Privacy Policy

1. Who controls your personal information

CLP SOFTWARE STUDIO S.R.L., a company registered in Romania with fiscal identification number 38691736, operates Parts Finder Software and is the data controller for personal information used to manage this website, customer relationships, accounts, billing, and direct support.

Privacy contact: clapalucian10@gmail.com. Use the subject “PartsFinderSoftware privacy request” so we can route your request promptly.

2. Scope and our controller/processor roles

This policy covers:

• the public website at partsfindersoftware.com and its subdomains;
• the Parts Finder Software applications, storefront components, administrative tools, APIs, integrations, and support;
• sales, onboarding, account, billing, and business communications with prospective and current customers.

For merchant account, contact, billing, security, and relationship data, CLP SOFTWARE STUDIO S.R.L. acts as controller. When a merchant uses Parts Finder Software with information about its own shoppers, customers, staff, or orders, that merchant normally determines why and how the information is processed and is the controller. In that situation, we act as its processor under its instructions and the applicable data-processing terms.

If you are a shopper or another end user of a merchant using Parts Finder Software, direct your request to that merchant first. We assist the merchant with valid data-subject requests as required by the GDPR and our processor obligations.

3. Personal information we process

Depending on how you interact with the service, we may process the following limited categories:

• Business and account details: name, work email address, telephone number, role, company, shop domain, account and Shopify identifiers, installation status, settings, and billing or subscription status.
• Communications: enquiries, support messages, meeting details, feedback, and information you choose to provide.
• Technical and security data: IP address, timestamps, browser and device details, requested URLs, authentication and session events, error reports, and security logs.
• Service and storefront activity: product searches, product and diagram interactions, saved vehicle or garage selections, feature settings, and performance events needed to provide and improve merchant-enabled features.
• Merchant-directed customer and order data: customer identifiers and contact or order information only when a merchant enables a feature that needs it, such as support, chatbot lead collection, order workflows, or an integration. We do not collect or store full payment-card numbers.
• Consent choices: the cookie and similar-technology preferences saved by the public website.

We receive this information directly from you, from the merchant that provides or enables the service, from Shopify and other systems the merchant connects, and automatically when a device requests or uses the service. We do not intentionally collect special-category data such as health, biometric, political, religious, or sexual-orientation information.

4. Why we process information and our legal bases

Account and contract information is required when it is necessary to enter into or provide the service. Without it, we may be unable to create an account, provide a requested feature, invoice the customer, or respond to support. Optional communications and optional cookies are not required to use the core service.

5. Service providers and permitted disclosure

We do not share personal information for third parties' own purposes

We do not sell personal information. We do not provide it to advertisers, data brokers, list brokers, social-media advertising audiences, unrelated affiliates, contest sponsors, or marketing partners. We do not permit service providers to use it for their own advertising or independent commercial purposes.

Processors that help us operate the service

The minimum necessary information may be processed on our behalf by vetted providers in these categories: cloud and server hosting, content delivery, database and file storage, email and calendaring, authentication and security, monitoring and error diagnostics, customer support, payment and subscription administration, Shopify and merchant-connected platforms, and AI infrastructure when an enabled feature requires it. They are bound by contracts, confidentiality, security, and data-protection obligations appropriate to their role.

Legal requirements and organisational change

We may disclose the minimum necessary information when required by applicable law, a binding court order, or a competent public authority, or when necessary to establish, exercise, or defend legal claims. If the business is reorganised or transferred, personal information may be transferred only subject to confidentiality and continued data-protection obligations. We will provide further notice where the law requires it.

6. International transfers

We prefer providers and processing locations in the European Economic Area where practical. Some providers may process information in other countries. When personal information is transferred outside the EEA, we use a lawful transfer mechanism, such as an adequacy decision or the European Commission's Standard Contractual Clauses, together with supplementary safeguards where required.

Contact us if you want information about the transfer mechanism relevant to your information or a copy of the applicable safeguards, subject to permitted redactions for confidential information.

7. How long we keep information

We keep personal information only for as long as necessary for the relevant purpose:

• enquiry and pre-contract correspondence is reviewed after the conversation ends and deleted when it is no longer reasonably needed;
• account, configuration, and support information is kept while the service relationship is active and for a limited period afterward;
• invoices, accounting records, and information needed for tax, compliance, or legal claims are kept for the period required or permitted by applicable law;
• security, access, and diagnostic logs are retained for short operational periods unless an incident requires longer preservation;
• merchant-controlled data is deleted or anonymised when instructed by the merchant, when a valid GDPR or Shopify compliance request applies, or when it is no longer needed to provide the enabled feature, subject to legal retention duties;
• backup copies age out according to controlled backup-retention cycles and are not used for ordinary processing.

We use documented retention criteria because the exact period can depend on the data, the merchant configuration, the contract, and mandatory legal obligations. You may contact us for the period or criteria applying to a specific category of your information.

8. Your GDPR rights

Subject to the conditions and exceptions in applicable law, you may have the right to:

• be informed about processing and obtain access to your personal information;
• correct inaccurate or incomplete information;
• request erasure or restriction of processing;
• receive information you provided in a structured, commonly used, machine-readable format and transmit it to another controller;
• object to processing based on legitimate interests and object at any time to direct marketing;
• withdraw consent at any time, without affecting processing carried out before withdrawal;
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects;
• lodge a complaint with a competent supervisory authority.

Parts Finder Software does not use personal information for solely automated decisions that produce legal or similarly significant effects. Features may use automation or AI to assist search, support, or operational workflows, but the service does not make such significant decisions about individuals.

Send a request to clapalucian10@gmail.com. We normally respond within one month. We may ask for information reasonably necessary to confirm your identity and protect other people's information. A request is free unless it is manifestly unfounded or excessive as defined by the GDPR.

9. Security, cookies, and external links

We use technical and organisational safeguards appropriate to the risk, including encrypted transport, access controls, least-privilege practices, logging and monitoring, backups, tenant separation controls, and provider review. No internet service can guarantee absolute security, but we maintain procedures to identify, respond to, and notify relevant parties of a personal-data breach where required.

The public website saves a local record of cookie preferences. It also requests resources or user-facing functions from providers of content delivery, fonts, scripts, and scheduling tools; those providers receive technical request data such as an IP address and browser details needed to deliver the resource. Where consent is the required legal basis for non-essential browser technology, you may refuse or withdraw it. See our Cookie Policy for more information and available controls.

Links to third-party websites take you outside our service. Those operators determine their own processing and privacy practices. We encourage you to read their notices before providing personal information.

10. Children

Parts Finder Software is a business service for merchants and is not directed to children. We do not knowingly create accounts for or solicit personal information directly from anyone under 16. If you believe a child has provided information directly to us, contact us so we can investigate and delete it where appropriate.

11. Changes to this policy

We update this policy when our processing or legal obligations change. The date at the top identifies the current version. If a change materially affects how we use personal information, we will provide additional notice where required and will obtain consent when a new consent-based purpose requires it. Continued use does not replace consent where GDPR consent is legally required.

12. Contact and complaints

For questions, requests, or concerns, contact CLP SOFTWARE STUDIO S.R.L. at clapalucian10@gmail.com.

You may also lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), including at dataprotection.ro, or with the supervisory authority in the EU/EEA country where you live, work, or believe an infringement occurred.