Privacy Policy
1. Data Controller
The data controller for your personal information is:
Part Collector Ltd
Bulgaria
Contact: partcollector.com/#contact — select Legal & Privacy
For any privacy or GDPR-related requests, please use our contact form (select Legal & Privacy).
2. Data We Collect
Part Collector operates exclusively within Discord. We collect the minimum data required to operate the Community. Buyers’ search activity, messages, and communications are handled entirely through Discord and are not stored by us. However, to enforce the Community Terms of Service and maintain a complete legal record for dispute resolution, we record the minimum data listed below for all users (both buyers and sellers) who interact with the Community.
| Category | Data Points | Source | Who |
|---|---|---|---|
| Discord Identity | Discord user ID, username | Discord bot interaction at server entry | Sellers |
| Seller Payment Email | PayPal email address (entered by the seller) | Seller-provided | Sellers only |
| Business / Tax Identity | VAT/MVA registration number, ABN, NZBN, company name, tax country code; seller type classification (Company or Private); the EU OSS declaration; declared small-business exemption (national scheme, or EU SME “EX” number) and the date it was declared | Seller-provided and stored exactly as typed; not checked by us | Business sellers (EU, UK, Norway, Australia, New Zealand — as applicable) |
| Seller Profile | Shipping origin country, preferred currency, weight unit, custom shipping rates | Seller-provided during Shipping Setup in Discord | Sellers only |
| Subscription Records | Subscription tier, billing cycle, PayPal subscription ID, payment amounts, payment dates | PayPal subscription webhooks | Sellers only |
| Seller Listing Data | Part descriptions, photographs, prices, shipping terms of listed items | Seller-provided when creating listings | Sellers only |
| Consent Records | Discord user ID; Discord username at the time of acceptance; exact UTC timestamp of acceptance; policy version accepted; URLs of all policy documents presented at the time of acceptance; and — where available following a completed payment — the verified PayPal email address associated with the account. Per-transaction non-refundable payment acknowledgements are recorded separately for each subscription purchase. | Community bot interactions (TOS acceptance button); PayPal payment confirmation webhook (PayPal email, retroactively linked after first completed payment) | All Community users (buyers and sellers) |
| Buyer Payment Email | PayPal email address of the buyer, obtained from the PayPal payment confirmation when an invoice is paid | PayPal Orders API payment confirmation; stored into the buyer’s Terms of Service consent record for dispute resolution purposes | Buyers who have completed at least one payment |
| Buyer Tax Data | VAT/MVA registration number, VAT country code, company name (for B2B reverse-charge transactions) | Buyer-provided during checkout or Setup My Country; used to validate B2B VAT exemptions | Buyers who opt to provide VAT details for business-to-business purchases |
| Tax Audit Log | Per-order: invoice ID, seller and buyer IDs and countries, tax scheme applied, VAT rate, VAT amount, subtotal, shipping cost, total, currency, exemption reason, the buyer's and the seller's VAT identification numbers used on the sale, and any EU customs duty charged | Generated automatically at checkout for every transaction; stored with the order so it can be explained, and not reported to any tax authority | All Community users (buyers and sellers) — per-transaction |
We do not collect or store PayPal OAuth credentials, credit card numbers, or banking details. All payment processing is handled directly by PayPal.
3. Lawful Basis for Processing
| Purpose | Lawful Basis (EU GDPR) |
|---|---|
| Account and profile data (seller or buyer: PayPal email, VAT details, tax scheme flags, shipping profile, listings, address) | Until the user deletes the account (“⚙️ Setup Shipping” → “Delete Account”, or “⚖️ Legal & Privacy” → “Request Deletion”), or upon written request |
| Per-order tax decision records | Kept with the order for as long as the account exists. There is no statutory retention period: Part Collector is a calculator, not the supplier, so no tax archive is kept |
| Subscription and payment records | For as long as the account exists. The payment itself is handled by PayPal and the tier subscription is billed by Discord under their own records |
| Terms of Service consent and tier-acknowledgment records | For as long as the account exists, and beyond it only while needed to establish, exercise or defend a legal claim |
| Discord identity (user ID, username) | Until the account is deleted |
| Chat messages exchanged through the messenger | Until either side deletes them. Deletion is immediate — nothing is held back for a payment dispute: we do not monitor, open or close disputes |
4. How We Use Your Data
- To create PayPal payment links for your subscription billing (where Part Collector is the merchant and receives the tier fee via PayPal);
- To create PayPal checkout orders for purchases from sellers, using the seller’s verified PayPal email as the payee so the buyer pays the seller directly via PayPal. Funds go directly to the seller’s PayPal account and never pass through Part Collector; Part Collector takes no fee on these orders;
- To automatically calculate the tax on a sale from the declarations the seller has made and the figures the seller accepted or entered — EU VAT, EU OSS, IOSS, UK VAT, Norway VOEC, GST and the rest;
- To remove or apply VAT on invoices for VAT-registered business sellers and buyers, including B2B reverse-charge exemptions;
- To keep a record of how the tax on each order was calculated, so the order, the invoice and any question about it can be answered. It is not a statutory tax archive and is not reported to any tax authority;
- To display and manage your seller shipping profile, rates, tax scheme settings, and active listings;
- To keep your subscription and payment records while your account exists (the payment itself is handled by PayPal, and the tier subscription is billed by Discord);
- To enforce Community rules, resolve disputes, and prevent abuse;
- To respond to your support requests and legal rights enquiries;
- For buyers who complete a payment: to link the PayPal email address from the payment confirmation to your Community Terms acceptance record, solely for the purpose of dispute resolution and enforcement of the Terms of Service you accepted.
5. Data Sharing
We share personal data only as strictly necessary:
- PayPal: We use PayPal for two distinct purposes. (1) Subscriptions: we use the PayPal Subscriptions/Billing API to collect tier fees — here Part Collector is the merchant and receives the payment. (2) Orders: we use the PayPal Orders API to create checkout orders for purchases from sellers, using the seller’s verified PayPal email as the payee — the buyer pays the seller directly, funds go straight to the seller’s PayPal account, and Part Collector neither receives nor touches those funds and charges no fee. Payment capture and processing in both cases is governed entirely by PayPal’s own Privacy Policy;
- Brreg (Brønnøysund Register Centre): Norwegian sellers’ organisation numbers are submitted to the Brreg API in real-time for MVA number validation. See Brreg’s Privacy Policy;
- ECB (European Central Bank): We fetch daily exchange rates from the ECB for currency conversion. No personal data is transmitted;
- OCI (Oracle Cloud Infrastructure): All Tool data is hosted on OCI servers in Turin, Italy (EU). See Oracle’s Privacy Policy;
- Cloudflare: Our website (partcollector.com) is served via Cloudflare for security and CDN. See Cloudflare’s Privacy Policy;
- Legal Authorities: Where we are legally obliged to disclose data (e.g., court orders, government requests).
We do not sell your personal data to third parties, use it for advertising profiling, or share it with any other party.
6. Data Storage & Location
All personal data collected by Part Collector is stored exclusively on servers located within the European Economic Area (OCI Turin, Italy). We do not transfer your personal data outside the EEA for our own processing purposes.
PayPal operates as an independent data controller under its own privacy policy; please refer to it for information about its own data storage and international transfer practices.
7. Data Retention
| Data Type | Retention Period |
|---|---|
| Account and profile data (seller or buyer: PayPal email, VAT details, tax scheme flags, shipping profile, listings, address) | Until the user deletes the account (“⚙️ Setup Shipping” → “Delete Account”, or “⚖️ Legal & Privacy” → “Request Deletion”), or upon written request |
| Per-order tax decision records | Kept with the order for as long as the account exists. There is no statutory retention period: Part Collector is a calculator, not the supplier, so no tax archive is kept |
| Subscription and payment records | For as long as the account exists. The payment itself is handled by PayPal and the tier subscription is billed by Discord under their own records |
| Terms of Service consent and tier-acknowledgment records | For as long as the account exists, and beyond it only while needed to establish, exercise or defend a legal claim |
| Discord identity (user ID, username) | Until the account is deleted |
| Chat messages exchanged through the messenger | Until either side deletes them. Deletion is immediate — nothing is held back for a payment dispute: we do not monitor, open or close disputes |
When a seller deletes their account via the Discord bot (“⚙️ Setup Shipping” → “Delete Account”), all seller profile data, listings, shipping credentials, and PayPal details are permanently and immediately deleted. Nothing is retained to satisfy a tax-accounting obligation: Part Collector is a calculator, not the supplier, so it keeps no tax archive and no chat archive.
8. Your Rights
Under EU GDPR you have the following rights:
Request a copy of the personal data we hold about you.
Ask us to correct inaccurate or incomplete data.
Sellers: Use “Delete Account” in the Discord bot for immediate self-service deletion of all profile, listing, and PayPal data. Buyers: Submit a written request via our contact form (select Legal & Privacy). Note: the Terms of Service consent records may be kept beyond the erasure request where necessary to establish, exercise or defend a legal claim (Art. 17(3)(e) GDPR). Nothing else is kept — there is no statutory tax archive, no chat archive and no dispute hold.
Request that we restrict processing in certain circumstances.
Receive your listing and seller data in a machine-readable format. Use the Export feature in the bot or contact us.
Object to processing based on legitimate interests.
Withdraw any consent you have given at any time without affecting prior lawful processing.
Lodge a complaint with the CPDP (Bulgaria) or your national supervisory authority (EU).
To exercise any of the above rights, use the self-service “Delete Account” feature in the Discord bot, or submit a request via our contact form (select Legal & Privacy). We will respond within 30 days.
9. Cookies and Tracking
The Part Collector website (partcollector.com) uses minimal, essential-only cookies:
- Session cookies: Temporary cookies for secure navigation; deleted when you close your browser.
- Cloudflare security cookies: Set by our CDN provider for DDoS protection and security; see Cloudflare’s Privacy Policy.
We do not use advertising, tracking, or analytics cookies. No third-party tracking scripts are deployed on our site.
10. Children’s Privacy
Our Community is not directed at persons under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with data, please contact us via our contact form (select Legal & Privacy) and we will delete it promptly.
11. Security
We employ industry-standard security measures including encrypted data storage, access controls, and strict internal data handling policies. While we take all reasonable precautions, no system is completely immune to breach. In the event of a notifiable data breach, we will inform the relevant supervisory authority within 72 hours and notify affected individuals where required by law.
12. Changes to This Policy
We may update this Privacy Policy periodically. Significant changes will be notified via the Discord server and/or DM at least 14 days before taking effect. The current Policy is always accessible at partcollector.com/privacy.
13. Contact & Supervisory Authority
For privacy-related enquiries: partcollector.com/#contact — select Legal & Privacy
As a Bulgaria-registered company, our lead data protection supervisory authority is the Commission for Personal Data Protection (CPDP). If you believe your rights have been violated, you may contact the CPDP at cpdp.bg.
If you are in the European Union, you may also contact your national data protection authority. A list of EU authorities is available at edpb.europa.eu.