Last updated: 3 June 2026

This Privacy Policy explains how JGB Auto Parts (the “Business”, “we”, “us”, or “our”) collects, uses, and protects personal data when you visit or use the website https://www.jgbautoparts.com.mt (the “Website”), create an account, purchase products, or subscribe to our newsletter.

We are committed to protecting your privacy and processing your personal data in accordance with Regulation (EU) 2016/679 (GDPR) and the Data Protection Act (Chapter 586 of the Laws of Malta).

1. Data Controller

The data controller is JGB Autoparts, a business operated by a sole trader. The details of the business are as follows:

Registered address: 130 Triq il-Wied Ta’ l-Imsida, Malta
Email address: [email protected]
Telephone: +356 2134 6669

Please note that JGB Auto Parts has not appointed a Data Protection Officer (DPO), as the business is not legally required to do so under the provisions of the General Data Protection Regulation (GDPR). Should you have any queries regarding data protection, please contact us using the details provided above.

2. Personal Data We Collect and How We Collect it

Personal data means any information about an individual from which that person can be identified. We collect the following categories of personal data directly from you during the following activities on our Website:

a. Account Registration

When you create an account on our Website, we collect:

• First name and last name
• Email address
• Phone number
• Password (stored in one-way encrypted/hashed form)

b. Orders and Purchases

When you place an order, we collect:

• Billing and delivery address
• Payment-related details such as payment method chosen and transaction ID returned after successful payments (card details are processed securely by our payment service providers; we do not store full card details)
• Order history and transaction information

c. Newsletter Subscription

When you subscribe to our newsletter, we collect your email address. Subscribers are eligible for a 10% discount coupon upon sign-up.

d. Technical and Usage Data

We may automatically collect limited technical data such as:

• IP address
• Device and browser information
• Website usage data (via cookies, where applicable)

Please refer to our Cookie Policy for further details.

For the avoidance of doubt, the numberplate search functionality available on our Website relies on vehicle technical data and does not involve or process any personal data.

3. Purposes and Legal Bases of Processing

When we process your personal data, we rely on the following legal bases:

• Performance of a contract: Where it is necessary to fulfil the terms of a contract that we are entering into, or have already entered into, with you.
• Legitimate interests: We may process your personal data when it is necessary to operate our business and pursue our legitimate interests, such as preventing fraud and ensuring a secure and high-quality customer experience. Prior to processing your personal data on this basis, we carefully assess and balance any potential effects on your rights and interests. We do not use your personal data for activities where our interests are outweighed by the impact on you, unless we have your explicit consent or are legally required or permitted to do so.
• Legal obligation: We may process your personal data to comply with applicable laws and will specify the relevant legal requirement when doing so.
• Consent: We use your personal data for specific purposes only with your explicit consent. You can withdraw consent at any time without affecting prior processing.

The table below demonstrates the purposes for which we process your personal data and the legal basis we rely on for each purpose:

Purpose	Legal Basis
Creating and managing user accounts	Contract performance
Processing orders and deliveries	Contract performance
Handling payments	Contract performance
Customer communications and support	Contract performance and Legitimate interest
Newsletter and promotional emails	Consent
Website security and fraud prevention	Legitimate interest
Compliance with legal obligations	Legal obligation

Certain personal data is required to for Users to create an account and for the Business to complete purchases and deliveries requested by Users. Failure to provide such data may prevent us from providing our services.

Certain information is collected to comply with our legal obligations, such as tax and invoicing requirements. In these cases, we are legally required to collect and retain the relevant data.

Other information such as newsletter subscriptions, marketing preferences, and optional profile details is entirely voluntary, and choosing not to provide it will not affect your ability to use our services.

4. Recipients of Personal Data

Your personal data may be shared only where necessary with the third parties set out below:

• Payment service providers
• Delivery and logistics providers
• IT hosting and website service providers
• Newsletter service providers
• Professional advisers, where required

We may also share personal data with legal authorities where we may be required by law.

Every recipient handles personal data with contractual confidentiality and data protection requirements. Our third-party service providers are not authorised to use your personal data for their own interests; they are only allowed to process it for specific purposes and must follow our directions.

5. International Transfers

Our Website’s servers and primary databases are hosted within the European Union. While we do not transfer personal data outside the EEA, we make use of certain thirdparty service providers that may process non-personal data outside the EU such as product-related information, technical identifiers or anonymised usage data.

Certain providers outside the EU such as payment providers, may process a user’s email address and order total only when the user selects their chosen payment method. In the event that such transfers become necessary, they will be conducted strictly under the following conditions:

• To countries subject to an adequacy decision by the European Commission, or
• Using appropriate safeguards such as standard contractual clauses approved for use by the European Commission , or
• Using any other appropriate safeguards as detailed in the GDPR.

6. Data Retention

Your personal data will be kept only as long as needed to accomplish the purposes for which it was collected, including meeting legal, regulatory, tax, accounting, or reporting obligations, such as:

• Account data: for the duration of the account and thereafter as required by law
• Order and transaction data: in accordance with accounting and tax obligations
• Newsletter data: until you unsubscribe
• Technical data: for limited periods required for security and analytics

If you file a complaint or we think there might be legal action related to our relationship, we may keep your personal information for a longer time.

We set data retention periods based on the type and sensitivity of personal data, potential risks of unauthorised use or disclosure, processing purposes, alternative options, and relevant legal or regulatory requirements.

7. Your Rights under the GDPR

Under the GDPR, you have the following rights in relation to your personal data:

• Request access to your personal data: This allows you to obtain a copy of the personal data that we hold about you.
• Correction of inaccurate or incomplete data: You may request that we update and correct any incomplete or inaccurate personal data maintained about you.
• Request the erasure of your data: You can ask us to erase your data if there is no longer a valid reason for us to keep or process your personal information.
• Restrict or object to processing: this enables you to request us to suspend the processing of your personal data if you want us to establish the data’s accuracy, where our use of data is unlawful by you do not wish us to erase it, where you need us to hold the data even if we no longer need it as you need it to establish, exercise or defend legal claims.

You can also request to object to processing your personal data where we rely on a legitimate interest or those of a third party as the legal basis for processing your data.

• You have the right to request data portability, which allows you to request we transfer your personal data directly to you or direct its transfer to a third party in a structured, commonly used, and machine-readable format.
• Withdraw consent at any time where we rely on consent to process your personal data.

To confirm your identity and protect your data, we may ask for specific information before granting access or processing your request. This helps ensure only authorised individuals receive personal data.

Additionally, you also have the right to lodge a complaint with the Information and Data Protection Commissioner (IDPC) in Malta. However, before doing so please make sure you have first made your complaint to us or asked us for clarification if there is something you do not understand.

You may contact us about this privacy policy or about the use of your personal data or if you want to exercise your privacy rights, at the following details:

• Email address: [email protected]
• Postal address: 130 Triq il-Wied Ta’ l-Imsida, Malta
• Telephone number: +356 2134 6669

8. Security Measures

We implement appropriate technical and organisational security measures to protect personal data against unauthorised access, loss, or misuse. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

9. Automated Decision-Making

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on users.

10. Cookies

Please refer to our Cookie Policy for detailed information on the types of cookies used on our Website and how you can manage your preferences.

11.Third-party links

This Website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third-parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our Website, we encourage you to read the privacy policy of every website you visit.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The latest version will always be published on the Website.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us, for example a new address or email address.