1 Introduction

Welcome to Machine Parts Toolbox (“we,” “us,” or “our”). We operate the website located at www.machinepartstoolbox.com (the “Site”), an e-commerce platform powered by Magento Open Source that sells industrial machine parts, tools, and related equipment.

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our Site, create an account, place orders, or otherwise interact with us. Please read this policy carefully. By accessing or using our Site you agree to the terms described herein.

We are committed to protecting your privacy and maintaining transparency about our data practices. If you do not agree with this policy, please discontinue use of our Site.

2 Information We Collect

2.1 Information You Provide Directly

When you interact with our Site, you may voluntarily provide the following personal information:

• Account Registration: Full name, business name, email address, username, and password.
• Billing & Shipping Information: Street address, city, state/province, ZIP/postal code, country, and telephone number.
• Payment Details: Credit/debit card numbers, billing address, and expiration dates. Full card details are processed by our payment gateway and are not stored on our servers.
• Order Information: Products purchased, order quantities, special instructions, and order history.
• Communications: Messages, inquiries, support tickets, reviews, and feedback you submit to us.
• Business Information (B2B): Company name, tax identification number (TIN/EIN), reseller certificate, and purchasing authority details where applicable.

2.2 Information Collected Automatically

Our Magento-powered platform and associated services automatically collect certain information when you visit the Site:

• Log Data: IP address, browser type and version, operating system, referring/exit pages, date and time of visit, and pages viewed.
• Device Information: Device identifiers, hardware model, and mobile network information.
• Cookies & Tracking Technologies: Session cookies (required for shopping cart functionality), persistent cookies (saved preferences and “Remember Me” login), and analytics cookies. See Section 7 for full cookie details.
• Usage Data: Products viewed, search queries entered, items added to cart or wish lists, and navigation paths through the Site.
• Magento Session Data: Temporary session tokens (PHPSESSID) that maintain your shopping cart and login state.

2.3 Information from Third Parties

• Payment Processors: Transaction confirmation and fraud-screening signals from processors such as Stripe, Authorize.Net, or Braintree.
• Shipping Carriers: Delivery status updates from UPS, FedEx, USPS, and freight carriers.
• Analytics Providers: Aggregated behavioral data from Google Analytics or similar services.
• Tax Compliance Services: Address-validated tax data from services such as Avalara TaxJar, if used.

3 How We Use Your Information

3.1 Order Fulfillment & Customer Service

• Processing, fulfilling, shipping, and tracking your orders.
• Sending order confirmations, invoices, shipping notifications, and delivery updates.
• Handling returns, refunds, exchanges, and warranty claims.
• Responding to product inquiries, support requests, and complaints.

3.2 Account Management

• Creating and maintaining your customer account on our Magento platform.
• Allowing you to view order history, manage addresses, and store preferences.
• Authenticating your identity and preventing unauthorized account access.

3.3 Payments & Financial Processing

• Authorizing and processing credit card, ACH, and other payment transactions.
• Detecting, investigating, and preventing fraudulent transactions and chargebacks.
• Complying with applicable sales tax collection and remittance obligations.

3.4 Marketing & Communications

• Sending promotional emails, catalogs, and newsletters (only with your consent or where otherwise permitted by law).
• Personalizing product recommendations based on your browsing and purchase history.
• Displaying relevant advertisements on third-party platforms (e.g., Google Ads remarketing).

3.5 Site Improvement & Analytics

• Analyzing traffic patterns, conversion rates, and user behavior to improve Site performance.
• Diagnosing technical issues, bugs, and security vulnerabilities.
• Conducting A/B testing and product assortment optimization.

3.6 Legal & Compliance

• Complying with applicable laws, regulations, and court orders.
• Enforcing our Terms of Sale, Terms of Use, and other agreements.
• Protecting the rights, property, and safety of Machine Parts Toolbox, our customers, and the public.

4 Legal Basis for Processing (GDPR & Similar Frameworks)

For customers in the European Economic Area (EEA), United Kingdom, or other jurisdictions that require a lawful basis for processing personal data, we rely on the following:

• Contractual Necessity: Processing required to fulfill your orders and manage your account.
• Legal Obligation: Processing required to comply with tax, accounting, and regulatory requirements.
• Legitimate Interests: Fraud prevention, security monitoring, and Site analytics, where these interests are not overridden by your rights.
• Consent: Marketing communications and non-essential cookies, where your explicit consent is obtained.

If you are an EEA or UK resident, you have additional rights described in Section 9.

5 Sharing and Disclosure of Information

5.1 Service Providers

We engage third-party vendors who process personal data on our behalf. These providers are contractually obligated to protect your data and use it only for specified purposes:

• Payment Processors: Stripe, Authorize.Net, PayPal, Braintree — to process transactions.
• Shipping & Fulfillment: UPS, FedEx, USPS, freight brokers — to ship and track orders.
• Hosting & Infrastructure: Cloud hosting providers that operate our Magento servers.
• Email Service Providers: Transactional email platforms (e.g., Mailchimp, Klaviyo, SendGrid) for order and marketing emails.
• Tax & Compliance: Services such as Avalara or TaxJar for automated tax calculation.
• Customer Support Platforms: Helpdesk software used to manage support tickets.
• Analytics Providers: Google Analytics, Hotjar, or similar services for Site behavior analysis.

5.2 Business Transfers

If Machine Parts Toolbox is involved in a merger, acquisition, asset sale, or bankruptcy proceeding, your personal information may be transferred as part of that transaction. We will provide notice before your data is transferred and becomes subject to a different privacy policy.

5.3 Legal Requirements

We may disclose your personal information if required to do so by law or in good-faith belief that such disclosure is necessary to: (a) comply with a legal obligation or government request; (b) protect and defend our legal rights or property; (c) prevent or investigate possible wrongdoing in connection with the Site; or (d) protect the personal safety of users or the public.

5.4 With Your Consent

We may share your information with third parties when you explicitly consent, such as when you opt into a co-branded promotion or product review platform.

6 Data Retention

We retain personal information for as long as necessary to fulfill the purposes outlined in this policy, subject to the following retention guidelines:

7 Cookies and Tracking Technologies

7.1 What Are Cookies

Cookies are small text files placed on your device by our Site. Magento uses cookies as a core part of its e-commerce functionality. We use both first-party cookies (set by Machine Parts Toolbox) and third-party cookies (set by our partners).

7.2 Types of Cookies We Use

7.3 Managing Cookies

You can control cookies through your browser settings — most browsers allow you to refuse cookies, delete existing cookies, or alert you before cookies are placed. Disabling strictly necessary cookies will impair core Site functionality such as your shopping cart and account login.

For analytics and marketing cookies, you may also opt out via:

• Google Analytics Opt-Out
• Google Ads Settings
• Network Advertising Initiative Opt-Out

8 Data Security

We implement industry-standard technical and organizational measures to protect your personal information, including:

• TLS/SSL Encryption: All data transmitted between your browser and our Site is encrypted using TLS 1.2 or higher.
• PCI-DSS Compliance: Payment card data is processed through PCI-DSS compliant payment gateways. We do not store full card numbers on our servers.
• Magento Security Patches: We maintain our Magento Open Source installation with current security patches and updates.
• Access Controls: Admin access to our Magento backend is restricted by role-based permissions, strong passwords, and two-factor authentication (2FA).
• Firewall & Intrusion Detection: Web application firewall (WAF) protection and server-level intrusion detection.
• Regular Security Audits: Periodic vulnerability scanning and security reviews of our hosting environment.
• Data Minimization: We collect only the personal information necessary to operate our business.

9 Your Privacy Rights

9.1 Rights Available to All Customers

• Access: Request a copy of the personal information we hold about you.
• Correction: Request that inaccurate or incomplete information be corrected.
• Deletion: Request deletion of your personal information, subject to legal retention obligations.
• Opt-Out of Marketing: Unsubscribe from promotional emails at any time.

9.2 California Residents (CCPA / CPRA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of categories and specific pieces of personal information collected, sold, or disclosed in the past 12 months.
• Right to Delete: Request deletion of your personal information, with certain exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out of Sale / Sharing: We do not sell personal information for monetary consideration. If we share data with advertising partners, you may opt out via our cookie preference center.
• Right to Limit Sensitive Data Use: To limit how we use sensitive personal information beyond what is necessary to provide our services.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

9.3 EEA / UK Residents (GDPR / UK GDPR)

If you are located in the European Economic Area or United Kingdom, you have rights under the General Data Protection Regulation (GDPR) or UK GDPR, including:

• Right of Access (Article 15): Obtain confirmation and a copy of your data.
• Right to Rectification (Article 16): Have inaccurate data corrected.
• Right to Erasure (Article 17): “Right to be forgotten” subject to retention requirements.
• Right to Restrict Processing (Article 18): Restrict how we use your data in certain circumstances.
• Right to Data Portability (Article 20): Receive your data in a structured, machine-readable format.
• Right to Object (Article 21): Object to processing based on legitimate interests, including direct marketing.
• Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise these rights, contact [email protected]. You also have the right to lodge a complaint with your local data protection authority.

10 Third-Party Links and Services

Our Site may contain links to third-party websites, manufacturer pages, or integrated services (e.g., shipping carrier portals, payment processors). This Privacy Policy does not apply to those third-party sites. We encourage you to review the privacy policies of any third-party services you use through or in connection with our Site. We are not responsible for the privacy practices or content of third-party sites.

11 Children's Privacy

Our Site is intended for use by individuals who are 18 years of age or older, or minors using the Site under the supervision of a parent or legal guardian. We do not knowingly collect personal information from children under the age of 13. If you believe we have inadvertently collected information from a child under 13, please contact us immediately at [email protected] and we will take steps to delete such information.

12 Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We will respond to all legitimate privacy requests within 30 days of receipt, or within the timeframe required by applicable law.

13 Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time. When we make material changes, we will:

• Update the “Last Updated” date at the top of this page.
• Post a prominent notice on our Site homepage for at least 30 days.
• Send an email notification to registered account holders for significant changes.

Your continued use of the Site after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. We encourage you to review this policy periodically.