EEA/UK Privacy Addendum

Effective Date: August 15, 2026

Last Updated: August 15, 2026

Version: 2026-08-15

This EEA/UK Privacy Addendum supplements the Privacy Notice and the Cookie Policy for individuals in the European Economic Area (EEA), the United Kingdom, and, where similar rules apply, Switzerland. If this Addendum conflicts with the Privacy Notice for those individuals, this Addendum controls. If a translation conflicts with the English version, the English version controls. Nothing in this Addendum limits non-waivable consumer, privacy, or other rights that apply to you under the law of your country or state of residence.

1. Controller

The controller of personal data processed to operate the WPARTS platform (accounts, security, marketplace search, Order routing, platform messaging, and first-party cookies) is:

WPARTS LLC
A California limited liability company

privacy@wparts.com · legal@wparts.com

Sellers as controllers. A Seller is an independent controller for: (a) lead-form submissions on that Seller’s hosted site; (b) buyer contact data shared so the Seller can respond to an inquiry or Order; and (c) any analytics or advertising tools the Seller configures. WPARTS hosts the site and acts as a processor for those seller-controlled activities. Questions about a Seller’s use of your data should also be directed to that Seller.

2. Article 27 Representative

We will appoint an EU/UK representative and update this page. Until then, contact privacy@wparts.com.

We do not currently claim that an EU or UK representative has been appointed.

3. Categories of Personal Data

We process the categories described in the Privacy Notice, including identifiers (name, email, phone, address, account ID); Order and inquiry content (no payment card numbers); vehicle and VIN data; device and security data (IP address and security identifiers); usage data; Seller business information and uploaded documents; calendar guest details; seller-site leads; Secure Rooms metadata (ciphertext we cannot read); and notification delivery records.

We do not collect payment card PAN, bank account numbers, or tax identification numbers as a routine part of the Services, because we do not process payments or issue tax forms.

4. Legal Bases

Processing	Legal basis (GDPR / UK GDPR Art. 6)
Creating and administering an account; listings; transmitting Orders, part requests, service requests, and messages	Art. 6(1)(b) contract; Art. 6(1)(f) legitimate interests in operating the platform where no contract yet exists (for example, a guest inquiry)
Hosted seller sites, custom domains, and site-builder storage	Art. 6(1)(b) contract with the Seller; Art. 6(1)(f) legitimate interests in hosting
Lead forms on a Seller site (WPARTS as processor)	Seller’s basis (typically Art. 6(1)(b) or (f)); WPARTS processes on the Seller’s documented instructions
Security, fraud and abuse prevention	Art. 6(1)(f) legitimate interests in protecting accounts and the Services; Art. 6(1)(c) where required by law
VIN / vehicle data sent to catalog, fitment, or optional assistant providers when you use those features	Art. 6(1)(b) contract when you use the feature; Art. 6(1)(f) legitimate interests in providing search results. This is also an international transfer (Section 6)
Coarse location from IP; maps or geocoding when you use a map	Art. 6(1)(b) or (f) to provide the feature you request
Transactional messages and optional notifications you enable	Art. 6(1)(b) contract; Art. 6(1)(f) legitimate interests in delivering service messages
Marketing email	Art. 6(1)(a) consent, or another lawful basis where permitted. You may withdraw consent at any time
Non-essential analytics and advertising cookies, including tools a Seller enables	Art. 6(1)(a) consent (and ePrivacy consent). Scripts load only after you accept, and not when you reject non-essential cookies or send GPC
Error and reliability monitoring, if enabled	Art. 6(1)(f) legitimate interests in reliability; consent if the technology is not strictly necessary in that environment
Records of your acceptance of our terms	Art. 6(1)(c) legal obligation / Art. 6(1)(f) to demonstrate consent and contract formation
Responding to rights requests, copyright notices, and lawful process	Art. 6(1)(c) legal obligation; Art. 6(1)(f) legitimate interests in defending claims
Optional third-party catalog or shopping results	Art. 6(1)(b) or (f) when you use search features that call those providers

Where we rely on legitimate interests, those interests are operating a secure lead-generation and RFQ platform, preventing fraud, and improving reliability. You may object as described in Section 7. We do not process special-category data as a core part of the Services. Government ID appears only if a Seller voluntarily uploads it in company documents; we review those files manually for onboarding.

5. Recipients

Recipients are described by category in the Privacy Notice and on the Subprocessors page, including hosting and storage; messaging; security; maps; catalog, fitment, and optional assistant providers; coarse geolocation; and reliability monitoring. A named list is available to Sellers under contract and on confidential request at privacy@wparts.com. Sellers receive the contact and Order or lead details needed to respond to you. We do not disclose data to payment processors, banks, or carriers as payment or logistics processors, because those services are not integrated.

6. International Transfers

WPARTS is established in the United States. Using the Services means your personal data is transferred to and processed in the United States and in other countries where our vendors operate.

Where the GDPR or UK GDPR requires a transfer tool, we rely on the European Commission’s Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum (or successor clauses) with vendors that process EEA/UK personal data, together with supplementary measures where appropriate. Copies of relevant clauses may be requested at privacy@wparts.com, subject to confidentiality and redaction of commercial terms.

VIN and vehicle data. If you use VIN search or an optional parts assistant, we may send the VIN or vehicle identifiers to service providers that return catalog or fitment results. Those recipients may process the data in the United States or other third countries. This is an international transfer for the purpose of returning results. Results are informational only and are not a warranty of fitment or safety.

7. Your Rights

Subject to conditions and exceptions in the GDPR and UK GDPR, you have the right to:

Access your personal data and obtain a copy;
Rectify inaccurate personal data;
Erase personal data (“right to be forgotten”) in the circumstances set out in Art. 17;
Restrict processing;
Object to processing based on legitimate interests, including profiling related to those interests;
Data portability for data you provided and that we process by automated means on the basis of contract or consent;
Withdraw consent at any time, without affecting processing that occurred before withdrawal (Cookie Settings, marketing unsubscribe, or email);
Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, except as permitted by Art. 22. We use automated tools for fraud scoring, account security, and search ranking. These do not produce legal or similarly significant effects without human review available on request.

We will not require a government identity document to opt out of cookies, sale/share, or marketing. We may need to verify identity for access, correction, or deletion (for example, by confirming control of the account email).

8. How to Exercise Rights

Submit a request using:

The privacy request form; or
Email privacy@wparts.com.

We will respond within one month of receipt, with a lawful extension of up to two further months for complex or numerous requests. We will tell you if we extend and why. You may also use Cookie Settings in the footer and the opt-out methods for cookies and sale/share.

9. Supervisory Authorities

You have the right to lodge a complaint with a supervisory authority, in particular in the EEA Member State of your habitual residence, place of work, or alleged infringement, or with the UK Information Commissioner’s Office (ICO).

EEA authorities: see the European Data Protection Board list of supervisory authorities.
United Kingdom: Information Commissioner’s Office, ico.org.uk.

We invite you to contact privacy@wparts.com first so we can try to resolve your concern.

Non-essential cookies and pixels require consent. The banner offers Accept all, Reject non-essential, and Customize. Cookie Settings remain available in the footer. We honor GPC. Analytics or advertising tools a Seller configures load only after consent. Details: Cookie Policy.

11. Retention

Retention periods are set out in the Privacy Notice (account data until deletion plus security logs; Order/lead/booking records up to 7 years where needed for claims; security logs up to 24 months; records of your acceptance of our terms up to 5 years; marketing opt-out and GPC records at least 12 months). We keep data no longer than necessary for the purposes in Section 4 or as required by law.

GDPR Details (Moved)