Privacy Policy

This policy explains what personal data we collect, why we collect it and what you can do about it. It is written to meet the UK GDPR and the Data Protection Act 2018.

Who is responsible for your data

The data controller is AT AUTO & SPARES LTD, trading as Heritage Motor Spares, registered in England and Wales under company number 17176482, registered office Unit 1 Main Road, Tydd Gote, Wisbech, PE13 5QD, United Kingdom.

For any privacy question, email info@atautoparts.co.uk.

What we collect

Order information. Name, delivery and billing address, email address, telephone number and what you bought.
Payment information. Card payments are processed by our payment provider. We receive confirmation that a payment succeeded and the last four digits of the card. We never see or store your full card number.
Vehicle information. Chassis, commission and engine numbers, registration, model and year, where you give them to us so we can confirm fitment.
Account information if you create an account, including order history and saved addresses.
Technical information. IP address, browser, device and pages viewed, collected through cookies.
Marketing preferences if you subscribe to emails.

Why we use it, and our lawful basis

To fulfil your order including delivery, fitment checks and support. Lawful basis: performance of a contract.
To meet legal obligations such as keeping accounting records. Lawful basis: legal obligation.
To prevent fraud and secure the site. Lawful basis: legitimate interests.
To improve our catalogue and fitment data. Lawful basis: legitimate interests.
To send marketing email. Lawful basis: consent, which you may withdraw at any time using the unsubscribe link.

Who we share it with

We share only what is necessary, and we do not sell personal data to anyone.

Shopify, which hosts this store and processes orders on our behalf.
Payment providers to take payment and handle refunds and chargebacks.
Carriers and pallet networks so your order can be delivered. They receive your name, address and telephone number.
Our reconditioning workshops where a unit is being built or a core is being returned.
Professional advisers and authorities where the law requires it.

Some providers operate outside the UK. Where data is transferred abroad it is protected by adequacy regulations or by standard contractual clauses.

How long we keep it

Order and transaction records are kept for seven years to satisfy accounting and tax requirements. Fitment and vehicle records linked to an order are kept for the same period, since they are often needed for warranty claims years later. Marketing consent records are kept until you withdraw consent and for two years afterwards. Everything else is deleted when no longer needed.

Cookies

We use cookies that are strictly necessary to run the store, such as keeping your basket and keeping you logged in. We also use analytics cookies to understand how the site is used. You can control non essential cookies through the consent banner and your browser settings. Blocking strictly necessary cookies will stop the checkout working.

Your rights

You have the right to access a copy of your data, to have inaccurate data corrected, to have data erased where we no longer need it, to restrict or object to processing, to data portability, and to withdraw consent at any time. Email us and we will respond within one calendar month.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put it right first.