The protection of your personal data matters to us. partSmart holds what a trade business runs on — stock, jobs, customers, suppliers and the people who do the work — and we treat that as yours. We do not sell customer data, or any data entered into the partSmart service, and we do not use it to train models. Personal data is always processed in accordance with the General Data Protection Regulation (GDPR) and the Irish Data Protection Acts.
This statement explains what we collect through this website and through the partSmart app, why, who processes it on our behalf, how long we keep it, and the rights you have. Where a processing activity has no other legal basis we will ask for your consent first.
We have appointed a Data Protection Officer. For any question about this statement or how your personal data is used, or to exercise your rights, contact:
Data Protection OfficerData protection incidents — unauthorised access, disclosure, loss or processing of personal data — can be reported to the same address.
partsmart.org is a static site hosted on Amazon Web Services (AWS Amplify and CloudFront) in the EU (Ireland) region. Each visit records, in server logs, the ordinary technical data a web server sees: browser type and version, operating system, the referring page, the pages requested, date and time, IP address and internet service provider. We need this to deliver the site correctly, to keep it secure and to investigate attacks. There is no profiling.
The site sets no advertising or tracking cookies. The only cookie it sets on its own account records your answer to the cookie notice, so we do not ask again; it is technically essential, needs no consent of its own, and lapses after 180 days, at which point we ask again. Fonts are loaded from Google Fonts, which receives your IP address in order to serve them.
We intend to add website analytics to understand which pages people find useful. It will run only for visitors who accept it on the cookie notice, and nothing is loaded at all until then — declining leaves the site working exactly as it does now. You can change your answer at any time through Cookie settings, at the foot of every page. At the date above no analytics is running on this site; this statement will name the provider and what it collects on the day it is switched on.
Legal basis: Article 6(1)(f) GDPR — legitimate interest in running a secure website.
The contact form on this site does not send data to our servers. It opens a pre-filled message in your own email application, which you then send to sales@partsmart.org. What you send us by email — name, company, phone number, email address and your message — is used to reply to you and to arrange the demo or call you asked for. It is kept for as long as the conversation is live and then for our normal business-records period.
Legal basis: Article 6(1)(b) GDPR — steps at your request prior to entering a contract; Article 6(1)(f) for follow-up.
partSmart is used by trade businesses (our customers) and the people who work for them (users). For the data in a customer’s account, the customer is the controller and we are the processor under the Master Service Agreement. This section describes what the app handles.
Name, work email address, role (admin or member), the locations you are assigned to, and login credentials held as a salted hash. Used to authenticate you, decide what you can see and do, and record who made each stock movement.
Parts, stock levels per location, minimum and standard quantities, jobs and the materials recorded against them, timesheets (user, date, hours, notes), customers and suppliers (names, addresses, emails, phone numbers), quotations, purchase orders and invoices. Some of this is personal data — a sole-trader customer’s name and address, a supplier contact’s email, a user’s hours. It is processed only to provide the service to the customer who entered it.
When a user sends a purchase order, quotation or invoice, the app generates a PDF and emails it from an address on the partsmart.org domain, in the customer’s name, with a reply-to address of the user who sent it. The recipient’s email address and the document contents pass through our email provider (section 6) for delivery. A copy is sent to the sending user.
The app keeps a working copy of the customer’s data on the device so it can be used without signal, and queues changes until a connection returns. That copy is protected by the device’s own security; users should lock their phones. Signing out clears the queue.
The app records technical events (errors, sync failures, timing) to keep the service working. These are tied to the account, not to behaviour outside the app, and are not used for advertising.
This website: essential only (see section 2). The app: uses secure local storage for your session token and offline data, which is not a cookie and is not shared with third parties.
We use a small number of providers to run partSmart. Each processes data only on our instructions under a data-processing agreement.
| Provider | Purpose | Data |
|---|---|---|
| Amazon Web Services | Hosting of this website | Server logs (section 2) |
| Supabase | Database, authentication and file storage for the app | Account and business data (section 4) |
| Resend | Sending purchase-order, quotation and invoice emails | Recipient address, document contents, delivery events |
| Google (Maps Platform) | Turning a typed address into map coordinates when a customer or supplier address is saved | The address text |
| Google Fonts | Typefaces on this website | IP address |
| Apple / Google app stores | Distributing the app | Governed by their own policies |
Where a provider processes data outside the EU/EEA, transfers rest on the European Commission’s adequacy decisions or Standard Contractual Clauses. Details of the safeguards for any provider are available from the DPO.
Under GDPR you can ask us to confirm what personal data we hold about you and to provide a copy (access); to correct it (rectification); to delete it (erasure); to restrict or object to processing; and to receive it in a portable format. Where processing rests on consent you can withdraw it at any time without affecting what was done before.
Write to dpo@partsmart.org. We respond within one month. If you are a user of a customer’s account, we may direct the request to that customer, who controls the data, and help them answer it.
You also have the right to lodge a complaint with a supervisory authority — in Ireland, the Data Protection Commission.
Data is encrypted in transit (TLS) and at rest with our providers. Access inside the app is governed by roles and location assignments, so a user sees the vans and stores they are given and no others; every stock movement records who made it. Access to production systems on our side is limited to named staff with multi-factor authentication.
partSmart is a business tool for tradespeople and is not directed at anyone under 16. We do not knowingly collect data from children.
We update this statement when the service or the law changes. The date at the top tells you when. Material changes affecting app users are also announced in the app.
Controller: partSmart Ltd., 36 Dewberry, Mount Oval Village, Rochestown, Co. Cork, Ireland, T12 W8CK. Data Protection Officer: dpo@partsmart.org. Purposes and legal bases: as set out above. Recipients: the processors in section 6. Retention: section 7. Rights: section 8. Providing personal data is voluntary; without an email address we cannot create an account or reply to an enquiry.
