Privacy Policy

1. Purpose and scope

Car Parts Market (CPM) (we, us, or our) is committed to protecting personal information in accordance with the New Zealand Privacy Act 2020, including the information privacy principles (IPPs).

This Privacy Policy explains how we collect, use, store, disclose, and protect personal information when you:

• browse or use https://www.carpartsmarket.co.nz;
• create or use a customer account;
• buy, collect, return, or make a warranty claim for a product;
• ask us for product or vehicle-fitment assistance;
• subscribe to marketing;
• contact customer support or interact with us in store; or
• otherwise deal with us as a customer, delivery recipient, authorised collector, supplier contact, or website user.

It does not apply to staff or job-applicant information governed by a separate internal privacy notice.

2. Who collects and holds your information

The agency collecting and holding personal information is:

Car Parts Market Limited trading as Car Parts Market (CPM)

NZBN: 9429053800602

11A Akatea Road, Glendene, Auckland

info@carpartsmarket.co.nz

09 836 0807

Our Privacy Officer oversees our compliance with the Privacy Act 2020 and handles privacy enquiries, access requests, correction requests, and complaints.

3. Personal information we collect

Depending on how you interact with us, we may collect:

3.1. Identity and contact information

• name;
• email address and telephone number;
• billing, delivery, and collection address;
• account identifier and verification status;
• authorised purchaser, recipient, or collector details; and
• proof of identity or authority where reasonably required for account security, fraud prevention, high-value collection, or release of an order.

We minimise the personal information we collect. Delivery checkout necessarily requires the recipient and delivery details needed to fulfil the order, whether or not the purchaser creates an account. We do not automatically add a guest or ordinary retail customer's delivery address to a reusable address book. A trade or company account may ask us to save one or more delivery locations for future orders and may ask us to update or remove them.

An order record may retain the name, contact details, and delivery-address snapshot used for that transaction. This is different from saving the address as a reusable account location and is subject to the retention rules in section 13.

3.2. Order and payment information

• cart, product, order, invoice, payment-status, refund, and transaction information;
• payment-provider tokens and transaction references;
• billing name and address;
• promotion, store-credit, and communication records; and
• fraud, chargeback, and payment-verification information.

Card and wallet payments are processed by Stripe, and bank-payment options may be processed by POLi, where displayed at checkout. Payment information entered into a provider-controlled or provider-rendered payment flow is handled by that provider under its privacy terms and security controls.

Our application servers do not collect or store raw card numbers, card security codes, bank passwords, internet-banking credentials, or bank-account credentials. We retain only the order amount, payment-method category, payment status, provider transaction or session reference, timestamps, refund and reconciliation records, and limited fraud or chargeback information reasonably required to administer the transaction.

3.3. Vehicle and fitment information

• registration number, VIN or chassis number;
• make, model, year, build date, body style, engine, transmission, trim, and market specification;
• original and alternative part numbers;
• vehicle modifications and relevant technical details; and
• fitment requests, recommendations, confirmations, and related communications.

A registration number or VIN may be personal information when it can be linked to an identifiable person. We use vehicle information only for relevant catalogue, fitment, order, support, return, warranty, safety, fraud, and record-keeping purposes.

3.4. Returns, warranty, and support information

• order or proof-of-purchase information;
• reason for return, complaint, or claim;
• descriptions, photographs, videos, diagnostic reports, scan codes, installer information, invoices, odometer readings, and product condition;
• collection, inspection, testing, remedy, refund, and correspondence records; and
• safety incident, recall, or product-performance information.

Please do not include unrelated personal information in photographs, videos, diagnostic reports, or messages.

3.5. Website, device, and security information

• IP address, browser, operating system, device type, language, time zone, and approximate region;
• website pages and features used, referral source, session events, and error information;
• essential cookie, cart, session, authentication, and preference identifiers; and
• login, rate-limiting, fraud-prevention, audit, and security-event information.

3.6. Communications and marketing preferences

• customer-service messages, call notes, and feedback;
• review or survey responses;
• newsletter or promotional preferences;
• consent source, date, scope, and withdrawal records; and
• delivery, read, bounce, and unsubscribe events for electronic messages where provided by our communications service.

We do not intentionally collect sensitive personal information unless it is reasonably necessary for a lawful purpose. Please provide only information relevant to your request.

4. How we collect personal information

4.1. Direct collection

We usually collect personal information directly from you when you browse the website, create an account, place an order, complete a form, contact us, collect a product, or make a return or warranty request.

At or before collection, we will take reasonable steps to make you aware of:

• that information is being collected;
• why it is being collected;
• who will receive it;
• our name and address as the collecting and holding agency;
• whether supplying it is voluntary or required, and any law requiring it;
• what may happen if it is not provided; and
• your rights to access and request correction of it.

This policy provides general notice. We may give a shorter or more specific notice at a form, checkout, camera, telephone, support, return, warranty, or other collection point where appropriate.

4.2. Indirect collection

We may collect information about you from someone or somewhere else, including:

• a purchaser, family member, employer, workshop, insurer, fleet operator, or other person acting for you;
• a person who names you as a delivery recipient or authorised collector;
• payment processors, banks, fraud-prevention providers, and identity or authentication providers;
• shipping platforms, New Zealand Post AddressChecker and other address-verification providers, and carriers;
• vehicle-catalogue or fitment-data providers;
• suppliers or manufacturers handling a product, return, warranty, safety, or recall issue; and
• public registers or sources where collection is lawful, fair, and necessary.

From 1 May 2026, IPP 3A generally requires us to take reasonable steps to notify you when we collect your personal information from another source, unless an exception applies. We may notify you by email, SMS, account notice, delivery communication, direct contact, or another method reasonable in the circumstances. The notice will cover the matters required by IPP 3A.

If you give us another person's information, you must be authorised to do so and should tell them about this policy. That does not remove our own IPP 3A obligations.

5. Why we collect and use personal information

We collect and use personal information where it is necessary for a lawful purpose connected with our business, including to:

• operate, secure, maintain, and improve the website, accounts, stores, and customer services;
• create and manage carts, accounts, orders, payments, invoices, delivery, and collection;
• verify payment, identity, authority, delivery details, and transaction security;
• identify products and assess vehicle compatibility or fitment;
• communicate order, payment, collection, delivery, safety, recall, return, refund, and warranty information;
• prevent, detect, investigate, and respond to fraud, misuse, chargebacks, security incidents, and unlawful activity;
• provide customer support and resolve complaints and disputes;
• inspect products and administer change-of-mind returns, statutory remedies, voluntary warranties, and manufacturer claims;
• maintain stock, product-quality, safety, accounting, tax, legal, audit, and business records;
• establish, exercise, or defend legal claims;
• analyse service performance using aggregated or appropriately de-identified information where practicable;
• send marketing where we have a lawful permission and maintain suppression records when a person opts out; and
• comply with legal obligations, lawful requests, court orders, recalls, and regulatory requirements.

We will not use personal information for a materially different purpose unless you authorise it or the use is otherwise permitted by the Privacy Act or another law.

6. Whether you must provide information

Unless we tell you that a particular collection is required by law, providing personal information is generally voluntary. However, if you do not provide information we reasonably require, we may be unable to:

• create or secure an account;
• verify or accept payment;
• identify a compatible product;
• accept, deliver, or release an order;
• process a return, refund, or warranty claim;
• investigate fraud or a safety issue; or
• respond to your request.

We may be legally required to collect or retain some transaction, tax, identity, safety, recall, or dispute information. Where the Privacy Act requires it, the relevant collection notice will identify the law and whether supply is mandatory.

7. Who we may share information with

We disclose only information reasonably necessary for the relevant purpose. Recipients may include:

• staff and contractors who need access for their authorised role;
• Stripe, POLi, and relevant banks or payment networks;
• GoSweetSpot, the Freightways domestic and international network, New Zealand Couriers, Post Haste, Castle Parcels, Freightways Global, and the overseas airline, postal, customs, and final-mile partners used for the selected service;
• Resend for transactional email, and any replacement communications provider identified in an updated policy;
• Vercel for website hosting and delivery, Supabase for database and product-media storage, and authorised authentication, technical, or security providers;
• CarJam if the optional registration-lookup feature is offered, limited to the registration and catalogue data needed for the lookup;
• New Zealand Post AddressChecker, limited to the address fragment or selected delivery-point identifier needed to suggest and complete a delivery address, and other address-verification, customer-support, document, and fraud-prevention providers used for the relevant service;
• product suppliers, manufacturers, testing providers, and repairers handling a fitment, quality, warranty, recall, or safety issue;
• accountants, auditors, insurers, banks, lawyers, and other professional advisers;
• a buyer, investor, or adviser involved in a genuine proposed sale or restructure of all or part of the business, subject to appropriate confidentiality and privacy safeguards;
• New Zealand Customs Service and overseas customs, border, tax, sanctions, or import authorities where reasonably required for international delivery;
• Police, courts, regulators, government agencies, or other persons where disclosure is authorised or required by law; and
• another person you authorise, such as a delivery recipient, collector, workshop, insurer, or representative.

Service providers may process information only for the services they provide to us, subject to appropriate contractual, confidentiality, security, and access controls where applicable.

We do not sell personal information.

8. Overseas storage, processing, and disclosure

Our providers may store or process information in New Zealand, Australia, the United States, and other locations in which their approved infrastructure or subcontractors operate. For example, our selected Supabase database region is Australia, while global providers such as Stripe, Vercel, and Resend may use infrastructure in multiple countries. Provider locations can change, so we assess their current safeguards and contractual terms as part of provider management.

When you request international delivery, the recipient's name, contact details, address, order-related customs information, and necessary parcel information will be sent to carriers, delivery partners, customs brokers, and border authorities in the destination and any transit countries as needed to deliver and clear the consignment.

Where an overseas provider acts solely as our agent for storage or processing and does not use information for its own purposes, we remain responsible for its handling as required by the Privacy Act.

Where we disclose personal information to a foreign person or entity for its own use, we will comply with IPP 12. This means we will use a permitted basis, such as reasonably believing the recipient is subject to the New Zealand Privacy Act or comparable safeguards, or requiring comparable safeguards by agreement. If we instead rely on your authorisation, we will first expressly tell you if the recipient may not provide safeguards comparable to New Zealand law.

9. Cookies and similar technologies

We use essential cookies or similar storage where necessary to operate carts, checkout, security, authentication, load balancing, preferences, and fraud prevention. Blocking essential storage may prevent parts of the website from working.

Non-essential analytics and marketing tracking are disabled. If we later enable them, we will first update the applicable notice to identify the provider, purpose, information collected, retention period, and available controls, and obtain consent where consent is required.

You can use browser controls to delete or block cookies, although this may affect website functions.

10. Marketing communications

We send promotional email, SMS, or other commercial electronic messages only where permitted by the Unsolicited Electronic Messages Act 2007 and other applicable law.

Commercial electronic messages will:

• be sent with the required consent;
• accurately identify the sender and provide valid contact information; and
• include a clear, free, and functional way to unsubscribe.

You can withdraw marketing consent at any time through the message's unsubscribe method or by contacting info@carpartsmarket.co.nz. We will action electronic-message unsubscribe requests within five working days, as required by the Unsolicited Electronic Messages Act 2007. We may keep a minimal suppression record so we do not contact you again against your instructions.

Opting out of marketing does not stop non-promotional messages reasonably required to operate an account, complete a transaction, provide a requested service, or communicate a safety, recall, delivery, return, refund, or warranty issue.

11. Accuracy

We take reasonable steps to ensure personal information is accurate, up to date, complete, relevant, and not misleading before using or disclosing it. Please update your account or contact us if your information changes.

Vehicle and delivery information can be especially time-sensitive. You are responsible for checking information you submit, but this does not remove our obligation to take reasonable accuracy steps before using it.

12. Security

We use administrative, technical, and physical safeguards reasonable in the circumstances. Depending on the system, these may include:

• role-based and least-privilege access controls;
• account and staff authentication controls;
• encryption in transit and appropriate protection at rest;
• payment tokenisation and hosted payment processing;
• audit logging, monitoring, backups, patching, and vulnerability management;
• secure provider selection and contractual controls;
• staff privacy and security training; and
• incident-response, recovery, and access-review procedures.

No internet or storage system is completely secure. If a privacy breach has caused or is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and affected people as soon as practicable, unless an exception applies. The Commissioner's guidance indicates notification should ideally occur within 72 hours after awareness of a notifiable breach, even if investigation continues.

13. Retention and disposal

We keep personal information only for as long as reasonably required for the purpose for which it may lawfully be used, subject to legal, tax, accounting, fraud, safety, recall, warranty, dispute, and backup requirements.

Our standard retention periods are:

• Financial and statutory records: transaction, order-item, invoice, payment, refund, income, expense, banking, return, warranty, and related records are retained for at least seven tax years where required by Inland Revenue. We minimise or remove personal information that is not required as part of those records;
• Completed-order contact and delivery details: recipient contact details and delivery-address snapshots are deleted or de-identified within 90 days after delivery or collection is completed, unless reasonably required for an active return, warranty claim, delivery dispute, recall, fraud investigation, trade-account record, or other legal obligation;
• Unsuccessful checkout attempts: contact and delivery details from an expired or abandoned checkout are deleted or de-identified within 30 days after expiry, unless reasonably required for security, fraud, dispute, or legal purposes;
• Customer accounts: account-profile information is retained while the account is active. After a verified closure or deletion request, reusable profile information is deleted or de-identified within 90 days, except for information linked to records we must retain;
• Saved trade or company locations: retained until the account holder deletes them, asks us to remove them, or closes the account, then handled under the 90-day account rule, subject to retained transaction records;
• Support records: retained for up to 24 months after the enquiry is closed, unless linked to a transaction, safety matter, claim, dispute, or legal requirement with a longer lawful period;
• Security and access logs: retained for up to 12 months, unless an incident, investigation, or legal requirement justifies longer retention;
• marketing-consent and unsubscribe evidence is retained while relevant, including a minimal suppression record where needed;
• Carts without checkout contact details: normally expire or are de-identified within 90 days after the cart becomes inactive; and
• Backups: protected backups normally rotate out within 90 days, unless isolated for disaster recovery, security investigation, or a legal hold.

When information is no longer required, we securely delete, destroy, or de-identify it. Deleted information may remain in protected backups until those backups rotate out under the retention schedule.

14. Access and correction

You may ask us to:

• confirm whether we hold personal information about you;
• provide access to that information; or
• correct information you believe is inaccurate.

Contact our Privacy Officer at info@carpartsmarket.co.nz or 11A Akatea Road, Glendene, Auckland. Describe the information and request clearly. We may ask for reasonable evidence of identity or authority before disclosing information.

We will respond as soon as reasonably practicable and generally no later than 20 working days, unless the Privacy Act permits an extension. The Act allows limited grounds for withholding information. If we refuse access or correction, we will explain the applicable reason and your right to complain where required.

If we do not make a requested correction, you may ask us to attach a statement of correction to the information. Where required and reasonably practicable, we will inform relevant recipients of a correction or statement.

Access is usually free. If the law permits a charge in a particular case, we will tell you before incurring it.

15. Privacy questions and complaints

Please raise any privacy question or complaint with our Privacy Officer first:

Privacy Officer

info@carpartsmarket.co.nz

09 836 0807

11A Akatea Road, Glendene, Auckland

Please explain what happened and the outcome you seek. We will acknowledge, investigate, and respond within a reasonable time.

If you are not satisfied, you may complain to the New Zealand Office of the Privacy Commissioner:

• Website: privacy.org.nz
• Complaint information: privacy.org.nz/your-rights/how-to-complain/

16. Children's information

The website is not directed at children under 16. A person under 18 should use the website or place an order only with the involvement of a parent or legal guardian.

If we know we are dealing with a young person, we will take particular care that collection is fair, necessary, and explained in an age-appropriate way. Contact our Privacy Officer if you believe a child has provided information without appropriate involvement.

17. Third-party websites

The website may link to third-party services. Their privacy practices are governed by their own notices. A link does not make us responsible for an unrelated third party's handling of information, although we remain responsible for providers acting as our agents and for our own disclosures as required by law.

18. Changes to this policy

We may update this policy when our practices, providers, or legal obligations change. We will publish the new effective date and version. If a change is material, we will take reasonable steps to bring it to the attention of affected people and obtain authorisation where the law requires it.