Privacy policy

Who we are and how to contact us

Controller: Partsformed
Privacy contact: privacy@partsformed.com
If you are located in the EEA/UK, you may also contact us at this email to reach our EU/UK point of contact for privacy matters.

Scope

This Policy applies to information we collect:

• on the Site (including contact/checkout forms and accounts),
• via email, phone or chat communications with us related to the Site,
• via cookies and similar technologies on the Site.

This Policy does not apply to information processed by independent third parties you reach from external links, or to protected health information governed by HIPAA (we do not collect PHI through the Site).

What data we collect and sources

Data you provide:

• Identification and contact data (name, company, email, phone, shipping/billing address).
• Account credentials (if you create an account).
• Order information (cart contents, purchased items, delivery instructions, invoices).
• Communications (support requests, messages, uploaded files).
• Marketing preferences and consents (e.g., email/SMS).

Data collected automatically:

• Device/usage data (IP address, approximate location derived from IP, timestamps, pages viewed, referring/exit pages, user agent, language, and similar event data).
• Cookie/SDK identifiers and similar online identifiers.

Data from third parties:

• Payment processors (payment status; we do not receive full card numbers).
• Logistics/fulfilment and fraud-prevention partners (verification or risk signals).
• Public or commercial sources (e.g., business contact info in B2B contexts), where permitted by law.

Purposes of processing and legal bases (GDPR/UK GDPR)

We process personal data to:

• Perform a contract and provide the Site/services (process and deliver orders, provide support, manage accounts).
• Operate and secure the Site (debugging, monitoring, preventing fraud and abuse).
• Improve our services and user experience (analytics, product/service development).
• Send transactional communications (order updates, service notices).
• Send marketing communications with your consent (where required) and honor your right to opt out at any time.
• Comply with legal obligations (tax, accounting, sanctions/export, regulatory requests).
• Pursue legitimate interests (B2B communications, measuring campaign performance), balanced against your rights. You may object to processing based on legitimate interests (see §10).

Cookies and similar technologies

We use cookies and similar technologies to operate the Site, remember settings, analyze traffic, and (where enabled) support advertising/retargeting.

• Consent: In the EEA/UK, non-essential cookies are used only with your consent.
• Preferences: You can manage cookie preferences via our cookie banner or your browser settings.
• Analytics: We use privacy-respecting analytics practices (e.g., GA4 with IP masking and data-retention limits) and do not allow analytics vendors to use our data for their own purposes without your consent.

Disclosure of personal data

We disclose data to:

• Service providers/processors under contract (hosting/CDN, analytics, email/SMS, payment processing compliant with PCI-DSS, fulfilment and couriers, customer support tools, security/fraud prevention).
• Business partners only as needed to fulfill your order (e.g., customs brokers/shippers for international deliveries).
• Authorities or third parties when required by law or to protect rights, safety, and security.
• Corporate transactions (e.g., merger, acquisition) where permitted by law.

We do not sell personal information, and we do not share it for cross-context behavioral advertising as defined by the California Consumer Privacy Act, as amended by the CPRA (“sale”/“sharing”). If we ever begin such practices, we will update this Policy and provide a “Do Not Sell or Share My Personal Information” link.

International transfers

We may transfer personal data to countries outside your own, including to the United States and other jurisdictions where our service providers operate. Where required, we use appropriate safeguards (e.g., EU Standard Contractual Clauses and UK addenda) and supplementary measures consistent with applicable law.

Retention

We retain personal data only as long as necessary for the purposes described above, including to meet legal, accounting, or reporting requirements, and then delete or anonymize it. Typical examples:

• Order/transaction records: up to 7 years (tax/accounting).
• Support messages: up to 2 years after resolution.
• Marketing data: until you opt out or after a defined inactivity period.
• Cookies: per the durations shown in the Cookie Policy.Changes to the privacy policy

Security

We implement appropriate technical and organizational measures designed to protect personal data, including encryption in transit, access controls, least-privilege practices, and vendor due diligence. No method of transmission or storage is 100% secure; if we detect a breach affecting you, we will notify you and regulators as required by law.

Your rights

Your rights depend on your location. Where applicable (e.g., GDPR/UK GDPR), you may request:

• Access to your data and a copy (data portability in common formats).
• Correction of inaccurate data.
• Deletion (“right to be forgotten”).
• Restriction or objection to certain processing (including legitimate-interest processing and direct marketing).
• Withdrawal of consent at any time (for activities based on consent).
•  Lodge a complaint with your data-protection authority.

How to exercise your rights: email privacy@partsformed.com. We may need to verify your identity and ask for additional details to process your request.

 U.S. state privacy notices (e.g., CA/VA/CO/CT/UT)

If you are a resident of a U.S. state with a comprehensive privacy law, you may have the right to know/access, delete, correct, opt out of targeted advertising, profiling, or “sale/sharing” (where applicable), and to appeal our decision. We will not discriminate against you for exercising your rights. Submit requests to privacy@partsformed.com; authorized agents may act on your behalf subject to verification.

Children’s privacy

The Site is not directed to children under 13 (or under 16 in jurisdictions that require parental consent for marketing). We do not knowingly collect personal data from children. If you believe a child has provided personal data, contact privacy@partsformed.com and we will delete it promptly.

Third-party links

The Site may contain links to third-party sites or services not controlled by Partsformed. We are not responsible for their content or privacy practices. Review their policies before providing data.

Changes to this Policy

We may update this Policy from time to time. The “Effective date” shows when it was last revised. Material changes will be highlighted on this page and, where required by law, we will seek your consent.

Contact

Questions or requests about this Policy: privacy@partsformed.com
Add your postal address and, if applicable, the contact of your EU/UK representative and a toll-free number for California residents.

Additional disclosures for business customers (B2B)

Where we act as a processor for a customer (e.g., handling data under a purchase or service agreement), our processing is governed by the applicable contract and data-processing addendum (DPA). Where we act as a controller (e.g., Site analytics, our marketing), this Policy applies.