Privacy Policy

Privacy Policy

Effective Date: 10.07.2025

This Privacy Policy ("Privacy Policy") explains how R2A group, MB ("Seller", "PartsInn", "we", "our", or "us") collects, uses, stores, shares and protects personal data when you visit https://www.partsinn.com ("Website"), create an account, submit a Vehicle Identification Number (VIN), place an order, contact us, or otherwise interact with our services.

This Privacy Policy forms an integral part of our Terms & Conditions. Where mandatory data protection legislation grants additional rights, such legislation shall prevail.

1. Data Controller

The controller of your personal data is:

R2A group, MB

Company Registration No.: 306168417

VAT No.: LT100015494513

Registered Office:

Pramonės pr. 6-113 , LT-51267 Kaunas

Lithuania

Email:

info@partsinn.lt

Telephone:

+370 653 31 339

Website:

https://www.partsinn.com

For questions concerning this Privacy Policy or the processing of personal data, please contact us using the details above.

2. Scope of this Privacy Policy

This Privacy Policy applies whenever you:

• visit our Website
• browse our product catalogue
• create a customer account
• place an Order
• request compatibility verification using a VIN or other vehicle information
• contact our customer support
• subscribe to newsletters or marketing communications (where applicable)
• participate in promotions or surveys (where applicable)
• submit warranty or return requests
• otherwise interact with our services.

This Privacy Policy applies to both Consumers (B2C) and Business Customers (B2B) to the extent personal data are processed.

3. Applicable Legislation

We process personal data in accordance with applicable legislation, including but not limited to:

• Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR)
• the Lithuanian Law on Legal Protection of Personal Data, where applicable
• the EU ePrivacy rules and applicable national legislation concerning electronic communications and cookies
• other applicable European Union and Lithuanian legislation.

4. Principles of Data Processing

We process personal data in accordance with the following principles:

• lawfulness, fairness and transparency
• purpose limitation
• data minimisation
• accuracy
• storage limitation
• integrity and confidentiality
• accountability.

We collect only the personal data reasonably necessary for the purposes described in this Privacy Policy.

5. Categories of Personal Data

Depending on your interaction with us, we may process the following categories of personal data.

5.1 Identification Data

• first name
• last name
• company name (where applicable)
• company registration number (where applicable)
• VAT identification number (where applicable).

5.2 Contact Data

• email address
• telephone number
• billing address
• delivery address
• country
• postal code.

5.3 Order Data

• ordered Products
• quantities
• prices
• invoices
• payment status
• discounts
• delivery method
• shipping information.

5.4 Account Data

If you create a customer account we may process:

• username
• encrypted password
• order history
• saved addresses
• communication preferences.

Passwords are stored using appropriate cryptographic protection and are never stored in plain text.

5.5 Vehicle Information

Where you request assistance selecting Products we may process:

• Vehicle Identification Number (VIN)
• vehicle make
• model
• model year
• engine code
• transmission information
• production date where provided
• original equipment (OE) numbers
• photographs of the vehicle or vehicle parts
• technical information voluntarily supplied by you.

Vehicle information may constitute personal data where it can reasonably be linked to an identifiable individual.

5.6 Communication Data

When you contact us we may process:

• emails
• chat messages
• telephone call information where applicable
• attachments
• warranty documentation
• return requests
• complaint correspondence.

5.7 Technical Data

When you use the Website we may automatically collect:

• IP address
• browser type
• browser version
• operating system
• language settings
• device type
• date and time of access
• referring pages
• pages visited
• session information
• approximate geographic location derived from your IP address.

5.8 Payment Information

Payments are processed through secure third-party payment providers.

We do not store complete payment card numbers or card security codes.

Depending on the payment method selected, we may receive limited payment-related information, such as:

• payment confirmation
• transaction identifier
• payment status
• partial card information (where provided by the payment processor)
• payer name.

6. Purposes of Processing

We process personal data only where there is a legitimate and lawful purpose.

The purposes include:

• processing Orders
• supplying Products
• arranging deliveries
• providing customer support
• responding to enquiries
• performing VIN compatibility reviews
• processing returns
• handling warranty claims
• issuing invoices
• complying with accounting obligations
• preventing fraud
• improving Website security
• improving customer service
• complying with legal obligations
• protecting our legal rights.

We do not sell personal data.

7. Legal Bases for Processing

Under Article 6 GDPR, we process personal data on one or more of the following legal bases.

7.1 Performance of a Contract

We process personal data where necessary to:

• accept Orders
• process payments
• arrange shipment
• provide customer support
• administer returns
• fulfil warranty obligations.

Without this information we may be unable to perform our contractual obligations.

7.2 Compliance with Legal Obligations

We process personal data where necessary to comply with legal obligations, including:

• accounting requirements
• tax legislation
• anti-fraud obligations
• consumer protection legislation
• court orders
• regulatory requests.

7.3 Legitimate Interests

We may process personal data where necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms.

Legitimate interests include:

• preventing fraud
• improving Website security
• protecting legal claims
• maintaining customer records
• improving our products and services
• responding to complaints
• ensuring business continuity
• preventing misuse of the Website.

7.4 Consent

Where required by law, we process personal data based upon your consent.

Examples include:

• marketing communications
• optional cookies
• promotional newsletters.

You may withdraw consent at any time.

Withdrawal of consent does not affect processing carried out before withdrawal.

8. When You Are Required to Provide Data

Certain personal data are necessary in order for us to:

• conclude a sales contract
• process payment
• deliver Products
• issue invoices
• provide warranty services.

Failure to provide mandatory information may prevent us from accepting or fulfilling your Order.

Providing optional information is voluntary.

9. Accuracy of Personal Data

You are responsible for ensuring that the personal data you provide are accurate, complete and up to date.

If your contact details, billing information, delivery address or vehicle information change, you should inform us without undue delay.

We are not responsible for delays, failed deliveries or incorrect compatibility assessments resulting from inaccurate or incomplete information provided by you.

10. Children

Our Website is intended for adults.

We do not knowingly collect personal data from children under the age of sixteen (16).

If we become aware that personal data relating to a child have been collected without appropriate legal basis, we will take reasonable steps to delete such information.

11. Automated Decision-Making

We do not make decisions producing legal or similarly significant effects based solely on automated processing within the meaning of Article 22 GDPR.

Certain automated systems may be used for fraud prevention, order validation or Website security.

Where appropriate, such processing includes meaningful human oversight.

12. Data Minimisation

We collect and retain only the personal data necessary for the purposes described in this Privacy Policy.

Where information is no longer required, it will be securely deleted or anonymised in accordance with our retention procedures and applicable law.

13. Payment Processing

To process Orders securely, the Seller cooperates with trusted payment service providers.

Depending on the payment method selected, personal data may be shared only to the extent necessary for payment processing.

The Seller does not collect or store full payment card numbers or card verification values (CVV/CVC).

13.1 Stripe

Where Customers choose to pay using Stripe, payment-related personal data are processed by Stripe in accordance with its own Privacy Policy.

The information transferred may include:

• Customer name
• billing address
• email address
• payment amount
• currency
• transaction identifier
• fraud prevention information where necessary.

Stripe acts as an independent data controller or processor depending on the specific processing activity.

More information is available at:

https://stripe.com/privacy

13.2 PayPal

Where Customers choose PayPal, payment information is processed by PayPal in accordance with its Privacy Statement.

Transferred information may include:

• Customer identification details
• billing information
• payment amount
• transaction identifiers
• fraud prevention information.

More information is available at:

https://www.paypal.com/privacy

13.3 Bank Transfers

Where Customers choose payment by bank transfer, we process information necessary to:

• identify the payment
• reconcile invoices
• fulfil accounting obligations
• prevent fraud.

14. Accounting and Tax Compliance

Personal data contained within invoices and accounting records are processed to comply with legal obligations under accounting and tax legislation.

Such information may include:

• Customer name
• company information
• VAT number
• billing address
• transaction history
• invoices
• payment confirmations.

Accounting documentation is retained for the period required by applicable legislation.

15. Delivery of Products

To deliver Products we share only the information necessary with logistics providers and authorised suppliers.

Depending on the delivery method, shared information may include:

• recipient name
• delivery address
• telephone number
• email address
• shipment reference
• Order number.

Delivery partners process personal data only for the purpose of transporting Products and associated customer service.

16. Dropshipping Fulfilment

The Seller operates primarily through a dropshipping fulfilment model.

Accordingly, certain personal data may be shared with authorised manufacturers, distributors or fulfilment partners strictly to the extent necessary to:

• prepare Products
• dispatch shipments
• fulfil Orders
• process warranty claims
• process authorised returns.

Such partners receive only the information necessary to perform the relevant services.

17. VIN Compatibility Requests

Where a Customer requests assistance selecting Products using a Vehicle Identification Number (VIN), we process the information provided solely for the purpose of assessing Product compatibility and responding to the request.

Information processed may include:

• VIN
• vehicle make
• vehicle model
• engine type
• production year
• transmission information
• factory options where provided
• photographs
• technical documentation supplied by the Customer.

VIN information is processed only for legitimate business purposes connected with Product selection, Order fulfilment, warranty administration or dispute resolution.

Where necessary, VIN information may be shared with authorised suppliers or manufacturers to verify compatibility.

18. Customer Communications

We process communications sent by Customers in order to:

• respond to enquiries
• provide technical assistance
• administer Orders
• process returns
• process warranty claims
• improve customer service
• establish legal claims where necessary.

Communications may include:

• emails
• attachments
• warranty documents
• photographs
• videos
• technical reports.

19. Customer Account

Where a Customer creates an account, personal data are processed to:

• authenticate access
• maintain order history
• store delivery addresses
• facilitate repeat purchases
• improve customer experience.

Customers are responsible for maintaining the confidentiality of their login credentials.

20. Fraud Prevention

The Seller has a legitimate interest in preventing fraudulent transactions.

Accordingly, personal data may be processed for:

• payment verification
• identity verification
• unusual transaction detection
• prevention of chargeback fraud
• Website security.

Fraud prevention measures include appropriate human oversight where necessary.

21. Customer Service

Personal data are processed to:

• answer questions
• provide technical assistance
• investigate complaints
• administer returns
• coordinate warranty claims
• improve service quality.

Customer service interactions may be retained where necessary for quality assurance, legal compliance or defence of legal claims.

22. Marketing Communications

Where permitted by applicable law and, where required, based on your consent, we may send:

• newsletters
• promotional offers
• product updates
• service announcements.

You may unsubscribe at any time by:

using the unsubscribe link contained in marketing emails; or

contacting us at info@partsinn.lt.

Withdrawal of marketing consent does not affect communications necessary for Order fulfilment.

23. Cookies and Similar Technologies

Our Website uses cookies and similar technologies.

Some cookies are strictly necessary for Website functionality.

Other cookies may be used only with your consent where required by applicable law.

Detailed information is available in our separate Cookie Policy.

24. Categories of Data Recipients

Depending on the purpose of processing, personal data may be disclosed to:

• payment service providers
• banks
• authorised logistics companies
• manufacturers
• authorised OEM distributors
• IT service providers
• website hosting providers
• accounting service providers
• legal advisers
• auditors
• public authorities where legally required.

Recipients receive only the personal data necessary for their specific functions.

25. Data Processors

Where third parties process personal data on our behalf, they act under appropriate contractual arrangements designed to protect personal data in accordance with GDPR.

We require processors to:

• process data only on documented instructions
• implement appropriate security measures
• ensure confidentiality
• assist with GDPR compliance
• delete or return data where appropriate after services conclude.

26. International Data Transfers

Some service providers may process personal data outside the European Economic Area (EEA).

Where such transfers occur, appropriate safeguards are implemented in accordance with Chapter V GDPR.

These safeguards may include:

• European Commission adequacy decisions
• Standard Contractual Clauses (SCCs)
• other lawful transfer mechanisms recognised by GDPR.

We take reasonable steps to ensure that international transfers provide an adequate level of protection.

27. Retention Periods

Personal data are retained only for as long as necessary for the purposes described in this Privacy Policy or as required by law.

Retention periods depend upon the category of data and applicable legal obligations.

Examples include:

Customer Account Data

Retained until the account is deleted or becomes inactive, subject to legal obligations.

Order Information

Retained for the period necessary to fulfil contractual obligations and comply with accounting and tax legislation.

Warranty Documentation

Retained for the duration of applicable statutory limitation periods and warranty administration.

Customer Service Communications

Retained for as long as reasonably necessary to respond to enquiries, resolve disputes and defend legal claims.

Technical Logs

Retained for security, fraud prevention and system administration purposes for an appropriate period.

Where retention is no longer necessary, personal data are securely deleted or anonymised.

28. Data Security

We implement appropriate technical and organisational measures designed to protect personal data against:

• accidental loss
• unauthorised access
• unauthorised disclosure
• alteration
• destruction
• unlawful processing.

Security measures may include:

• encrypted communications (HTTPS/TLS)
• access controls
• authentication mechanisms
• network security
• monitoring systems
• secure backup procedures
• staff confidentiality obligations.

Although we strive to protect personal data using commercially reasonable security measures, no method of electronic transmission or storage can be guaranteed to be completely secure.

29. Your Rights Under the GDPR

If you are located within the European Economic Area (EEA) or where the GDPR otherwise applies, you may have the following rights in relation to your personal data, subject to applicable legal limitations.

29.1 Right of Access

You have the right to request confirmation as to whether we process your personal data.

Where we do, you may request access to:

• the categories of personal data processed
• the purposes of processing
• the recipients or categories of recipients
• the envisaged retention period
• the source of the data where it was not obtained directly from you
• information regarding automated decision-making, where applicable.

You may also request a copy of your personal data.

29.2 Right to Rectification

You may request correction of inaccurate or incomplete personal data.

We encourage Customers to keep their account information up to date to help ensure accurate processing of Orders and customer support requests.

29.3 Right to Erasure ("Right to be Forgotten")

You may request deletion of your personal data where one of the following applies:

• the data are no longer necessary for the purposes for which they were collected
• you withdraw consent where consent was the legal basis and no other lawful basis applies
• you successfully object to processing based on legitimate interests
• the data have been processed unlawfully
• deletion is required by applicable law.

This right is not absolute.

We may retain certain information where required by:

• accounting legislation
• tax legislation
• warranty obligations
• legal claims
• fraud prevention requirements
• other applicable legal obligations.

29.4 Right to Restrict Processing

You may request restriction of processing where:

• you contest the accuracy of personal data
• processing is unlawful but you oppose deletion
• we no longer require the data but you require them for legal claims
• you have objected to processing pending verification of legitimate interests.

29.5 Right to Data Portability

Where processing is based on consent or contract and carried out by automated means, you may request your personal data in a structured, commonly used and machine-readable format.

Where technically feasible, you may also request direct transmission to another controller.

29.6 Right to Object

Where processing is based upon legitimate interests, you may object to such processing.

We will cease processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms or where processing is necessary for legal claims.

29.7 Right to Withdraw Consent

Where processing relies upon consent, you may withdraw consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

29.8 Marketing Communications

You may object at any time to the processing of personal data for direct marketing purposes.

Where you do so, we will stop sending marketing communications without undue delay.

This does not affect service-related communications necessary for Order administration or legal compliance.

30. Automated Decision-Making and Profiling

The Seller does not make decisions producing legal effects or similarly significant effects based solely on automated processing within the meaning of Article 22 GDPR.

Certain automated tools may assist with:

• fraud detection
• payment verification
• website security
• spam prevention.

Such tools support decision-making but do not replace meaningful human review where legally required.

31. Exercising Your Rights

To exercise your data protection rights, please contact us using the details below.

Email:

info@partsinn.lt

To protect your personal data, we may request reasonable information to verify your identity before responding to certain requests.

Requests are handled free of charge unless they are manifestly unfounded, excessive or repetitive as permitted by applicable law.

32. Response Time

We will respond to requests concerning personal data without undue delay and, in any event, within one month of receipt.

Where requests are particularly complex or numerous, this period may be extended by up to two additional months as permitted by Article 12 GDPR.

If an extension is necessary, we will inform you within the initial one-month period.

33. Complaints

If you believe that your personal data have been processed in violation of applicable data protection legislation, we encourage you to contact us first so that we may attempt to resolve your concerns.

You also have the right to lodge a complaint with the competent supervisory authority.

For processing carried out by R2A group, MB, the competent supervisory authority is generally:

State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija – VDAI)

L. Sapiegos g. 17

LT-10312 Vilnius

Lithuania

Website:

https://vdai.lrv.lt

You may also have the right to lodge a complaint with the supervisory authority in the EU Member State of your habitual residence, place of work or the place of the alleged infringement, where applicable.

34. Security Incidents

The Seller maintains procedures designed to detect, assess and respond to personal data security incidents.

Where required by applicable law, personal data breaches will be reported to the competent supervisory authority and, where necessary, to affected individuals.

35. Third-Party Websites

Our Website may contain links to third-party websites.

We are not responsible for the privacy practices or content of websites operated by third parties.

Customers are encouraged to review the privacy policies of such websites before providing personal data.

36. Business Transfers

In the event of a merger, acquisition, corporate restructuring, sale of assets or similar transaction, personal data may be transferred to the successor entity where permitted by applicable law.

Any successor shall remain bound by applicable data protection obligations.

37. Changes to this Privacy Policy

The Seller may amend this Privacy Policy from time to time.

The most recent version will always be published on the Website.

Material changes affecting the processing of personal data may be communicated by appropriate means where required by applicable law.

38. Relationship with Other Policies

This Privacy Policy should be read together with the following documents published on the Website:

• Terms & Conditions of Sale
• Return & Refund Policy
• Shipping Policy
• Warranty Policy (where applicable)
• Cookie Policy.

In the event of inconsistency regarding the processing of personal data, this Privacy Policy shall prevail unless mandatory legislation provides otherwise.

39. Contact Details

For all questions relating to this Privacy Policy or personal data processing, please contact:

R2A group, MB

Company Registration No.: 306168417

VAT No.: LT100015494513

Registered Office:

Kalnų g. 56

LT-47178 Kaunas

Lithuania

Email:

info@partsinn.lt

Telephone:

+370 653 31 339

Website:

https://www.partsinn.com

40. Effective Date

This Privacy Policy becomes effective on the date published on the Website.

It remains in force until amended or replaced by a newer version.

41. Governing Law

This Privacy Policy shall be interpreted in accordance with:

• Regulation (EU) 2016/679 (GDPR)
• applicable Lithuanian legislation; and

other applicable European Union data protection legislation.

Where mandatory legislation grants greater protection than this Privacy Policy, the mandatory legislation shall prevail.

42. Acceptance

By using the Website, creating an account, submitting personal data, requesting VIN compatibility assistance or placing an Order, you acknowledge that you have read and understood this Privacy Policy.

Where consent is required by applicable law, such consent will be requested separately and may be withdrawn at any time.