Privacy Policy

WE SOURCE PARTS is an automotive parts sourcing service operated by the data controller identified above (“WSP”, “we”, “us” or “our”). We help vehicle owners, garages, workshops, body shops, dealers, fleets and other automotive businesses identify and source genuine, OEM, aftermarket, reconditioned and verified-used components from suppliers in the UAE and international markets.

For the personal data covered by this Policy, the identified legal entity normally acts as the data controller: it decides why and how that data is processed. A supplier, payment provider, delivery company, vehicle-data provider or other third party may act as a separate controller for its own processing, as explained in its own privacy notice.

This Policy applies to wesourceparts.com, wesourceparts.ae, our customer and trade portals, online forms, email, telephone, WhatsApp, Instagram and other official WSP channels. It also applies to information we receive while providing quotations, sourcing parts, taking payment, arranging import or delivery, handling returns and providing support.

It does not govern an unrelated third-party website, app or service merely because we link to it. Please review that provider’s privacy information before supplying data directly to it.

Depending on how you interact with us, we may collect:

• Identity and contact data: name, business name, job title, customer or account number, email address, telephone or WhatsApp number, billing address and delivery address.
• Vehicle data: VIN, chassis or frame number, registration market, make, model, year, production date, engine, transmission, trim, specification, colour, installed equipment and modification details. A VIN or similar identifier may be personal data where it can be linked to you, your account or a vehicle owner.
• Part-request data: OEM or other part numbers, descriptions, required side or position, quantities, condition preference, urgency, photographs, videos, labels, diagnostic reports and messages.
• Account and trade data: login information, saved vehicles, request history, employer or workshop details, trade references, authorised users and communication preferences.
• Quotation and transaction data: quoted options, approvals, deposits, orders, invoices, refunds, warranties, returns and payment status. Our payment provider normally processes full card details; we should not receive or store your full card number or card security code.
• Delivery and compliance data: consignee details, shipment records, tracking information, customs or import documents, tax details and identity information where lawfully required for payment, fraud prevention, customs clearance or delivery.
• Communications data: emails, WhatsApp or Instagram messages, call notes, enquiries, complaints, reviews and customer-service records.
• Technical and usage data: IP address, browser and device type, operating system, approximate location derived from IP, page activity, referral source, security logs, cookie identifiers and consent choices.
• Marketing data: subscription status, campaign interactions, event registrations and the content or channels in which you have shown interest.

We use a VIN, chassis or frame number to identify a vehicle, obtain available build or specification data, check catalogue information and reduce the risk of sourcing an incompatible component. Vehicle-data services do not necessarily cover every market, imported vehicle, manufacturer, trim or production change, and their results may be incomplete.

We may submit the vehicle identifier and relevant request details to commercial VIN decoders, vehicle-data providers, electronic parts catalogues, manufacturer or dealer systems, suppliers and technical specialists. We use these tools to support human review; a decoded result is not, by itself, a guarantee that a part will fit.

Part photographs, registration documents, diagnostic reports and delivery records may contain names, addresses, registration numbers, faces or other personal information. Upload only what is reasonably needed. Please cover or remove unrelated information before sending a document.

Do not upload an Emirates ID, passport, payment card, driving licence or other sensitive identity document unless we specifically request it for a lawful purpose and provide an appropriate secure method. We may delete or redact unnecessary information.

We collect data:

• directly from you when you browse, create an account, submit a form, upload a photograph, contact us, approve a quotation, pay or receive an order;
• from an employer, workshop, fleet manager, authorised representative or other person who submits a request for you;
• from VIN decoders, vehicle-data services, catalogue providers, dealers, manufacturers, suppliers and technical specialists;
• from payment providers, banks, fraud-prevention services, couriers, freight agents, customs intermediaries and delivery recipients;
• from Meta services, WhatsApp, Instagram, email or other communication providers when you interact with our official account; and
• automatically through necessary website technologies and, where enabled and permitted, analytics or advertising tools.

We may use personal data to:

• identify your vehicle and the part you require;
• check fitment information and ask for missing technical details;
• search suppliers, compare available products and prepare a quotation;
• create and manage an account, saved vehicle or trade relationship;
• take payment, prevent fraud, issue invoices and maintain financial records;
• purchase, import, process, deliver and track an order;
• manage cancellations, returns, warranties, complaints and customer support;
• communicate service updates through email, telephone, WhatsApp, Instagram or another channel you use;
• operate, secure, troubleshoot and improve our website, systems and sourcing process;
• measure campaign and website performance where the required notice and consent have been provided;
• send relevant marketing where you have consented or where another lawful basis applies, and record opt-outs;
• comply with tax, accounting, customs, sanctions, law-enforcement and other legal obligations; and
• establish, exercise or defend legal claims, protect customers and suppliers, and support a genuine business transaction or reorganisation.

Where the UAE Federal Personal Data Protection Law applies, and where another applicable law requires a legal basis, we rely on one or more of the following as appropriate:

• Contract and pre-contract steps: to respond to your request, prepare a quotation, accept an order, source a part, take payment, deliver it and provide after-sales support.
• Consent: for optional marketing, non-essential cookies or analytics, or another activity where consent is the appropriate basis. You may withdraw consent at any time, without affecting earlier lawful processing.
• Legal obligation: to meet accounting, tax, customs, regulatory, fraud-prevention, recordkeeping or lawful authority requirements.
• Legitimate interests, where recognised and not overridden by your rights: to secure and improve the service, manage supplier and customer relationships, prevent misuse, maintain business records and understand service performance.
• Legal claims, vital interests, public interest or another basis specifically permitted by applicable law, where relevant.

If we ask for personal data that is required by contract or law, we will explain this where it is not obvious. We may be unable to prepare a reliable quotation, accept an order or deliver a component without the necessary information.

We disclose only information reasonably needed for the relevant purpose. Recipients may include:

• VIN decoders, vehicle-data companies, catalogue and fitment providers, manufacturers, dealers and technical specialists;
• parts distributors, authorised dealers, dismantlers, recyclers, manufacturers and other potential or confirmed suppliers;
• payment gateways, acquiring banks, financial institutions, invoicing and fraud-prevention providers;
• couriers, freight forwarders, warehouses, customs brokers, insurers and border or customs authorities;
• hosting, cloud-storage, cybersecurity, customer-relationship, email, customer-support and document providers;
• Meta, Instagram, WhatsApp and approved messaging or automation providers when you contact us or use those services;
• accountants, auditors, insurers, lawyers and other professional advisers;
• regulators, courts, law-enforcement bodies or public authorities where disclosure is required or lawfully requested; and
• a genuine prospective buyer, investor, lender or adviser involved in a merger, acquisition, financing, reorganisation or sale, subject to appropriate confidentiality and due diligence controls.

We do not sell personal data as a standalone product. We do not authorise service providers to use personal data for their own unrelated marketing.

To locate a part, we may share a VIN or abbreviated VIN, vehicle specification, part number, photographs and technical description with suppliers in multiple countries. Where practical, we avoid sharing your direct contact details until they are needed for fulfilment, customs, warranty or delivery.

Some providers decide independently how they process information submitted to their systems. Others process it only on our instructions. We assess the role and contractual requirements of material providers as part of onboarding and ongoing vendor management.

Payments may be processed by an independent payment gateway or bank. The checkout page should identify the provider and link to its privacy notice. Payment providers may process your name, contact and billing details, IP address, device information, transaction amount and payment credentials to authorise payment, manage chargebacks and prevent fraud.

WSP should not store full card details when the payment is hosted or tokenised by the payment provider. We may retain a payment reference, card type, masked digits, status, amount and fraud or verification result where needed for the order and our records.

If you contact us through WhatsApp, Instagram or another social platform, the platform provider receives and processes information under its own terms and privacy policy. We receive the information you choose to send and may transfer relevant details into our customer or request-management system so that we can answer and maintain a reliable service record.

Do not send full payment-card details or unnecessary identity documents through social-media messages. You may ask us to continue a sensitive discussion by email, secure form or another appropriate method.

WE SOURCE PARTS operates from the UAE and searches suppliers internationally. Your personal data may therefore be accessed, stored or processed in the UAE, UK, European Economic Area and other countries where our suppliers and service providers operate. The privacy laws in those countries may differ from those in your country.

Before a restricted cross-border transfer, we use the legal mechanism and safeguards applicable to the circumstances. These may include a legally recognised destination, contractual safeguards, a transfer necessary to perform your order or another permitted basis. We also aim to minimise the personal data shared with overseas suppliers.

We keep personal data only for as long as reasonably necessary for the purpose collected, including service, warranty, accounting, tax, customs, fraud-prevention, dispute and legal requirements. The period depends on the type of record, the product warranty, whether an order was placed, the risk of a claim and any mandatory retention period.

As an operating guideline, unless a longer period is required or justified:

• Unconverted sourcing requests and quotations: kept for up to 24 months so that we can resume the enquiry and analyse sourcing demand;
• Orders, invoices, payment references, shipment records and related correspondence: kept for the applicable statutory accounting, tax and legal period and while a claim may reasonably arise;
• Warranty and return records: kept through the relevant warranty or claim period and for a reasonable period afterwards;
• Marketing contact details: kept until you opt out or the campaign purpose ends, with a limited suppression record retained to respect your opt-out;
• Security logs and unsuccessful form submissions: kept for a limited period proportionate to security and abuse-prevention needs; and
• Cookie duration: disclosed in the cookie notice or consent tool used on the website.

When data is no longer required, we delete it, anonymise it or securely isolate it until deletion from backup systems in line with our retention process.

Our website may use small files or similar technologies to remember settings, maintain security, operate forms and measure use. Strictly necessary technologies may operate without optional consent where permitted. Analytics, advertising or social-media technologies will be activated only after the notice and consent required by applicable law.

A live cookie notice should identify the technologies actually installed, their provider, purpose and duration. You can use the website’s cookie controls or browser settings to reject or remove optional cookies. Some essential functions may not work correctly if necessary storage is blocked.

We will not describe a tracker as active, or ask for consent through a cookie banner, unless it is actually installed. If we introduce a new analytics or advertising provider, we will update the cookie notice and consent configuration before activation.

We may send launch news, service updates, offers or useful parts-sourcing content where you have consented or where permitted by law. You can opt out at any time by using an unsubscribe link, replying STOP where supported, changing your account preferences or contacting us.

Stopping marketing does not stop service messages needed for a quotation, order, payment, shipment, recall, security notice or support case. We may keep a minimal suppression record so that we do not add you back to marketing by mistake.

We use reasonable administrative, technical and physical measures designed to protect personal data against accidental or unlawful loss, alteration, access, disclosure or destruction. Depending on the system, measures may include encryption in transit, access controls, least-privilege permissions, backups, monitoring, staff procedures, supplier due diligence and incident response.

No online transmission or storage method can be guaranteed completely secure. You are responsible for keeping account credentials and one-time access links confidential and for notifying us promptly if you suspect unauthorised use.

Subject to the law that applies and any permitted exception, you may have the right to:

• obtain information about how we process your personal data and request access to it;
• request correction of inaccurate data and completion of incomplete data;
• request deletion of personal data in applicable circumstances;
• request restriction or suspension of certain processing;
• object to processing based on a legitimate interest or to direct marketing;
• receive or transfer certain data in a portable format where the relevant conditions apply;
• withdraw consent at any time where processing is based on consent;
• request review of a qualifying solely automated decision and express your point of view; and
• submit a complaint to the competent data-protection authority or seek a remedy as provided by law.

To make a request, email privacy@wesourceparts.com or info@wesourceparts.com. State your name, contact details, relationship with us and the right you wish to exercise. We may ask for proportionate information to verify identity and protect your account. We will respond within the period required by applicable law and explain any lawful limitation or refusal.

VIN decoders, catalogue searches, fraud checks and workflow tools may automatically return vehicle details, compatibility indicators, risk signals or suggested matches. We use these outputs to assist staff. We do not intend to make a decision producing legal or similarly significant effects solely by automated processing unless we first provide the information, safeguards and choices required by law.

Our services are intended for adults and businesses and are not directed to children under 18. We do not knowingly collect personal data directly from a child for a parts order. If you believe a child has submitted personal data without appropriate authority, contact us so that we can review and delete it where required.

If WSP is involved in an investment, financing, merger, acquisition, reorganisation, asset sale or insolvency process, relevant personal data may be disclosed under confidentiality to advisers and genuine transaction parties and may transfer to a successor. We will continue to protect the data and provide any notice required by law.

We may update this Policy when our services, providers, legal obligations or processing activities change. The website will show the effective date of the current version. If a change materially affects how we use personal data, we will provide an appropriate additional notice and obtain consent where required.