Privacy policy

Version 3.7, 24 October 2026. This policy explains what personal data EVParto collects, why, how long we keep it, who else sees it, and the rights you have over it.

We sell vehicle parts. We need an address to ship to, a way to take payment and a way to reach you about your order. That is most of what follows. We do not sell personal data, we do not trade it, and we do not build profiles for other companies to buy.

1. Who is responsible for your data

The controller of your personal data processed on www.evparto.com, www.evparto.de, www.evparto.es, checkout.evparto.com, checkout.evparto.de and checkout.evparto.es, in the sense of Article 4(7) of Regulation (EU) 2016/679 (GDPR), is:

Dragon Wagon Export Limited, trading as EVParto (A DW-Export Brand)
Room No. 15, Unit 603, 6th Floor, Sunbeam Centre, No. 27 Shing Yip Street, Kwun Tong, Kowloon, Hong Kong SAR
Company number 79920083 (Companies Registry, Hong Kong), also its Business Registration Number
Email: contact@evparto.com

Our representative in the European Union, appointed under Article 27 GDPR, is Mario Zaccagnini, Calle de Ayala 112, 3B, 28006 Madrid, Spain, contact@evparto.com. You may address the representative on any matter concerning the processing of your personal data, in addition to or instead of contacting us. Supervisory authorities may do the same.

We have not appointed a data protection officer. Our processing does not meet the conditions in Article 37(1) GDPR: it is not carried out by a public authority, our core activities do not consist of large scale regular and systematic monitoring, and we do not process special categories of data on a large scale. Data protection questions go to the address above and reach our management.

2. What we collect, why, and on what legal basis

What we collect	Why	Legal basis (GDPR Article 6(1))	How long we keep it
Name, delivery address, billing address, email, telephone number	To form the contract, ship the goods, clear customs and contact you about the order	(b) performance of a contract; (c) legal obligation for customs and tax records	7 years from the end of the tax year of the transaction
Order contents, part numbers, prices, currency, delivery choice, split-consignment choice	To fulfil and account for the order, and to handle returns and guarantee claims	(b) contract; (c) legal obligation	7 years, and for the life of the 24 month guarantee plus any statutory period that is longer
Payment confirmation, last four digits of the card, payment method, authorisation result	To take payment, refund, and investigate chargebacks and fraud	(b) contract; (f) legitimate interests in preventing fraud	7 years. We never receive or store the full card number
Tax identification number, personal identification number or customs registration where a destination requires it	To clear the consignment through customs in your country	(c) legal obligation of the destination country; (b) contract	7 years, as part of the customs record
Vehicle identification number, registration, model and year, where you send it to us	To check which part fits your vehicle before you buy	(b) steps at your request before a contract; (f) legitimate interest in giving accurate advice	24 months from the enquiry, unless it forms part of an order record
Emails, quote requests, WhatsApp messages, complaints and the notes we make on them	To answer you, to handle guarantee and return claims, and to keep a record of what was agreed	(b) contract; (f) legitimate interest in defending claims and improving service	3 years from the last message, or longer where a claim is live
Account details if you create one: email, password hash, saved addresses, order history	To let you sign in, reorder and track	(b) contract	Until you delete the account, then 7 years for the underlying order records
Marketing consent, and the record of when and how you gave or withdrew it	To send the newsletter you asked for, and to prove the consent was valid	(a) consent; (c) legal obligation to evidence consent	Until you unsubscribe, then 3 years for the consent record
IP address, device and browser type, pages viewed, referring page, timestamps, error logs	To run and secure the site, to spot fraud and abuse, and to fix faults	(f) legitimate interests in security and in a working site	12 months for logs, 90 days for detailed request logs
Analytics data from optional cookies	To understand which pages work and which do not	(a) consent, given through the cookie banner	Up to 14 months
Sanctions and restricted party screening results	To meet export control and sanctions obligations before we ship	(c) legal obligation; (f) legitimate interest in lawful trade	5 years from the screening

Where we rely on legitimate interests under Article 6(1)(f), we have carried out a balancing assessment in each case and concluded that our interest does not override your rights. You can ask us for a summary of that assessment, and you can object under Article 21, which section 7 explains.

What we do not collect. We do not ask for and do not want special category data under Article 9 GDPR: health, biometrics, political or religious views, trade union membership, sexual orientation. Do not send it to us. If you include it in a message, we redact it. We do not knowingly collect data from children under 16, and our products are not directed at them.

Automated decision-making. We do not make decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing within the meaning of Article 22 GDPR. Our fraud and sanctions screening flags orders for a person to review, and a person decides.

3. Who else sees your data

We share the minimum needed, with parties who are contractually bound to use it only for the purpose we give them. Most act as processors under Article 28 GDPR and are covered by a data processing agreement.

Our e-commerce platform, which hosts the store, the checkout and the order records.
Payment providers, who take the payment. They receive your payment details directly and act as independent controllers for their own fraud prevention and regulatory duties. We receive a result and a masked card number, never the full number.
Carriers, freight forwarders and customs brokers, who receive your name, address, telephone number, email, the goods description, the commodity code and the declared value. Some destinations also require a tax or identification number. Customs authorities in the destination country receive the customs declaration, which is a legal obligation.
Our email and messaging providers, for order emails and any newsletter you have asked for.
Analytics and error monitoring providers, where you have consented to optional cookies. Today that is Google Analytics 4, run for us by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as our processor under the Google Ads Data Processing Terms. It receives the pages you view, the parts you look at or add to your basket, the items and value of an order you place, and technical data about your device and browser, under a random identifier. We do not send it your name, email or address, and we have switched off Google's option to use this data for its own products.
Cloudflare, which serves the site, protects it and our forms from abuse, and routes our email. It sees your IP address and the technical details of each request.
Google, if we offer its customer reviews survey after an order. You would be asked separately, and only if you agree does Google receive your email address, your country and the expected delivery date so that it can invite you to rate us.
Our accountants and auditors, and our legal advisers where a claim arises.
Authorities, where the law requires disclosure, or to establish, exercise or defend legal claims.
A buyer of the business, if it is ever sold, with notice to you before the transfer.

We do not sell personal data, we do not rent mailing lists, and we do not share your data with other retailers for their own marketing.

Google services we use as a business. We use Google Merchant Center, Google Analytics, Google Search Console and Google Ads to run and measure our shop. Our technical connection to these services (Google Cloud project "EVParto") works only on our own business accounts. It never asks you to sign in with Google and does not read, store or share any data from your Google account. If that ever changes, this section will first say exactly what is accessed and why, and any such use will follow the Google API Services User Data Policy, including its Limited Use requirements.

4. Transfers outside the European Economic Area

We are established in Hong Kong. If you buy from us, your data is processed in Hong Kong, and it may be processed by our providers in the European Economic Area, the United Kingdom, the United States and elsewhere.

Hong Kong is not the subject of an adequacy decision of the European Commission under Article 45 GDPR. Transfers from the EEA to us therefore rely on appropriate safeguards under Article 46(2)(c) GDPR, namely the standard contractual clauses adopted by the Commission in Implementing Decision (EU) 2021/914, which we have entered into with the exporting parties, supported by a transfer impact assessment and by technical measures including encryption in transit and at rest and strict access control.

Where a transfer is necessary for the performance of the contract you have asked for, in particular sending your address to a carrier so your parcel can reach you, Article 49(1)(b) GDPR also applies. Where a transfer to a destination customs authority is necessary, it is a legal obligation of that country and the goods cannot be imported without it.

Transfers to providers in the United States rely on the standard contractual clauses and, where the provider is certified, on the EU-US Data Privacy Framework adequacy decision. Transfers to the United Kingdom rely on the UK adequacy decision. You may ask us for a copy of the safeguards in place at contact@evparto.com.

Hong Kong has its own data protection law, the Personal Data (Privacy) Ordinance (Cap. 486), and we comply with its six data protection principles in addition to the GDPR obligations we have accepted.

5. Cookies and similar technologies

Cookies are small files a site stores on your device. We use as few as we can.

Strictly necessary cookies keep you signed in, remember your basket, hold your language and currency, and protect the checkout against fraud. The site does not function without them. They are set on the basis of Article 5(3) of Directive 2002/58/EC as amended, which does not require consent for cookies strictly necessary to provide a service you have requested, and they are covered by our legitimate interest under Article 6(1)(f) GDPR.
Analytics cookies tell us which pages people use and where they get stuck. They are set only if you accept them. We use Google Analytics 4 for this.
Preference cookies remember choices you have made, such as a dismissed banner. They are set only if you accept them.
We do not use advertising or cross-site tracking cookies, and we do not run retargeting pixels. If we start advertising, for example with Google Ads, the Cookie Policy is updated first and it runs only with your consent to marketing cookies.

The cookie banner appears on your first visit. Nothing beyond the strictly necessary set is placed until you choose, refusing is as easy as accepting, and you can change your choice at any time from the link in the footer. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

Our Cookie Policy describes each category and lists the cookies by name and duration.

6. Marketing

We send marketing email only where you have asked for it. Signing up is a positive act, a pre-ticked box is not consent, and every message carries a one-click unsubscribe that works immediately. Unsubscribing does not affect the emails we have to send about an order you have placed, such as the dispatch confirmation, which are service messages rather than marketing.

Where you have bought from us and we email you about similar parts, we rely on the soft opt-in permitted by Article 13(2) of Directive 2002/58/EC, we tell you at the point of purchase, and we give you the chance to refuse then and in every message afterwards.

7. Your rights

Under Articles 15 to 22 GDPR, and under equivalent rights in other countries, you can:

Access your data and get a copy of it, with the information listed in Article 15.
Correct anything inaccurate, and complete anything incomplete, under Article 16.
Erase your data under Article 17, where we no longer need it, where you withdraw the consent it rested on, or where you object and we have no overriding ground. Records we must keep for tax and customs law cannot be erased until the retention period ends, and we will tell you which ones those are. To ask for deletion, see Delete your data.
Restrict processing under Article 18, for example while a dispute about accuracy is resolved.
Port the data you gave us, in a structured, commonly used, machine-readable format, and have it sent to another controller where technically feasible, under Article 20.
Object under Article 21 to processing based on legitimate interests, on grounds relating to your particular situation. Where you object to direct marketing, we stop immediately and without argument.
Withdraw consent at any time under Article 7(3), without affecting the lawfulness of what was done before.
Not be subject to a decision based solely on automated processing with legal or similarly significant effects, under Article 22. We do not make such decisions.

How to use them. Email contact@evparto.com, marked "Data protection", or write to our EU representative at the Madrid address in section 1. We answer within one month, as Article 12(3) requires, and we may extend by two further months for a complex request, in which case we tell you within the first month and say why. There is no charge, unless a request is manifestly unfounded or excessive, when we may charge a reasonable fee or refuse and explain why.

We may ask for enough information to be sure who you are. That is a security measure, not an obstacle, and we ask for the least that will do the job.

8. Complaints

Tell us first at contact@evparto.com and we will try to put it right.

You also have the right under Article 77 GDPR to lodge a complaint with a supervisory authority, in the member state of your habitual residence, your place of work, or the place of the alleged infringement. Our EU representative is established in Spain, so the Spanish Agencia Española de Protección de Datos is one available route, and you are equally free to go to your own national authority. In the United Kingdom the authority is the Information Commissioner's Office. In Hong Kong it is the Office of the Privacy Commissioner for Personal Data. You also have a right to an effective judicial remedy under Articles 78 and 79 GDPR.

9. Security

We take the measures required by Article 32 GDPR, appropriate to the risk:

encryption in transit using TLS across the whole site, and encryption at rest for stored order data;
access on a need-to-know basis, with individual accounts and multi-factor authentication on every administrative system;
payment card data handled entirely by PCI DSS compliant providers, so full card numbers never reach our systems;
logging and monitoring of administrative access, and regular review of who has it;
backups held encrypted, with restoration tested;
staff and contractors bound by confidentiality and instructed on handling personal data.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we notify the competent supervisory authority within 72 hours under Article 33, and we notify you directly without undue delay under Article 34 where the risk is high.

10. Retention

The table in section 2 gives the period for each category. Behind those periods sit three rules:

accounting and customs records are kept for 7 years from the end of the relevant tax year, which is what Hong Kong company law and the tax and customs rules of the countries we ship to require;
records that support a guarantee or a legal claim are kept while the claim can still be brought, which is up to 3 years in most countries and longer in a few;
everything else is deleted or anonymised once its purpose has ended.

Anonymised data, which can no longer identify anyone, may be kept indefinitely for statistics and for improving our catalogue.

11. If you are in California

Under the California Consumer Privacy Act as amended by the California Privacy Rights Act, California residents have the right to know what personal information is collected and how it is used and shared, to request deletion, to request correction, to opt out of the sale or sharing of personal information, and not to be discriminated against for exercising those rights.

We do not sell or share personal information as those terms are defined in that Act, and we do not use it for cross-context behavioural advertising. The categories we collect, the purposes and the recipients are the ones set out in sections 2 and 3 above. To make a request, email contact@evparto.com. We respond within 45 days and may extend once by a further 45 days where the request is complex.

12. Changes to this policy

We update this policy when our processing changes. The version number and date at the top tell you which version you are reading. Where a change is material, we tell customers by email or by a notice on the site before it takes effect. We keep previous versions and will send you one on request.

13. Contact

Controller: Dragon Wagon Export Limited, Room No. 15, Unit 603, 6th Floor, Sunbeam Centre, No. 27 Shing Yip Street, Kwun Tong, Kowloon, Hong Kong SAR, contact@evparto.com
EU representative under Article 27 GDPR: Mario Zaccagnini, Calle de Ayala 112, 3B, 28006 Madrid, Spain, contact@evparto.com