Privacy Policy

Introduction

1. This Privacy Policy explains how OEConnection Limited ("OEC", "we", "us" or "our") collects and uses personal data in connection with the Mercedes-Benz UK Limited PartsPro Trade website, hosted at mb-vanspartspro.co.uk (the "Site"). OEC operates this Site on behalf of Mercedes-Benz UK Limited.
2. This Policy describes the categories of personal data we collect, the purposes for which we use it, how we protect it, when we share it with third parties, when we may transfer it outside the UK or European Economic Area (EEA), and your rights under the UK General Data Protection Regulation (UK-GDPR) and the EU General Data Protection Regulation (EU) 2016/679 (GDPR) (together, the "Data Protection Laws").
3. Our use of cookies and similar technologies on the Site is additionally governed by the Privacy and Electronic Communications Regulations 2003 (as amended) ("PECR"). Where PECR applies, we will obtain your consent before placing any non-essential cookies on your device. Please see Section 10 (Cookies) for further details.
4. We will process your personal data in accordance with this Policy unless you object or unless applicable law otherwise requires. We take all reasonable steps to ensure that personal data we hold is adequate, relevant, not excessive, and only processed for specified, limited purposes.
5. This Policy is subject to and shall be interpreted in accordance with applicable law. Any disputes shall be submitted to the appropriate authority as defined by applicable law.

Data Controller

1. For the purposes of the Data Protection Laws, the data controller is:

1. Where OEC processes your personal data purely on the documented instructions of Mercedes-Benz UK Limited, it acts as a data processor. Where OEC independently determines the purposes and means of processing, it acts as a controller. If you have questions about which capacity applies to a specific processing activity, please contact us using the details in Section 16.

Personal Data We Collect

1. Personal data is any information from which a living individual can be identified. We may collect, use, store and share the following categories about you:

• Identity Data – first name, last name, title and job role;
• Contact Data – billing address, delivery address, email address and telephone numbers;
• Technical Data – IP address, login credentials, browser type and version, time zone, pages visited, duration of visit, browser plug-in types, operating system and platform, and other device technologies;
• Profile Data – username and password, details of parts orders placed, preferences, feedback and survey responses;
• Usage Data – information about how you use the Site, products and services;
• Marketing and Communications Data – your preferences for receiving marketing from us and your communication preferences.

1. We also collect, use and share aggregated statistical or demographic data for operational purposes. Aggregated data is derived from personal data but does not, by itself, identify you. If we combine aggregated data with personal data in a way that could directly or indirectly identify you, we will treat the combined data as personal data subject to this Policy.
2. We do not intentionally collect special category personal data (including data about race or ethnicity, religious beliefs, health, sexual orientation, political views, trade union membership, or genetic/biometric data), nor data about criminal convictions or offences. Please do not submit such data through the Site.

How We Collect Your Data

1. We collect personal data through the following means:

Direct Interactions

1. You may provide personal data by filling out forms, or by corresponding with us by post, phone, email or otherwise, including when you:

• create an account on the Site;
• place an order for parts or services;
• complete a "Contact Us" form;
• subscribe to publications or marketing materials;
• enter a competition, promotion or survey; or
• provide us with feedback.

Automated Technologies

1. When you use the Site, we may automatically collect Technical Data about your device, browsing activity and patterns via cookies, server logs and similar technologies. Please see Section 10 (Cookies) for more details.

Third Parties and Public Sources

1. We may receive personal data about you from third parties and public sources, including:

• analytics and engagement service providers, which may be based outside the UK and EU;
• marketing and CRM platform providers, which may be based outside the UK and EU;
• payment and transaction service providers; and
• publicly available sources such as Companies House.

Legal Basis for Processing

1. We are required by the Data Protection Laws to identify a lawful basis for each type of processing we carry out. We rely on the following legal bases:

1. Where we rely on legitimate interests, we balance those interests against your rights and freedoms. You may object to such processing at any time – see Section 14 for details.

How We Use Your Data

1. We may process your personal data for the following purposes:
   • To register you as a new customer and manage your account;
   • To process and fulfil your orders for parts and services;
   • To administer and protect our business and the Site, including troubleshooting, testing, data analysis and system maintenance;
   • To deliver relevant content and measure the effectiveness of communications we send to you;
   • To use data analytics to improve the Site, our products, services and customer relationships;
   • To send you recommendations about goods or services that may interest you;
   • To notify you about changes to our terms, this Policy or our services;
   • To comply with applicable law, including our tax and accounting obligations; and
   • To enforce our terms and conditions and protect the rights and property of OEC and Mercedes-Benz UK Limited.
2. We will only process your personal data for the purpose for which it was collected, or for a compatible purpose. If we need to use it for an incompatible purpose, we will provide notice and, where required by law, seek your consent.

Sharing Your Personal Data

1. We may share your personal data with the following categories of recipient for the purposes described in this Policy:
   • Service providers and IT vendors acting as processors who provide systems administration, hosting, payment processing and related services;
   • Professional advisers including lawyers, auditors, bankers and insurers;
   • Regulators and government authorities where required by applicable law or legal process, including HMRC, the Police, the ICO and equivalent EU regulators;
   • Mercedes-Benz UK Limited and other companies within the Mercedes-Benz Group, for the purposes described in this Policy;
   • Authorised PartsPro Retailers and other trade partners to facilitate transactions on the Site; and
   • Third-party survey providers used to conduct customer satisfaction research (data shared with such providers is anonymised or pseudonymised).
2. We may also disclose your personal data:
   • to comply with a legal obligation or valid legal process (search warrants, subpoenas, court orders), disclosing only the minimum data necessary;
   • in connection with a business transfer, merger or acquisition, limiting sharing to what is strictly necessary; and
   • for any additional purpose where we have obtained your prior consent.
3. All third-party processors are required by contract to keep your data secure, to process it only on our instructions, and not to use it for their own purposes.

International Transfers

1. Some of our service providers and group companies are located outside the UK and EEA. Where we transfer personal data to such countries, we ensure an equivalent level of protection through one or more of the following safeguards:
   • Transfers to countries with a UK adequacy decision made by the Secretary of State (or, for EU transfers, a European Commission adequacy decision);
   • Use of the ICO's International Data Transfer Agreement (IDTA) or the ICO's UK Addendum to the EU Standard Contractual Clauses (SCCs); or
   • Use of the European Commission's 2021 Standard Contractual Clauses for transfers from EU entities.
2. For further information about the safeguards in place for a specific transfer, or to obtain a copy of the relevant documentation, please contact us at privacy@oeconnection.com.

Data Retention

1. We retain personal data only for as long as necessary to fulfil the purposes set out in this Policy, and to comply with our legal, accounting and reporting obligations. Key retention periods are:

1. A full retention schedule is available on request. Please contact privacy@oeconnection.com.
2. In some circumstances we may anonymise personal data for research or statistical purposes, in which case we may use that information indefinitely without further notice to you.

Cookies

1. The placement of cookies on your device is governed by the Privacy and Electronic Communications Regulations 2003 (as amended) (PECR), which require us to obtain your informed consent before setting any cookies that are not strictly necessary for the operation of the Site. We rely on PECR as the legal basis for our cookie consent mechanism, and on the Data Protection Laws for any subsequent processing of personal data collected through those cookies.
2. Our Site uses cookies and similar tracking technologies. A cookie is a small text file placed on your device when you visit a website. We use cookies to enable the Site to function, to remember your preferences, and to understand how the Site is used.
3. Full details of the cookies we use, their purposes, their duration, and how to manage or withdraw your consent are set out in our Cookies Policy. You can also update your cookie preferences at any time using the Cookie Settings link in the footer of the Site.
4. By continuing to use the Site after being presented with our cookie banner, you consent to the use of non-essential cookies as described in the Cookie Policy. You may withdraw this consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Analytics and Tracking Tools

1. We use web analytics tools to understand how visitors interact with the Site and to improve our services. These tools collect information such as pages visited, session duration, device type, and approximate location derived from IP address. Where such tools use cookies or similar technologies, they are covered by your cookie consent – see Section 10 and our Cookie Policy for details.
2. Analytics data is processed at an aggregated or pseudonymised level wherever possible. Where analytics providers act as data processors on our behalf, they are contractually required to process data only on our instructions and to implement appropriate security measures.
3. Where analytics providers are located outside the UK or EEA, appropriate transfer safeguards are in place as described in Section 8. You may opt out of analytics tracking at any time via the Cookie Settings link in the Site footer.

Automated Decision-Making

1. We do not make decisions about you that produce legal or similarly significant effects solely by automated means, without human review, except where:
   • you have given your explicit consent; or
   • the processing is necessary for the performance of a contract with you and appropriate safeguards are in place.
2. In the limited cases where automated decision-making is used (for example, automated fraud screening on orders), you have the right to:
   • request human review of the decision;
   • express your point of view; and
   • contest the decision.
3. To exercise these rights, please contact us at privacy@oeconnection.com.

Security

1. We have implemented appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, alteration or disclosure. Access to personal data is restricted to staff, contractors and third parties who have a legitimate business need and are subject to confidentiality obligations.
2. All third-party processors are required by contract to implement equivalent security measures and to process data only on our documented instructions.
3. We have procedures in place to respond to suspected personal data breaches and will notify you and the relevant supervisory authority where we are legally required to do so.
4. While we take all reasonable precautions, transmission of data over the internet cannot be guaranteed as completely secure. Any transmission is at your own risk.

Marketing

1. We will only send you direct marketing communications by post, telephone, email or SMS where you have given your prior opt-in consent. You may withdraw that consent at any time by:
   • clicking the unsubscribe link in any marketing email;
   • emailing us at PartsPro@oeconnection.com; or
   • writing to us at the address in Section 16.
2. We will obtain your express opt-in consent before sharing your personal data with any company outside OEC or Mercedes-Benz UK Limited for their own marketing purposes.
3. Withdrawing marketing consent does not affect the lawfulness of processing that occurred before withdrawal, nor does it affect processing carried out on another legal basis (e.g. processing necessary to fulfil an existing order).

Your Data Protection Rights

1. Under the Data Protection Laws, you have the following rights in relation to your personal data:
   • Right of access – to obtain a copy of the personal data we hold about you and information about how we use it (a "data subject access request").
   • Right to rectification – to have inaccurate or incomplete data corrected.
   • Right to erasure – to request deletion of your personal data where there is no lawful basis for us to continue holding it. Note that legal obligations may require us to retain certain data.
   • Right to restriction – to ask us to pause processing of your data while we address an accuracy dispute or objection.
   • Right to object – to object to processing based on our legitimate interests (including direct marketing). We will comply with direct marketing objections immediately and without requiring justification.
   • Right to data portability – to receive your personal data in a structured, commonly used, machine-readable format and to have it transferred directly to another controller, where technically feasible.
   • Right to withdraw consent – where we rely on consent, to withdraw it at any time without affecting the lawfulness of prior processing.
   • Rights related to automated decisions – to request human review of, and to contest, any decision made about you solely by automated means. See Section 12.
2. To exercise any of these rights, please contact us at privacy@oeconnection.com. We will respond within one month of receipt. Complex or multiple requests may take up to three months; we will notify you if this is the case.
3. We may need to verify your identity before processing your request. This is a security measure to ensure personal data is not disclosed to an unauthorised person. We will not ordinarily charge a fee, but may do so where requests are manifestly unfounded or excessive.

Contact Us

1. If you have any questions about this Policy, wish to exercise your rights, or wish to raise a complaint, please contact us:
   • Email: privacy@oeconnection.com
   • Post: PartsPro, OEConnection Limited, Construction House, Winchester Road, Burghclere, Newbury, RG20 9EQ, England
   • Data Protection Representative (EU): Justyna Sorn, OEC Sp. z o.o, Wadowicka 3A, 30-347 Krakow, Poland
2. If you are contacting us about the Site specifically (e.g. marketing opt-outs or account queries), you may also email PartsPro@oeconnection.com.

Right to Complain to a Supervisory Authority

1. You have the right to lodge a complaint with a data protection supervisory authority if you believe we have not handled your personal data lawfully. The relevant authorities are:
   • UK: Information Commissioner's Office (ICO) – ico.org.uk – 0303 123 1113
   • EU: The European Data Protection Board (EDPB) and the data protection authority in your EU member state of residence or place of work.
2. We would, however, appreciate the opportunity to address your concerns before you contact a supervisory authority.

Links to Other Websites

1. The Site may contain links to third-party websites or applications. This Policy applies only to mb-vanspartspro.co.uk. When you follow a link to another website, you should read that site's own privacy policy. We have no control over third-party sites and are not responsible for their privacy practices.

Changes to This Policy

1. We may update this Policy from time to time to reflect changes in law, technology or our business. Where we make material changes, we will notify you by posting an updated Policy on the Site and, where appropriate, by email. Changes take effect 7 days after publication unless law requires an earlier date.
2. If we wish to process your previously collected personal data for a new purpose that is incompatible with the original purpose, we will provide prior notice and, where required by law, seek your consent.
3. The current Policy is always available at Cookies Policy.