Privacy Policy

This Privacy Policy explains how Ayda Cavuldar (SubmitParts Business), operating SubmitParts (“SubmitParts”, “we”, “us”, or “our”), collects, uses, discloses, stores and protects personal data when you access or use submitparts.com, associated SubmitParts digital services and, where made available, official SubmitParts mobile applications (collectively, the “Platform”).

SubmitParts operates an international business-to-business (“B2B”) RFQ, sourcing, communication and marketplace platform for spare parts.

SubmitParts does not sell physical spare parts and does not collect or process the commercial purchase price payable between independent Buyers and Suppliers for physical goods. Payments processed by or on behalf of SubmitParts relate to SubmitParts' own digital services, such as eligible Membership Plans and Extra Credit Packs.

This Privacy Policy should be read together with the Terms & Conditions, Cookie Policy, and other applicable SubmitParts legal documents.

1. WHO IS RESPONSIBLE FOR YOUR PERSONAL DATA

For the purposes of applicable data-protection law, the operator responsible for the personal data described in this Privacy Policy is:

SubmitParts
Ayda Cavuldar (SubmitParts Business)
Website: submitparts.com
Privacy enquiries: privacy@submitparts.com
General enquiries: info@submitparts.com

Depending on the circumstances and applicable law, SubmitParts may act as the data controller or equivalent responsible organisation for personal data processed in connection with the Platform.

2. PERSONAL DATA WE MAY COLLECT

The information we collect depends on how you interact with SubmitParts and which Platform functionality you use.

2.1 Identity and Contact Information

We may collect information such as:

• full name;
• business email address;
• telephone number;
• job title or business role;
• account identifiers; and
• other contact information you provide.

2.2 Business and Organisation Information

Where relevant to Platform participation, we may collect:

• company or trading name;
• business address;
• country of operation;
• company registration information;
• tax or VAT information;
• business type;
• business website; and
• other information supplied for account or business verification.

2.3 Account and Authentication Information

We process information necessary to create, secure and administer accounts, which may include:

• account email address;
• securely stored password credentials;
• account role or capabilities;
• account status;
• email verification information;
• authentication and session information;
• password-reset activity;
• trusted-device or security information; and
• login and account-security records.

Passwords are not intended to be stored in readable plain-text form.

2.4 Technical and Security Information

When you use the Platform, we may automatically process technical information such as:

• IP address;
• browser type;
• device or operating-system information;
• User-Agent information;
• request and access information;
• login timestamps;
• session information;
• security events;
• failed authentication attempts;
• fraud-prevention information; and
• administrative or security audit records.

This information may be used to operate, protect, troubleshoot and secure the Platform.

2.5 RFQ Information

When a User creates a Request for Quotation (“RFQ”), we may process information including:

• equipment or vehicle information;
• manufacturer or brand;
• model;
• serial or identification information;
• part numbers;
• part descriptions;
• required quantities;
• preferred condition;
• destination information;
• photographs;
• drawings;
• attachments; and
• other information submitted with the RFQ.

Users should avoid including unnecessary personal or sensitive information in RFQs or attachments.

2.6 Quotation Information

When Suppliers submit quotations, we may process information including:

• quoted parts;
• quantities;
• prices;
• currency;
• part condition;
• availability;
• shipping information;
• lead or dispatch estimates;
• quotation validity;
• commercial terms; and
• other information submitted by the Supplier.

2.7 Deal and Communication Information

Where a quotation is accepted, we may process and retain information relating to the resulting Deal / Commercial Agreement record.

This may include:

• Buyer and Supplier information;
• accepted quotation information;
• parts and quantities;
• quoted prices;
• Deal status;
• relevant timestamps;
• Deal Room messages; and
• other information required to administer or record the Platform interaction.

2.8 Ratings, Reviews and Feedback

Where Platform functionality permits, we may process:

• ratings;
• reviews;
• reports;
• feedback; and
• information associated with moderation or review disputes.

2.9 Membership and Extra Credit Information

Where paid Platform services are used, we may process information including:

• Membership Plan;
• membership status;
• activation date;
• expiry date;
• Platform allowances;
• Extra Credit purchases;
• credit usage;
• payment status;
• transaction reference;
• amount;
• currency; and
• other information necessary to administer the purchase.

2.10 Payment Information

Payments made to SubmitParts for its own digital services may be processed using supported payment providers or bank transfer.

Depending on the payment method, SubmitParts may receive or retain information such as:

• payment status;
• payment-provider transaction identifier;
• payment reference;
• amount;
• currency;
• date;
• payer information supplied with a bank transfer; and
• information necessary to reconcile the payment with a SubmitParts account or purchase.

Where card payments are processed directly by an external payment provider, SubmitParts does not intend to store complete payment-card numbers or card security codes.

Payment providers may independently process payment information according to their own legal obligations and privacy practices.

3. HOW WE COLLECT PERSONAL DATA

We may collect personal data:

• directly from you when you register or update an account;
• when you create an RFQ;
• when you submit a quotation;
• when you accept a quotation or participate in a Deal;
• when you send Platform communications;
• when you purchase a Membership or Extra Credit Pack;
• when you contact SubmitParts;
• when you submit a rating, review or report;
• automatically when you access or use the Platform;
• through security, fraud-prevention or authentication systems;
• from payment providers or banks in connection with a transaction; and
• from other Users where reasonably necessary to operate an RFQ, quotation, Deal or other Platform interaction.

4. WHY WE USE PERSONAL DATA

We may process personal data for purposes including:

4.1 Providing the Platform

To:

• create and administer accounts;
• authenticate Users;
• provide RFQ functionality;
• provide quotation functionality;
• create and administer Deal records;
• provide messaging and communication features;
• provide memberships and account entitlements;
• administer Extra Credits; and
• provide customer or account support.

4.2 Platform Communications

To send communications necessary or appropriate to Platform operation, which may include:

• email verification;
• password-reset communications;
• account-security notices;
• RFQ alerts;
• quotation notifications;
• Deal notifications;
• membership or payment communications;
• administrative messages; and
• legal or policy notices.

4.3 Security and Fraud Prevention

To:

• protect User accounts;
• detect unauthorised access;
• prevent fraud and abuse;
• detect automated or malicious activity;
• enforce Platform restrictions;
• investigate security incidents;
• maintain security logs; and
• protect SubmitParts, Users and third parties.

4.4 Payments and Accounting

To:

• verify payments made to SubmitParts;
• activate purchased digital services;
• reconcile bank transfers;
• administer refunds or payment corrections;
• maintain transaction records; and
• comply with applicable accounting, tax and legal obligations.

4.5 Platform Administration and Improvement

To:

• monitor Platform operation;
• diagnose technical problems;
• understand use of Platform functionality;
• maintain service quality;
• develop or improve features;
• enforce applicable Platform agreements; and
• maintain appropriate audit records.

4.6 Legal Compliance

To comply with legal obligations, lawful requests, court orders, regulatory requirements, tax requirements, fraud-prevention duties or other obligations applicable to SubmitParts.

5. LEGAL BASES FOR PROCESSING

Where the General Data Protection Regulation (“GDPR”), UK GDPR or another law requiring a legal basis applies, SubmitParts may rely on one or more of the following legal bases depending on the processing activity:

5.1 Performance of a Contract

Where processing is necessary to provide Platform services requested by the User or to take steps at the User's request before entering into a contract.

This may include:

• account administration;
• RFQ functionality;
• quotation functionality;
• Deal functionality;
• Membership administration; and
• Extra Credit purchases.

5.2 Legitimate Interests

Where processing is necessary for legitimate business or security interests and those interests are not overridden by applicable rights and freedoms.

This may include:

• Platform security;
• fraud prevention;
• abuse prevention;
• service administration;
• appropriate business communications;
• enforcement of Platform rules; and
• establishment, exercise or defence of legal claims.

5.3 Legal Obligations

Where processing is necessary to comply with applicable legal, tax, accounting, regulatory or law-enforcement obligations.

5.4 Consent

Where applicable law requires consent, SubmitParts may rely on consent for specific processing, such as certain non-essential cookies, advertising technologies or optional marketing activities.

Where processing is based on consent, consent may be withdrawn in accordance with applicable law without affecting processing lawfully carried out before withdrawal.

5.5 Other Applicable Legal Bases

Where Türkiye's Personal Data Protection Law (“KVKK”) or another applicable privacy law applies, SubmitParts will process personal data on a lawful basis available under that legislation.

The precise legal basis may vary according to the User, jurisdiction and processing activity.

6. WHEN INFORMATION MAY BE SHARED

SubmitParts does not sell personal data as a standalone business activity.

We may disclose or make personal data available where reasonably necessary for Platform operation or legal compliance, including to the categories described below.

6.1 Other Platform Users

Certain information may be shared between Requesters, Buyers and Suppliers where necessary to provide Platform functionality.

For example:

• information contained in an RFQ may be made available to eligible Suppliers;
• Supplier quotation information may be made available to the relevant Requester; and
• relevant Buyer and Supplier contact or business information may become available following quotation acceptance or at another stage permitted by Platform functionality.

Users should understand that information intentionally included in RFQs, quotations, reviews or other marketplace content may be visible to other eligible Users.

6.2 Hosting and Infrastructure Providers

Personal data may be processed by service providers supporting:

• hosting;
• servers;
• databases;
• content delivery;
• cybersecurity;
• bot protection;
• monitoring; or
• related technical infrastructure.

6.3 Payment Providers and Banks

Where a User purchases a SubmitParts digital service, information may be shared with or received from the applicable payment provider, bank or financial institution as necessary to process, verify, reconcile, refund or investigate the transaction.

6.4 Email and Communications Providers

Service providers may process contact and message-routing information to deliver:

• verification emails;
• security messages;
• password resets;
• RFQ notifications;
• Deal notifications;
• membership communications; and
• other Platform emails.

6.5 Professional Advisers

Information may be disclosed where reasonably necessary to professional advisers such as accountants, lawyers, auditors, insurers or consultants subject to appropriate obligations.

6.6 Authorities and Legal Requirements

We may disclose information where reasonably necessary to:

• comply with applicable law;
• respond to a valid legal process;
• comply with a court or regulatory order;
• protect legal rights;
• investigate fraud or security incidents; or
• protect Users or other persons from serious harm.

7. PAYMENT PROVIDERS

SubmitParts may make different payment methods available over time.

Where an external payment provider is made available, that provider may independently collect and process payment information.

The identity of the applicable provider will ordinarily be apparent during the payment process.

Payment-provider availability may vary according to:

• country;
• currency;
• service;
• technical availability; and
• SubmitParts operational decisions.

Users should review the privacy information provided by the applicable payment provider when making a payment.

This Privacy Policy does not represent that every payment provider previously, currently or potentially supported by SubmitParts is available to every User.

8. COOKIES AND SIMILAR TECHNOLOGIES

SubmitParts may use cookies, local storage and similar technologies for purposes such as:

• authentication;
• account security;
• session management;
• Platform preferences;
• consent preferences;
• fraud prevention;
• essential Platform functionality; and
• where enabled and lawfully permitted, analytics or advertising.

Further information is provided in the Cookie Policy.

Where applicable law requires consent before non-essential technologies are used, SubmitParts will seek the required consent.

Users may be provided with controls for managing applicable cookie or technology preferences.

9. ADVERTISING

9.1 SubmitParts Direct Advertising

SubmitParts may display advertising or promotional content sold, arranged or managed directly by SubmitParts.

The display of direct advertising does not necessarily require third-party behavioural advertising or cross-site tracking.

Where personal data or non-essential technologies are used for advertising purposes, SubmitParts will apply the disclosures and consent requirements required by applicable law.

9.2 Third-Party Advertising Services

SubmitParts may in the future enable third-party advertising services, including services such as Google AdSense.

Where such services are not enabled, SubmitParts does not represent that their advertising or tracking technologies are actively operating.

Before activating third-party advertising technologies, SubmitParts will implement the privacy disclosures, consent mechanisms and other controls required for the relevant service and applicable jurisdictions.

This may include, where required:

• an appropriate consent-management solution;
• consent or preference controls for applicable advertising technologies;
• mechanisms required for Users in relevant jurisdictions; and
• updates to applicable privacy and cookie disclosures.

9.3 Advertising Independence

Advertising does not determine which Supplier quotation a Requester accepts.

Direct or third-party advertising does not make an advertiser a party to RFQs, quotations or Deals merely because advertising appears on the Platform.

10. INTERNATIONAL DATA TRANSFERS

SubmitParts operates an international B2B Platform and may use service providers or infrastructure located in different countries.

As a result, personal data may be processed or stored outside the User's country of residence.

Where applicable law requires safeguards for an international transfer, SubmitParts will use an appropriate lawful transfer mechanism or other legally recognised safeguard.

The safeguards required may depend on:

• the countries involved;
• the service provider;
• the nature of the information; and
• the privacy law applicable to the transfer.

11. DATA SECURITY

SubmitParts uses reasonable technical and organisational measures designed to protect personal data against risks such as:

• unauthorised access;
• accidental loss;
• unlawful disclosure;
• alteration;
• misuse; and
• destruction.

Measures may include, where appropriate:

• authentication controls;
• password protection;
• access restrictions;
• security logging;
• bot and abuse prevention;
• encrypted network communications;
• account verification;
• administrative access controls; and
• other security measures appropriate to the Platform.

No internet-based service can guarantee absolute security.

Users are also responsible for maintaining the confidentiality and security of their account credentials.

12. DATA RETENTION

SubmitParts retains personal data for no longer than reasonably necessary for the purposes for which it was collected, subject to applicable legal, accounting, security, fraud-prevention and dispute-resolution requirements.

Different categories of information may be retained for different periods.

Factors used to determine retention may include:

• whether the account remains active;
• the nature of the information;
• whether the information relates to an RFQ, quotation or Deal;
• legal or contractual obligations;
• tax and accounting requirements;
• security and fraud-prevention needs;
• limitation periods;
• disputes or legal claims; and
• whether deletion, anonymisation or restriction is appropriate and technically feasible.

Certain temporary or operational records may be automatically removed according to Platform retention rules.

SubmitParts may retain information for a longer period where required by law or reasonably necessary to establish, exercise or defend legal claims.

13. ACCOUNT CLOSURE AND DELETION REQUESTS

Users may contact SubmitParts to request account closure or exercise an applicable right to deletion or erasure.

Requests may be sent to:

privacy@submitparts.com

Account closure does not necessarily require immediate deletion of every record associated with the account.

SubmitParts may retain information where reasonably necessary or legally required for purposes including:

• accounting;
• tax records;
• fraud prevention;
• security;
• dispute resolution;
• enforcement of agreements;
• legal claims;
• RFQ, quotation or Deal integrity; and
• other mandatory legal obligations.

Where appropriate and technically feasible, information may be deleted, restricted, anonymised or otherwise processed in a manner consistent with applicable law.

SubmitParts may request reasonable information to verify the identity and authority of a person making a privacy request.

14. YOUR PRIVACY RIGHTS

Privacy rights vary according to jurisdiction.

Subject to applicable law, Users may have rights including:

• Access — requesting information about personal data held about them;
• Rectification — requesting correction of inaccurate or incomplete information;
• Erasure — requesting deletion of personal data in applicable circumstances;
• Restriction — requesting restriction of certain processing;
• Objection — objecting to certain processing, including processing based on legitimate interests where applicable;
• Data Portability — receiving certain personal data in a structured, commonly used and machine-readable format where the right applies;
• Withdrawal of Consent — withdrawing consent where processing relies on consent; and
• Complaint — lodging a complaint with an applicable data-protection authority.

These rights are not absolute and may be subject to exemptions, verification requirements and legal retention obligations.

For privacy requests, contact:

privacy@submitparts.com

15. TÜRKİYE AND KVKK

Where Türkiye's Law on the Protection of Personal Data No. 6698 (“KVKK”) applies, personal data will be processed in accordance with applicable KVKK requirements.

Depending on the circumstances and applicable law, relevant persons may exercise applicable rights concerning their personal data through the contact information provided in this Privacy Policy.

Nothing in this Privacy Policy is intended to limit rights that cannot lawfully be limited under KVKK.

16. EEA, UNITED KINGDOM AND OTHER PRIVACY REGIMES

Where the GDPR, UK GDPR or comparable privacy legislation applies, SubmitParts will process personal data in accordance with applicable requirements concerning matters such as:

• lawful basis;
• transparency;
• data minimisation;
• security;
• individual rights;
• retention; and
• international transfers.

The application of a particular privacy regime depends on the circumstances of the User and processing activity.

17. MOBILE APPLICATIONS

SubmitParts services may be made available through official mobile applications.

Where a mobile application is offered, this Privacy Policy applies to personal data processed through that application unless a more specific notice is provided.

The information processed by a mobile application will depend on the functionality actually provided by that application.

A SubmitParts mobile application may request access to device features only where required or useful for functionality selected by the User and subject to applicable device permissions.

Depending on the final application functionality, this could include features such as access to photos or a camera when a User chooses to upload or capture an image.

SubmitParts will update its privacy disclosures where necessary before introducing materially different mobile data collection or third-party mobile technologies.

Users should also review any privacy information displayed in the applicable application store or within the application.

18. CHILDREN

SubmitParts is a B2B Platform intended for adults and business users.

The Platform is not directed to children, and Users must satisfy the eligibility requirements stated in the Terms & Conditions.

SubmitParts does not knowingly offer Supplier or Requester accounts to children.

If we become aware that personal data has been collected in circumstances contrary to applicable age requirements, we may take appropriate steps to investigate and delete or restrict that information where required.

19. MARKETING COMMUNICATIONS

Where SubmitParts sends optional promotional or marketing communications, Users will be provided with applicable choices or opt-out mechanisms required by law.

Service communications necessary to operate an account or Platform transaction are different from optional marketing communications.

For example, account verification, security alerts, RFQ notifications, Deal notices or essential membership communications may continue where necessary to provide the requested Platform service even if a User opts out of promotional marketing.

20. CHANGES TO THIS PRIVACY POLICY

SubmitParts may update this Privacy Policy from time to time to reflect changes in:

• Platform functionality;
• data-processing practices;
• service providers;
• advertising technologies;
• mobile applications;
• legal requirements; or
• business operations.

Each published version may have a version identifier and effective date.

Where changes are material or applicable law requires additional notice or consent, SubmitParts may provide an appropriate notice and/or request consent before the relevant processing occurs.

Previous versions may be retained where necessary for legal, consent or audit purposes.

21. CONTACT AND PRIVACY REQUESTS

For questions about this Privacy Policy or requests concerning personal data, contact:

SubmitParts
Ayda Cavuldar (SubmitParts Business)
Website: submitparts.com
Privacy enquiries: info@submitparts.com
General enquiries: info@submitparts.com

When submitting a privacy request, please provide enough information for SubmitParts to identify the relevant account or records and verify the request.

For security reasons, do not send passwords, complete payment-card numbers or other unnecessary sensitive credentials by email.