Privacy and Cookies Policy

1. Data Controller

Controller: HD PARTS AND ACCESSORIES SL
VAT: ESB19925114
Address: POL FORTIZ SECTOR A, 15, 21007 HUELVA, HUELVA, SPAIN
Email: [email protected]
Phones: +34 959 05 75 47 / +34 636 847 491

2. Scope of this Policy

This Policy explains how we process personal data when you visit our website, create an account, place an order, contact us, or agree to receive commercial communications. It also describes the use of cookies and similar technologies.

3. Purposes of Processing

• Order and after-sales management: processing orders, payments, invoicing, logistics, customer support and warranties.
• Account management: registration, authentication, account maintenance and security.
• Customer service: responding to requests for information, incidents, or rights requests.
• Marketing communications: newsletters and offers where you have consented or where allowed under applicable law (Art. 21 LSSI).
• Fraud prevention and security: monitoring to prevent abuse and unauthorized access.
• Legal obligations: accounting, tax, and consumer law compliance.
• Service improvement: aggregated and anonymized statistical analysis of website usage.

4. Legal Bases

• Performance of a contract (Art. 6.1.b GDPR): managing orders, accounts, and customer service.
• Consent (Art. 6.1.a GDPR): sending commercial communications and the use of non-essential cookies.
• Legal obligation (Art. 6.1.c GDPR): compliance with tax, accounting, and consumer regulations.
• Legitimate interest (Art. 6.1.f GDPR): fraud prevention, network security, and service improvements.

5. Categories of Data

• Identification and contact: name, surname, address, email, phone.
• Transactional: purchased products, amounts, incidents, warranties.
• Billing: data required to issue invoices.
• Access and account: login credentials (hashed), activity logs, and security records.
• Communications: queries, tickets, marketing preferences.
• Technical data: IP address, cookies, device identifiers, browsing data.

6. Data Sources

Data is collected directly from you (forms, checkout, communications) and, where applicable, from payment or shipping providers when processing your order.

7. Recipients

• Logistics providers: carriers and collection points to deliver your order.
• Payment processors: to manage secure transactions.
• IT services: hosting, maintenance, Cloudflare (security and CDN), Google (analytics/ads cookies), PrestaShop modules.
• Public authorities where a legal obligation applies.

8. International Transfers

Some providers (such as Google or Cloudflare) may transfer data outside the EEA. In such cases, European Commission Standard Contractual Clauses and additional safeguards are applied.

9. Data Retention

• Accounts and orders: while the account is active and as long as needed for order management and after-sales.
• Billing: 6 years (Commercial Code) and 4 years for tax obligations.
• Marketing: until you withdraw consent or object.
• Cookies: as detailed in the Cookies section.

10. Data Subject Rights

You may exercise your rights of access, rectification, erasure, objection, restriction, and portability, as well as the right not to be subject to automated decisions, by contacting us at [email protected] or by postal mail to our address, indicating “Data Protection” and including proof of identity.

If you are not satisfied with our response, you may lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.

11. Marketing Communications

We will only send commercial communications if you have subscribed or if you are a customer and applicable law allows it. You may unsubscribe at any time using the link in each email or by contacting us.

12. Security

We apply appropriate technical and organizational measures to protect data (access controls, encryption in transit, minimization policies, and backups), reviewed regularly.

13. Minors

Our services are not directed to children. In Spain, parental or guardian consent is required if you are under 14 years old.

14. Cookies Policy

This website uses first-party and third-party cookies to ensure technical operation, improve services, and analyze usage.

• Technical cookies (PrestaShop): required for the store to work (cart, login, sessions).
• Security and performance cookies (Cloudflare): protect the site against attacks and optimize performance.
• Analytics/advertising cookies (Google): Google Analytics and, where applicable, Google Ads for statistics and ad personalization.

On entering the site, you are informed via a banner and can accept or reject non-essential cookies. You may manage or revoke consent at any time from the banner or your browser settings.

Retention depends on each cookie: technical cookies usually expire at the end of the session, while Google cookies may last between 1 day and 24 months depending on their purpose.

More information about Google cookies: policies.google.com/technologies/cookies
More information about Cloudflare cookies: cloudflare.com/en-gb/privacypolicy

15. Governing Law and Jurisdiction

This Policy is governed by Spanish law. For the resolution of any dispute or conflict arising from access to or use of this website, both parties expressly agree to submit to the Courts of Huelva (Spain), waiving any other jurisdiction that may apply.