1. Introduction

This Privacy Statement explains what personal information we collect when you use astrak.com or deal with us, why we collect it, who we share it with, how long we keep it and what rights you have over it.

It covers astrak.com and every regional storefront we operate: the United Kingdom, Ireland, France, Germany, Spain, Sweden, Denmark, the United States, Canada, Australia and New Zealand. It should be read alongside our Cookie Policy, which sets out the cookies we use and how to control them.

We review this statement at least once a year and whenever we change how we handle personal information. The date above shows when it was last revised.

2. Who we are

This website is operated by Astrak Group Ltd, Wheatfield Road, Dunnikier Business Park, Kirkcaldy, Fife KY1 3PD, United Kingdom (registered in Scotland, company number SC468615). For the personal information described in this statement, Astrak Group Ltd is the data controller.

Astrak Group Ltd is established in the European Union through the following subsidiaries, which act as the selling entity for customers in their territories:

Because we are established in the European Union, we are not required to appoint a representative under Article 27 of the EU GDPR. We are subject to UK GDPR and PECR as well as EU GDPR and the ePrivacy Directive, and we apply the same standard across every storefront rather than the minimum required in each country.

Where this statement says ‘we’ or ‘us’, it means Astrak Group Ltd and the group companies that trade through this website.

3. What personal information we collect

We only collect what we need. Depending on how you deal with us, that may include:

• Identity and contact details — your name, company name, billing and delivery address, email address and telephone number.
• Account information — your username and an encrypted record of your password, plus your saved addresses and preferences if you create an account.
• Order and transaction information — the products you view, add to your basket, buy, return or cancel; your order history; delivery and invoicing records; and details of any discount codes used.
• Payment information — the type of payment used and confirmation that payment succeeded. Card details are entered directly into our payment providers' systems; we do not see or store full card numbers.
• Communications with us — the content of emails, contact-form submissions, WhatsApp messages and telephone enquiries, and our notes from them.
• Technical and usage information — your IP address, device and browser type, the pages you view, the storefront and country you visit from, the site you arrived from, and the searches you run in our parts finder.
• Marketing engagement — whether you open our emails and which links you click.

We do not ask for your gender, date of birth or any special category information, and we do not knowingly collect information about children.

4. Where we get it from

• Directly from you — when you place an order, create an account, subscribe to our emails, complete a form, or contact us by email, telephone or WhatsApp.
• Automatically as you use the site — through cookies and similar technologies, as described in our Cookie Policy.
• From our service providers — for example our payment providers confirming a transaction, or a courier confirming delivery.
• From publicly available business sources — for example a company's published trading address, where we are establishing a trade account.

5. How and why we use it

The table below sets out what we do with your information and the legal basis we rely on for each purpose.

Where we rely on legitimate interests, we have considered whether the processing is something you would reasonably expect and whether it affects your rights. You can object to any of it — see section 9.

We do not make decisions about you by automated means alone, and we do not build profiles of you to sell or share with other companies.

6. Who we share it with

We share your personal information only with organisations that need it to provide a service to us, and only for the purpose we specify. They act on our instructions, are bound by contract to protect it, and must delete or anonymise it when our relationship ends.

• Shopify — hosts this store and processes your order and checkout information on our behalf. Shopify also processes some information as a controller in its own right for certain platform features; see the Shopify Consumer Privacy Policy.
• Payment providers — take your payment and screen the transaction for fraud.
• Couriers and freight partners — receive your name, address and telephone number so they can deliver your order.
• Manufacturers and suppliers — where an item ships direct, we pass the contact details needed to deliver it and to honour any guarantee.
• Klaviyo — sends our marketing emails and records whether they were opened.
• Google — provides Google Analytics, which we use in aggregate to understand site usage, and reCAPTCHA, which protects our forms from automated abuse.
• Our IT and professional advisers — support our systems and advise us, under confidentiality obligations.

We will disclose personal information to the police, a regulator or another public authority where we are legally required to, assessing each request on its merits. If the group is restructured or sold, information may transfer to the new owner under the terms of this statement.

We do not sell your personal information, and we do not share it with third parties for their own independent marketing.

7. Where your information is processed

We are based in the United Kingdom and our EU subsidiaries are in the European Union, so information moves between the UK and the EEA in the ordinary course of running the business. The European Commission has decided that the UK provides an adequate level of protection, and the UK recognises the EEA in the same way, so those transfers need no additional safeguard.

Some of our service providers operate outside the UK and EEA, including in the United States. Where information is transferred to a country without an adequacy decision, we rely on the UK International Data Transfer Addendum or the European Commission's Standard Contractual Clauses, together with any additional measures the transfer requires.

You can ask us for more detail about the safeguards applying to a particular transfer using the contact details in section 15.

8. How long we keep it

We keep personal information only as long as we need it, then delete or anonymise it.

• Order and accounting records — six years after the end of the relevant financial year, to meet UK tax and accounting requirements and to cover the period in which a contract claim can be brought.
• Warranty records — until the warranty period ends, plus one year.
• Account information — while your account is active, and for two years after your last order, after which we close and delete dormant accounts.
• Marketing preferences and consent records — for as long as you are subscribed, and for a further period afterwards so we can evidence that you opted out.
• Enquiries that do not become orders — two years.
• Cookie and analytics data — for the periods set out in our Cookie Policy.

9. Your rights

You have the right to ask us to:

• Give you access to the personal information we hold about you, normally free of charge.
• Correct it where it is wrong, incomplete or out of date.
• Delete it, where we no longer have a good reason to keep it.
• Send you a copy in a commonly used machine-readable format, or transfer it to someone else where that is technically feasible.
• Restrict what we do with it while a question about it is resolved.
• Stop processing it where we rely on legitimate interests and you object. We must stop unless we have compelling grounds to continue, and we will explain them if so.
• Stop using it for direct marketing. This is an absolute right and we will always comply.
• Withdraw your consent at any time, where consent is the basis we rely on. Withdrawing consent does not affect processing already carried out.
• Have a human review any decision made solely by automated means.

To protect your information we will verify your identity before acting on a request. If someone is making a request on your behalf, we will ask them to show they are authorised. We respond within one month, and will tell you if we need longer because the request is complex.

Exercising any of these rights costs you nothing and we will not treat you differently for doing so.

10. Marketing and how to opt out

We send marketing emails where you have subscribed, or where you have bought from us and have not opted out. Every email has an unsubscribe link, and using it stops marketing email immediately. You can also email us and ask us to stop.

You may still receive service messages about an order after you unsubscribe from marketing, because we need those to fulfil the contract.

11. Cookies and tracking

Our Cookie Policy lists every cookie we set, what it does and how long it lasts. Analytics and marketing cookies are set only if you accept them, and you can change your choice at any time using the Cookie preferences link in the footer of every page.

12. Additional rights for residents of the United States

If you live in California or another US state with comparable privacy legislation, you also have the right to:

• Know what categories of personal information we have collected about you, where we got it, why we collected it and who we disclosed it to.
• Access a copy of that information.
• Delete it, subject to the exceptions the law allows.
• Correct inaccurate information.
• Opt out of the sale or sharing of personal information, and of its use for targeted advertising. We do not sell personal information. You can register an opt-out from targeted advertising using the Cookie preferences link in our footer.
• Limit our use of sensitive personal information. We do not collect sensitive personal information as that term is defined in California law.
• Not be discriminated against for exercising any of these rights.

We honour the Global Privacy Control signal. If you visit our site with GPC enabled, we treat it as an opt-out request for that browser and device automatically. We do not respond to other ‘do not track’ signals, as there is no agreed standard for them.

You may appoint an authorised agent to make a request for you; we will ask for proof of their authority and may ask you to confirm it directly.

13. Complaints

If you are unhappy with how we have handled your information or responded to a request, please tell us first using the contact details below and we will try to put it right. You also have the right to complain to a supervisory authority:

• United Kingdom — the Information Commissioner's Office, ico.org.uk/concerns
• European Union / EEA — the data protection authority in your own country of residence. A list is published by the European Data Protection Board.
• Elsewhere — the relevant privacy regulator in your country of residence.

14. Changes to this statement

We may update this statement to reflect changes in what we do or in the law. We will change the date at the top, and where a change materially affects how we use your information we will tell you directly — by email if we hold your email address, and through a notice on the site.

15. Contact us

For any question about this statement, or to exercise any of your rights, please contact our Data Protection Officer:

Data Protection Officer
Astrak Group Ltd
Wheatfield Road, Dunnikier Business Park
Kirkcaldy, Fife KY1 3PD
United Kingdom
Email: marketing@astrak.com

Requests reach the same team wherever they are sent — you do not need to contact your local Astrak company separately, though you are welcome to.

This statement is provided in English. Where it is translated and the meaning differs, the English version applies.