1. Introduction and Data Controller
Thank you for your interest in our website.
This Privacy Policy describes how we collect, use, disclose, and safeguard personal data when you browse our website, get in touch with us, register an account, place an order, or request a withdrawal from a contract.
2. Data Generated by Simply Browsing the Site
When you visit our website without registering or submitting any information, our server automatically processes certain technical data sent by your browser, which may include:
- the page or file you requested
- date and time of the request
- volume of data transferred
- referring page or source
- browser type and version
- operating system
- your IP address (shortened or anonymised where feasible)
- HTTP status codes and other diagnostic information
We rely on our legitimate interest under Art. 6(1)(f) GDPR in keeping the website secure, stable, and functioning correctly, in identifying technical faults, and in preventing misuse. Server logs may be reviewed specifically where there is reason to suspect unlawful activity or a security incident.
The site uses SSL/TLS encryption to protect data in transit; an encrypted connection is generally shown by “https://” and a padlock icon in the browser bar.
3. Hosting and Infrastructure Providers
We rely on external hosting and infrastructure providers to operate this website. These providers may, on our behalf, process page content, server logs, IP addresses, and other technical connection data. This is based on Art. 6(1)(f) GDPR and, where the provider acts as a processor for us, on a data processing agreement under Art. 28 GDPR.
If any provider processes data outside the European Economic Area, we put an appropriate transfer safeguard in place (e.g. an adequacy decision or standard contractual clauses) as required by law.
4. Cookies and Consent
This website uses cookies and comparable technologies — small files stored on your device. Some are strictly necessary to make core features work (cart, checkout, login, language preference, security); others are only used for analytics or additional functionality, and only after you’ve given consent.
Necessary cookies are processed under Art. 6(1)(b) GDPR (to deliver a service you’ve requested) or Art. 6(1)(f) GDPR (our legitimate interest in a secure, working site). Non-essential cookies rely on your consent under Art. 6(1)(a) GDPR.
You can manage or withdraw consent at any time via the cookie settings on our site, and you can configure your browser to block or delete cookies — though disabling necessary cookies may break parts of the site.
5. Contact Forms and Enquiries
When you reach out by email or via a contact form on our website, we process what you submit — typically your name, email address, order number, and message.
The legal basis is Art. 6(1)(b) GDPR where your message relates to an order, a contract, a warranty claim, or a return/withdrawal request. For general enquiries, we rely on our legitimate interest in responding efficiently, under Art. 6(1)(f) GDPR.
Submissions may also carry technical metadata (timestamp, IP address, browser details) used for security and spam prevention. We delete this data once the matter is resolved, unless we’re required to keep it longer for legal or accounting reasons.
6. Accounts, Orders, and Contract Processing
Creating an account or placing an order involves processing the data needed to fulfil that contract, which may include:
- name and, where applicable, company name
- billing and delivery address
- email address and phone number
- order details — products, quantities, prices, currency
- payment method and payment status
- VAT ID, where provided
- shipping and tracking details
- your correspondence with us, including returns, complaints, and warranty claims
This is based on Art. 6(1)(b) GDPR (performing the contract) and, where data is needed for accounting, tax, customs, or product-compliance obligations, on Art. 6(1)(c) GDPR.
Where a product requires safety updates or compliance notices, we may use your contact details to send this legally required information, under Art. 6(1)(c) or Art. 6(1)(b) GDPR as applicable.
7. Payment Processing
Depending on the payment method chosen, payment details may be processed both by us and by the relevant payment provider. We typically do not see or store full card numbers. Providers process payment data under their own legal bases and privacy notices.
Bank transfer — We process the payment reference, payer details shown on the transaction, amount, date, and status, under Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(c) GDPR (accounting obligations).
PayPal — If offered and selected, your payment data is sent to PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, under Art. 6(1)(b) GDPR. PayPal’s privacy notice: https://www.paypal.com/webapps/mpp/ua/privacy-full
Stripe / card payments / Apple Pay / Google Pay — If offered, your data may be processed by Stripe Payments Europe, Limited (Ireland) and related entities, and by Apple or Google for their respective wallets, under Art. 6(1)(b) GDPR. More information: https://stripe.com/privacy https://policies.google.com/privacy https://www.apple.com/legal/privacy/
Only the payment options actually shown at checkout are available to you.
8. Shipping Providers
To deliver your order, we pass the necessary details — typically recipient name, delivery address, and shipment information — to the selected carrier or postal operator, under Art. 6(1)(b) GDPR.
If you’ve consented to delivery notifications, or where it’s necessary to complete delivery, we may also share your email or phone number with the carrier, under Art. 6(1)(a) or 6(1)(b) GDPR as applicable.
The carrier used depends on destination, parcel type, and the shipping method selected. Carriers process shipment data under their own privacy notices and legal obligations.
9. VAT Number Verification
Where a business customer provides a VAT ID, we may verify it via official databases such as the EU VIES system, processing the VAT number, company name, and address for that purpose. This relies on Art. 6(1)(c) GDPR where legally required, and otherwise on our legitimate interest under Art. 6(1)(f) GDPR in applying correct tax treatment.
10. Google reCAPTCHA
We may use Google reCAPTCHA (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to tell human visitors apart from bots and protect our forms from spam and abuse.
reCAPTCHA can process technical and behavioural signals — IP address, browser and device data, time on page, interaction patterns — under Art. 6(1)(f) GDPR (our legitimate interest in protecting the site), or under Art. 6(1)(a) GDPR where consent is required for the specific implementation.
Data may be transferred to Google outside the EEA under appropriate safeguards. More: https://policies.google.com/privacy
11. Google Analytics
Where enabled, we use Google Analytics (Google Ireland Limited, Dublin, Ireland) to understand site usage and traffic via cookies or similar technologies.
Analytics only runs with your consent, under Art. 6(1)(a) GDPR, which you can withdraw anytime via our cookie settings. Where available, we apply privacy-friendly settings such as IP controls and limited retention.
Data may be processed by Google outside the EEA under appropriate safeguards. More: https://policies.google.com/privacy
12. Transactional Email Delivery
We use Google’s email infrastructure (Google Workspace/Gmail SMTP) to send transactional and service-related emails, including order confirmations, password resets, contact-form replies, and other necessary communications.
Depending on the configuration, message content, sender and recipient email addresses, and delivery-related metadata may be processed by Google for the purpose of delivering these emails.
The processing of personal data for contract-related communications is based on Art. 6(1)(b) GDPR, and processing necessary for reliable email delivery is based on Art. 6(1)(f) GDPR. Where applicable, Google acts as a data processor under the relevant data protection terms.
13. Comments and Reviews
(Only if your site allows product reviews/comments.)
If you leave a comment or review, we may process and display your chosen name, the content submitted, any rating, and the submission time. We may also process your email and IP address for verification, abuse prevention, and moderation.
This relies on Art. 6(1)(b) GDPR where linked to a customer relationship, and otherwise on our legitimate interest in running and moderating these features under Art. 6(1)(f) GDPR. We may remove content that is unlawful, misleading, abusive, or fraudulent.
14. Who We Share Data With
We only disclose personal data where necessary and lawful, which may include:
- hosting, IT, security, and email service providers
- payment providers and banks
- carriers, postal operators, and customs intermediaries
- accounting, tax, and legal advisers
- public authorities, courts, or law enforcement, where legally required
- official VAT/business verification services
Each recipient only gets what it needs for its specific task, and processes it under its own data protection obligations.
15. International Transfers
Where a service provider processes data outside the EEA, we ensure a valid transfer mechanism is in place — such as an adequacy decision under Art. 45 GDPR, standard contractual clauses under Art. 46 GDPR, or another lawful safeguard.
16. How Long We Keep Data
We keep personal data only as long as necessary for its purpose, and in line with legal retention requirements:
order, invoice, accounting, and tax records are kept for the period required EU law
support correspondence is kept until resolved, and afterwards only as long as needed to establish or defend legal claims
consent-based data is kept until consent is withdrawn, unless another legal basis applies
server and security logs are kept only as long as needed for operations, troubleshooting, and fraud prevention
account data is kept while the account is active, and afterwards only where legally required
Once the relevant purpose and retention period end, data is deleted or anonymised unless the law requires otherwise.
17. Your Rights under the GDPR
Subject to the conditions set by law, you have the right to:
access your data (Art. 15 GDPR)
have inaccurate data corrected (Art. 16 GDPR)
request erasure (Art. 17 GDPR)
request restriction of processing (Art. 18 GDPR)
be notified of corrections/erasures made (Art. 19 GDPR)
receive your data in a portable format (Art. 20 GDPR)
object to processing (Art. 21 GDPR)
withdraw consent at any time (Art. 7(3) GDPR)
lodge a complaint with a supervisory authority (Art. 77 GDPR)
To exercise any of these, contact us at hfvhfparts@gmail.com. We may ask you to verify your identity before acting on your request.
18. Right to Object
Where we process data based on our legitimate interests (Art. 6(1)(f) GDPR), you may object at any time for reasons relating to your particular situation.
If you do, we will stop that processing unless we can show compelling legitimate grounds that override your rights, or the processing is needed to establish, exercise, or defend a legal claim.
If we process your data for direct marketing, you can object to that at any time — after which we will stop using your data for marketing purposes.
19. Right to Lodge a Complaint
You may lodge a complaint with the supervisory authority in the EU country of your habitual residence, place of work, or where the alleged infringement occurred.
20. Data Security
We apply appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, or unauthorised access or disclosure — including encrypted connections, access controls, regular updates, backups, authentication measures, and security monitoring.
No method of transmission or storage can be guaranteed 100% secure. Please keep your account credentials confidential and notify us promptly if you suspect any unauthorised access.
21. Changes to This Policy
We may update this Privacy Policy to reflect changes to our website, service providers, legal requirements, or processing activities. The version published here is the current one.
Last updated: 1 Sep 2026