Privacy policy

Who is responsible

The data you leave on https://oem.industries is processed by OEM Industries, ⟨COMPANY_ADDRESS⟩, which decides what it is used for. For anything about your data, write to contact@oem.industries.

What we collect, and why

Your account. Signing in through an identity provider (Google, GitHub, Facebook or Discord) gives us your name, email address and, where the provider offers one, your username and avatar. We use them to run your account and to write to you about what you did on the site. Basis: the contract between us.

Your orders. An order needs a name, a delivery and billing address, a phone number for the carrier, and a record of what you bought and paid. We keep it to deliver, to handle returns and guarantees, and because accounting law requires us to. Basis: the contract, then our legal obligations. Card details are entered on Stripe's pages and never reach us.

What you post. Part requests, comments, votes, reviews and photos are public by nature: they carry your name and stay on the site. Basis: the contract, since posting is what you asked for.

Your garage. The vehicles you save to check fitment. For a visitor without an account, they live in a cookie on your device only; after sign-in, in your account. Basis: our legitimate interest in showing you which parts fit.

Email. We send transactional email about your orders and account, which cannot be switched off, and, by category, email you can opt out of at any time from your settings or the link in every message. Basis: the contract for the first, your consent for the rest.

The newsletter. Nobody is put on it: an account joins by ticking a box at checkout or in its settings, and an address without an account by typing it into the footer and clicking the link we then send to it. Until that click, nothing else is sent to it, and the address is dropped after thirty days. We keep the address, the language it was entered in and the date it confirmed, and every issue carries a link that takes it off the list. Basis: your consent.

Technical data. Our servers log the IP address, the pages requested and the browser used, to keep the site running and secure and to spot abuse. Basis: our legitimate interest in a site that works. There is no advertising and no tracking of you across other sites.

Audience measurement. We count which pages are read, where visits come from and what is searched for, in our own database and for no one else. The count holds no IP address and no name: your address and browser are turned into a code under a key that changes every day, so nobody, not even us, can tell one day's visitor from the next, and no cookie is set for it. That is the form of measurement the CNIL exempts from consent, which is why there is no banner to click. Basis: our legitimate interest in knowing what the site is used for. Kept thirteen months.

Cookies

The site sets only the cookies it needs to function: the session, the token that protects forms, your language, your appearance setting and, for visitors without an account, the garage. None of them is used to profile you, so no consent banner is shown. You can delete them from your browser at any time; the site will simply forget the settings they held.

Who else sees it

We share data only with the providers that do a job for us, and only what that job needs:

• Stripe for payment;
• Shippo and the carrier you picked, for shipping labels and delivery;
• Resend for sending email;
• Mapbox for address suggestions while you type a delivery address;
• our hosting provider, OVH SAS, on whose servers the site runs;
• the identity provider you signed in with, which learns that you signed in here.

Some of these providers are in the United States. Where data leaves the European Union, it does so under the safeguards the GDPR provides for: the European Commission's standard contractual clauses or an adequacy decision.

We never sell your data, and we hand it to authorities only when the law compels us to.

How long we keep it

• Your account, and what is in it, for as long as it is open. Delete it from your settings and it is removed at once; the requests, comments and reviews you posted stay on the site, detached from your name, because other people's conversations are built on them.
• Orders and invoices, ten years after the order, as accounting law requires.
• Server logs, twelve months.
• Email preferences and opt-outs, for as long as needed to honour them; a newsletter address without an account, until it leaves the list, or thirty days if it never confirmed.

Your rights

You may ask to see the data we hold about you, to have it corrected or deleted, to receive it in a portable form, to restrict or object to its processing, and to withdraw a consent you gave. You may also leave instructions on what should happen to it after your death. Write to contact@oem.industries; we answer within a month.

If you think we have handled your data wrongly, you may complain to the CNIL, the French data protection authority, at cnil.fr.

Changes

When this policy changes, the version and date at the top of this page change with it.