Version 4. Last updated: 25 October 2026. The retention review periods below have been adopted; they are manual review points, not automatic deletion settings.
This notice explains how HVACentral uses personal information when you browse our store, create an account, contact us or place an order. We collect information needed to run the shop and deal with your purchases and enquiries. Optional tracking is separate from the information needed to fulfil an order.
1. Who is responsible for your information?
HVACentral Parts, is the data controller. For a privacy question or request, email sales@hvacentralparts.co.uk. Our postal details are available on the Contact page. We operate online only; there are no customer visits or collections.
2. Information we handle
- Orders and delivery: your name, email, billing and delivery addresses, telephone number where supplied, products, quantities, prices, order status and payment or refund references. Delivery records can include the carrier, dispatch date and tracking number. We also keep a record of the order-policy agreement submitted at checkout, including its time and the policy versions shown; this is separate from optional cookie choices.
- Your account: your username, contact details, saved addresses and linked order history. An account is optional; guest checkout is available.
- Enquiries and after-sales service: emails, part references, photographs you send, return or cancellation messages, the requesting account identifier, submission time and internal handling notes. Please avoid including unrelated personal information in photographs or messages.
- Website operation: IP address, browser and device information, request times, requested pages and technical or security events. Basket contents and delivery estimates are linked to your shopping session.
- Optional source attribution: with permission, the referring website or campaign, entry page, visit timing, device category and session page-view count may be associated with an order. See section 6.
Most information comes directly from you or your use of the website. Order administration may also involve information from the payment provider or carrier. If you order for another person or business, provide only necessary and accurate details and make this notice available to the person concerned.
3. Why we use it
- To provide what you request: answer pre-order enquiries, administer your account, process and deliver orders, send service messages and deal with returns. Our basis is performing a contract with you or taking requested steps before it.
- To meet legal requirements: maintain the necessary tax and accounting records and handle applicable consumer and data-protection obligations.
- For proportionate business and security needs: prevent misuse, investigate problems, manage disputes and communicate with a business customer’s representatives. We rely on legitimate interests in operating a secure shop, providing customer service and protecting legal claims, balanced against your rights.
- For optional tracking: with consent, we use source-attribution cookies and related information to understand which referral sources and campaigns lead to orders and assess our marketing effectiveness. This information can be linked to an individual order. Refusing these cookies must not prevent shopping or account access.
We need the required checkout details to process and deliver an order; without them we may be unable to complete it. Buying from us or accepting our sales terms does not subscribe you to marketing emails. Order and account messages are service communications, not marketing subscriptions.
4. Who can receive your information?
Access is limited to people and providers who need it for their role, including authorised store administrators and website maintenance support. We do not sell customer information.
- Hostinger: website hosting, storage, business email and related technical services. The store’s account and order records are held in our hosted website; customer emails pass through our email service.
- Delivery providers: normally Royal Mail, receiving the details needed to deliver and manage your parcel. Selecting an external tracking link takes you to the carrier’s service, which has its own privacy information.
- Stripe: payment processing, authentication, fraud prevention, refunds and disputes. See Stripe’s Privacy Policy.
- Professional advisers and authorities: relevant information where needed for accounting, legal advice, a legal requirement or a properly assessed claim.
When you pay through Stripe, we share information needed to process and support your payment, including your name and contact details, billing and delivery addresses, order details and amount, and order and transaction identifiers. Card details are collected directly by Stripe through its hosted payment fields; we do not store your full card number or CVC on our website or server. We retain payment references and may retain payment tokens and limited card details, such as the card brand and last four digits, to administer payments, refunds and saved payment methods where used. Stripe may also collect your IP address, device and browser information and activity signals, including through cookies and similar technologies, for automated payment and fraud checks using Stripe Radar. Stripe acts as a processor when handling payments on our instructions and as a controller for its own fraud prevention, legal compliance and service improvement activities.
Our hosting, email and payment suppliers, including Stripe, may process information outside the UK, including in the United States. Where a restricted transfer occurs, an applicable UK adequacy decision or appropriate contractual safeguards are required. Hostinger’s Data Processing Addendum describes its transfer arrangements, including the UK Addendum where applicable. Stripe’s Data Transfers Addendum describes its transfer mechanisms, including the UK Extension to the EU-US Data Privacy Framework and contractual safeguards where applicable. Contact us for information about the safeguards relevant to your data. We do not promise that all information remains physically in the UK.
5. How long information is kept
Retention depends on the purpose, any unresolved issue and the applicable legal requirement. It is not determined solely by whether your account remains open. Our manual review schedule is quarterly. The periods below identify records for review; they are not promises of automatic deletion on a particular day. We assess information for deletion or effective anonymisation when it is no longer needed.
- Tax and accounting records: necessary sole-trader business records are generally retained for at least five years after the 31 January filing deadline for the relevant tax year; a legal requirement or ongoing enquiry may require longer.
- Account details: accounts with no recorded activity for 24 months are identified for review, using the latest available evidence of account use or customer interaction. We consider open orders, requests and disputes before deciding whether account information is still needed. Closing an account does not automatically erase order records that must still be kept.
- Enquiries that do not lead to a sale: identified for review 12 months after the last meaningful correspondence or closure of the enquiry, whichever is later. If the enquiry is closed and there is no documented continuing need, we assess the information for deletion or anonymisation.
- Returns, cancellation requests and disputes: while needed to complete the after-sales process and address a relevant claim. We review the necessary scope of messages, internal notes and delivery evidence separately. Information needed for an order or legal record follows that record’s retention requirement.
- Technical records and backups: for troubleshooting, security and recovery as needed for those purposes. Backup copies follow the provider’s retention cycle and are not used as an alternative marketing database.
- Optional attribution: identifiable source information saved against an order is identified for review 90 days after it was recorded, for deletion or effective anonymisation through our quarterly review. Any continuing retention needs a specific, documented lawful reason. Browser-cookie expiry does not remove information already saved against an order. Necessary financial records are assessed separately and are not a reason to retain optional attribution automatically.
Adopting these review periods does not itself delete existing records. A legal hold or active dispute may delay deletion of relevant information; we document the reason and review it when the issue is resolved. Privacy requests and withdrawal of consent are handled when received, not deferred until the quarterly review. Closing an account does not promise immediate removal of every copy.
6. Cookies and your choices
Cookies and similar browser storage help the basket, login and requested website functions work. Necessary storage is distinct from optional measurement of the channel or campaign that brought a customer to us.
The consent panel offers Accept optional, Reject optional and Preferences. Necessary functions remain available and source attribution is configured to require permission. Use Cookie preferences to change a previous choice. Browsing, placing an order or accepting sales terms does not count as cookie consent.
Optional attribution uses WooCommerce’s Sourcebuster integration. Information is stored in the browser for the session and can be saved in the store’s order record when an order is placed. This is not a newsletter subscription. Withdrawing permission stops optional collection and use based on that consent. Where identifiable attribution already exists in an order, contact us with the order reference so it can be located and erased or anonymised unless a separate, explained lawful reason requires retention. Necessary order and tax records are assessed separately.
You can also remove or block cookies through your browser settings. Blocking necessary cookies may prevent the basket or login from working. Our Cookie Policy describes the store technologies and documented default lifetimes.
7. Your rights
Depending on the circumstances, you can ask to access or correct your personal information, request erasure or restriction, receive certain information in a portable form, and object to processing based on legitimate interests. Where we rely on consent, you can withdraw it without affecting the lawfulness of earlier use. These rights have conditions and exceptions; necessary legal records may need to be retained.
Email sales@hvacentralparts.co.uk with enough information to identify the relevant account or order. We may need proportionate identity checks before disclosing or changing records. Please do not send passwords, full card details or identity documents unless a suitable verification method has been agreed.
We normally respond to a data-rights request within one month, subject to lawful extensions or other applicable rules. Stripe and your bank or payment method provider use automated payment authentication and fraud checks. Stripe Radar assesses transaction information and device, browser and activity signals to identify potentially fraudulent payments. These checks may result in a payment being declined or additional verification, such as 3D Secure, being required. If this affects your order, contact us so we can review the order issue and explain available next steps.
Optional live chat
Our optional live chat is provided by tawk.to and loads only after you select Start chat in our separate notice. Each new page requires you to start chat again. This does not accept source attribution or subscribe you to marketing. You can email sales@hvacentralparts.co.uk instead.
To answer your enquiry, authorised store staff and tawk.to may handle your messages, uploaded images or files, any contact details you provide, and technical information such as your IP address, device and chat-session/page information. Please do not send passwords, payment-card details or unrelated personal information.
tawk.to processes chat information on our behalf and states that stored chat data is hosted in the United States. Its Data Processing Addendum describes international-transfer safeguards, including the UK Addendum. See also its Privacy Policy.
Chat enquiries, files and any notification-email copies follow the retention approach in section 5. Enquiries that do not lead to a sale are identified for the existing 12-month manual review, not automatic deletion. tawk.to retains chat records until deletion; closing chat or removing cookies does not erase them. Email us for privacy or deletion requests.
8. Privacy concerns and updates
If you are unhappy with how we handle your information, email us and explain your concern. We will acknowledge a data-protection complaint within 30 days, investigate appropriately and provide an outcome without undue delay. You can also complain to the Information Commissioner’s Office (ICO).
We update this notice when our services or data practices change. The date and version identify the notice you are reading. New payment, marketing or tracking services will be assessed and explained before they are introduced.