1. Who we are
CAR.OS is operated by Trade Parts Hub Ltd, trading as CAR.OS TPR / CAR.OS Trade.Part.Recycle, registered in England and Wales (company number 15435255). Our registered office is 5 Moss Road, Billinge, Wigan, England, WN5 7BU.
For privacy enquiries, email sales@tradepartrecycle.com, call 01942 620 678 or write to our registered office, marked “CAR.OS privacy”.
This notice covers caros.tradepartrecycle.com and its customer, staff, seller and driver workspaces. Retail purchases on Trade.Part.Recycle are also covered by that website’s privacy notice.
We are the controller for our own account administration, billing, support, security and services we arrange. Where a business uses CAR.OS to manage its customers, employees or orders, that business normally decides why the information is used and is the controller; we process it on its behalf. We may refer requests about those records to that business and help it respond.
2. Information and sources
- Accounts: names, business details, contact information, addresses, workspace membership, permissions and sign-in records, supplied by you or your organisation’s administrator.
- Stock and channels: listings, SKUs, photographs, vehicle or part details, marketplace identifiers, connection credentials and synchronisation records, from your uploads and connections you authorise, including eBay and Shopify.
- Orders and fulfilment: buyer and recipient contact details, delivery addresses, items, values, status and tracking references, supplied by sellers, connected channels, customers or carriers.
- Collections and deliveries: sites, routes, driver assignments, timestamps, notes, photographs, signatures and proof of delivery. Device location may be included when you use a location feature and allow the browser’s location request.
- Billing and support: selected services, invoices, payment and subscription references, payment status and correspondence. Stripe collects card details through its payment interface; CAR.OS receives payment records rather than your full card number or security code.
- Technical information: IP address, browser and device information, requests, errors and audit logs generated while operating and protecting the service.
Provide only information needed for the task. Avoid unrelated people, sensitive documents or payment details in photographs and AI prompts. Without necessary account, payment or delivery details, we may be unable to provide access, process a payment or fulfil a booking.
3. How and why we use information
When we act as controller, we use the following lawful bases under UK data protection law. Contract applies where the contract is with you personally; for a company’s staff contacts, we generally rely on our legitimate interest in administering that business relationship.
| Purpose | Lawful basis |
|---|---|
| Manage accounts, supply selected modules and answer support enquiries. | Contract; legitimate interests in providing business services. |
| Administer subscriptions, payments, invoices and financial records. | Contract; accounting and tax obligations; legitimate interests in administering business payments. |
| Coordinate and document collections, deliveries and tracking for services we arrange. | Contract; legitimate interests in completing services and resolving delivery queries. |
| Protect accounts, investigate misuse or faults, improve reliability and resolve disputes. | Legitimate interests in security, reliable operation and protecting legal rights; legal obligations where applicable. |
| Optional marketing or optional tracking, if introduced. | Consent where required, which you can withdraw. Essential service messages are separate. |
For business data processed on a customer’s behalf, that business identifies its lawful basis and informs the people concerned. Device permission does not replace an employer’s responsibility to explain its use of staff location or delivery evidence.
Enabled AI features may send submitted photographs, listing details or scheduling instructions to an AI provider to suggest descriptions, counts or plans. Suggestions can be wrong and need human review; they must not be the sole basis for decisions about a person’s legal rights or similarly significant interests. Contact us to request human review of an account or service issue.
5. Cookies, security and retention
CAR.OS uses cookies and similar storage for sign-in, security and requested features. Browser storage can retain interface state and queue photographs or driver evidence during interrupted connectivity. Unsynchronised uploads can remain on the device until submitted or removed. Use a trusted device and check uploads have completed; clearing site storage before synchronisation can lose pending work.
These public information pages do not add advertising or analytics cookies. Third-party checkout and connected stores have their own notices. Any optional tracking introduced by CAR.OS will be explained and consent requested where required. Browser controls let you manage cookies and site storage, but blocking essential storage can prevent sign-in or offline features.
We use HTTPS, access permissions and operational safeguards to protect information. No internet service can guarantee absolute security. Keep credentials private, remove access for staff who leave and report suspected unauthorised access through support.
Retention
We keep information only as long as needed for its purpose. The applicable period depends on the record, legal requirements, unresolved claims and the customer’s instructions where we act as processor:
- Account records are kept while needed to provide access, then reviewed when the account closes or deletion is requested.
- Orders, delivery evidence and operational records are retained for the service, related claims, reporting duties and agreed customer retention requirements.
- Invoices and payment records are kept for applicable accounting, tax and legal recordkeeping periods.
- Support, security and audit records are kept as needed to resolve issues, investigate incidents and protect legal rights.
- Removed data may remain in restricted backups until those backups expire through their normal cycle. Account closure does not immediately remove every copy.
Contact us for retention criteria for a specific record. We may retain a limited record of a deletion request or marketing objection after other information is removed.
6. Your rights and complaints
Depending on the circumstances, you can request access, correction, deletion, restriction of processing or a portable copy. You can object to processing based on legitimate interests and to direct marketing at any time. Where we rely on consent, you can withdraw it without affecting earlier lawful processing.
Email sales@tradepartrecycle.com with enough information to identify the record. We may need proportionate identity checks. We normally respond within one month; if the law permits an extension or exception, we will explain it.
You can complain directly to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint. You do not have to contact us first, although we welcome the chance to resolve your concern.
CAR.OS is a business service and is not directed at children. Contact us if a child’s information has been provided unnecessarily. We will update this notice when practices change, show the revision date above and give additional notice of material changes where appropriate. This notice explains processing; it is not a request for blanket consent.