Privacy Policy

1. Who we are

This Privacy Policy explains how PartCycle Ltd ("PartCycle", "we", "us", "our") collects, uses and protects information about you when you use our website at partcycle.co.uk (the "Site") and our services.

We are the data controller responsible for your personal data under the UK GDPR and the Data Protection Act 2018.

2. Information we collect

We collect the following categories of personal data:

Information you give us

• Account details: name, email address, password (encrypted), phone number
• Delivery address: when you place an order or save an address
• Order history: what you've bought, when, and the price paid
• Vehicle registration numbers when you use our reg lookup feature
• Communications: messages, enquiries and support requests you send us

Information collected automatically

• Technical data: IP address, browser type, device type, operating system
• Usage data: pages visited, time spent on pages, referring URL
• Cookies: see our Cookie Policy for details

Information from third parties

• DVLA: vehicle details when you enter a registration number
• Payment processors: confirmation of payment status (we do not see or store card details)

3. How we use your information

We use your personal data on the following legal bases:

To fulfil our contract with you

• Process and dispatch orders
• Provide customer support
• Handle warranty claims and returns
• Send order confirmations and dispatch notifications

For our legitimate interests

• Improve our website and services
• Prevent fraud and protect our network
• Maintain business records

To comply with legal obligations

• Keep records for tax and accounting purposes (minimum 6 years per HMRC)
• Respond to lawful requests from public authorities

With your consent

• Send marketing emails (you can opt out at any time)
• Place non-essential cookies (see our Cookie Policy)

4. Who we share your data with

We share your data only with the following recipients, and only where necessary:

• Supabase (database and authentication provider — EU/UK based)
• Cloudflare (website hosting and security)
• Payment processors (Stripe or similar — only what's needed to take payment)
• Couriers (delivery address only, for dispatching orders)
• HMRC and other authorities where legally required

We do not sell your data to third parties. We do not share it for marketing purposes.

5. International transfers

Some of our service providers may process data outside the UK. Where this happens, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the UK Information Commissioner.

6. How long we keep your data

• Account data: until you delete your account, plus 6 years for tax records
• Order data: 6 years from the order date (HMRC requirement)
• Enquiries and support: 2 years
• Marketing preferences: until you withdraw consent

7. Your rights

Under UK GDPR, you have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your data (where not legally required for us to keep it)
• Restrict processing in certain circumstances
• Object to processing based on legitimate interests
• Data portability — receive your data in a portable format
• Withdraw consent at any time, where consent is the basis
• Lodge a complaint with the Information Commissioner's Office (ico.org.uk)

To exercise any of these rights, email privacy@partcycle.co.uk. We will respond within one month.

8. Security

We take security seriously. Passwords are hashed using bcrypt and never stored in plain text. Connections to our site are encrypted using TLS. We use industry-standard cloud providers (Supabase, Cloudflare) with their own robust security practices. However, no method of transmission over the internet is 100% secure.

9. Children

Our services are not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Changes to this policy

We may update this policy from time to time. Significant changes will be communicated by email or a prominent notice on the site. The "last updated" date at the top shows the most recent version.

11. Contact

Questions about this policy or your data:

Email: privacy@partcycle.co.uk
Post: [Registered address]