Privacy Policy

Eazzy Buy Parts (also referred to as Eazy Buy on this website; we, us or our) is responsible for the customer information described in this policy. It explains how we handle personal information when you use https://eazy-buy.co.uk, create an account, request an order or contact us.

It covers our website and customer services. Other services you choose to use, including Google, have their own privacy notices.

• Accounts: your name and email address, sign-in method and account identifier. When you register with email and password, we process your password to create a salted password hash; we store that hash rather than the readable password.
• Google Sign-In: basic profile information such as your name, email address, Google account identifier and email verification status. We use the verification status to validate sign-in and retain the information needed for your account.
• Authentication: session identifiers, expiry information and temporary sign-in security records that help keep you signed in and protect account access.
• Orders and transactions: your contact details, delivery address, items, order reference, prices, delivery charges, order/payment status, Stripe payment identifiers and relevant correspondence. Stripe collects and processes your payment details; we do not receive or store your full card number or card security code.
• Support: your name, email, optional phone number, part/order reference and the content of your enquiry or subsequent correspondence.
• Email preferences: whether you request basket reminders, the time and wording of your choice, an unsubscribe token and reminder delivery records. Basket reminders are off unless you choose to enable them in your account.
• Technical information: our hosting and security services may process IP addresses, browser/device information, request times, error records and security logs. Cookies and browser storage are described below.

Google Sign-In is optional. If you choose it, Google authenticates you and sends us information needed to create or access your customer account. We request basic identity, email and profile permissions, not access to your Gmail messages, contacts or Drive files.

We do not receive or store your Google password. Enter it only on Google’s own sign-in service. We use Google account information for authentication, account identification and related account support/security, not for advertising or to obtain your Google password.

We do not sell personal information or Google account information. Google account information is shared only where needed to provide and secure account functionality through our service providers, at your request, or to meet legal obligations.

You can manage the connection through your Google Account. Removing Google access does not itself delete an Eazy Buy account or records we must retain; use the deletion procedure below. Read Google’s Privacy Policy for information about Google’s own processing.

We use information to authenticate customers, maintain accounts, respond to order requests, arrange fulfilment, handle support and returns, prevent fraud and misuse, and operate and improve the reliability of the website.

• Contract and steps before a contract: providing the account or services you request, responding to buying enquiries and processing orders.
• Legitimate interests: securing the website, investigating misuse, resolving support issues and improving service reliability, balanced against your rights and reasonable expectations.
• Legal obligations: maintaining required transaction records and responding to valid legal or regulatory requests.
• Consent: where required for optional activities, including basket reminders you request and non-essential tracking. You can turn off basket reminders in your account or use the unsubscribe link in a reminder email. This does not stop order or enquiry updates. You can withdraw consent without affecting earlier lawful processing.

Required account and order details enable us to provide the requested service. If you do not provide them, we may be unable to create an account or fulfil an order. Optional enquiry fields may be left blank.

Information may be handled by providers needed to operate the website, including hosting, database storage, authentication, payments, support communications and delivery services. Railway hosts the application, MongoDB stores website records, Stripe processes online payments and Google handles optional Google authentication. Our postcode lookup sends the entered postcode to Postcodes.io to identify the delivery region.

Stripe receives the transaction amount, order reference, email address and payment information needed to process and protect the payment. A delivery service receives the information necessary to deliver your order. We may also disclose relevant records to professional advisers, public authorities where required by law, or where necessary to establish or defend legal claims. We limit information to what is needed for the purpose.

Some providers may process information outside the UK. Where this involves a restricted international transfer, applicable safeguards must be in place, such as an adequacy arrangement or approved contractual protections. Contact us for details of the arrangements relevant to your information.

We keep account information while it is needed to provide your account. When you request deletion, we assess which records can be erased and which must be retained for a legal obligation, an unresolved transaction, fraud prevention or a legal claim.

Order and transaction retention depends on applicable accounting, tax and consumer obligations. Support records are kept for as long as needed to resolve the enquiry and related disputes. Technical/security records are kept according to their operational purpose and the relevant provider’s settings. These purposes and any outstanding obligations determine retention; information should not be kept indefinitely merely because it is available.

Active and abandoned cart records expire after 30 days. Carts that are cleared, merged or converted to an order are retained for up to seven more days for reliable cart and order handling. Customer sessions expire after seven days, and Google sign-in challenges after ten minutes. Expired records cannot be used to sign in, although record cleanup and backup removal may occur later. Account deletion does not necessarily erase transaction records or backups immediately.

We use measures including password hashing, secure production session cookies, expiry and revocation of sessions, sign-in attempt limits and restricted staff access. Google sign-in responses are checked before an account session is issued.

No online service can guarantee absolute security. Keep your credentials private, use a strong unique password, sign out on shared devices and contact us if you suspect unauthorised access. We will assess security incidents and make notifications where required.

• Customer session cookie: keeps you signed in for up to seven days; signing out ends that session.
• Google sign-in security cookie: connects a sign-in request to your browser, lasts up to ten minutes and is cleared after the callback.
• Basket storage: browser storage and a random cart cookie remember basket items and synchronise them with our database for up to 30 days. A signed-in cart is linked to the customer account; a guest cart has no name or email attached. Staff can view carts left inactive for at least 24 hours to support sales and service. Clearing the basket marks its server record as cleared.
• Homepage preference: a session cookie remembers the last featured product so the homepage can vary what it displays.
• Google Analytics: if you accept optional analytics, Google Analytics uses cookies and similar information to measure visits, traffic sources and actions such as product searches, basket additions, checkout starts, purchases and contact requests. We do not send your name, email address, phone number, delivery address or payment-card details to Analytics. You can reject analytics or change your choice using Cookie settings.

You can clear or block cookies and site storage through your browser. Blocking authentication cookies prevents sign-in. Clearing only browser storage may not immediately remove a synchronised basket from our server; use the website basket controls or contact us to request deletion. Google and other third-party services may use their own cookies under their policies. Where optional cookies or similar technologies require consent, that consent must be obtained before they are used.

Depending on the circumstances, you can ask to access or correct your information, erase it, restrict its use, receive a portable copy, object to processing based on legitimate interests, or withdraw consent. Some rights are subject to legal exceptions.

To request account or data deletion, use our contact form and state “Account/data deletion”, with the email associated with your account. You can also phone us. No customer login is required to submit the form. We may ask for proportionate identity verification; we will never ask for your password.

We will explain any records that must be retained and why, and respond within the applicable legal time limit, normally one month, with any permitted extension explained. You may complain to the Information Commissioner’s Office (ICO) if you are unhappy with our handling of your information.

We may update this policy when our services or data practices change. The date above identifies the latest revision. Where a change materially affects you, we will provide additional notice where appropriate.