Who we are
Partsyol runs this marketplace for used car parts and decides how personal data on it is processed — under the EU General Data Protection Regulation (GDPR) we are the controller, except for the car-purchase records sellers keep in their workspace (see “Data we keep for sellers”). You can reach us with any privacy question or request at the contact below.
- Company
- Being added
- Address
- Being added
- Registration number
- Being added
- VAT number
- Being added
- Privacy questions and requests
- Being added
Your account
When you create an account we store your e-mail address and your password. The password is stored only as a secure hash by our sign-in service — nobody at Partsyol can read it. You may add a display name. We also store your language and the kind of account you chose (private buyer, garage or seller).
If you sign in with Google, Google tells us your name, your e-mail address and an account identifier; we use the name as your display name. We never receive your Google password. You only use Google if you choose the “Continue with Google” button.
For a garage account we also store the garage's legal and trading name, VAT and registration numbers, address and the people you add as staff. For a seller (dismantler) account we store the company details, a contact person, VAT and registration numbers, the staff members of the business and, when the EU's platform reporting rules (DAC7) apply to the seller, the details those rules require — such as tax identification number, tax residence and a bank-account reference. Those details are visible to the seller's own members in masked form and to our finance staff.
Why: to create and run your account and to provide the marketplace to you (performance of our contract with you); for sellers' tax details, because the law requires us to report them (legal obligation).
Our sign-in service keeps security records of sign-ins and account changes, which can include your IP address and browser, to protect your account against misuse (our legitimate interest in security).
Buying a part
When you order, we store your name, e-mail address, delivery address, the invoice details (for a business: company name, address and VAT number), if you give it an optional phone number for the courier, what you ordered, the prices and the status of payment, shipment and any return.
- The seller of your order sees your name, delivery address, invoice details and — if you gave it — the courier phone. The seller never sees your e-mail address: questions about an order go through Partsyol's messages.
- If you order without an account, we do not keep your e-mail address in readable form: we store only a one-way fingerprint (hash) of it, and you follow your order with a private link we give you.
- Business VAT numbers are checked with VIES, the European Commission's VAT number service; we keep the answer as proof of the check.
- Invoices, credit notes and the order record are kept as long as the tax and accounting rules that apply to us require.
- Payments run in test mode at the moment: no card or bank details are collected. Before real payments start, the payment provider will be named here.
Why: to process your order and deliver it (contract); to issue invoices and keep records the law requires (legal obligation).
Messages, questions, reviews and support
- Order messages between you and the seller, with any attachments, are stored with the order and visible to the people taking part in that order's conversation and to our support staff. When a message seems to contain a phone number or e-mail address we show a warning: contact should stay on the platform so that we can help if something goes wrong.
- Questions to sellers and part requests: sellers receive only the vehicle and part specification you enter (for example a VIN or part number) — never your name, e-mail or phone. A part request goes to at most ten sellers who stock that make and ship to your country.
- Reviews you write after a delivery (rating, comment) are public on Partsyol, and the seller can reply.
- Garage quotes: a garage can send a quote to its customer; we keep only a masked hint of the customer's contact details.
- Support conversations between sellers and Partsyol are visible to that seller's members and to our support staff.
- Reports of abusive content are kept with the reporter's account so that our moderators can handle them; moderators can remove messages, attachments and reviews.
Why: to run the marketplace and resolve problems with orders (contract), and to keep the platform safe and fair (legitimate interest).
Data we keep for sellers
Dismantlers can record in their workspace from whom they bought a car. They may record only the seller's name, address and contact details (phone and e-mail) — never an identity-document or ID number. The phone and e-mail are deleted automatically one month after they are saved; the name and address stay with the purchase record. Only the dismantler's own business and our administrators can see these details; they are never shown on the public site.
For these records the dismantler is the controller and Partsyol processes them on the dismantler's behalf. If you sold a car to a dismantler and have a question about your data, contact that dismantler, or us and we will pass it on.
Businesses we invite
To invite vehicle dismantlers to sell on Partsyol we use business contact details from public sources, such as company directories and the company's own website: company name, business e-mail and phone, website and VAT number. We use them only to invite that business to Partsyol. Every invitation lets you decline; if you do, we keep only the e-mail address or phone number on a do-not-contact list so that we never contact you again.
Why: our legitimate interest in offering our service to businesses, which you can object to at any time.
Usage statistics
We count how the site is used — for example searches, viewed parts, carts and checkouts — with our own measurement. Each event carries a random session id from the partsyol_asid cookie and your language. It carries no account id, no IP address and no browser details, and it is used only by us to improve the marketplace. The events are deleted after 395 days (about 13 months).
Why: our legitimate interest in understanding and improving our service.
Who else receives data
We do not sell personal data. Besides the sellers of your orders (see above), these service providers process data for us or receive it for the purposes described:
| Who | What for | Where |
|---|---|---|
| Hetzner Online GmbH | Hosts our server, database and backups | Germany |
| Cloudflare, Inc. | Delivers the site and protects it against attacks; processes your IP address | Global network (US company) |
| Zoho (ZeptoMail) | Sends account e-mails such as confirmations and password resets (being set up) | EU data centre |
| Only if you choose “Continue with Google” | Google's own terms | |
| European Commission (VIES) | Checks business VAT numbers | EU |
| RDW (Netherlands) | Looks up the Dutch registration plate you enter to find your car; we send only the plate | Netherlands |
When shipping with carriers and real payments start, the carrier (name, delivery address and courier phone of the order) and the payment provider will be added to this list. We also share data with authorities when the law requires it.
Some providers are companies based outside the European Economic Area. Where personal data leaves the EEA, it is protected by the safeguards the GDPR provides, such as an adequacy decision of the European Commission or its standard contractual clauses.
How long we keep data
| Data | How long |
|---|---|
| Your account and profile | As long as your account exists; ask us to delete it |
| Orders, invoices and credit notes | As long as the tax and accounting rules that apply to us require |
| Order messages and returns | With the order they belong to |
| Phone and e-mail of a person who sold a car to a dismantler | One month after they were saved |
| Usage statistics | 395 days |
| Saved-search alerts | Until you unsubscribe; switched off after 6 months without activity |
| Do-not-contact list for business invitations | For as long as it is needed to respect your choice |
| Backups of our database | 14 days |
Your rights
You can ask us for a copy of your personal data, to correct it, to delete it, to limit its use, to receive it in a portable format, or object to processing based on our legitimate interest. Where we rely on your consent you can withdraw it at any time. Write to the privacy contact at the top of this page; we answer within one month. You also have the right to lodge a complaint with a data protection authority, in particular in the EU country where you live or work.
Security
All traffic to Partsyol is encrypted (HTTPS). Passwords are stored only as secure hashes. Inside the platform each person sees only what their role needs — for example a seller sees only its own orders — and this is enforced both by the application and in the database. Photos shown publicly are re-encoded without location data; photos you upload as evidence for a return are kept as uploaded, so remove location data from them beforehand if you prefer.
Children
Partsyol is not meant for children under 16, and we do not knowingly collect their data.
Changes to this policy
When what we do with personal data changes, we update this page and the date at the top. For important changes we will also let account holders know.