Privacy Policy

1. Who We Are

indSpare LLC, an industrial spare parts supplier trading as indSpare, is the controller of the personal data described in this policy.

For privacy enquiries, write to [email protected] with "Privacy" in the subject line.

2. What Information We Collect

2.1 Information you provide directly:

• Account registration: name, email, phone, company name, billing and delivery address
• Order data: items purchased, payment information (we do NOT store full card numbers — see clause 4)
• Collection on your own courier account: the courier you name and your account number with it
• Communications: messages you send via the contact form or email
• Support and return correspondence: photos, videos, and order details you submit when raising a defect or RMA claim

2.2 Information collected automatically when you visit the Website:

• Server log data: IP address, user agent, referring URL, request timestamps, response codes
• Usage data: pages viewed, products clicked, search queries, time on site, device and browser type
• Cookie data: see clause 5 for details

We do NOT collect special-category data such as government ID numbers, biometric data, religious beliefs, or political opinions.

3. Why We Collect It

We use the information described in clause 2 for the following purposes:

• To create and maintain your customer account
• To process and fulfil your orders, including payment, shipping, customs documentation, and returns
• To respond to your enquiries and provide customer support
• To send order confirmations, shipping notifications, and administrative messages required to perform the contract
• To invite you, after your order is delivered, to review your purchase on Trustpilot (see clause 4)
• To send marketing emails about products and offers, where you have given consent or where permitted by law for similar products you have already purchased (you can unsubscribe at any time)
• To detect and prevent fraud, abuse, and security incidents
• To improve the Website, our product catalogue, and our search experience
• To comply with our legal and regulatory obligations

4. Third Parties We Share Data With

We share data only with service providers who help us operate the business. We do not sell personal data to anyone.

• Hetzner Online GmbH (Germany) — hosts our application servers. Receives all website data processed during normal operation. The website's search runs on these servers, not with an outside search service. Some searches may also be sent to the AI providers listed below, to help understand them.
• Cloudflare, Inc. (USA) — content delivery network, DDoS protection, web application firewall. Receives server log data, IP address, request metadata.
• Tap Payments (Kuwait) — card payment processing. Receives order amount, customer name, billing email, billing address. We do NOT see or store full card numbers — these are entered directly on Tap's secure form.
• International courier — the express courier that carries your order. Receives delivery name, address, phone, order weight and contents declaration.
• Google LLC (USA) — Google Analytics 4 and Google Ads for website analytics and advertising measurement. Receives pseudonymous usage data and IP-anonymised visit data.
• Google LLC (USA) — address suggestions at checkout (Google Maps Platform). Receives the address text you type in the street field and the country you chose, sent from our servers, only while you use the suggestions.
• OpenAI, L.L.C. (USA) — generates text embeddings that power search across our internal records. This includes the text of business correspondence and its attachments — enquiries, quotations and order threads — so it can include your name, company, contact details and the content of what you sent us. It also receives the words typed into this website's search box. Embeddings are numerical representations used for retrieval; we do not use this data to train anyone's models.
• Anthropic, PBC (USA) — powers the assistant on our website and the internal assistant our staff use. Receives whatever you type into the chat, the words typed into this website's search box when our search cannot read them on its own, and, for staff queries, the business records the assistant is asked about.
• Amazon Web Services (USA / EU) — transactional and marketing email delivery via Amazon SES. Receives customer email address, order metadata, message content.
• Trustpilot A/S (Denmark) — independent customer reviews. Receives your name, email address and order number when your order is delivered, so that it can invite you to review your purchase. Trustpilot sends one invitation per order; writing a review is optional, and you can unsubscribe from Trustpilot's emails at any time.
• Manufacturer warranty teams — only when you file a warranty claim. Receives order number, customer contact, defect details.

We may also disclose information where required by law (court order, regulatory request, lawful authority) or where reasonably necessary to protect our legal rights.

5. Cookies and Tracking Technologies

We use cookies and similar technologies to operate the Website, remember your preferences, and measure performance.

• Strictly necessary cookies — required for the Website to function (e.g. login session, shopping cart, CSRF protection). Cannot be disabled.
• Analytics cookies — Google Analytics 4 measures aggregate Website usage. IP addresses are anonymised. Data is retained for 14 months by default.
• Advertising cookies — Google Ads conversion tracking measures whether visitors arriving from a Google Ads click subsequently make a purchase. We use this only to evaluate ad performance.

You can disable cookies in your browser settings. Disabling strictly necessary cookies will prevent the Website from working correctly. Disabling analytics or advertising cookies will not affect your ability to browse or place orders.

6. International Data Transfers

Several of our service providers (Cloudflare, Google, OpenAI, Anthropic, Amazon SES, Trustpilot) process data in the United States, the European Union, or other countries.

Where data is transferred to another country, we rely on the service provider's own contractual safeguards (typically standard contractual clauses or equivalent) to ensure data is handled securely. Customers should be aware that data processed by these providers may be subject to the laws of the relevant country.

If you would like more information about a specific transfer, write to [email protected].

7. How Long We Keep Your Data

• Customer account data: until you request account deletion, or 5 years of inactivity (whichever is sooner)
• Order and invoice records: 7 years from the date of the order, to meet tax and commercial record-keeping obligations
• Server log data (IP, request logs): 90 days
• Cloudflare access logs: as per Cloudflare's standard retention (typically 7–30 days)
• Google Analytics aggregated data: 14 months
• Marketing email subscription: until you unsubscribe
• Support and return correspondence: 3 years from the close of the case

When we no longer need data, we either delete it or anonymise it so it can no longer be linked to you.

8. Your Rights

You have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Correction — ask us to correct inaccurate or incomplete data
• Deletion — request that we delete your data, subject to our legal obligation to keep order records (clause 7)
• Restriction — ask us to limit how we use your data while a query is resolved
• Objection — object to direct-marketing use of your data (we will always honour this immediately)
• Withdrawal of consent — where we rely on consent (e.g. marketing emails), you can withdraw it at any time without affecting earlier processing
• Portability — request your data in a machine-readable format

Exercise these rights by writing to [email protected]. We will respond within 30 days. We may need to verify your identity before acting on a request.

These rights are provided as a matter of indSpare's policy to all customers regardless of jurisdiction, in addition to any rights the data-protection law that applies to you gives you.

9. Security

We protect your data using a combination of:

• HTTPS/TLS encryption for all Website traffic
• Cloudflare web application firewall and DDoS protection
• Tap Payments' PCI DSS-certified card processing (we never see your full card number)
• Application-level access controls and audit logging
• Regular security updates to our infrastructure

No system is perfectly secure. If you suspect unauthorised access to your account, contact [email protected] immediately.

10. Children

The Website is intended for professional B2B buyers. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, please contact [email protected] and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent revision. Material changes will be communicated by an on-site notice or by email to registered customers.

12. Contact

For any privacy enquiry, please contact: