FF CORSE PARTS / WEBSITE LEGAL

Effective 11 August 2026 Version 1

This Policy explains how FF Corse Limited collects and uses personal data in connection with https://www.ffcorseparts.com/, quotations, parts enquiries, orders, accounts, delivery, customer service and marketing.

Legal entity	FF Corse Limited trading as FF Corse Parts
Company number	06785271
Registered office	The Counting House, High Street, Tring, Hertfordshire, HP23 5TE, United Kingdom
Trading address	Unit 1 Silverstone Technology Park, Silverstone Circuit, Silverstone, NN12 8TN, United Kingdom
Website	https://www.ffcorseparts.com/
Contact	parts@ffcorse.com \| +44 (0)1327 857601

At a glance: we use personal data to answer enquiries, identify and supply parts, fulfil contracts, operate and secure the Site, meet legal duties and send permitted marketing. We do not sell personal data. You can exercise your rights or raise a data-protection complaint by contacting parts@ffcorse.com.

1. Scope and purpose of this Policy

This Privacy Policy explains how we collect, use, disclose, retain and protect personal data when you use the Site, create an account, request a quotation, buy Goods, contact us, receive marketing or otherwise deal with FF Corse Parts as a customer, prospective customer, supplier or business contact.

We process personal data under the UK General Data Protection Regulation, the Data Protection Act 2018 as amended, the Privacy and Electronic Communications Regulations 2003 and other applicable law. This Policy should be read with our Terms and Conditions and our cookie settings or cookie notice.

Personal data means information relating to an identified or identifiable living person. Anonymous information that cannot reasonably identify a person is not personal data.

2. Who we are and how to contact us

FF Corse Limited is the controller of personal data covered by this Policy. We trade as FF Corse Parts and operate the Site. Our company number is 06785271 and our ICO registration number is ZA359259.

Contact point	Details
Data protection and privacy enquiries	parts@ffcorse.com \| +44 (0)1327 857601
Registered office	The Counting House, High Street, Tring, Hertfordshire, HP23 5TE, United Kingdom
Trading address	Unit 1 Silverstone Technology Park, Silverstone Circuit, Silverstone, NN12 8TN, United Kingdom
Website	https://www.ffcorseparts.com/

3. Personal data we collect

3.1 Identity, contact and account data

Name, title, company or team name, role and account username.
Billing and delivery addresses, email address and telephone number.
Account credentials, preferences and communication choices.

3.2 Vehicle and parts-enquiry data

Vehicle make, model, year, race series, chassis number or VIN, existing part numbers and technical specifications.
Photographs, documents and descriptions of the vehicle, component, damage, fitment or parts requirement that you choose to provide.
Quote requests, compatibility questions and correspondence with our parts team.

3.3 Order, transaction and payment data

Goods ordered, quotations, prices, discounts, delivery method, order history, invoices, returns, warranty claims and customer-service records.
Payment status, transaction reference and limited billing information. Where an external payment provider processes card or other payment details, it acts under its own privacy information and we do not normally receive complete card credentials.
Fraud-prevention, identity-verification or credit information where relevant and lawful.

3.4 Technical and usage data

Internet Protocol address, device and browser type, operating system, time zone, referring page, Site pages viewed, clicks, session information and error or security logs.
Cookie identifiers, consent choices and information collected through similar technologies, subject to the choices described in section 8.

3.5 Marketing and communications data

Your preferences for receiving news, product updates and offers from us.
Records of emails sent, delivered, opened or selected where the relevant service provides those metrics and their use is lawful.
Feedback, survey responses and interactions with our marketing or social-media content.

Please do not send special-category data, criminal-offence data or unrelated personal information through a parts enquiry. If a document or photograph contains personal data that we do not need, redact it before sending where practical.

4. How we collect personal data

Directly from you when you browse, register, place an order, request a quote, submit a contact form, telephone or email us, return Goods, make a claim, attend an event or communicate with our staff.
Automatically from the Site, servers, cookies, analytics, security and ecommerce systems.
From payment providers, delivery companies, fraud-prevention services, manufacturers, authorised distributors and technical suppliers where needed to process a transaction or identify a part.
From the company, race team or other organisation you represent, and from publicly available business sources where appropriate.

5. Why we use personal data and our lawful bases

We use personal data only where we have a lawful basis. More than one basis may apply. The table summarises our main activities.

Purpose	Data commonly used	Lawful basis
Respond to enquiries and prepare quotes	Identity, contact, vehicle, chassis, parts requirement and correspondence	Steps at your request before a contract; legitimate interests in responding to business enquiries
Create and manage accounts	Identity, contact, credentials, preferences and order history	Contract; legitimate interests in customer administration and account security
Accept and fulfil orders	Identity, contact, order, vehicle, delivery and transaction data	Contract; legitimate interests for Business Customer contacts
Take payment and prevent fraud	Billing, transaction, device, fraud and limited identity data	Contract; legal obligation; legitimate interests in protecting customers and our business
Identify, source and confirm parts	Vehicle model, chassis or VIN, part numbers, photographs and technical enquiry	Contract or pre-contract steps; legitimate interests in accurate sourcing and safe fulfilment
Deliver Goods and handle returns or claims	Contact, address, order, carrier, evidence and correspondence	Contract; legal obligation; legitimate interests in resolving issues and defending claims
Keep accounts and comply with law	Invoices, transaction, tax, customs, complaint and rights-request records	Legal obligation; legitimate interests in governance and legal protection
Operate, secure and improve the Site	Technical, usage, cookie, security and error data	Legitimate interests in secure and effective services; consent where required for cookies
Send marketing and measure engagement	Contact, purchase history, preferences and permitted engagement data	Consent where required; legitimate interests and the existing-customer soft opt-in where lawful
Manage a business sale or reorganisation	Relevant customer, supplier, contract and transaction records	Legitimate interests in corporate transactions, subject to confidentiality and safeguards

5.1 Legitimate interests

Where we rely on legitimate interests, we consider whether the use is necessary, proportionate and reasonably expected, and balance our interests against your rights. Our interests include operating a specialist parts business, responding to enquiries, sourcing accurately, keeping records, preventing fraud, protecting systems, improving service and communicating with customers. You may object in the circumstances described in section 12.

5.2 If you do not provide data

Where personal data is needed to enter into or perform a contract, meet a legal requirement, verify fitment or arrange delivery, we may be unable to quote, accept or fulfil the order if it is not supplied or is inaccurate.

6. Vehicle, chassis and technical information

A chassis number or VIN can relate to an identifiable owner or customer when combined with other information and is therefore handled as personal data where applicable. We use vehicle and chassis information to identify compatible parts, check supersessions, obtain supplier information, prepare quotations, fulfil orders, maintain service records and address safety or warranty issues.

We may share the minimum necessary vehicle or chassis information with a manufacturer, authorised distributor or technical supplier for those purposes. Do not provide information about another person or vehicle unless you are authorised to do so.

7. Marketing communications

We may send product news, availability updates, event information or offers where you have consented or where the law permits us to contact an existing customer about similar products and we offered an opt-out when collecting the details.

You can unsubscribe at any time using the link in a marketing email or by contacting parts@ffcorse.com.
Opting out of marketing does not stop service messages about an order, account, safety issue, recall, quotation or legal matter.
We do not sell or rent personal data to third parties for their own marketing.
We may keep a minimal suppression record so that we continue to respect an opt-out.

8. Cookies and similar technologies

The Site uses cookies and similar technologies to make core features work, remember choices, maintain security, understand performance and, where enabled, support analytics or marketing.

Strictly necessary technologies are used for functions such as security, basket, checkout, account login, load balancing and consent management.
Functional technologies remember optional settings or improve convenience.
Analytics technologies help us understand Site use and improve performance.
Advertising or social-media technologies may measure campaigns or tailor content where enabled.

We request consent before using non-essential technologies unless an applicable legal exemption allows use without consent. Where an exemption applies, we provide the information and opt-out required by law. You can change choices through the Site cookie settings and can also control cookies through the browser. Blocking some technologies may affect Site functions. The cookie banner or separate cookie notice identifies the technologies currently in use and their durations.

9. When we share personal data

We share only what is reasonably necessary with recipients that need the information for a permitted purpose. Categories may include:

our authorised staff, contractors and professional advisers;
website, ecommerce, hosting, cloud, email, customer-support, analytics, security and backup providers;
payment, banking, fraud-prevention and credit-service providers;
carriers, freight forwarders, customs agents and delivery partners;
manufacturers, authorised parts distributors and technical suppliers where needed to identify, source, verify or fulfil a part;
tax authorities, regulators, courts, law-enforcement bodies and other authorities where disclosure is required or lawful;
a buyer, investor, lender or adviser in connection with a proposed sale, investment, financing or reorganisation, subject to appropriate confidentiality.

Service providers acting as processors must handle data on our instructions, keep it secure and use it only for agreed purposes. Some independent recipients, such as payment providers, carriers or authorities, may act as separate controllers under their own privacy notices.

10. International transfers

Some suppliers or service providers may process personal data outside the United Kingdom. Where the destination is not covered by UK adequacy regulations, we use an appropriate safeguard where required, such as the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful mechanism. We also assess supplementary protections where appropriate.

Contact us for more information about the safeguard used for a relevant transfer. Commercially confidential information may be redacted from any copy provided.

11. Retention

We keep personal data only for as long as reasonably necessary for the purpose collected, including contractual, safety, accounting, tax, warranty, dispute and legal requirements. Our normal retention framework is:

Record type	Normal retention period
Orders, invoices, payments, tax and accounting records	Normally 6 years after the end of the relevant financial period or customer relationship, unless law requires longer
Unconverted enquiries and quotations	Normally 24 months after the last meaningful interaction
Customer account profile	While active and normally up to 24 months after inactivity or closure; transaction records are retained separately for the applicable legal period
Returns, warranty, safety and customer-service cases	Normally 6 years after closure, or longer where a product-safety, warranty or legal issue justifies it
Marketing contact data	Until you opt out or after a reasonable period of inactivity, normally no more than 24 months without meaningful engagement; a minimal suppression record may be kept longer
Security and technical logs	Normally up to 12 months, unless needed longer to investigate an incident or legal claim
Cookie and consent records	For the duration stated in the current cookie settings or notice and as needed to demonstrate consent or an opt-out
Data-protection complaints and rights requests	Normally 6 years after closure to demonstrate compliance and address related claims

We may anonymise data so that it no longer identifies anyone and use that anonymous information for statistics, planning or service improvement.

12. Your data-protection rights

Depending on the circumstances, you may have the following rights:

Access: ask whether we process your personal data and receive a copy and related information.
Rectification: ask us to correct inaccurate or incomplete data.
Erasure: ask us to delete data where there is no continuing lawful reason to keep it.
Restriction: ask us to limit use while an issue is considered.
Objection: object to processing based on legitimate interests and object at any time to direct marketing.
Portability: receive certain data you provided in a structured, commonly used and machine-readable format, and ask for transfer where technically feasible.
Withdraw consent: withdraw consent at any time for future processing where consent is the basis.
Automated decisions: rights relating to a decision based solely on automated processing that produces legal or similarly significant effects.

To exercise a right, contact parts@ffcorse.com. We may request information reasonably needed to verify identity and understand the request. We normally respond without undue delay and within one month. A right may be restricted or subject to an exemption, in which case we will explain the position where the law permits.

13. Data-protection complaints

To raise a data-protection complaint, email parts@ffcorse.com with the subject line Data Protection Complaint, or write to our registered office. Explain what happened, the personal data involved, relevant dates and the outcome you seek.

We will provide a clear route to complain and will acknowledge receipt within 30 days.
We will take appropriate steps to investigate without undue delay, consider the relevant facts fairly and keep you informed where the investigation is ongoing.
We will communicate the outcome without unjustifiable or excessive delay and explain any action taken or reason for not taking action.

You may also complain to the Information Commissioner’s Office. We ask that you contact us first so we have an opportunity to resolve the issue, but you do not have to do so.

ICO contact	Details
Address	Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline	0303 123 1113
Website	ico.org.uk/make-a-complaint

14. Security

We use proportionate technical and organisational measures designed to protect personal data against accidental or unlawful loss, alteration, disclosure, access or destruction. Measures may include access controls, authentication, encryption in transit, backups, system monitoring, supplier due diligence, staff confidentiality and incident procedures.

No internet transmission or storage system can be guaranteed completely secure. You are responsible for protecting account credentials and for contacting us promptly if you suspect misuse. Please do not send complete payment-card details by ordinary email.

15. Children

The Site and online purchasing service are intended for people aged 18 or over. We do not knowingly seek personal data directly from children through the Site. A parent, guardian, team or organisation should contact us before providing information relating to a child.

16. Automated decision-making

We do not currently make decisions about customers based solely on automated processing that produce legal or similarly significant effects. Payment or fraud-prevention providers may use automated tools under their own privacy information. If this changes for processing we control, we will provide the information and safeguards required by law.

17. Third-party links

The Site may contain links to third-party websites, platforms or services. Their operators are responsible for their own privacy practices. Review their privacy information before providing personal data.

18. Changes to this Policy

We review this Policy regularly and may update it to reflect legal, regulatory, technical or business changes. The current version will be published on the Site with its effective date. Where a change materially affects how we use personal data, we will take reasonable steps to bring it to the attention of affected people and obtain consent where required.

19. Contact us

For privacy questions, rights requests or data-protection complaints, contact parts@ffcorse.com, telephone +44 (0)1327 857601, or write to FF Corse Limited at The Counting House, High Street, Tring, Hertfordshire, HP23 5TE, United Kingdom.

FF Corse Parts | Last updated 11 August 2026 Version 1