PARTSWAREHOUSE PRIVACY POLICY

1. Introduction

This privacy policy ("Privacy Policy") describes how VacPartsWarehouse.com LLC, doing business as PartsWarehouse ("PartsWarehouse," "we," "us," or "our"), collects, uses, and discloses information about visitors to and customers of the website located at www.partswarehouse.com (the "Site"), and about persons who communicate with us by email, telephone, or text message in connection with the Site or our products. This Privacy Policy is incorporated into our Terms of Service ("Terms"), where a defined term is undefined in this Privacy Policy it shall have the meaning as set forth within the Terms.

By accessing the Site or communicating with us through the channels described above, you acknowledge that you have read this Privacy Policy.

2. Scope of This Policy

This Privacy Policy applies to information we collect from and about visitors and customers located within the United States and Canada. The Site is not directed to, and does not knowingly collect personal information from, residents of any other country or jurisdiction.

3. Information We Collect

3.1 Information You Provide Directly

We collect information you provide directly to us when you create an account, place an order, contact customer service, complete a form on the Site, or otherwise communicate with us. This information may include:

Name, email address, mailing address (billing and shipping), telephone number.
Payment information (credit or debit card number, billing address, and CVV). Payment information is collected through our payment processor and is not stored on our systems.
Federal Tax Identification Number, if you claim tax-exempt status.
Order history, return history, and customer-service correspondence.
Account credentials (username and password).
Any other information you choose to provide in messages, surveys, reviews, or product inquiries.

3.2 Information Collected Automatically

When you visit the Site, we automatically collect certain information about your visit and your device, including:

Internet Protocol (IP) address.
Browser type, browser version, and operating system.
Device type and screen resolution.
Approximate geographic location (city or region level, derived from IP address).
Pages viewed, time spent on each page, links clicked, search queries entered on the Site, products viewed, items added to cart, and orders placed.
Referring website or source (for example, whether you arrived from a search engine, an advertisement, or a direct link).
Date and time of your visit.
Error and performance data related to your interaction with the Site.

This information is collected through cookies and similar technologies as described in Section 5 below.

3.3 Information from Third Parties

We may receive information about you from third parties in limited circumstances:

From our payment processors, confirmation of payment authorization or decline.
From shipping carriers, tracking and delivery status information.
From advertising platforms (Google, Microsoft), aggregate and modeled data about advertising performance.
From product manufacturers, in the course of obtaining warranty service or technical support for products you have purchased.

3.4 Categories of Personal Information

For purposes of the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and similar state privacy laws, the categories of personal information we collect are:

Identifiers (name, address, email, IP address, account identifier, order identifier).
Customer records (name, address, telephone number, payment information through our payment processor).
Commercial information (transaction history, products viewed, products purchased, returns).
Internet and other electronic network activity information (Site usage, search queries, click data).
Geolocation data (approximate, IP-derived; not precise geolocation).
Inferences drawn from the foregoing to characterize your interests for advertising and product-recommendation purposes.

4. How We Use Information

We use the information we collect for the following purposes:

To operate the Site, process orders, fulfill purchases, provide any associated or requested services, and provide customer service.
To communicate with you about your orders, returns, and inquiries.
To send transactional emails (order confirmations, shipping notifications, return acknowledgments) and order-related text messages (such as shipping updates) where you have provided a mobile telephone number.
To send marketing emails and, where you have consented, marketing text messages about products, promotions, and offers.
To measure and improve the performance of the Site, including detecting errors and bugs and understanding aggregate usage patterns.
To measure the effectiveness of our advertising and to deliver advertising to you on third-party platforms.
To detect, prevent, and investigate fraud, unauthorized access, and other unlawful activity.
To comply with legal obligations, including tax reporting and responding to lawful requests by public authorities.
To enforce our Terms and other agreements with you.
To facilitate corporate transactions (merger, acquisition, financing) where personal information may be transferred as part of business assets, subject to this Privacy Policy.

5. Cookies and Similar Technologies

5.1 What We Use

We use cookies, web beacons, pixels, and similar technologies on the Site. We use them in five categories:

Strictly Necessary. Required for the Site to function, including session management, security, fraud detection, and load balancing. These technologies cannot be disabled without breaking the Site. Examples: Cloudflare security cookies (__cf_bm, cf_clearance), shopping cart session cookies, authentication cookies.
Preferences. Remember your settings and choices on the Site (for example, your preferred shipping zip code). Examples: New Relic Browser agent for performance monitoring.
Statistics (Analytics). Help us understand how visitors use the Site so we can improve it. Examples: Google Analytics 4 (cookie names _ga, _ga_*, _gid).
Marketing. Used to measure advertising effectiveness and to deliver advertising relevant to your interests on third-party sites. Examples: Google Ads (cookie names _gcl_au, _gcl_aw, NID, IDE); Microsoft Bing Universal Event Tracking (cookie names _uetsid, _uetvid, MUID).
Cookieless analytics. We use Cloudflare Web Analytics, which does not set cookies but collects aggregate visit data through a server-side beacon.

5.2 Third Parties to Whom We Disclose Information Through These Technologies

The following third-party service providers receive information from our use of cookies and similar technologies:

Google LLC (Google Analytics 4 and Google Ads). Google receives information about your use of the Site for the purposes of measurement, analytics, and targeted advertising. Specifically:
— Google Analytics 4 with Google Signals. We have enabled Google Signals in our GA4 property. Google Signals enriches our analytics with cross-device behavior and aggregate demographic and interest information derived from users who have signed into Google services and opted in to Ads Personalization. Google may also use the resulting data for its own advertising and measurement purposes.
— Google Ads with Enhanced Conversions for Web. When you complete a purchase, our site transmits to Google a SHA-256 hashed (one-way encrypted) version of the email address you provided at checkout, along with conversion details. Hashing occurs in your browser before the data is sent. Google uses this information to match conversions to advertising interactions for measurement purposes.
— Google Ads conversion tracking and remarketing. Google receives conversion events and audience signals to measure advertising effectiveness and to enable us to show advertising to prior visitors of our Site on Google services and partner websites.
Google's privacy practices are described at https://policies.google.com/privacy. You can manage Google ad personalization at https://adssettings.google.com. You can opt out of Google Analytics tracking on this Site at any time using the "Your Privacy Choices" link in the Site footer; if you have Global Privacy Control enabled in your browser, this opt-out applies automatically.
Microsoft Corporation (Microsoft Advertising / Bing UET). Microsoft may use this information to measure advertising effectiveness and to deliver targeted advertising. Microsoft's privacy statement is at https://privacy.microsoft.com/en-us/privacystatement. You can manage Microsoft ad personalization at https://account.microsoft.com/privacy/ad-settings.
New Relic, Inc. (application performance monitoring). New Relic processes performance and error data on our behalf as a service provider; it does not use this data for advertising or other independent purposes. New Relic's privacy policy is at https://newrelic.com/termsandconditions/privacy.
Cloudflare, Inc. (content delivery, security, cookieless analytics). Cloudflare processes traffic data on our behalf as a service provider for the purpose of delivering and securing the Site. Cloudflare's privacy policy is at https://www.cloudflare.com/privacypolicy/.
Twilio Inc. / SendGrid (transactional email, marketing email, and SMS / text messaging). Twilio and its SendGrid service process email and text-message delivery and engagement data on our behalf as a service provider, including email-open events, link-click events, bounce and unsubscribe events, and SMS delivery status. Twilio's privacy notice is at https://www.twilio.com/en-us/legal/privacy.

5.3 Your Choices Regarding Cookies

You have several ways to control how cookies and similar technologies are used on the Site:

Cookie preference center: Click the "Your Privacy Choices" link in the footer of any page to open the preference center, where you can accept or reject each non-essential cookie category.
Global Privacy Control: If your browser or browser extension transmits a Global Privacy Control (GPC) signal, we will treat that signal as an opt-out of the sale or sharing of your personal information and as an opt-out of targeted advertising. We honor GPC automatically; you do not need to take any additional action on the Site.
Browser settings: Most browsers allow you to block or delete cookies through your browser settings. Note that blocking strictly-necessary cookies will impair the functioning of the Site.
Industry opt-out tools: You may opt out of interest-based advertising from participating companies through the Network Advertising Initiative at www.networkadvertising.org/choices and through the Digital Advertising Alliance at www.aboutads.info/choices.

6. How We Disclose Information

We disclose personal information in the following circumstances:

Service providers and processors. We disclose information to vendors who perform services for us, including payment processing (PayPal/Braintree, Authorize.net), shipping (UPS, FedEx, USPS, DHL), email and text-message delivery (Twilio/SendGrid), customer-service infrastructure, web hosting, content delivery and security (Cloudflare), application performance monitoring (New Relic), advertising platforms (Google, Microsoft), accounting, and legal services. These vendors are contractually required to use the information only for the services they provide to us.
For advertising purposes ("sharing" under the California Privacy Rights Act). We disclose personal information to Google and Microsoft for cross-context behavioral advertising purposes. Specifically, we disclose: (i) to Google, identifiers, internet and electronic network activity, and inferences for analytics and advertising measurement, including enriched cross-device and demographic data through the Google Signals feature; (ii) to Google, at the moment of purchase, a SHA-256 hashed (one-way encrypted) version of the email address you provided at checkout, along with conversion details, through Google's Enhanced Conversions for Web feature; and (iii) to Microsoft, identifiers, internet and electronic network activity, and inferences for advertising measurement and audience-building through Microsoft Advertising. Under the California Privacy Rights Act, each of these disclosures constitutes "sharing" of personal information for cross-context behavioral advertising. You have the right to opt out of all of this sharing through the methods described in Section 9.2 below.
Manufacturers and distributors. To fulfill orders, process returns, and address product issues, we may share your name, contact information, and order details with the original equipment manufacturer or distributor of products you have purchased.
Legal compliance and protection of rights. We may disclose information in response to subpoenas, court orders, or other legal process; to comply with government inquiries; to enforce our agreements; to investigate or prevent fraud; and to protect the rights, property, or safety of PartsWarehouse, our customers, or others.
Corporate transactions. In connection with a merger, acquisition, financing, reorganization, dissolution, or sale of all or substantially all of our assets, personal information may be transferred to the acquiring party as part of the transaction, subject to the same protections set forth in this Policy.

Sale of personal information. We do not "sell" personal information for monetary consideration. However, as noted above cross-context behavioral advertising purposes are treated as "sharing or selling" or targeted advertising under the California Consumer Privacy Act and other similar state laws, and you may have the right to opt out of these disclosures.

7. How Long We Keep Information

We retain personal information for as long as needed to fulfill the purposes described in this Privacy Policy and as required to comply with our legal obligations. Specific retention periods:

Account information: for the life of your account, plus seven years after account closure (for tax and warranty purposes).
Order and transaction history: seven years from the date of the transaction (for tax and warranty purposes).
Customer service correspondence: three years from the date of the last communication.
Marketing email engagement data: three years, or until you unsubscribe, whichever is later.
Analytics and advertising cookie data: as configured in each platform (Google Analytics 4: 14 months; Microsoft Bing UET: 13 months).
Consent records: 36 months from the date of consent or last change.
Backups and disaster recovery copies: rotated on a 90-day cycle; deleted backups may temporarily contain personal information until the next rotation cycle completes.

8. How We Protect Information

We maintain administrative, technical, and physical safeguards designed to protect personal information against accidental loss, unauthorized access, alteration, and disclosure. Please be aware that no security measure is perfect; we cannot guarantee that personal information will never be subject to a security incident. If a security incident affects your personal information, we will notify you and any applicable regulator as required by law.

9. Your Rights — United States Residents

Depending on the state in which you reside, you may have specific rights regarding your personal information. The sections below describe those rights and how to exercise them.

9.1 Rights Available to All Users

Regardless of your state of residence, you may:

Access information we hold about you by logging into your account and reviewing the "My Account" page.
Update your account information directly through the "My Account" page.
Unsubscribe from marketing email by clicking the unsubscribe link at the bottom of any marketing email or by contacting us at [email protected].
Manage cookies and similar technologies through the "Your Privacy Choices" link on the Site footer.
Contact us with questions or concerns at [email protected] or (866) 243-2721.

9.2 California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act ("CCPA"), as amended by the California Privacy Rights Act ("CPRA"), where applicable you may have the following rights:

The right to know what categories of personal information we have collected about you, the sources of that information, the purposes for which we use it, the categories of third parties to whom we disclose it, and the specific pieces of personal information we hold about you.
The right to delete personal information we have collected from you, subject to certain exceptions (for example, where retention is required to complete a transaction, to detect security incidents, or to comply with legal obligations).
The right to correct inaccurate personal information we hold about you.
The right to opt out of the "sale" and "sharing" of your personal information. We do not sell personal information for monetary consideration. We do share personal information for cross-context behavioral advertising, as described in Section 6 above; you may opt out of this sharing.
The right to limit our use and disclosure of sensitive personal information. As noted in Section 3.4, we do not collect sensitive personal information.
The right not to be subjected to discrimination for exercising any of these rights.

How to exercise California rights: Click the "Your Privacy Choices" link in the Site footer to access the cookie preference center and the rights-request form. You may also submit a request by email to [email protected] or by telephone at (866) 243-2721.

Global Privacy Control: If your browser transmits a Global Privacy Control signal, we will treat that signal as an opt-out of the sale and sharing of your personal information.

California "Shine the Light": California Civil Code Section 1798.83 permits California residents to request information about our disclosures of personal information to third parties for those third parties' direct marketing purposes. We do not make such disclosures.

9.3 Texas Residents (TDPSA)

If you are a resident of Texas, under the TDPSA where applicable you may have the following rights:

Confirm whether we are processing your personal data.
Access the personal data we are processing about you.
Correct inaccuracies in your personal data.
Delete your personal data.
Obtain a portable copy of your personal data.
Opt out of the sale of personal data, the processing of personal data for targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects.

To exercise these rights, submit a request to [email protected] or call (866) 243-2721.

9.4 Additional US Residents

If you are a resident of one of the states (Virginia, Colorado, Connecticut, Utah, Indiana, Iowa, Kentucky, Tennessee, Rhode Island, Delaware, New Hampshire, New Jersey, Maryland, Minnesota, Montana, Nebraska, Florida, and Oregon) and where applicable, you may have the following rights to:

Confirm whether we are processing your personal data and access that data.
Correct inaccuracies.
Delete your personal data.
Obtain a portable copy of your personal data.
Opt out of the sale of personal data, the processing of personal data for targeted advertising, and (in most listed states) profiling in furtherance of decisions that produce legal or similarly significant effects.

To exercise these rights, submit a request to [email protected] or call (866) 243-2721.

10. Your Rights — Canadian Residents

10.1 All Canadian Residents (PIPEDA)

If you are a resident of Canada, the federal Personal Information Protection and Electronic Documents Act ("PIPEDA") gives you rights regarding personal information we hold about you. Any questions or concerns regarding handling of personal information under Canada's PIPEDA, or related to revocation of consent to collect, process, transfer, or disclose your personal information should be directed by email to [email protected] or (866) 243-2721.

11. Children

Users of the Site must be 18 years of age or older. We do not knowingly collect personal information from children under the age of 13 years old. We do not knowingly sell or share the personal information of minors under 16 for cross-context behavioral advertising or targeted advertising purposes.

If you believe we have collected personal information from a child please contact us at [email protected] immediately

12. Do Not Track and Global Privacy Control

Global Privacy Control (GPC): We honor Global Privacy Control signals transmitted by your browser or browser extension. When we detect a GPC signal, we treat it as an opt-out of (a) the sale of your personal information, (b) the sharing of your personal information for cross-context behavioral advertising, and (c) the processing of your personal information for targeted advertising. This opt-out is applied automatically; you do not need to take any additional action.

Do Not Track (DNT): Some Internet browsers may be configured to send "Do Not Track" signals to the online services that you visit. We currently do not respond to "Do Not Track" or similar signals. To find out more about "Do Not Track," please visit http://www.allaboutdnt.com.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, in the law, or in the technologies we use. We will post any updated Policy on the Site with a revised Effective Date. You must agree to our changes prior to using our Site or purchasing any products.

14. Contact Information

For questions about this Privacy Policy, to exercise any of your rights described above, or to contact our designated Privacy Officer:

By mail: PartsWarehouse Privacy Office, 2578 State Highway 276, Rockwall, TX 75032, USA

By telephone: (866) 243-2721

By email: [email protected]

Effective Date: June 4, 2026