Privacy Policy

Parts Corp (Pty) Ltd ("Parts Corp", "we", "us", "our") operates the Parts Corp online storefront for the supply of genuine OEM replacement parts for commercial foodservice and beverage equipment. Parts Corp is registered and operates in the Republic of South Africa.

This Privacy Policy describes how we collect, use, disclose, and retain your personal information when you access or use our website and services. It applies to all visitors, registered customers, and franchise account holders. It is written to comply with the Protection of Personal Information Act 4 of 2013 ("POPIA") and, where applicable to data subjects in the European Economic Area, the General Data Protection Regulation 2016/679 ("GDPR").

By using our website you acknowledge that you have read and understood this policy.

Parts Corp has designated an Information Officer as required by POPIA s.55 and consistent with the GDPR Art. 37 contact point obligation. You may contact the Information Officer for any privacy-related enquiry, access request, or complaint:

• Email: privacy@partscorp.co.za
• Information Officer: [Name — TODO(legal): confirm and insert]

We collect the following categories of personal information:

We process personal information only where we have a lawful basis under POPIA s.11 and (where GDPR applies) Art. 6:

We engage the following third-party processors to operate our service. Each processor is bound by data processing agreements and is only permitted to use your data as instructed by Parts Corp:

Some processors operate on global edge networks (Vercel, Cloudinary, Cloudflare) meaning your request data may be processed in data centres outside South Africa, including in the European Union, the United States, and the Asia-Pacific region. Paystack processes payment data in Nigeria and South Africa. Our primary Medusa backend and order data reside on AWS af-south-1 (Cape Town), and our AWS S3 buckets are configured to their designated regions.

Where personal information is transferred outside of South Africa, Parts Corp takes reasonable steps to ensure that the recipient is subject to a law, binding corporate rules, or binding agreement that provides an adequate level of protection, as required by POPIA s.72. For transfers to countries that are parties to adequacy decisions (e.g. EU under GDPR), we rely on those adequacy determinations. For other transfers, we rely on contractual safeguards and the legitimate operational necessity of using these globally distributed infrastructure providers to deliver the service.

We retain personal information only for as long as is necessary for the purpose for which it was collected, or as required by applicable law:

Under POPIA s.23/24 and (where applicable) GDPR Art. 15–22, you have the following rights in relation to your personal information:

• Access — You may request a copy of the personal information we hold about you. Registered customers can initiate a download from Account → "Download my data".
• Erasure — You may request deletion of your account and associated personal data. Registered customers can initiate this from Account → "Delete my account". Deletion is subject to a 30-day soft-delete window before permanent removal. Note that order records required for legal or tax compliance are retained as described in section 7 above.
• Rectification — You may correct inaccurate or incomplete personal information by updating your profile in your account, or by contacting the Information Officer.
• Withdraw consent — Where processing is based on your consent (e.g. analytics cookies, marketing emails), you may withdraw consent at any time. Cookie settings are accessible via the footer. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
• Lodge a complaint — You may lodge a complaint with the Information Regulator of South Africa (POPIA) or, if you are in the EEA, with the relevant supervisory authority in your country of residence. The Information Regulator can be contacted at inforegulator.org.za.

To exercise any of these rights, contact the Information Officer at privacy@partscorp.co.za. We will respond within 30 days.

We use the following cookies. Strictly-necessary and functional cookies cannot be disabled as they are essential to the operation of the website. Analytics cookies are opt-in only and set only with your consent.

You can manage your cookie preferences at any time via the Cookie settings link in the footer.

The Parts Corp website and services are not directed at persons under the age of 18. We do not knowingly collect personal information from minors. If you believe that we have inadvertently collected personal information from a person under 18, please contact the Information Officer at privacy@partscorp.co.za so that we can delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal obligations. Where changes are material, we will notify you by email (to the address associated with your account) or by displaying a prominent banner on the website. The "Last updated" date at the top of this page reflects the most recent revision. We encourage you to review this policy periodically.

For any questions, access requests, or complaints relating to this Privacy Policy or the processing of your personal information, please contact us:

Complaints about our handling of personal information may also be lodged with the Information Regulator of South Africa at inforegulator.org.za.

For a full copy of our Terms & Conditions, please visit the linked page.