1. Data controller
The controller responsible for your personal data is:
Please use the email address above for privacy enquiries and requests concerning your personal data.
2. Scope of this Policy
This Policy applies when you:
- visit or use our website;
- create or use a customer or business account;
- request a quotation or contact our sales team;
- purchase, return, or enquire about a part or vehicle;
- arrange payment, delivery, warranty, or after-sales support;
- interact with us through a marketplace where we determine the purposes and means of processing.
A marketplace or payment provider may also process your data as an independent controller under its own privacy policy.
3. Personal data we collect
Depending on your interaction with us, we may process:
- Identity data: name, company name, job title, VAT number, registration details, and customer or supplier identifier.
- Contact data: email address, telephone number, billing address, delivery address, and business contact details.
- Vehicle and parts data: VIN, registration number, make, model, year, OE or part number, compatibility information, photographs, and requested specifications.
- Order data: products, quotations, prices, invoices, returns, warranty requests, delivery status, and communications concerning the transaction.
- Payment data: payment status, currency, bank-transfer reference, and limited transaction information. Card or payment-account credentials are normally processed directly by the selected payment provider.
- Technical data: IP address, browser and device information, access time, security logs, and necessary cookie identifiers.
- Communications: emails, enquiries, complaints, reviews, call notes, and information you voluntarily provide.
- Marketing preferences: consent status, preferred communication channel, and opt-out records.
Please do not provide sensitive personal data unless it is specifically required and we have asked you to provide it.
4. Purposes and legal bases
| Purpose | GDPR legal basis |
|---|---|
| Responding to enquiries, quotations, compatibility checks, orders, payment, delivery, returns, warranties, and after-sales service | Performance of a contract or steps requested before entering a contract — Article 6(1)(b) |
| Invoices, accounting, taxation, customs, product safety, and legally required records | Compliance with a legal obligation — Article 6(1)(c) |
| Fraud prevention, IT and website security, service improvement, B2B relationship management, internal administration, and establishment or defence of legal claims | Our legitimate interests or those of a third party — Article 6(1)(f), subject to a balancing assessment |
| Email marketing, non-essential analytics, and advertising cookies | Your consent — Article 6(1)(a), which you may withdraw at any time |
Where information is required to enter into or perform a contract, failure to provide it may prevent us from processing an enquiry, order, delivery, return, or warranty request.
5. How we obtain personal data
We obtain data:
- directly from you or your organisation;
- from our website, customer-service channels, and transaction records;
- from marketplaces such as mobile.de, OTOMOTO, AUTO1.com, OVOKO, Allegro, and eBay where permitted by their terms and applicable law;
- from payment providers, banks, couriers, logistics providers, vehicle suppliers, warranty providers, and public registers;
- from another person within your organisation who names you as a contact.
6. Recipients of personal data
We disclose only the data reasonably necessary for the relevant purpose. Recipients may include:
- website hosting, cloud, IT support, cybersecurity, and communications providers;
- payment providers, banks, insurers, and fraud-prevention providers;
- couriers, customs representatives, transport companies, and Fulfilio Sp. z o.o. for logistics and 3PL services;
- TIAS Sp. z o.o. and other accounting, tax, legal, audit, and professional advisers;
- G-Man Auto Parts Corp. in South Korea where necessary for parts sourcing, compatibility checks, fulfilment, or customer support;
- marketplaces and business partners involved in the requested transaction;
- public authorities, courts, regulators, law-enforcement bodies, or other parties where disclosure is required by law or necessary to protect legal rights.
Service providers acting on our behalf are required to process personal data only under documented instructions and appropriate confidentiality and security obligations.
7. International data transfers
Some transactions require data to be shared between our European operations and G-Man Auto Parts Corp. in South Korea. The European Commission has adopted an adequacy decision for the Republic of Korea, allowing covered personal data to flow from the EU/EEA under the conditions of that decision.
If data is transferred to another country outside the EU/EEA that does not benefit from an adequacy decision, we will use an appropriate GDPR transfer mechanism, such as the European Commission’s Standard Contractual Clauses, together with supplementary measures where required.
8. Data retention
We retain personal data only for as long as necessary for the purposes described in this Policy, including:
- order, invoice, tax, accounting, customs, and transaction records for the applicable statutory period, generally at least five years where Polish law requires it;
- contract, warranty, complaint, return, and legal-claim records until the relevant limitation period has expired;
- uncompleted sales enquiries generally for up to 24 months after the last meaningful contact;
- marketing data until consent is withdrawn or you object, while retaining a limited suppression record to respect your choice;
- website and security logs generally for up to 12 months, unless a longer period is necessary to investigate a security event or establish legal claims.
Data may be deleted, anonymised, or retained for a longer period where required by law, a court, a regulator, or an ongoing dispute.
9. Cookies and similar technologies
We may use strictly necessary cookies or local-storage technologies required for security, language or currency preferences, account sessions, shopping-cart operation, and essential website functions. These technologies do not require consent where they are strictly necessary to provide the service requested by you.
Analytics, personalisation, or advertising cookies will not be activated before your consent where consent is required. You must be able to accept, reject, or later withdraw consent with comparable ease. Rejecting non-essential cookies will not prevent access to the website’s basic functions.
Before enabling a non-essential technology, we will provide clear information about its category, purpose, provider where applicable, and duration, and request consent where required.
10. Marketing communications
We send electronic marketing only where permitted by applicable law. Where consent is required, you may withdraw it at any time by using the unsubscribe method in the communication or by contacting us. Withdrawal does not affect processing that occurred before the withdrawal.
We may contact existing business customers about closely related products or services only where permitted and with a clear opportunity to object.
11. Your GDPR rights
Subject to the conditions and limitations of the GDPR, you may:
- request access to your personal data and obtain a copy;
- request correction of inaccurate or incomplete data;
- request erasure of personal data;
- request restriction of processing;
- receive data you provided in a structured, commonly used, machine-readable format and request portability where applicable;
- object to processing based on legitimate interests, including profiling based on those interests;
- object at any time to processing for direct marketing;
- withdraw consent at any time;
- lodge a complaint with a supervisory authority.
To exercise your rights, email sales@enoparts.kr. We may request information reasonably necessary to verify your identity. We will respond within the period required by applicable law.
12. Complaints to the Polish supervisory authority
You have the right to lodge a complaint with the President of the Personal Data Protection Office:
You may also contact the competent supervisory authority in the EU or EEA country where you live, work, or believe an infringement occurred.
13. Automated decision-making
We do not currently make decisions producing legal or similarly significant effects based solely on automated processing. If this changes, we will provide the information and safeguards required by the GDPR before such processing begins.
14. Security
We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures are reviewed in light of the nature of the data, processing risks, and available technology.
No internet transmission or storage system can be guaranteed to be completely secure. Please contact us immediately if you suspect unauthorised use of your account or personal data.
15. Children
Our products and services are intended for adults and automotive businesses. We do not knowingly offer services directly to children or knowingly collect children’s personal data for marketing.
16. Changes to this Policy
We may update this Policy when our services, technology, partners, or legal obligations change. The current version will be published on this page with a revised effective date. We will provide additional notice where a change materially affects your rights or where required by law.