Privacy policy
This Privacy Policy explains how ST Trackparts ("we", "us", "our") collects, uses, and protects your personal data when you visit st-trackparts.com (the "Website"), place an order, or otherwise interact with us. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Dutch Implementation Act (UAVG).
1. What Data We Collect
Depending on how you use the Website, we may collect:
- Identity & contact data — name, email address, telephone number, billing and shipping address.
- Order & transaction data — products purchased, order value, payment status, and correspondence about your order. We do not store full card details; these are handled by our payment providers.
- Account data — if you create an account: login credentials and order history.
- Communication data — messages you send us by email, contact form, or social media, and our replies.
- Marketing data — your preferences for receiving marketing and your interactions with our emails and ads.
- Technical & usage data — IP address, device and browser type, pages viewed, referring source, and similar information collected via cookies and analytics (see Section 6).
2. How and Why We Use Your Data
We only process your data where we have a lawful basis under the GDPR:
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Processing and delivering your orders | Identity, contact, order data | Performance of a contract (Art. 6(1)(b)) |
| Handling payments and preventing fraud | Order, transaction data | Contract & legitimate interest (Art. 6(1)(b), (f)) |
| Customer service and warranty handling | Contact, order, communication data | Contract & legitimate interest (Art. 6(1)(b), (f)) |
| Sending marketing emails and newsletters | Contact, marketing data | Consent (Art. 6(1)(a)) — withdrawable at any time |
| Showing and measuring advertising (e.g. on social platforms) | Technical, usage, marketing data | Consent (Art. 6(1)(a)) |
| Analytics and improving the Website | Technical, usage data | Consent / legitimate interest (Art. 6(1)(a), (f)) |
| Meeting legal and tax obligations | Identity, transaction data | Legal obligation (Art. 6(1)(c)) |
Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
3. Who We Share Your Data With
We do not sell your personal data. We share it only with trusted service providers (processors) who help us run our business, and only as needed. These typically include:
- E-commerce platform & hosting — Shopify, which hosts the Website and processes orders.
- Payment providers — [e.g. Mollie, Stripe, PayPal], which process payments securely.
- Shipping & logistics partners — [e.g. PostNL, DHL, DPD], to deliver your orders.
- Email & marketing tools — [e.g. Klaviyo], to send transactional and marketing messages.
- Advertising & analytics providers — [e.g. Meta, Google], to measure and deliver advertising and understand Website use.
Each processor is bound by a data-processing agreement requiring them to protect your data and use it only on our instructions. We may also disclose data where required by law or to competent authorities.
4. International Transfers
Some of our providers are based outside the European Economic Area (EEA), for example in the United States. Where data is transferred outside the EEA, we ensure an appropriate safeguard is in place — typically the European Commission's Standard Contractual Clauses or an equivalent recognised transfer mechanism.
5. How Long We Keep Your Data
We keep your data only as long as necessary for the purposes described above:
- Order and invoice data — retained for 7 years, as required by Dutch tax law.
- Account data — kept until you delete your account or request removal.
- Marketing data — kept until you unsubscribe or withdraw consent.
- Contact/support messages — kept for a reasonable period to handle your query and any follow-up.
When data is no longer needed, we securely delete or anonymise it.
6. Cookies
The Website uses cookies and similar technologies for functionality, analytics, and (with your consent) marketing. Non-essential cookies are only placed after you accept them via our cookie banner. You can change or withdraw your cookie preferences at any time through the banner settings, and manage cookies via your browser. For details, see our Cookie Policy.
7. Your Rights
Under the GDPR you have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate or incomplete data;
- Erase your data ("right to be forgotten");
- Restrict or object to certain processing;
- Data portability — receive your data in a structured, machine-readable format;
- Withdraw consent at any time where processing is based on consent.
To exercise any of these rights, contact us at [privacy@st-trackparts.com]. We will respond within one month. We may ask you to verify your identity first.
8. How We Protect Your Data
We take appropriate technical and organisational measures to protect your data against loss, misuse, and unauthorised access — including encryption in transit (SSL/TLS), access controls, and vetted processors. No system is completely secure, but we work to keep your data safe and will notify you and the relevant authority of a data breach where legally required.
9. Children
The Website and our products are not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, please contact us so we can remove it.
10. Changes to This Policy
We may update this Privacy Policy from time to time. The version published on the Website applies to your visit, and material changes will be indicated by an updated "Last updated" date.
11. Contact & Complaints
For any privacy question or request, contact us at [privacy@st-trackparts.com].
If you believe we have not handled your data properly, you have the right to lodge a complaint with the Dutch supervisory authority:
Autoriteit Persoonsgegevens Website: autoriteitpersoonsgegevens.