iParts4U Ltd is a private limited company registered in England and Wales. We supply mobile device repair parts and accessories to UK trade and retail customers and have done so since 2013.

We are the data controller for personal data processed via the iparts-4u.co.uk website. Our supervisory authority is the Information Commissioner's Office (ICO).

Different parts of this policy may apply depending on whether you're shopping as an individual consumer, browsing the website, or operating a registered trade account.

This policy is written in line with current UK data protection law, which includes:

• The UK General Data Protection Regulation (UK GDPR)
• The Data Protection Act 2018 (DPA 2018)
• The Data (Use and Access) Act 2025 (DUAA), which amended UK GDPR, the DPA 2018, and PECR, with provisions coming into force in stages from February 2026
• The Privacy and Electronic Communications Regulations 2003 (PECR), as amended

The UK's Information Commissioner's Office (ICO) is the supervisory authority for data protection in the UK. You can find out more about your rights at ico.org.uk.

3.1 Data you provide directly

When you create an account (consumer or trade):

• Your name (or business contact name for trade)
• Email address
• Telephone number
• Billing and delivery address
• For trade accounts: business name, Companies House number, VAT number (if applicable), trade references

When you place an order:

• Items ordered, quantities, order history
• Delivery address (if different from account address)
• Payment confirmation reference (full card details are never stored — see Section 8)

When you contact us:

• The content of your message, email, or chat conversation
• Records of our response and any resolution
• HubSpot live chat records, if you use the chat feature on our website

When you leave a review:

• Review content and rating (via Trustpilot)
• Your Trustpilot account details if you choose to use that platform

3.2 Data collected automatically

• IP address
• Browser type, version, and operating system
• Device type (mobile, desktop, tablet)
• Pages visited and time spent on each
• Referring website (where you came from) and search terms used
• Products viewed and added to the basket

3.3 Data from third parties

• Payment confirmation data from Braintree, PayPal, and Clearpay
• Delivery tracking information from couriers
• Review notifications from Trustpilot

3.4 CCTV at our premises

We operate CCTV at our packing and working areas. CCTV is used solely for security and operational purposes (loss prevention, dispute resolution, and staff safety). Footage is retained for 7 days before being automatically overwritten, unless an active incident or insurance matter requires a specific clip to be retained for longer.

3.5 What we do not collect

• Special category personal data (health, ethnic origin, political views, religion, etc.) — not relevant to our business
• National Insurance numbers or government identifiers (except VAT numbers for trade customers)
• Personal data from children under 13 — see Section 14

UK GDPR requires us to identify a specific legal basis for every type of processing we carry out. The table below sets out each processing activity and the lawful basis we rely on.

You can withdraw consent for marketing or personalisation at any time without affecting our ability to fulfil orders or operate your account. Where we rely on legitimate interests, you have the right to object — see Section 12.

A cookie is a small text file stored on your device when you visit a website. We use cookies and similar technologies for several purposes, explained below.

5.1 Your cookie choices

When you first visit our website, you'll see a cookie banner explaining your choices. You can:

• Accept all cookies — including analytics, personalisation, and marketing cookies
• Reject all non-essential cookies — we'll only use cookies strictly necessary for the site to function
• Customise your preferences — pick which categories you're happy with

You can change your cookie preferences at any time via the "Cookie Settings" link in our website footer. Note that disabling strictly necessary cookies may prevent the site from working correctly.

5.2 Categories of cookies we use

5.3 Changes to our cookie approach

The Data (Use and Access) Act 2025 introduced new exemptions to PECR cookie consent rules, with effect from 5 February 2026. These cover certain low-risk cookies, including analytics, in defined circumstances. We are reviewing how these exemptions apply to our website and intend to implement Google Consent Mode v2 as part of that review. When we update our cookie approach, this policy will be updated to reflect the changes.

5.4 Do Not Track signals

Our website does not currently respond to "Do Not Track" browser signals, but you can manage your cookie preferences via our cookie banner and footer link as described above.

6.1 Marketing emails

If you opt in (by ticking the consent box at registration, at checkout, or via a marketing preference centre), we may send you emails about new products, promotions, and trade offers. We also rely on the PECR "soft opt-in" to send existing customers marketing about similar products, with a clear opt-out in every email.

You can unsubscribe at any time by clicking the unsubscribe link in any marketing email or by emailing info@iparts-4u.co.uk.

6.2 Personalisation via Salesfire

If you consent to functionality and personalisation cookies, Salesfire (Salesfire Limited, UK company number 11614028) tracks your search and browsing behaviour to personalise product recommendations and search results. This is automated processing that produces no legal effects on you and does not significantly affect you.

6.3 Reviews via Trustpilot

After a purchase, you may receive an automated invitation to leave a review via Trustpilot. We use Trustpilot under their own privacy terms — see uk.legal.trustpilot.com/end-user-privacy-terms.

6.4 No third-party advertising on our site

We do not allow third-party advertising on iparts-4u.co.uk. We use Google Tag Manager, Google Analytics, and Google Ads measurement for our own marketing activity, but we do not sell or share your personal data with advertising networks for ad targeting.

We use some automated tools that involve profiling — meaning automated processing of personal data to analyse or predict aspects of your behaviour or preferences. Specifically:

• Salesfire analyses browsing behaviour on our site to recommend relevant products
• HubSpot may segment customers based on engagement for customer service and marketing
• Google Analytics generates aggregated insights about how visitors use our site
• Google Ads may show our adverts to users it identifies as having relevant interests

None of these activities involve solely automated decisions that produce legal effects on you or similarly significantly affect you. We do not use any automated decision-making for credit scoring, employment, or other high-impact purposes.

We don't sell your personal data to anyone, ever. We share it only with carefully selected service providers ("processors") who help us run our business. Every processor we use is contractually required to handle your data securely and only for the purposes we instruct.

8.1 Hosting and infrastructure

• Sonassi (UK): Our web hosting provider. Our website and customer data are hosted on UK-based servers.
• Cloudflare, Inc. (US): Provides security, content delivery, and DDoS protection for our website. Cloudflare may process your IP address and browsing data to protect our site from threats.

8.2 Payment processing

• Braintree (a service of PayPal Inc.) — for card payment processing
• PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) — for PayPal payments
• Clearpay Finance Ltd (UK) — for "buy now, pay later" instalment payments

We never see or store your full card number, CVV, or expiry date — these are handled entirely within the secure environments of our payment providers, which are PCI DSS compliant. We receive only confirmation of payment status.

When you choose to pay via Clearpay, you enter into a separate agreement with Clearpay and share data directly with them under their own privacy policy. Clearpay may perform affordability or identity checks. We receive only confirmation of payment status, not the details of any credit assessment.

8.3 Delivery couriers

• DPD (UK)
• Royal Mail (UK)
• DHL (UK and international)
• UPS (international)

We share with couriers only the data needed to deliver your order: name, delivery address, and contact telephone number.

8.4 Customer service and on-site personalisation

• HubSpot, Inc. (US): CRM, customer service ticketing, live chat on our website, and email marketing. HubSpot processes your contact details, conversation history, and behavioural data on our site.
• Salesfire Limited (UK, company number 11614028): On-site personalisation, product recommendations, and search enhancement. Salesfire processes browsing behaviour to deliver more relevant content on our website.

8.5 Accounting and business operations

• Xero Limited (UK): Our accounting software. Order data and invoice details are processed through Xero for bookkeeping and HMRC reporting.
• Microsoft Corporation (US): Microsoft 365 for business email, document storage, and productivity tools.
• Google LLC (US): Google Workspace tools for business communications.

8.6 Website analytics, advertising measurement, and reviews

• Google LLC (US): Google Analytics 4 for aggregated website analytics, Google Tag Manager for tag deployment, and Google Ads measurement.
• Trustpilot A/S (Denmark/UK): Customer review collection and display. Only customers who choose to leave a review submit personal data to Trustpilot.
• Ahrefs Pte. Ltd. (Singapore): SEO measurement and analysis. Ahrefs processes technical and aggregate data about how our website performs in search results, and may process limited identifiers for analytics purposes.

8.7 Legal disclosures

We may disclose personal data where required by law, court order, or to protect our legal rights. We share data with HMRC for tax compliance and with other authorities where we are legally required to do so.

8.8 What we do not do

• We do not sell your personal data to anyone
• We do not share data with advertising networks for ad targeting
• We do not allow third-party advertising on our website

Several of the processors above are based outside the United Kingdom — primarily in the United States, Singapore, and Europe. When personal data is transferred outside the UK, we ensure appropriate safeguards are in place to protect your data, including:

• The UK International Data Transfer Agreement (IDTA), or
• The UK Addendum to the EU Standard Contractual Clauses (SCCs), or
• The UK-US Data Bridge (extension of the EU-US Data Privacy Framework), where applicable to specific US processors, or
• Reliance on UK adequacy decisions where applicable (for example, transfers to EU/EEA countries)

Each of our US-based processors (Google, HubSpot, Cloudflare, Microsoft) has executed the UK IDTA or equivalent with us as part of their standard terms.

We use technical and organisational measures to protect personal data:

• HTTPS (TLS 1.2+) encryption for all data in transit
• Cloudflare web application firewall and DDoS protection
• Secure payment processing through PCI DSS compliant providers
• Password hashing using strong cryptographic methods
• Account-based access controls — only staff who need data for their role can access it
• Regular security updates and platform maintenance
• Written Data Processing Agreements with all third-party processors
• CCTV monitoring of our packing and working areas (7-day retention)
• Staff training on data protection and security awareness
• Documented procedures for data breach response (within 72 hours to the ICO where required)

No system is completely secure. We recommend using a strong, unique password for your account and notifying us immediately if you suspect unauthorised access. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify you directly without undue delay.

We keep personal data only as long as we need it for the purpose it was collected, balanced against legal retention obligations.

When retention periods expire, we securely delete or anonymise your data.

Under UK data protection law, you have the following rights regarding your personal data:

1. The right to be informed — to know how we use your data (this policy)
2. The right of access — to request a copy of the personal data we hold about you ("Subject Access Request")
3. The right to rectification — to have inaccurate or incomplete data corrected
4. The right to erasure — to request deletion of your data, subject to legal retention obligations
5. The right to restrict processing — to limit how we use your data in certain circumstances
6. The right to data portability — to receive your data in a structured, machine-readable format
7. The right to object — to processing based on legitimate interests, and absolutely to direct marketing
8. The right to withdraw consent — at any time, for processing based on consent
9. Rights relating to automated decision-making — we do not use automated decisions that produce legal or similarly significant effects on you
10. The right to complain to the ICO — see Section 13

To exercise any of these rights, email info@iparts-4u.co.uk or write to us at the address in Section 1. We may need to verify your identity before responding to make sure we share data with the right person. We aim to respond within one calendar month. If your request is complex or involves a high volume of data, we may extend this by a further two months, but we will let you know within the first month if we need to do so.

Some legal obligations (such as tax record retention) may limit your right to erasure for certain data. We will explain clearly any such limits in our response.

If you're unhappy with how we've handled your personal data, you have the right to complain. We would appreciate the opportunity to put things right.

13.1 Complain to us first

Contact us at:

• Email: info@iparts-4u.co.uk
• Telephone: 0330 380 1148
• Post: Data Protection Enquiries, iParts4U Ltd, Unit 2 Ash Court, Viking Way, Winch Wen Industrial Estate, Swansea, SA1 7DA

When you complain to us about how we've handled your personal data, we will:

• Acknowledge your complaint within 30 days of receiving it
• Investigate the matter without undue delay, keeping you informed of progress where appropriate
• Inform you of the outcome of the investigation and any steps we are taking
• Tell you about your right to escalate to the ICO if you are not satisfied with our response

You don't need to use specific legal language or quote particular legislation to make a complaint — just explain what you're unhappy with and we'll treat it appropriately.

13.2 Complain to the ICO

If you're not satisfied with our response, or you prefer to go directly to the regulator, you can complain to the Information Commissioner's Office at any time. You do not need to complain to us first.

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Our website and services are intended for trade buyers, repair professionals, and adult consumers. We do not knowingly collect personal data from anyone under the age of 13. Under UK data protection law, children under 13 cannot consent to their data being processed for information society services without parental authorisation.

If you believe a child under 13 has provided personal data to us, please contact us immediately at info@iparts-4u.co.uk and we will take steps to delete it.

We may update this policy from time to time to reflect changes in our business, our services, technology, or the law. The "Last updated" date at the top of the policy reflects the most recent revision. Material changes will be communicated to account holders via email and via a notice on our website. Earlier versions are available on request.

For any privacy-related question or to exercise your rights: