1. Who is responsible for your information

Vinci Parts is a trading name of VINCI REPAIRES LTD, registered in England and Wales, company number 15739605.

Registered office: 8 Royal Parade, London, England, W5 1ET. This is our address for legal correspondence, not a collection or parts-return location. Contact us for the correct return address before sending a part.

Email: contact@vinciparts.co.uk. WhatsApp: +44 7570 662869 (messages only). You can also write to our registered office or use your existing case or order conversation.

We are the controller of personal information used to run Vinci Parts, handle enquiries and fulfil our orders. This notice covers visitors, enquirers, customers and people contacting us on their behalf. Send privacy requests or complaints to contact@vinciparts.co.uk, marked “Privacy”.

2. Information we use and where it comes from

• Contact and account information: name, email, telephone number, chosen communication channels, account details, authentication and security records.
• Vehicle and parts information: registration, VIN, make, model, specification, part numbers, compatibility details and the descriptions you give us. Vehicle identifiers can be personal information when connected to a person.
• Enquiries and evidence: messages, quotes, order history, return and complaint records, photographs, video and files you choose to provide.
• Order and payment information: delivery and billing addresses, recipient details, agreed prices, invoices, payment status, transaction references and relevant transfer evidence. Do not send full payment-card details or online-banking credentials in a message.
• Technical information: IP address, browser and device information, timestamps, authentication events, security checks, limited diagnostic information and, if you agree, website analytics identifiers and events.
• Preferences: consent choices, communication requests, objections and the minimum information needed to honour an unsubscribe.

Most information comes from you. We also receive relevant vehicle data from Vehicle Data Global, transaction and delivery updates from service providers, information from staff handling your case, and details provided by a person acting for you. We do not use vehicle lookup to request the registered keeper’s identity.

Please avoid uploading identity documents, unrelated people, medical information or other sensitive material. Crop or obscure irrelevant details, especially on vehicle documents and payment evidence. If you provide another person’s information, have a legitimate reason and tell them about this notice.

3. Purposes and lawful bases

• Your enquiry and purchase — contract or steps you request before a contract: assess parts, check compatibility, prepare and revise a quote, process payment, arrange delivery, and handle contractual returns or warranty requests.
• Business contacts and people acting for customers — legitimate interests: communicate with an authorised representative and manage the business relationship where the individual is not personally party to our contract.
• Legal duties — legal obligation: accounting and tax records, statutory consumer remedies, applicable product-safety duties, and responding to binding lawful requests.
• Safety, security and disputes — legitimate interests: prevent abuse and fraud, protect accounts, diagnose service faults, maintain appropriate evidence and establish or defend legal claims. We balance these purposes against your rights and limit the information used.
• Optional analytics — consent: understand visits to public pages and progress through the parts request process.
• Optional marketing and future advertising tracking — consent: send the marketing you choose or use advertising technologies when separately enabled and accepted. A request for a quote is not consent to these purposes.

Information necessary to check a part, communicate with you, deliver an order or meet the law may be required for that service. If you do not supply it, we may be unable to quote or fulfil the order. Refusing optional tracking or marketing does not prevent you from using the service. Consent can be withdrawn without affecting earlier lawful use.

4. Service messages and marketing

We use the contact details and available channels relevant to your enquiry or order for quotes, questions, access links, payment instructions, delivery updates and support. These service messages are separate from advertising. Infobip supports service email and SMS; Google Workspace supports staff email and replies.

If you choose to contact us through WhatsApp, WhatsApp/Meta processes information under its own notice as well as the information we use to answer you. Relevant case correspondence may be recorded in Vinci Parts so staff can handle your request. A link that opens WhatsApp does not itself install Meta Pixel. Automated WhatsApp Business messaging is a separate planned facility, not a promise that every WhatsApp message is already synchronised with the portal.

Marketing choices are optional and off by default. You can unsubscribe through the message where offered or email us. We keep a minimal suppression record so we do not resume unwanted marketing. Withdrawing marketing permission does not stop essential messages about an existing purchase.

5. Who receives information

Access is limited to the work each person or provider needs to do. Staff sourcing parts do not receive your customer contact details. Staff arranging customer support and delivery receive the information needed for those tasks. We do not sell your personal information.

• Vercel: hosting, application delivery, server processing and operational logs.
• Supabase: accounts, database, private file storage and case-related application services.
• Bunny: delivery of permitted images and video, including protected media where the feature is used.
• Cloudflare and Upstash: bot protection, network/security services and abuse-rate controls.
• Infobip and Google Workspace: service communications and staff email.
• Vehicle Data Global: vehicle identification and specification lookup using the relevant registration or VIN.
• ShipStation and the carrier handling a delivery: necessary destination, contact and parcel information for delivery quotes and fulfilment.
• Banks and payment providers: payment, reconciliation and fraud handling. Bank transfer is our current payment route. Stripe, and any separately enabled backup such as Mollie, would receive relevant payment information only when their payment option is offered and used.
• Sentry: limited error and diagnostic information, as explained below.
• Google: consented Google Analytics information and, separately, limited content for the staff-reviewed translation service described below.

We may also disclose necessary information to professional advisers, insurers, regulators, courts or law enforcement where justified or legally required, and to a successor if the business is lawfully transferred. Providers acting on our instructions are subject to data-processing arrangements. Some recipients, including banks, carriers and messaging or advertising platforms, may also act as controllers for their own stated purposes.

6. Google Analytics and planned Meta Pixel

Google Analytics 4: only after you allow analytics, we measure visits to a fixed set of public pages and broad steps in the parts request form. Data includes a pseudonymous browser identifier, permitted page names, language, technical visit information and events such as a completed request. Network connections also involve your IP address; “pseudonymous” does not mean anonymous.

Our event payloads exclude contact details, registration/VIN, typed form contents, uploaded files and private case, offer or order links. Staff areas and private customer pages are excluded from this analytics integration. Google Signals and advertising personalisation are disabled. The configured event-level retention period is two months; this is separate from browser-cookie lifetime and does not imply that aggregated statistics expire at the same time.

Meta Pixel — planned, not currently enabled: we intend to use it to measure advertising and, where you agree, show relevant Vinci Parts advertising on Meta services. It can disclose browser identifiers, device/IP information and selected website actions to Meta, which may associate them with a Meta account. It will require a separate marketing choice; “Allow analytics” will not authorise Meta Pixel.

Before activation, we will update the cookie inventory and explain the applicable Meta controller arrangements and transfer safeguards. We will not use this proposed integration to send contact details, vehicle identifiers, messages, uploaded evidence or private links, or to upload customer lists. This notice alone does not activate advertising tracking or give consent to it.

Where Meta’s applicable terms provide for joint control, we and Meta Platforms Ireland Limited would jointly control the collection and transmission of Pixel information. Meta’s subsequent use is governed by its own notice. The Meta Controller Addendum describes the allocation of duties, including our duty to inform you and Meta’s handling of rights for information it holds. The applicable arrangement must be confirmed before activation.

See Google’s information about partner sites, Meta’s privacy policy and our cookie policy and settings.

7. Error monitoring, translation and human decisions

Sentry helps us investigate technical errors and selected performance problems. The application filters diagnostic events to remove customer details, message and request contents, cookies, authentication data and private URL tokens. Session replay is disabled. Service providers still process the network and technical information needed to receive those reports; filtering is not a claim that no personal information can ever be processed.

Our current Google Gemini translation workflow uses limited, sanitised offer text to assist staff in producing English quotations. It does not intentionally send contact details, vehicle-owner information, images or private supplier information. A staff member must review and accept the translation before it can be used in a customer offer.

We do not use solely automated decisions with legal or similarly significant effects to refuse a refund or close an account. If evidence appears misleading, a person assesses it and you can provide an explanation and request review. We do not treat an AI-detector result alone as proof of fraud.

8. Processing outside the UK

Our providers and their support teams may process information in the UK, the EEA, the United States and other countries where their approved operations or subprocessors are located. A UK hosting region does not mean all support, email, media and diagnostic processing stays in the UK.

For restricted transfers we use an applicable UK adequacy regulation or appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, with the required assessment and supplementary measures. A US recipient’s UK Extension to the EU–US Data Privacy Framework can be used only where that recipient and the relevant transfer are covered. These mechanisms are assessed for the particular provider; we do not assume that every provider has the same status.

You can contact us for information about the safeguards relevant to your data and a copy of applicable safeguards, with confidential or security-sensitive details redacted where appropriate.

9. How long we keep information

• Enquiries that do not become orders: our retention policy is to archive inactive cases at 60 days and remove conversation content and case media after 90 days from the last meaningful activity. A page view or automatic reminder does not restart that period. An active complaint, legal hold or purchase can require a different justified period.
• Orders, invoices and financial records: necessary company accounting records are normally kept for six years from the end of the relevant financial year, or longer where the law or an unresolved matter requires. This is not a reason to keep every enquiry photograph or raw message for six years.
• Order evidence, returns and disputes: keep only what is needed for fulfilment, a live warranty/complaint, product-safety obligations or establishing or defending a claim. Review retention when the matter closes, considering the relevant statutory claim period and any legal hold.
• Accounts: information is kept while needed to provide the account and service history, then deleted or reduced following closure, subject to the specific financial, security and dispute needs above.
• Diagnostics and security records: keep only for the period proportionate to investigating faults, preventing abuse and resolving incidents; access and continued need are reviewed. A provider’s backup cycle may outlast deletion from the active service.
• Analytics and choices: Google Analytics event-level data is configured for two months. The analytics choice and analytics cookies last up to 180 days. Minimal consent or suppression evidence may be retained as needed to demonstrate and honour your choices.

Deleted information may remain temporarily in restricted backups until their normal replacement cycle, and information may be retained to comply with a legal obligation. It is not reused for unrelated purposes. Ask us about the retention criteria applying to your particular case.

10. Your rights and complaints

Depending on the circumstances, you can ask to access and obtain a copy of your information, correct it, erase it, restrict its use or receive portable information. You can object to processing based on legitimate interests and object to direct marketing at any time. You can withdraw consent as easily as giving it, including through Cookie settings for analytics.

Contact us using section 1. We may need proportionate information to verify your identity. We normally respond to rights requests within one month; we will explain any lawful extension or exception. These rights are not absolute, and we explain if a legal duty or another permitted reason limits a request. You do not need to close an account to make a privacy request.

You can complain to us and to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113. You can also seek a judicial remedy. We acknowledge privacy complaints within 30 days, investigate without undue delay, keep you informed of progress and explain the outcome.

11. Changes to this notice

The revision date is shown above. We will explain material changes and obtain fresh consent where required before using information for a new consent-based purpose. Listing a future provider here does not mean that its integration is active.