Privacy Policy

SpareCarPart Ltd ("SpareCarPart", "we", "us") is a UK-based marketplace that connects vehicle owners with independent breaker yards and parts suppliers. We are the data controller for personal data you provide to us through the website, mobile experience and customer support channels.

If you have any questions about this policy or how we handle your data, contact us at privacy@sparecarpart.com.

We collect only what we need to introduce you to suppliers, fulfil orders and run a safe marketplace. In plain English:

We process your personal data under the following lawful bases as set out in Article 6 of the UK GDPR:

• Contract — to provide the marketplace, send quote requests and process orders.
• Legitimate interests — to operate, secure and improve the service and prevent fraud.
• Legal obligation — to meet tax, accounting and consumer-protection duties.
• Consent — for marketing emails and non-essential cookies. You can withdraw consent at any time.

We share the minimum data needed to fulfil your request:

• With suppliers, so they can quote and dispatch the part you asked for.
• With service providers (hosting, payments, email, analytics) acting as data processors on our instructions.
• With authorities where required by law or to protect our rights or users.

We never sell your personal data.

We keep account data while your account is active and for up to 6 years after closure to meet UK tax and consumer-protection requirements. Marketing preferences are kept until you withdraw consent. Technical logs are typically deleted within 12 months.

Under UK GDPR you have the right to access, correct, delete, restrict, port and object to processing of your personal data, and to withdraw consent. To exercise any of these rights, email privacy@sparecarpart.com. We will respond within one month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

We use industry-standard safeguards including TLS encryption in transit, encryption at rest for personal data (database storage and backups), role-based access control, audit logging, and regular security reviews.

Multi-factor authentication. Supplier accounts can enrol time-based one-time-password (TOTP) MFA from Supplier security settings — recommended for everyone handling customer orders, and required for staff accounts.

No system is 100% secure — if we ever suspect a breach affecting you, we will notify you and the ICO as required by law.

You're in control of what we send you and what we measure:

• Marketing emails — opt in or out at any time from Your account → Communication preferences. We default to opted-out; we only email you when you tick the box.
• Cookies & tracking — toggle analytics and marketing cookies on Cookie preferences. Strictly-necessary cookies stay on because the site needs them to run.
• Transactional emails — quote replies, order updates and security alerts are always sent because they're part of the service you asked for.

We use the following third parties to run the Service. Each acts as a data processor on our written instructions under a Data Processing Agreement. A more detailed register is available on request.

We do not currently use any analytics, advertising, retargeting, A/B-testing or session-replay vendors. If we add one, we will update this list, refresh the cookie banner, and ask for fresh consent before it loads in your browser.

Some of our processors operate outside the UK. Where they do, we rely on UK adequacy regulations or the ICO's International Data Transfer Agreement to ensure your data remains protected to UK standards.

We may update this policy from time to time. Material changes will be flagged on the site or by email at least 14 days before they take effect.