Privacy Policy

Last updated: May 2026 · Version 1.1

1. Data Controller

PartsMarkt operates as the data controller for personal data processed on this platform.

2. Data We Collect

• Business information: company name, city, phone, registration number
• Account credentials: email address, password hash
• Listing data: part descriptions, photos, prices
• Buyer enquiry data: name, email, phone, message content
• GDPR consent records: timestamp, IP hash (SHA-256), policy version
• Analytics: page views, feature usage (anonymised)

3. Data Processors

• Supabase — EU Frankfurt — database and authentication
• Vercel — EU region — web hosting
• Cloudflare — EU CDN — image storage and delivery
• Resend — EU — transactional email
• Stripe — EU/US (Standard Contractual Clauses) — payments and Connect payouts
• Meta Platforms Ireland — EU — Commerce Catalog sync and Meta Pixel (only with analytics consent for the Pixel)
• PostHog EU — EU — analytics (only with analytics consent)
• Sentry — EU — error monitoring

4. Sharing with Meta / Facebook

We share product listing data with Meta Platforms Ireland Limited so our parts can be discovered on Facebook Marketplace and used in remarketing through our owned Commerce Catalog. The legal basis is Article 6(1)(f) GDPR (legitimate interest in marketplace distribution); for the Meta Pixel browsing events we rely on Article 6(1)(a) (consent), captured via the cookie banner.

• Catalog sync — listing title, description, photos, price, condition, make/model, and a stable internal listing id are sent to Meta's Commerce Catalog (id 960901226885125) when a listing is created, updated, or removed.
• Meta Pixel — anonymised browsing events (page view, search, view content) are sent only after the visitor accepts analytics cookies. No raw email or phone number is shared.
• Buyer enquiry data is never shared with Meta.

You can opt out of Pixel tracking at any time via the cookie banner. Catalog sync only contains listing data (not personal data of buyers); sellers who delete their account also have their listings removed from Meta's catalog within 30 days.

5. Legal Basis

We process personal data under Article 6(1)(b) GDPR (contract performance) for seller accounts and listings, and Article 6(1)(a) GDPR (consent) for analytics cookies.

6. Retention

• Account data: retained until account deletion request, then anonymised within 30 days
• Listing data: retained with account
• Enquiry data: retained for 12 months
• Analytics data: 12 months

7. Your Rights

Under GDPR you have the right to: access, rectification, erasure (right to be forgotten), restriction of processing, data portability, and objection. To exercise these rights, use the deletion flow at /data-deletion or the account deletion feature in your profile settings. To export your data, see /api/gdpr/export while logged in.

9. Cookies & third-party services

We use cookies and similar technologies in three categories. Strictly necessary ones are always active; analytics and advertising load only with your consent.

• Strictly necessary — sign-in and session (Supabase), language preference, payment/fraud protection (Stripe), and error monitoring for security and stability (Sentry). Required to operate the site; no consent needed.
• Analytics — product usage and performance (PostHog, Vercel Analytics). Loads only if you allow analytics.
• Advertising — marketing measurement and personalisation (Meta Pixel & Conversions API). Loads/sends only if you allow advertising.

You can change or withdraw consent at any time via the "Cookie settings" link in the footer; withdrawal stops the relevant tracking and is as easy as giving consent.

8. Contact

For privacy enquiries, contact support@partsmarkt.com.