Privacy Policy

Version: v1

Last updated: July 2026

1. Who We Are

This website is operated by Astrak UK Ltd, trading as EPD Parts / Excavator Parts Direct. References to "we", "us" or "our" in this policy mean Astrak UK Ltd.

Registered address: Wheatfield Road, Dunnikier Business Park, Kirkcaldy, Fife, KY1 3PD

Website: https://excavatorpartsdirect.co.uk

Email: info@excavatorpartsdirect.co.uk

Phone: 0330 058 1234

ICO Registration Number: ZA310700

Data Protection Contact: Stephen Cope

We are the data controller for the personal data we collect about you through this website. We have appropriate technical and organisational measures in place to protect your data.

2. What This Policy Covers

This Privacy Policy explains what personal data we collect about you when you use our website, why we collect it, who we share it with, and what rights you have. It covers data collected through browsing the site, creating an account, placing an order, signing up for marketing emails, and interacting with our adverts.

A separate Cookie Policy explains the specific cookies we use and how to manage your preferences.

3. What Data We Collect and Why

3.1 When you browse the website

We automatically collect technical information about your visit, including your IP address, browser type, pages visited, time on site, and how you arrived. We collect this using cookies, analytics tools, and session recording software to understand how the site is used and improve it.

3.2 When you create an account

We collect your name, email address, phone number, delivery address, and any other information you provide, to manage your account, process orders, and maintain your purchase history.

3.3 When you place an order

We collect your name, billing and delivery address, email address, phone number, and payment information. Payment card data is processed directly by our payment providers. Your order details are also transferred to our internal order management system (NetSuite) to process and fulfil your order, and your delivery details are passed to the carrier responsible for delivering your order.

3.4 When you sign up for marketing emails

We collect your email address and, if you provide it, your name and preferences, to send you promotional emails, product updates, and automated messages such as cart abandonment reminders.

3.5 When you interact with our adverts

If you click on one of our adverts on Google, Meta (Facebook or Instagram), Bing, or TikTok, data about your interaction may be collected by those platforms and shared with us for measurement and targeting purposes. See Section 6 for details.

3.6 When you use live chat

Our website includes an AI-powered chat tool (ZipChat). If you use it, we collect the content of your messages and any contact details you provide. This data may be processed on servers outside the UK. See Section 5.12.

3.7 When you contact us

If you contact us by email, phone, or via a contact form, we collect the information you provide in order to respond to your enquiry.

4. Legal Basis for Processing

UK GDPR requires us to have a lawful reason for every use we make of your personal data. The main bases we rely on are set out below. The specific basis for each activity is stated in Section 5 alongside the relevant processor.

Contract (Article 6(1)(b)): processing necessary to fulfil an order or manage your account.

Legitimate Interests (Article 6(1)(f)): where our interests are genuine and necessary, and not overridden by your rights. We document a balancing assessment before relying on this basis.

Consent (Article 6(1)(a)): where you have actively opted in. You can withdraw consent at any time; see Section 11.

Legal Obligation (Article 6(1)(c)): where we are required to process data by law, for example retaining transaction records for HMRC.

5. Third Parties Who Receive Your Data

We use a number of third-party services to operate this website, fulfil orders, and run our marketing. Each handles personal data on our behalf under a data processing agreement, or as an independent controller where noted. We do not sell your personal data to any third party.

Law enforcement and regulatory authorities: we may disclose personal data to the police, HMRC, the ICO, or other authorities where required to do so by law or court order.

5.1 Shopify

Shopify is the platform that powers our online store. It hosts our website, processes orders, manages customer accounts, and through Shopify Payments processes payment card transactions. Shopify handles your name, address, email, phone number, order history, and payment data.

Legal basis: Contract. order fulfilment and account management. Legitimate Interests: security and fraud prevention.

5.2 Google Analytics (GA4)

We use Google Analytics 4 to understand how visitors use our website. GA4 uses cookies to collect pseudonymous behavioural data. Our GA4 property is connected to Google Ads for conversion attribution; as a result the DUAA analytics exemption does not apply and prior consent is required before GA4 fires.

Legal basis: Consent. analytics cookies.

5.3 Google Ads

We run paid advertising on Google Search, Google Shopping, YouTube, and across Google's Display and Performance Max networks. Google Ads tracking cookies record whether someone who clicked one of our adverts later made a purchase. We also use Google Remarketing to show adverts to people who have previously visited the site. See Section 6 for Enhanced Conversions and Customer Match.

Legal basis: Consent. advertising and remarketing cookies.

5.4 Meta (Facebook and Instagram)

We use Meta's advertising platform to run paid campaigns on Facebook and Instagram. The Meta Pixel and Meta Conversions API track visits and purchases to enable ad measurement and remarketing. See Section 6 for Enhanced Conversions and Custom Audiences.

Legal basis: Consent. advertising cookies and Pixel/Conversions API tracking.

5.5 Klaviyo

Klaviyo is our email marketing platform. It sends marketing emails, manages subscriber lists, tracks email engagement, and tracks your browsing activity on our website to trigger automated emails such as browse abandonment and cart abandonment messages.

Legal basis: Consent. Consent for opted-in subscribers and Klaviyo tracking cookies. For marketing to existing customers about similar products, we rely on the PECR soft opt-in (Regulation 22(3)), with legitimate interests (Article 6(1)(f) UK GDPR) as the lawful basis for the underlying processing.

5.6 Microsoft Clarity

Microsoft Clarity records how visitors interact with our website, including mouse movements, clicks, scrolling, and session replays, to help us identify usability problems. Microsoft may also use this data for its own analytics purposes.

Legal basis: Consent. session recording cookies.

5.7 Hotjar

Hotjar is a session recording and heatmap tool we use to understand how visitors navigate the site. It records clicks, scrolls, and page interactions. Hotjar does not record payment fields or password inputs.

Legal basis: Consent. session recording cookies.

5.8 Trustpilot

After you place an order, we may invite you to leave a review on Trustpilot. We pass your email address and order reference to Trustpilot to send this invitation. Trustpilot acts as an independent controller for any data you provide when leaving a review.

Legal basis: Legitimate Interests. collecting customer feedback to improve our service.

5.9 Pandectes

Pandectes is our cookie consent management platform. It displays the cookie consent banner when you first visit our site and records your preferences so they can be applied on return visits.

Legal basis: Legal Obligation and Legitimate Interests. compliance with PECR.

5.10 Microsoft / Bing Ads

We run paid search advertising on Bing via the Microsoft Universal Event Tracking (UET) tag, which records whether someone who clicked one of our Bing adverts went on to make a purchase.

Legal basis: Consent. advertising cookies.

5.11 Algolia

Algolia powers our site search functionality. When you use the search bar, your queries are sent to Algolia to return product results. Algolia may use anonymised search data to help us improve search performance.

Legal basis: Contract. delivering search functionality. Legitimate Interests: improving search quality.

5.12 ZipChat (AI Chatbot)

Our website includes an AI-powered chatbot provided by ZipChat. If you use it, the content of your messages and any contact details you provide are processed by ZipChat to generate responses and may be stored to maintain conversation context. This data is transferred to and processed on servers outside the UK, including in the United States. Please do not enter payment card details or sensitive personal information into the chat window.

Legal basis: Contract. responding to customer service enquiries related to an order. Legitimate Interests: handling pre-sales enquiries and product queries.

5.13 NetSuite (Oracle)

We use NetSuite, an enterprise resource planning system operated by Oracle, to manage our orders, invoicing, stock, and accounts. When you place an order, your order details including your name, delivery address, items ordered, and invoice data are transferred to NetSuite to process and fulfil your order. Data may be processed on Oracle infrastructure outside the UK.

Legal basis: Contract. order processing and fulfilment. Legal Obligation: retaining transaction records for HMRC.

5.14 Shipping Carriers

To deliver your order, we pass your name, delivery address, and contact details to the carrier responsible for your shipment. The carrier varies depending on the size, weight, and destination of your order. Carriers are independent data controllers for the personal data they receive to manage delivery. If you would like to know which carrier will handle your order, please contact us and we will confirm at the time of despatch.

Legal basis: Contract. delivery of your order.

5.15 Anthropic (Claude AI, Internal Use)

Our team uses Claude, an AI assistant provided by Anthropic, to support internal tasks such as data analysis, drafting, and operational workflows. Where this involves customer data, that data is processed by Anthropic on our behalf under a Data Processing Agreement. Anthropic does not use data submitted through our account to train its AI models. Data is processed on US-based infrastructure.

Legal basis: Legitimate Interests. using AI tools to support efficient internal operations.

5.16 TikTok

We run paid advertising campaigns on TikTok. The TikTok Pixel tracks page visits and purchases, enabling us to measure the effectiveness of our TikTok adverts, build remarketing audiences, and optimise our campaigns. Data is shared with TikTok Technology Limited (an Irish company) and processed on TikTok servers in the United States and Singapore. TikTok is a product of ByteDance. Transfers are made under Standard Contractual Clauses. Data transferred to these jurisdictions may be subject to access by authorities under applicable local laws.

Legal basis: Consent. advertising cookies and TikTok Pixel tracking.

5.17 Klarna

We offer Klarna as a payment option at checkout. When you choose to pay with Klarna, we pass your contact details and order information to Klarna so they can assess whether you qualify for their payment methods and to process your payment. Klarna acts as an independent data controller for this processing and has its own privacy notice at klarna.com/uk/privacy.

Separately, Klarna's JavaScript loads on every page of our website as part of its on-site messaging feature, which displays Klarna payment options on product and basket pages. This may involve Klarna collecting your IP address and basic device information for fraud prevention and service delivery purposes even if you do not use Klarna to pay.

Legal basis: Contract. processing Klarna payments at checkout. Legitimate Interests: displaying payment options and fraud prevention via on-site messaging.

5.18 ClickCease

We use ClickCease, a click fraud protection service, to monitor our paid advertising campaigns for invalid or fraudulent clicks. ClickCease processes IP addresses and click behaviour data to identify and block suspicious traffic from our ads.

Legal basis: Legitimate Interests. protecting our advertising spend from click fraud and ensuring accurate campaign data.

6. Advertising, Remarketing, and Data Sharing with Ad Platforms

6.1 Cookie-based remarketing

When you visit our website, advertising cookies placed by Google, Meta, Bing, and TikTok record your visit. After you leave, you may see our adverts on other websites, in Google search results, on YouTube, on Facebook, on Instagram, or on TikTok. This only happens if you have consented to advertising cookies.

6.2 Customer Match and Custom Audiences

What this means in plain terms: we may upload a list of customer email addresses to Google and Meta.

Before uploading, we convert (hash) each email address using a one-way mathematical process so the raw address is never directly visible to those platforms. They compare the hashed data against their own user records to identify matching users. We use this to target existing customers, exclude them from new-customer campaigns, and improve advertising efficiency.

Legal basis: Consent. data use for Customer Match and Custom Audience purposes.

6.3 Enhanced Conversions

What this means in plain terms: when you complete a purchase, we send Google and Meta some of your hashed contact data alongside the conversion event.

We hash your email address, and sometimes your phone number or address, before sending. This helps Google and Meta match the purchase to a logged-in account, improving conversion measurement accuracy. This only happens at the point of a completed purchase and only where you have consented.

Legal basis: Consent. Enhanced Conversion data sharing.

6.4 Lookalike and Similar Audiences

Google and Meta allow us to use our Customer Match lists as seed data to find new potential customers with similar characteristics. Neither platform shares the underlying personal data with us. You cannot be individually identified from this process by us.

Legal basis: Consent. data shared for Lookalike and Similar Audience purposes.

6.5 YouTube advertising

We run video adverts on YouTube as part of our Google Ads activity. The same Google Ads consent framework applies. If you are logged into a Google account, Google may link your viewing activity to your account according to their own privacy policy.

Legal basis: Consent. advertising cookies and YouTube tracking.

6.6 TikTok advertising

We run paid video and image adverts on TikTok. The TikTok Pixel tracks whether someone who interacted with our TikTok ad visited our website or made a purchase. We may also use Custom Audiences on TikTok by uploading hashed customer email addresses, and Lookalike Audiences based on those lists. These features only operate where you have consented to advertising cookies.

Legal basis: Consent. TikTok advertising cookies and Pixel tracking.

6.7 Cross-device tracking

Google, Meta, and TikTok can track activity across different devices when you are logged into their platforms. This is managed by those platforms according to their own privacy policies and applies only where advertising cookies and platform tracking are enabled.

6.8 Klaviyo behavioural tracking

Klaviyo tracks your activity on our website using cookies, and tracks email engagement using a pixel (a small invisible image in emails that records when you open them). Klaviyo uses this to identify browse abandonment and cart abandonment, trigger automated emails, and personalise email content.

Legal basis: Consent. Consent for Klaviyo tracking cookies and email pixels for opted-in subscribers. For automated emails to existing customers, we rely on the PECR soft opt-in (Regulation 22(3)), with legitimate interests (Article 6(1)(f) UK GDPR) as the lawful basis for the underlying processing.

7. Email Marketing

7.1 Opted-in subscribers

If you have signed up for our marketing emails, we will send you promotional messages about our products and offers. You can unsubscribe at any time by clicking the unsubscribe link in any email or by contacting us at info@excavatorpartsdirect.co.uk.

Legal basis: Consent. direct marketing to opted-in subscribers.

7.2 Existing customers (soft opt-in)

Under the Privacy and Electronic Communications Regulations (PECR), we may send marketing emails to existing customers about similar products and services without a separate opt-in. We always include an unsubscribe option in every email and will stop immediately on request.

Legal basis: Legitimate Interests. We rely on the PECR soft opt-in rule (Regulation 22(3)), with legitimate interests (Article 6(1)(f) UK GDPR) as the lawful basis for the underlying processing.

8. How We Protect Your Data

We have appropriate technical and organisational measures in place to protect your personal data against unauthorised access, loss, alteration, or disclosure. These include encrypted connections (HTTPS), access controls, and contractual security obligations on all third-party processors.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours. Where the breach is likely to result in a high risk to you, we will also notify you directly without undue delay.

9. How Long We Keep Your Data

We keep your personal data only for as long as necessary for the purpose it was collected. Default retention periods are set out below and reviewed periodically.

• Order and transaction data: 7 years (HMRC requirement)

• Customer account data: Duration of account, plus 2 years after last activity

• Email marketing data: Until you unsubscribe or withdraw consent, reviewed annually

• Analytics data (GA4): 26 months (GA4 platform default)

• Session recordings (Hotjar and Clarity): 365 days

• Chat data (ZipChat): Duration of conversation context, subject to ZipChat's retention policy

• Contact and enquiry data: 2 years from last contact

10. International Data Transfers

Several processors listed in this policy operate servers outside the UK. Where data is transferred outside the UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement (IDTA), or an adequacy determination by the UK government.

Processors that may transfer data outside the UK:

• Shopify: Canada (adequacy status) and other countries. SCCs/IDTA for other transfers.

• Google (Analytics, Ads, Tag Manager): US. Uses SCCs.

• Meta (Facebook and Instagram): US. Uses SCCs.

• Klaviyo: US. Uses SCCs.

• Microsoft (Clarity, Bing Ads): US. Uses SCCs.

• Hotjar: EU/EEA-based; may transfer to US. Uses SCCs.

• Trustpilot: EU/EEA and US. Uses SCCs.

• Algolia: May transfer to US. Uses SCCs.

• ZipChat: US-based. Uses SCCs or equivalent safeguards.

• Oracle / NetSuite: US-based. Uses SCCs/IDTA.

• Anthropic (Claude): US-based. Uses SCCs/IDTA.

• TikTok: US and Singapore (ByteDance infrastructure). Uses SCCs. Data transferred to these jurisdictions may be subject to access by local authorities under applicable law. A transfer impact assessment is recommended.

• Klarna: Sweden (EU) and may transfer to US and other countries. Uses SCCs.

You can request details of the safeguards in place for any specific transfer by contacting us at info@excavatorpartsdirect.co.uk.

11. Your Rights Under UK GDPR

You have the following rights in relation to your personal data. To exercise any of them, contact us at info@excavatorpartsdirect.co.uk. We will respond within one calendar month. There is no charge in most cases.

Right of Access

You can ask for a copy of the personal data we hold about you (a Subject Access Request).

Right to Rectification

If any data we hold is inaccurate or incomplete, you can ask us to correct it.

Right to Erasure

In certain circumstances, for example if we no longer need the data or you withdraw consent, you can ask us to delete your personal data. We may need to retain certain data to comply with a legal obligation such as HMRC record-keeping requirements.

Right to Restriction of Processing

You can ask us to pause processing your data in certain circumstances, for example while you contest its accuracy or while an objection is being considered.

Right to Data Portability

Where we process your data based on consent or to perform a contract, and processing is by automated means, you can ask us to provide that data in a structured, machine-readable format.

Right to Object

Direct marketing: you have an absolute right to object to your data being used for direct marketing at any time. We will stop immediately.

Legitimate interests: you can also object to processing carried out on the basis of legitimate interests. We will stop unless we can demonstrate compelling grounds that override your interests, rights, and freedoms, or unless we need the data for legal claims.

Right to Withdraw Consent

Where we rely on consent, you can withdraw it at any time. To withdraw consent to cookies, update your preferences via the cookie settings link on this website. To unsubscribe from marketing emails, click the unsubscribe link in any email or contact us directly.

Right to Complain to Us Directly

Under the Data (Use and Access) Act 2025, you have the right to raise a data protection complaint directly with us before escalating to the ICO.

Email: info@excavatorpartsdirect.co.uk

Data Protection Contact: Stephen Cope

We will acknowledge your complaint within 30 days and investigate without undue delay. If you are not satisfied with our response, you may escalate to the ICO.

Right to Complain to the ICO

If you remain unhappy after raising the matter with us, you have the right to lodge a complaint with the ICO.

ICO website: ico.org.uk   |   ICO helpline: 0303 123 1113

12. Cookies

We use cookies and similar tracking technologies on this website. Strictly necessary cookies, those required for the website to function, do not require consent. For all other cookies, we use a consent banner managed by Pandectes to obtain your agreement before they are placed. You can update your preferences at any time using the cookie settings link on our website. Our separate Cookie Policy provides a full list of the cookies we use, what they do, and how long they last.

13. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices, technology, or the law. When we do, we will update the "Last updated" date at the top. If we make material changes, we will notify you by email or by placing a prominent notice on the website.

14. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

Astrak UK Ltd (trading as EPD Parts / Excavator Parts Direct)

Wheatfield Road, Dunnikier Business Park, Kirkcaldy, Fife, KY1 3PD

Email: info@excavatorpartsdirect.co.uk

Phone: 0330 058 1234

Data Protection Contact: Stephen Cope

ICO Registration Number: ZA310700