Privacy and cookies
This shop stores as little as possible. Below is exactly what is kept on your device, what goes into our database when you order, why, and for how long.
Last updated: 14 October 2026
What we store on your device
The law makes no distinction between cookies and other browser storage: the same rules apply to localStorage. That is why everything is listed together here.
| Name | Type | Purpose | Retention |
|---|---|---|---|
| NEXT_LOCALE | Cookie | Remembers whether you view the site in Dutch or English. | Until you close your browser (session cookie). |
| caro-cart | localStorage | Your shopping cart: which items you selected and how many. | Until you empty the cart or clear your browser data. |
| caro-checkout | localStorage | The delivery details you enter yourself, so you do not have to retype them. | Until you clear your browser data. |
| caro-vehicle | localStorage | The car you looked up, so we can show parts that fit it. | Until you choose another car or clear your browser data. |
| theme | localStorage | Your choice of light or dark theme. | Until you clear your browser data. |
| caro-cookie-notice | localStorage | Remembers that you dismissed the notice at the bottom about storage, so it does not come back. | Until you clear your browser data. |
Why we do not ask for consent
Consent is required for storage that is not needed to make the site work — think of measuring visitor behaviour or advertising. Everything in the table above is either necessary for the shop to function, or a choice you made yourself. A legal exception covers that, so we do not have to ask. We also think it is misleading to ask permission for something you cannot refuse without the cart breaking. The bar you saw at the bottom of the screen therefore asks nothing: it only tells you what is on this page, and disappears once you dismiss it. Note that this rule is only about what is placed on your device; what we keep on our own server about an order falls outside it — that is further down.
We use no analytics, no advertising cookies, no social media buttons and no third-party trackers. The site also loads no fonts or scripts from external servers.
Personal data we process
As long as you are only browsing, we process no personal data. That changes at three moments:
- At checkout you enter your name, address, email address and optionally a phone number. We need these to deliver your order and issue an invoice.
- When you enter your postcode and house number at checkout, we use them to look up your street and town so you do not have to type them. You can always change both fields yourself.
- If you enter a licence plate, we send it to the Dutch RDW vehicle database to look up your car. A licence plate is personal data, which is why it never appears in a web address and is not kept in our logs.
What we keep on our own server
The table above is about your own device. When you place an order, data is also stored in our database. It sits with our hosting provider in the Netherlands; we do not hand it to another party.
| What | Purpose | Retention |
|---|---|---|
| Your order: name, address, email address, phone number if given, and what you ordered | Needed to carry out the purchase agreement — delivering, keeping you informed and answering later questions. | Seven years. An order is also an accounting record, and the Dutch tax authority sets that term. |
| The invoice for your order, with amounts and VAT | Legal obligation: an invoice has to be kept. | Seven years (statutory retention). |
| For a code valid once per customer: your email address, the code and your order number | Without this we cannot tell whether you already used a one-off code. It is the only way to enforce that rule fairly. | As long as the discount code exists, and at most a year after that. |
| Your review: two ratings, your text and the name you chose to show | To display it on the site. We keep your email address with it, so we know who is asking for removal and so the invitation is only sent once. | For as long as it is on the site. Ask us to remove it and we will. |
| Messages sent: your order confirmation and anything you send through the contact form | So we can check what was said if you come back to it. | Contact messages stay in the mailbox until they are dealt with; they do not end up in a separate list. |
We do not use your email address to send you advertising. There is no newsletter and no separate mailing list: your address is only used for the order you entered it with. Should that ever change, you will read it here first and we will ask you at checkout.
Parties that receive data from us
We do not sell your data and share it only where needed to fulfil your order:
- Our wholesaler — receives the details needed to deliver your parcel when you place an order.
- Stripe — handles your payment. We pass on only the amount and our order number, not your name, address or what you ordered. What you enter on the payment screen, such as your account or card number, goes straight to Stripe and your bank; it never reaches our shop.
- overheid.io — provides the RDW vehicle data. Receives the licence plate you enter, and nothing else about you.
- gratis-postcodedata.nl — looks up the street and town for your postcode. Receives only your postcode and house number and nothing else about you: the request goes through our server, so your IP address is not shared either.
- Our hosting provider — processes technical data such as your IP address in order to serve the site.
Your rights
You may request which data we hold about you, have it corrected or deleted, and object to the processing. Contact us to do so. If we cannot resolve it together, you can file a complaint with the Dutch Data Protection Authority.
Contact
Questions about your data? Get in touch with:
- Company name
- CaroParts
- Address
- Gildebongerd 2, 7038 DE Zeddam
- info@caroparts.nl
- Chamber of Commerce number
- 93396252
- VAT number
- NL005015784B71