Privacy Policy

1. Data controller

The controller responsible for your personal data is:

Please use the email address above for privacy enquiries and requests concerning your personal data.

2. Scope of this Policy

This Policy applies when you:

• visit or use our website;
• create or use a customer or business account;
• request a quotation or contact our sales team;
• purchase, return, or enquire about a part or vehicle;
• arrange payment, delivery, warranty, or after-sales support;
• interact with us through a marketplace where we determine the purposes and means of processing.

A marketplace or payment provider may also process your data as an independent controller under its own privacy policy.

3. Personal data we collect

Depending on your interaction with us, we may process:

• Identity data: name, company name, job title, VAT number, registration details, and customer or supplier identifier.
• Contact data: email address, telephone number, billing address, delivery address, and business contact details.
• Vehicle and parts data: VIN, registration number, make, model, year, OE or part number, compatibility information, photographs, and requested specifications.
• Order data: products, quotations, prices, invoices, returns, warranty requests, delivery status, and communications concerning the transaction.
• Payment data: payment status, currency, bank-transfer reference, and limited transaction information. Card or payment-account credentials are normally processed directly by the selected payment provider.
• Technical data: IP address, browser and device information, access time, security logs, and necessary cookie identifiers.
• Communications: emails, enquiries, complaints, reviews, call notes, and information you voluntarily provide.
• Marketing preferences: consent status, preferred communication channel, and opt-out records.

Please do not provide sensitive personal data unless it is specifically required and we have asked you to provide it.

4. Purposes and legal bases

Where information is required to enter into or perform a contract, failure to provide it may prevent us from processing an enquiry, order, delivery, return, or warranty request.

5. How we obtain personal data

We obtain data:

• directly from you or your organisation;
• from our website, customer-service channels, and transaction records;
• from marketplaces such as mobile.de, OTOMOTO, AUTO1.com, OVOKO, Allegro, and eBay where permitted by their terms and applicable law;
• from payment providers, banks, couriers, logistics providers, vehicle suppliers, warranty providers, and public registers;
• from another person within your organisation who names you as a contact.

6. Recipients of personal data

We disclose only the data reasonably necessary for the relevant purpose. Recipients may include:

• website hosting, cloud, IT support, cybersecurity, and communications providers;
• payment providers, banks, insurers, and fraud-prevention providers;
• couriers, customs representatives, transport companies, and Fulfilio Sp. z o.o. for logistics and 3PL services;
• TIAS Sp. z o.o. and other accounting, tax, legal, audit, and professional advisers;
• G-Man Auto Parts Corp. in South Korea where necessary for parts sourcing, compatibility checks, fulfilment, or customer support;
• marketplaces and business partners involved in the requested transaction;
• public authorities, courts, regulators, law-enforcement bodies, or other parties where disclosure is required by law or necessary to protect legal rights.

Service providers acting as processors on our behalf are required to process personal data only under documented instructions and appropriate confidentiality and security obligations. Some recipients act as controllers for their own processing. In particular, Microsoft describes its role for Clarity as a data controller; see the analytics disclosures in section 9.

7. International data transfers

Some transactions require data to be shared between our European operations and G-Man Auto Parts Corp. in South Korea. The European Commission has adopted an adequacy decision for the Republic of Korea, allowing covered personal data to flow from the EU/EEA under the conditions of that decision.

If data is transferred to another country outside the EU/EEA that does not benefit from an adequacy decision, we will use an appropriate GDPR transfer mechanism, such as the European Commission’s Standard Contractual Clauses, together with supplementary measures where required.

8. Data retention

We retain personal data only for as long as necessary for the purposes described in this Policy, including:

• order, invoice, tax, accounting, customs, and transaction records for the applicable statutory period, generally at least five years where Polish law requires it;
• contract, warranty, complaint, return, and legal-claim records until the relevant limitation period has expired;
• uncompleted sales enquiries generally for up to 24 months after the last meaningful contact;
• marketing data until consent is withdrawn or you object, while retaining a limited suppression record to respect your choice;
• website and security logs generally for up to 12 months, unless a longer period is necessary to investigate a security event or establish legal claims.

Data may be deleted, anonymised, or retained for a longer period where required by law, a court, a regulator, or an ongoing dispute.

9. Cookies and similar technologies

We may use strictly necessary cookies or local-storage technologies required for security, language or currency preferences, account sessions, shopping-cart operation, and essential website functions. These technologies do not require consent where they are strictly necessary to provide the service requested by you.

Analytics, personalisation, or advertising cookies will not be activated before your consent where consent is required. You must be able to accept, reject, or later withdraw consent with comparable ease. Rejecting non-essential cookies will not prevent access to the website’s basic functions.

When you allow “Browsing analytics”, we use Microsoft Clarity, provided by Microsoft, to understand storefront navigation through usage statistics, heatmaps, and masked session recordings. Clarity receives browsing and device information, including eligible page URLs and interactions. It loads only after you save that choice or choose “Accept all”. Our integration keeps advertising consent denied and excludes account, checkout, payment, order, and administration pages.

Microsoft processes Clarity data as a controller under its own privacy statement. Microsoft states that EU Clarity customers contract with Microsoft Ireland Operations Limited and that transfers from that entity to Microsoft Corporation in the United States are covered by Standard Contractual Clauses. See Microsoft’s information on its role and international transfers.

When you allow “Traffic analytics”, we use Google Analytics 4, provided by Google, to measure storefront visits, traffic sources, page views, product views, completed purchases, scrolling, and engagement. Google receives browsing and device information and pseudonymous cookie identifiers. Our integration removes query strings and fragments from page URLs sent to Google, sends only the referring website origin on entry, and uses public catalog titles on product pages. Search and filter results use a general page label; their page views are counted without sending the search text or filter values. Internal navigation between results uses the previous page address without its query string as the referrer. Validated public campaign labels may be sent separately for traffic attribution. Free-text search queries are not sent. Pages with unsupported URL parameters, and account, checkout, payment, and administration pages remain excluded. Order pages are excluded except for purchase measurement on the confirmation page after a completed payment. For purchases, we send an order reference, product identifiers and names, quantities, amounts, tax, shipping, and currency. We do not send your name, email, address, phone number, account ID, or payment credentials. The purchase value represents discounted product amounts excluding tax and shipping; it is not a replacement for our accounting records. Advertising consent, Google signals, and advertising personalisation remain disabled.

The two optional categories are off until you consent and can be selected independently. “Save preferences” applies your selected toggles, “Reject optional” turns both off, and “Accept all” allows both available categories. Necessary cookies remain enabled. You can change your choices through “Cookie settings” in the footer. Withdrawing a category stops that integration, removes its first-party analytics cookies, and normally reloads the page if a tracker was running; on order confirmation, Google collection is disabled without reloading so your receipt remains visible; a category you still allow can resume after the reload. Withdrawal does not undo collection that occurred before it. A Global Privacy Control signal also prevents our analytics loaders from starting. If we add an analytics provider, we ask for a new choice before activating it; earlier acceptance of Clarity alone does not authorise Google Analytics. Previous traffic-only consent is also renewed before purchase measurement is enabled. The Privacy Policy explains these activities; opening it does not grant analytics consent.

• enoparts_analytics_consent (Enoparts, necessary): remembers your analytics choice for up to 180 days.
• enoparts_analytics_optout (Enoparts, necessary, when enabled): excludes this browser from analytics for up to 180 days.
• enoparts_analytics_changed (Enoparts local storage): stores only a timestamp to notify other open tabs when your preference changes; it remains until replaced or browser storage is cleared.
• _clck (Microsoft Clarity, optional): remembers a pseudonymous browser identifier and preferences, normally for up to one year.
• _clsk (Microsoft Clarity, optional): groups page views into a session recording, normally for up to one day.
• _ga and _ga_* (Google Analytics, optional): distinguish browsers and maintain session information. Our integration sets their lifetime to no more than the remaining analytics-consent period, up to 180 days.

Our Google Analytics property is currently set to retain event data for two months and user data for 14 months. Reset on new activity is enabled: new activity restarts the retention period for the user identifier, so an active identifier may be kept longer than 14 months from its first visit. This does not extend the retention of every earlier event. These settings do not limit the history of standard aggregated reports. Google explains the scope and automatic deletion process in its data retention documentation. Cookie lifetimes are separate from retention on Google’s servers.

You can also delete or block cookies through your browser settings. Deleting the preference cookie removes the saved choice and we will ask again before starting optional analytics. Blocking necessary cookies may affect login, cart, or other requested functions. Withdrawing consent prevents future collection by the selected integration; for requests about previously collected personal data, contact us using the details in section 1.

Clarity may also use session storage to distinguish open tabs. Browser settings can shorten storage periods. Microsoft describes its cookies and processing in the Clarity cookie documentation and Microsoft Privacy Statement. Clarity recordings are normally retained for 30 days; heatmap data and recordings marked as favourites can be retained for up to nine months under Microsoft’s retention policy.

Google explains its processing in How Google uses information from sites or apps that use its services and its Privacy Policy.

10. Marketing communications

We send electronic marketing only where permitted by applicable law. Where consent is required, you may withdraw it at any time by using the unsubscribe method in the communication or by contacting us. Withdrawal does not affect processing that occurred before the withdrawal.

We may contact existing business customers about closely related products or services only where permitted and with a clear opportunity to object.

11. Your GDPR rights

Subject to the conditions and limitations of the GDPR, you may:

• request access to your personal data and obtain a copy;
• request correction of inaccurate or incomplete data;
• request erasure of personal data;
• request restriction of processing;
• receive data you provided in a structured, commonly used, machine-readable format and request portability where applicable;
• object to processing based on legitimate interests, including profiling based on those interests;
• object at any time to processing for direct marketing;
• withdraw consent at any time;
• lodge a complaint with a supervisory authority.

To exercise your rights, email sales@enoparts.kr. We may request information reasonably necessary to verify your identity. We will respond within the period required by applicable law.

12. Complaints to the Polish supervisory authority

You have the right to lodge a complaint with the President of the Personal Data Protection Office:

You may also contact the competent supervisory authority in the EU or EEA country where you live, work, or believe an infringement occurred.

13. Automated decision-making

We do not currently make decisions producing legal or similarly significant effects based solely on automated processing. If this changes, we will provide the information and safeguards required by the GDPR before such processing begins.

14. Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures are reviewed in light of the nature of the data, processing risks, and available technology.

No internet transmission or storage system can be guaranteed to be completely secure. Please contact us immediately if you suspect unauthorised use of your account or personal data.

15. Children

Our products and services are intended for adults and automotive businesses. We do not knowingly offer services directly to children or knowingly collect children’s personal data for marketing.

16. Changes to this Policy

We may update this Policy when our services, technology, partners, or legal obligations change. The current version will be published on this page with a revised effective date. We will provide additional notice where a change materially affects your rights or where required by law.