage your account, process payment transactions, facilitate item delivery or local collection, and release seller payouts.
Legitimate Interests: To prevent fraud, moderate platform messaging, resolve buyer/seller disputes, maintain audit ledgers, and improve vehicle compatibility fitment algorithms.
Consent: To send our optional "Workshop Dispatch" email newsletter. You can opt out at any time via the link in the email or within your dashboard profile settings.
Legal Obligation: To comply with UK accounting, tax, and anti-fraud reporting requirements.
4. Third-Party Service Providers & Data Sharing
We do not sell, rent, or trade your personal information. We share data only with verified third-party processors necessary to operate the platform:
Payment & Transaction Processing: Stripe, Inc. processes card payments, manages secure transactions, and facilitates direct bank transfers via Stripe Connect.
Shipment Tracking: TrackingMore receives carrier codes and tracking numbers to push real-time delivery status updates to our platform.
Transactional Communications: Mailgun Technologies dispatches system emails, password reset links, and 6-digit login verification codes.
Vehicle Lookup APIs: Commercial DVLA data providers process inputted registration numbers to retrieve vehicle make, model, and year specifications.
Cloud Infrastructure & Hosting: Google Cloud Platform (GCP) hosts our managed databases, file storage, and server environments.
AI Search & OCR Scanning: Google Gemini API processes uploaded part images and search phrases for optical character recognition (OCR) and technical fitment parsing. No personal user data is shared or retained for public AI model training.
Buyer-Seller Transaction Sharing: When a purchase is completed, the buyer’s full name and delivery address are shared with the seller solely for fulfilling shipping.
5. Data Security & Storage
All data transmissions are encrypted using standard SSL/TLS encryption. Passwords, verification codes, and reset tokens are salted and stored using irreversible cryptographic hashes. User data is hosted on secure cloud servers located within the UK and EEA.
6. Data Retention
We retain personal information for as long as your account remains active. Transaction and dispute audit logs are maintained for up to 6 years following transaction completion to satisfy UK legal, tax, and financial dispute obligations.
7. Your Legal Rights
Under the UK GDPR, you have the right to:
Access: Request a copy of the personal information we hold about you.
Rectification: Update inaccurate or incomplete details via your Profile Settings tab.
Erasure ("Right to be Forgotten"): Request the deletion of your account and personal data, subject to statutory transaction retention requirements.
Restriction / Objection: Object to or restrict certain types of processing.
Withdraw Consent: Unsubscribe from marketing communications at any time.
To exercise any of these rights, contact support through our Help Center or dashboard. If you are unsatisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.