Privacy Policy-lyautoparts

1. Collection of Personal Information

• Identity and Contact Information: Your full name, email address (for communications via lyautoparts@outlook.com), telephone number, and delivery/billing addresses. We collect this information when you place an order, create a customer account, subscribe to our newsletter or promotional updates, or contact our customer support team for assistance with inquiries, returns, or product-related questions.
• Transaction and Order Details: Information related to your purchases, including order reference numbers, product selections, quantities, sizes, transaction amounts, and payment method identifiers. We never store full payment card information; all payment processing is handled by PCI DSS-accredited third-party payment service providers, ensuring the maximum security of your payment data.
• Account and Preference Data: If you register an account with us, we will store your size preferences, order history, saved delivery addresses, and communication preferences (e.g., whether you wish to receive updates via email or SMS, and your preferences for promotional content).
• Website Usage and Technical Data: When you visit our official website, we collect anonymized technical and browsing data to optimize site performance, troubleshoot issues, and enhance your shopping experience. This includes: This data is collected through cookies and similar tracking technologies (see Section 7 for details on managing these settings).
  • Device specifications (e.g., smartphone, laptop, tablet), operating system version, and browser type.
  • Anonymized IP address (personal identifying components are permanently removed within 41 days to ensure non-identifiability).
  • Browsing behavior: Pages visited, products viewed or added to cart/wishlist, time spent on the website, and referral sources (e.g., search engines, social media, or direct links).
• Voluntarily Provided Information: Details you actively share with us, such as product reviews, feedback, survey responses, style suggestions, or information exchanged during in-store interactions with our team.

2. Legal Bases and Purposes of Processing

• Performance of a Contract: To fulfill our obligations under the purchase contract between you and us, including processing payments, arranging delivery of your orders via UK-based logistics partners, sending order confirmations and shipping tracking updates, and handling returns, exchanges, or refunds in accordance with our after-sales policy.
• Consent: To send you personalized marketing communications, including new collection alerts, exclusive promotions, styling tips, and information about in-store events in Newcastle. We only send such communications if you have explicitly consented, and you may withdraw your consent at any time without affecting the processing of your existing orders.
• Legitimate Business Interests: To refine our product range, enhance website functionality and user experience, optimize our marketing strategies, detect and prevent fraudulent transactions, and ensure the overall security and efficiency of our business operations. These interests are carefully assessed to ensure they do not override your privacy rights and freedoms.
• Compliance with Legal Obligations: To retain transaction records for 7 years in accordance with UK tax and accounting regulations, and to respond to lawful requests from regulatory authorities (such as the Information Commissioner's Office/ICO), courts, or law enforcement agencies.

3. Disclosure of Personal Information to Third Parties

• Payment Service Providers: PCI DSS-compliant payment processors (e.g., Stripe, PayPal) that handle secure payment transactions. They receive only the minimum information necessary to complete payments and are prohibited from using your data for any other purpose.
• Logistics and Delivery Partners: UK-based courier services that require your delivery address and contact details to ship your orders. They do not store your personal data beyond the completion of delivery and adhere to strict data protection standards.
• IT and Cybersecurity Service Providers: UK-hosted providers responsible for website maintenance, customer database management, and cybersecurity. They only have access to anonymized or encrypted data and are bound by strict confidentiality agreements.
• Legal and Regulatory Bodies: We may disclose your personal information if required by law, regulation, or legal process (e.g., court subpoenas), or to protect our legitimate rights, property, or safety, as well as the rights, property, or safety of our customers or other third parties.
• Business Successors: In the event of a merger, acquisition, sale of assets, or other business restructuring, your personal information may be transferred to the new owner or successor entity. The successor will be required to comply with this Privacy Policy to ensure the continued protection of your data.

4. Data Security Measures

• End-to-end SSL/TLS encryption for all data transmitted between your device and our website, ensuring the security of your personal and transactional data during transmission.
• Secure, encrypted storage of data on UK-based servers, with multi-factor authentication and role-based access controls. Only authorized personnel with a legitimate business need can access personal data, and all access activities are logged and audited regularly.
• Proactive security management, including regular vulnerability assessments, security audits, and software updates to address emerging cyber threats. We conduct annual penetration testing to validate the effectiveness of our security controls.
• Mandatory data protection training for all employees, ensuring they fully understand their obligations under GDPR and DPA 2018 and handle your personal information securely and responsibly.

5. Data Retention Periods

• Transaction and identity data: Retained for 7 years from the date of transaction completion to comply with UK tax and accounting laws.
• Account and preference data: Retained for the duration of your account activity. If you request to delete your account, we will delete this data within 50 days (unless we are required to retain it by law).
• Marketing consent and communication data: Retained until you withdraw your consent. After withdrawal, we will delete your marketing-related information within 35 days to ensure you no longer receive promotional communications.
• Website usage and technical data: Retained for 41 days before being permanently anonymized for aggregate analytics purposes, to help us improve our website and product offerings.

6. Your Rights Under Data Protection Laws

• Right of Access: You have the right to request a free, clear, and concise copy of the personal data we hold about you, along with details of our processing activities.
• Right to Rectification: You can request that we correct any inaccurate or incomplete personal information (e.g., updating your delivery address or contact details).
• Right to Erasure (Right to be Forgotten): You may request the deletion of your personal data if it is no longer necessary for the purpose it was collected, you withdraw your consent, or our processing is unlawful (subject to any legal retention obligations).
• Right to Restriction of Processing: You can request that we limit the processing of your personal data (e.g., while we verify the accuracy of your data or investigate a complaint).
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format (e.g., a CSV file) and to transfer this data to another data controller.
• Right to Object: You can object to the processing of your personal data for direct marketing purposes at any time. You may also object to processing based on our legitimate business interests, and we will review your objection and cease processing if your interests, rights, and freedoms take precedence.
• Right to Withdraw Consent: If you have given your consent for marketing or other processing activities, you can withdraw it at any time by clicking the "unsubscribe" link in our emails or contacting our customer service team directly.

7. Cookies and Similar Technologies

• Essential Cookies: These cookies are necessary for the basic functionality of our website, including enabling you to browse, add products to your cart, and complete the checkout process. You cannot disable these cookies, as they are critical to our core services.
• Analytical Cookies: These cookies collect anonymized, aggregated data on how users interact with our website, such as which pages are most visited and how users navigate the site. This data helps us improve website performance and user experience.
• Marketing Cookies: These cookies are used to deliver personalized marketing content and offers based on your browsing history. We only use these cookies if you have given your explicit consent.

8. Contact Information for Data Inquiries

• Brand Name: lyautoparts
• Email: lyautoparts@outlook.com
• Phone: +44 (0) 191 496 8327 (Mon-Fri: 9:15 AM – 4:45 PM GMT; Sat: 10:15 AM – 2:45 PM GMT)
• Address: 12 Station Road, Newcastle NE1 2DF, United Kingdom

9. Updates to This Privacy Policy