Privacy Policy

Last updated: (08.01.2026)

This Privacy Policy explains how VRA Truckparts (“we”, “us”, “our”) collects, uses and protects your personal data when you use vra-truckparts.co.uk, contact us, or place an order. It also explains your rights under UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). 

Nothing in this Privacy Policy limits your legal rights.

1. Who we are & how to contact us

We act as the “data controller” for personal data processed in connection with this website and our truck parts business. As controller we decide how and why your data is used and must comply with UK GDPR.

VRA Truckparts
(Insert full legal entity name, company number, registered address)

Contact for privacy questions:

• Email: (insert dedicated privacy/quadrodizain@gmail.com)
• Postal: (The Manorway, Corringham, Stanford-Le-Hope, England, SS17 9LL
  Company number 12129994 – can be same as above, marked “Data Protection”)

You can use these details to ask questions, exercise your rights or raise concerns about how we handle your data. ICO guidance requires privacy notices to clearly name the organisation and give contact details.

2. What this policy covers

This Privacy Policy applies to:

• visitors to vra-truckparts.co.uk;
• people who create a customer account on our site;
• customers who place orders or request quotes;
• people who contact us by forms, email, phone or messaging;
• trade / wholesale contacts and suppliers.

It does not cover other websites (for example marketplaces such as eBay) – they have their own privacy policies. If you order via those platforms, they act as independent controllers for their part of the processing.

3. What personal data we collect

We only collect information that we genuinely need in order to run our business, provide our services and meet legal requirements. ICO guidance says a privacy notice should clearly list what types of data are collected and why. 

3.1 Data you give us directly

When you:

• browse and place an order
  • name and surname
  • company name (if applicable)
  • billing and delivery addresses
  • email address and phone number
  • VAT number (if provided)
  • order details (parts, prices, discounts, returns, core surcharges)
  • messages or notes you send with the order
• create or use an account
  • login details (email/username and hashed password)
  • saved delivery addresses
  • order history and preferences
• contact us or request a quote
  • contact details and company information
  • details of your enquiry (including VIN, vehicle details, photos you send)
  • follow-up notes and our replies
• sign up for marketing (newsletter or similar)
  • name, email and your marketing preferences

3.2 Data we collect automatically

When you visit our site we automatically collect:

• technical information like IP address, browser type, device type, operating system;
• usage data such as pages visited, links clicked, time spent on pages;
• cookie identifiers and similar technologies (see section 5).

Cookies and similar technologies are regulated under PECR and UK GDPR – we must tell you what they do and, for non-essential cookies, obtain your consent. 

3.3 Data from other sources

We may receive limited personal data from:

• payment providers (e.g. Global Payments) – payment status, transaction ID, but not full card details;
• couriers and freight companies (e.g. Evri, DPD, DHL) – tracking updates and delivery status;
• online marketplaces (e.g. eBay) – your contact and order details when you purchase our items through those platforms;
• professional advisers (accountants, legal advisers) where necessary.

When we get personal data from third parties we still have to inform you what we do with it, as part of the “right to be informed”.

4. Why we use your data & legal bases

UK GDPR requires us to tell you why we process your data and the lawful basis we rely on.

We mainly rely on:

• Contract – to process your orders and provide our services to you.
• Legal obligation – to keep records for tax, accounting and regulatory reasons.
• Legitimate interests – to run and secure our business, prevent fraud, answer enquiries and improve our services, where these interests are not overridden by your rights.
• Consent – mainly for certain cookies and some marketing activities.

4.1 To process and deliver your orders (Contract)

We use your data to:

• set up and manage your customer account;
• process orders, returns, core exchanges and refunds;
• send order confirmations, invoices and shipping updates;
• provide after-sales support and warranty handling.

This is necessary to perform the contract of sale between us, as recognised under UK consumer law and guidance on lawful bases.

4.2 To comply with law (Legal obligation)

We must keep certain records to:

• meet tax and VAT requirements;
• keep proper accounting and business records;
• respond to lawful requests from regulators, courts or law enforcement where required.

4.3 To run and improve our business (Legitimate interests)

We have a legitimate interest in:

• maintaining our website and IT systems, including security logging and spam prevention;
• tracking general site performance and usage (e.g. which pages are most visited) to improve navigation and content;
• handling customer service and technical enquiries;
• protecting against fraud, misuse of our site and non-payment.

ICO guidance allows legitimate interests as a lawful basis where processing is necessary for the organisation’s purposes and balanced against individuals’ rights.

Where we use analytics or marketing cookies, we generally rely on consent instead (see section 5).

4.4 Marketing & “soft opt-in” (Consent / Legitimate interests under PECR)

We may send you marketing emails about similar truck parts or services if:

• you are an existing customer or have actively requested a quote; and
• we gave you a clear chance to opt out when you first gave us your details and in every message;
• the emails relate only to similar products/services you have bought or discussed.

This is called the “soft opt-in” under PECR and is allowed for existing customers in specific circumstances, provided clear opt-out options are always given.

For new contacts or where soft opt-in does not apply, we will only send marketing if you have given explicit consent (e.g. by ticking a box).

You can unsubscribe at any time by using the link in our emails or contacting us.

5. Cookies & similar technologies

Cookies are small text files placed on your device. The rules on cookies are set out in PECR, enforced by the ICO.

5.1 Types of cookies we use

• Strictly necessary cookies – required for the site to function, e.g. to:
  • remember what’s in your basket;
  • keep you logged in;
  • perform basic security checks.
    These do not require consent but we still explain them.
• Performance / analytics cookies – help us understand how visitors use the site (e.g. page views, traffic sources) so we can improve navigation and content.
• Functionality cookies – remember choices like language or country, where we offer such options.
• Advertising / tracking cookies (if used) – help us measure and improve advertising or remarketing campaigns.

For any non-essential cookies (analytics, advertising, most functionality cookies), UK rules require active, informed consent – consent by scrolling or continued browsing is not sufficient.

5.2 Cookie banner & settings

When you first visit our site, you’ll see a cookie banner:

• essential cookies are set automatically;
• you can accept all, reject non-essential or manage settings;
• you can change your choices later (e.g. via a “Cookie settings” link in the footer).

For more detail on each cookie, please see our Cookie Policy (if provided separately).

6. Who we share your data with

We only share your data where necessary and with organisations that must keep it secure and confidential. As controller, we remain responsible for our processors’ compliance.

We may share personal data with:

• Payment service providers (e.g. Global Payments) to process card payments securely. Global Payments and similar providers operate under the PCI DSS security standard for cardholder data.
• Couriers and freight companies (e.g. Evri, DPD, DHL, pallet networks) to deliver your orders and handle returns.
• IT and hosting providers who run our website, email and backups.
• Professional advisers (accountants, legal advisers, auditors) where necessary.
• Marketplaces where you buy our products (e.g. eBay) – but only for fulfilling those marketplace orders.
• Regulators, law enforcement or courts where we are legally required to do so.

We do not sell your personal data to third parties for their own independent marketing.

7. International data transfers

Our servers and many of our core providers are either in the UK or EEA. If any service provider stores or accesses personal data outside the UK/EEA, we will ensure that one of the safeguards recognised under UK GDPR is in place, such as:

• an adequacy decision by the UK government for that country; or
• international data transfer agreements / standard contractual clauses approved under UK law; and
• additional technical and organisational security measures where appropriate.

8. How long we keep your data

We keep personal data only for as long as it is reasonably needed for the purposes set out above, and to meet legal or regulatory requirements. A privacy notice should always explain retention periods or the criteria used to determine them.

Typical retention periods:

• Order and invoice records: normally at least 6 years from the end of the financial year in which the transaction took place, to comply with tax and accounting obligations.
• Customer account data: as long as your account is active. If you ask us to close your account, we’ll deactivate it and retain only what we need for legal or audit reasons.
• Enquiries and quote requests: 12–24 months after last contact, unless they become part of a customer record.
• Marketing data: until you unsubscribe or object, or until we determine that you are no longer actively engaging.
• Technical logs and security data: typically a few months, unless needed longer for investigation of security incidents.

Different laws may require different retention periods; where that’s the case, we follow the longest period required for that data.

9. How we protect your data

We take appropriate technical and organisational measures to protect your data against loss, misuse, unauthorised access or disclosure. UK GDPR requires controllers to implement security appropriate to the risk.

Examples include:

• using HTTPS (TLS encryption) on the website to protect data in transit;
• restricting access to systems and data to staff and contractors who need it;
• using strong passwords, access controls and security logging;
• keeping software and infrastructure updated;
• working only with reputable payment processors who comply with PCI DSS standards, so your card details go directly to them and are not stored in full by us. 

No system is 100% secure, but we aim to protect your information to a level that reflects the nature of the data and the risks involved.

10. Your rights under data protection law

Under UK GDPR you have a range of rights over your personal data, including:

1. Right to be informed – to know how we collect and use your data (this Privacy Policy and related notices).
2. Right of access – to ask for a copy of the personal data we hold about you and certain information about how we use it.
3. Right to rectification – to have inaccurate or incomplete data corrected.
4. Right to erasure (“right to be forgotten”) – in some circumstances, to ask us to delete your data (for example where it’s no longer needed, or you withdraw consent and there is no other legal basis).
5. Right to restrict processing – to limit how we use your data in certain cases (e.g. while a dispute about accuracy or lawfulness is being resolved).
6. Right to data portability – to receive certain personal data in a structured, commonly used, machine-readable format and/or ask us to transfer it to another controller where technically feasible.
7. Right to object –
   • to processing based on legitimate interests, and
   • to direct marketing at any time (we will then stop using your data for marketing).
8. Rights related to automated decision-making and profiling – we do not currently carry out automated decisions producing legal or similarly significant effects using your data. 

Some rights only apply in specific circumstances. We will explain if a request cannot be fully met, and why.

11. How to exercise your rights

You can exercise your data protection rights by contacting us using the details in section 1.

• We may need to verify your identity before acting on your request.
• We aim to respond within one month as required by UK GDPR; complex requests may take longer, but we will keep you informed. 
• In most cases we will not charge a fee; we may charge a reasonable fee or refuse a request only if it is manifestly unfounded or excessive, in line with ICO guidance. 

12. Complaints & your right to contact the ICO

If you have concerns about how we use your data, please contact us first – we will do our best to resolve the issue.

You also have the right to make a complaint to the UK Information Commissioner’s Office (ICO), which supervises data protection law in the UK.

Information Commissioner’s Office

• Website: ico.org.uk
• Helpline: 0303 123 1113 (UK)

13. Children’s data

Our website and services are aimed at business users and adult consumers (e.g. fleet operators, workshops, truck owners).

We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it where required. This supports UK GDPR’s emphasis on special protection for children’s data. 

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example to:

• reflect changes in law or regulatory guidance;
• update our services, providers or internal processes;
• improve clarity and transparency.

The “Last updated” date at the top will show when changes were last made.
If we make significant changes, we may also notify you by email or via a notice on the website where appropriate.

15. Important note – not legal advice

This Privacy Policy is designed to be clear and practical, based on publicly available guidance from the UK ICO and other reputable sources on UK GDPR, PECR and privacy notices. 

It is not legal advice.
If you need confirmation that this text meets all requirements for your particular company, systems and international transfers, you should ask a qualified UK data protection lawyer or adviser to review it.