Privacy policy

Who we are

Partsyol runs this marketplace for used car parts and decides how personal data on it is processed — under the EU General Data Protection Regulation (GDPR) we are the controller, except for the car-purchase records sellers keep in their workspace (see “Data we keep for sellers”). For any question or request about your data, use the privacy request form or write to the address below; we answer within one month.

Company

Kodme (Partsyol)

Address

Noord-Scharwoude, NL

Registration number

KvK 42211525

VAT number

Being added

Privacy contact

privacy@partsyol.com · Privacy request form

In short

• We use your data to run the marketplace: your account, your orders and their delivery, payments, returns, messages with sellers, and to keep the platform safe.
• We do not sell personal data and we show no advertising. Google Analytics, a service of another company, counts how partsyol.com is used only if you allow it.
• Cookies that are not needed for the shop to work — remembering the parts you viewed, and usage statistics (our own and Google Analytics) — are only used if you allow them. You can change your choice at any time.
• Sellers see what they need to deliver your order (name, delivery address, invoice details), never your e-mail address.
• You can download, correct or delete your data yourself under Account → Privacy & data, or ask us through the privacy request form. We answer within one month.
• To open an account you need an e-mail address and a password (a seller also gives the business details that tax law makes us collect); to order, your name, a delivery address and an e-mail address. We need them to provide the service or because the law requires them — without them we cannot open the account or deliver the order. Everything else (a phone number for the courier, a name in your profile, saved cars, alerts) is up to you.

Privacy & data in your accountMake a privacy requestCookie settings

Your account

When you create an account we store your e-mail address and your password. The password is stored only as a secure hash by our sign-in service — nobody at Partsyol can read it. You may add a display name. We also store your language, the kind of account you chose (private buyer, garage or seller) and, if you save them, your delivery country, currency and preferred site.

If you sign in with Google, Google tells us your name, your e-mail address and an account identifier; we use the name as your display name. We never receive your Google password. You only use Google if you choose the “Continue with Google” button.

For a garage account we also store the garage's legal and trading name, VAT and registration numbers, address and the people you add as staff. For a seller (dismantler) account we store the company details, a contact person, VAT and registration numbers, the staff members of the business, the bank account for payouts and, when the EU's platform reporting rules (DAC7) apply to the seller, the details those rules require — such as tax identification number, tax residence, date and place of birth of a sole trader and a bank-account reference. Those details are visible to the seller's own members (in part masked) and to our finance staff.

Exception: a seller's name, registered name, city and company number appear publicly on its products, and its website and main contact e-mail appear to signed-in customers after a captcha.

Why: to create and run your account and to provide the marketplace to you (performance of our contract with you, GDPR Art. 6(1)(b)); for sellers' tax details, because the law requires us to report them (legal obligation, Art. 6(1)(c)).

Our sign-in service keeps a security log of sign-ins and account changes, with your IP address and browser, to protect your account against misuse (our legitimate interest in security, Art. 6(1)(f)). The log is kept 180 days; a sign-in session ends when it has not been used for 400 days.

Buying a part

When you order, we store your name, e-mail address, delivery address, the invoice details (for a business: company name, address and VAT number), if you give it an optional phone number for the courier, what you ordered, the prices and the status of payment, shipment and any return.

• The seller of your order sees your name, delivery address, invoice details and — if you gave it — the courier phone. The seller never sees your e-mail address: questions about an order go through Partsyol's messages.
• The carrier that delivers your parcel receives your name, delivery address and, if you gave it, the courier phone.
• If you order without an account, we keep your e-mail address with the order to send you the order e-mails and a private link to follow your order.
• Payments are processed by Stripe (Stripe Payments Europe, Ltd., Ireland). You enter your card or bank details in Stripe's own payment form: they never reach Partsyol's servers. We receive the payment's status and method and, when a payment fails, the reason Stripe gives (for example “insufficient funds”), so that we can tell you what to do. Stripe also uses payment data to prevent fraud, under its own privacy policy.
• Business VAT numbers are checked with VIES, the European Commission's VAT number service; we keep the answer as proof of the check.
• If you enter a Dutch registration plate to find your car, we look it up in the open data of the RDW (the Dutch vehicle authority); we send only the plate.

Why: to process your order, deliver it and handle returns (contract, Art. 6(1)(b)); to issue invoices and keep the records tax and accounting law require (legal obligation, Art. 6(1)(c)); to prevent payment fraud (legitimate interest, Art. 6(1)(f)).

Messages, questions, offers, reviews and support

• Order messages between you and the seller, with any attachments, are stored with the order and visible to the people taking part in that order's conversation and to our support staff. When a message seems to contain a phone number or e-mail address we show a warning: contact should stay on the platform so that we can help if something goes wrong.
• Automatic translation — only if you switch it on: with your consent, the messages you write to a buyer or a seller, the note of a price offer and your questions and answers about a part are translated into the reader's language by Claude, an AI service of Anthropic, PBC (United States). You switch it on with the box next to the send button, under Account → Privacy & data or, for sellers, in the message translation setting of the workspace; without it, your texts are shown as you wrote them. For that, the text — and only the text — is sent to Anthropic; the translation is stored next to the original, which the reader can always show. Please note: we use AI models of a third party over which we have no control, so texts sent for translation are exposed to that third party. This sending is not covered by a data processing agreement or by the safeguards described under “Data outside the European Economic Area”. Do not write anything in these texts that you would not want that third party to see. You can switch translation off at any time in the same places: texts still waiting are then not sent; translations already made stay next to the original. Messages from Partsyol's own team are translated without asking. We keep a record of your choices (on or off, where and when) as proof of your consent.
• Questions to sellers and part requests: sellers receive only the vehicle and part details you enter (for example a VIN or part number) and your question — never your name, e-mail or phone. A part request goes to at most ten sellers who stock that make and ship to your country.
• Price offers: the seller sees your offer and your note.
• Reviews you write after a delivery (rating, comment) are public on Partsyol, and the seller can reply.
• Garage quotes: a garage can send a quote to its customer; we keep only a masked hint of the customer's contact details.
• The contact form: your e-mail address and message go to our support team, who answer you by e-mail. We keep them 2 years.
• Support conversations between sellers and Partsyol are visible to that seller's members and to our support staff.
• Reports of abusive content are kept with the reporter's account so that our moderators can handle them; moderators can remove messages, attachments and reviews.

Why: to run the marketplace and resolve problems with orders (contract, Art. 6(1)(b)) and to keep the platform safe and fair (legitimate interest, Art. 6(1)(f)). Automatic translation: your consent (Art. 6(1)(a)) — and, because your texts then go to the United States without the usual safeguards, your explicit consent to that transfer after being told of its risks (Art. 49(1)(a)); you can withdraw it at any time, without affecting translations made before. Translating the messages of our own team: our legitimate interest in being understood by our customers (Art. 6(1)(f)). The record of your choices: to be able to prove your consent (legal obligation, Art. 7(1) with Art. 6(1)(c)).

Partsyol Assistant

When Partsyol Assistant — an AI chat that helps you find parts — is available on our site and you use it, your messages and its answers are processed by Claude (Anthropic, PBC, United States) and stored with your conversation for 30 days, then deleted. It tells you that it is an AI. It looks up parts, prices, delivery and — if you are signed in — the state of your own orders and payments in our database; it never sees card details, and card numbers you type are removed before anything is stored or sent. The conversation is tied to your browser by a cookie and, if you are signed in, to your account.

Why: to answer the questions you ask it (contract, Art. 6(1)(b)), and our legitimate interest in limiting abuse and costs (Art. 6(1)(f)).

Data we keep for sellers

Dismantlers can record in their workspace from whom they bought a car. They may record only the seller's name, address and contact details (phone and e-mail) — never an identity-document or ID number. The phone and e-mail are deleted automatically one month after they are saved; the name and address stay with the purchase record. Only the dismantler's own business and our administrators can see these details; they are never shown on the public site.

For these records the dismantler is the controller and Partsyol processes them on the dismantler's behalf. If you sold a car to a dismantler and have a question about your data, contact that dismantler, or us and we will pass it on.

Businesses we invite

To invite vehicle dismantlers to sell on Partsyol we use business contact details from public sources, such as company directories and the company's own website: company name, business e-mail and phone, website and VAT number. We use them only to invite that business to Partsyol. Every invitation lets you decline; if you do, we keep only the e-mail address or phone number on a do-not-contact list so that we never contact you again.

Why: our legitimate interest in offering our service to businesses (Art. 6(1)(f)), which you can object to at any time.

Cookies

We use our own cookies, on the payment page those of our payment provider and, only with your permission, those of Google Analytics. There are three kinds:

• Necessary cookies keep you signed in, hold your cart, favourites and comparison, remember your car, country, currency and language (taken from your browser and location until you choose them), protect forms and payments and tell people from bots. They are set without asking, because the shop does not work without them.
• Preferences cookies remember the parts you viewed and what you searched for (“Recently viewed”) and when your previous visit ended (“new parts for your car since your last visit”). Only with your permission.
• Statistics cookies hold random ids that link your visits in our own usage statistics and, on partsyol.com, in Google Analytics. Only with your permission.

You choose in the banner on your first visit and can change or withdraw your choice at any time under “Cookie settings” at the bottom of every page, where every cookie is listed with what it does and how long it is kept. Your choice is kept for six months, then we ask again; as proof of it we keep the choice and its date with a random id — no IP address — for 2 years. Stripe sets fraud-prevention cookies on the payment page only; Cloudflare, which delivers our site, may set a cookie that tells people from bots.

Why: necessary cookies — to provide the service you ask for (contract and legitimate interest); preferences and statistics cookies — your consent (Art. 6(1)(a) and the ePrivacy rules), which you can withdraw at any time; the record of your choice — to be able to prove your consent (legal obligation, Art. 7(1) with Art. 6(1)(c)).

Cookie settings

Usage statistics

We count how the site is used — for example searches, viewed parts, carts and checkouts — with our own measurement. Each event carries the page's language and an id: the random id of the statistics cookie if you allowed it, otherwise a new random id for each event, which links nothing. Events carry no account, no name, no IP address and no browser details, are used only by us to improve the marketplace and are deleted after 395 days (about 13 months).

With your permission we also use Google Analytics on partsyol.com (not on our country sites), a service of Google Ireland Limited. Its script sets cookies with a random id (_ga, _ga_…) and tells Google which pages you open, how you reached them, the type of your browser and device and an approximate location derived from your IP address; Google does not store the IP address itself. We have switched off Google's advertising features, so these data are not used for advertising. Google keeps them for 2 months and may process them in the United States; Google LLC is certified under the EU–US Data Privacy Framework.

Why: with the statistics cookie, your consent (Art. 6(1)(a)); without it, our legitimate interest in counting how our service is used (Art. 6(1)(f)). Google Analytics: only your consent (Art. 6(1)(a)), which you can withdraw at any time under “Cookie settings”.

Server and security logs

Like every website, our server records each request: the page, the time, your browser and the network part of your IP address (the last part is removed). These records are kept 14 days to keep the service running and secure. Our sign-in service's security log (see “Your account”) is kept 180 days.

Why: our legitimate interest in running a secure service (Art. 6(1)(f)).

Who else receives data

We do not sell personal data. Besides the sellers and carriers of your orders (see above), these service providers process data for us, under contracts that oblige them to protect it, or receive it for the purposes described:

We also share data with authorities, such as tax authorities or the police, when the law requires it.

Data outside the European Economic Area

Some providers are companies based outside the European Economic Area (EEA), mainly in the United States. Where personal data leaves the EEA, it is protected by the safeguards the GDPR provides: an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework for certified companies) or the European Commission's standard contractual clauses. The exception is Anthropic (automatic translation and Partsyol Assistant): texts go to Anthropic without these safeguards — for automatic translation only with the writer's explicit consent (GDPR Art. 49(1)(a)) — as explained under “Messages, questions, offers, reviews and support”. You can ask us for a copy of the safeguards that apply.

How long we keep data

When you delete your account we delete at once what we are not obliged to keep. What we must keep (orders, invoices, returns) loses your e-mail address and phone number and is no longer linked to an account; the name and address on orders and invoices stay, as tax law requires. Backups hold deleted data for up to 14 more days.

Your rights

Under the GDPR you have the right to:

• get a copy of your personal data and information about how we use it (access);
• have wrong or incomplete data corrected (rectification);
• have your data deleted, unless we must keep it, for example invoices for tax law (erasure);
• have the use of your data limited, for example while you contest its accuracy (restriction);
• receive the data you gave us in a machine-readable file, to take it to another service (portability);
• object to processing based on our legitimate interest, such as business invitations or statistics without a cookie (objection);
• withdraw a consent at any time — for cookies under “Cookie settings”, for e-mail alerts with the link in each e-mail, for automatic translation under Account → Privacy & data (sellers: the workspace's message translation setting) — without affecting what was done before.

With an account, you can download, correct and delete your data yourself under Account → Privacy & data. Anyone — with or without an account — can use the privacy request form: we confirm that the request comes from the owner of the e-mail address and answer within one month. If a request is complex, we may extend this by two more months and tell you why within the first month. Using your rights is free. We keep a record of each request and our answer for three years after it is closed, to be able to show that we handled it (legal obligation, Art. 6(1)(c) with Art. 5(2)).

We do not make decisions about you that are based only on automated processing and have legal or similarly significant effects. Our payment provider may automatically decline a payment to prevent fraud; you can then use another payment method or contact us.

You also have the right to lodge a complaint with a data protection authority, in particular in the EU country where you live, work or where you think your rights were infringed. The European Data Protection Board lists all of them on its website.

Privacy & data in your accountMake a privacy request

Security

All traffic to Partsyol is encrypted (HTTPS). Passwords are stored only as secure hashes. Inside the platform each person sees only what their role needs — for example a seller sees only its own orders — and this is enforced both by the application and in the database. Photos you upload (for example for a return, a message or a question) are stored without location data or other hidden image data. If a breach of personal data happens that puts you at risk, we tell the data protection authority within 72 hours and, if the risk is high, you too.

Children

Partsyol is not meant for children under 16, and we do not knowingly collect their data.

Changes to this policy

When what we do with personal data changes, we update this page and the date at the top. For important changes we will also let account holders know.