Privacy Policy

Korean Parts & More · Last updated: 12 September 2026

Your parts enquiry should not cost you your privacy. This policy explains what information we use, why we use it, who may receive it and how you can exercise your rights under South Africa’s Protection of Personal Information Act 4 of 2013 (POPIA).

At a glance: we use your details to help with your request; an enquiry is not a marketing subscription; optional tracking requires a separate choice; unsuccessful enquiries and their photographs have a three-calendar-month retention period after unsuccessful closure. For privacy help, email info@koreanpartsnmore.co.za.

1. Who we are and how to contact us

Korean Parts and More (Pty) Ltd, trading as Korean Parts & More (“we”, “us” or “our”), determines how personal information is used for koreanpartsnmore.co.za and the parts enquiries received through it. We are the responsible party for this processing under POPIA.

Address privacy, access, correction, objection or deletion requests to the Information Officer:

• Email: info@koreanpartsnmore.co.za
• Telephone: 053 050 9744
• Business address: Bobby’s Walk, 6A Long Street, Kimberley, 8301, South Africa.

Tell us that your request concerns privacy so it can be directed appropriately. You may deliver a written request to the business address. Do not send passwords, payment-card details or an identity-document copy with an initial enquiry.

2. What this policy covers

This policy covers website visits, parts and quotation requests, photographs you upload, contact with our team and related collection or delivery assistance. Personal information includes information about an identifiable living individual and, where applicable, an identifiable existing business or other juristic person. Vehicle identifiers, photographs and online identifiers can be personal information when linked to an identifiable person.

This notice is not blanket consent. Browsing the site, reading this policy or submitting an enquiry does not by itself authorise optional tracking or unrelated marketing. Separate notices may apply to employment, credit applications or activities outside the website enquiry process.

3. Information collected and its sources

We normally receive information directly from you through a form, email, telephone call, WhatsApp conversation or in-person follow-up. Relevant details may also come from your authorised representative, mechanic or workshop, or from a supplier or delivery provider helping with your request. Indirect collection must be permitted by POPIA, with further collection information provided where required.

• Contact and enquiry details: your name, telephone or WhatsApp number, email address, reply preference and message, used to respond and clarify what you need.
• Vehicle and part details: make, model, year, engine information, VIN or part number, part description and optional photograph, used to identify the part and discuss availability, fitment and quotation information.
• Collection and delivery details: your selected option and town or area, with a delivery address and recipient details if later needed to fulfil your request.
• Administration and transaction records: request reference, dates, follow-up notes, quotation, enquiry status and outcome; if a sale proceeds, order, invoice, relevant payment confirmation, delivery, return and warranty records.
• Technical and security information: IP address or derived security identifier, browser/device information, requested page, access time, errors and delivery-status information, used to operate and protect the service and troubleshoot failures.
• Optional measurement information: browser identifiers, page visits and selected interactions, approximate location and referral or campaign information, subject to your privacy choices as explained in section 7.
• Privacy administration: your request, proportionate verification, response, consent or objection details, used to respect your choices and demonstrate the handling of your request.

We do not request banking passwords, payment-card details, identity documents, medical information or other special personal information in the parts form. Do not put these in messages or photos. Crop unrelated people, documents and identifying details out of photographs, and remove unnecessary embedded location/device information before sending.

If you provide another person’s information, you must be entitled to do so, tell them about this notice where appropriate and include only relevant details. This does not remove our own POPIA duties.

4. Required and optional information

The parts form marks required fields with an asterisk. It requires your name and contact number, vehicle make/model/year, the part needed, reply method and collection/delivery choice. A town or area is required for delivery; an email address is required for an email reply and is otherwise optional. Engine details, a VIN or part number and a photograph are optional.

These are operational requirements for the enquiry, not a claim that a law compels you to submit it. Without sufficient contact and vehicle information, we may not be able to respond or identify the part. You may telephone the team to discuss what is needed. Permission to contact you about a request does not subscribe you to a marketing list. Optional tracking is not a condition of requesting a part.

5. Purposes and lawful grounds

We use information relevant and reasonably necessary for a stated purpose. The applicable POPIA grounds depend on the activity:

• Requested steps towards a transaction or performance of a contract: checking your request, quoting, discussing it, fulfilling an order and providing related service.
• Legal obligations: applicable tax, accounting, transaction and privacy records and lawful demands. Requirements under tax, companies and consumer law depend on the record and obligation; not every unsuccessful enquiry or photograph is a compulsory tax record.
• Legitimate interests recognised by POPIA: necessary administration, security, fraud/spam prevention, protecting customers and establishing or defending lawful claims, taking account of the need and privacy impact.
• Voluntary, specific and informed consent: optional analytics, advertising measurement and other optional processing for which consent is requested.

Consent may be refused or withdrawn without losing the essential enquiry service. An incompatible new purpose requires its own lawful ground and appropriate notice or choice before processing begins.

6. Enquiries, photographs and messages

A submitted website request is saved as a private enquiry record and emailed to relevant authorised sales staff. An uploaded photograph may be included as an email attachment and retained with the private request. If you provide an email address, the website may send an acknowledgement. Staff then respond using your selected method and record progress.

An acknowledgement is not confirmation of stock, fitment, price, payment or an order. The team reviews these with you. Your submitted photograph is not intended for publication in the public website image library.

The website, staff email systems and WhatsApp can hold separate copies. Deleting one does not automatically delete all others. Retention deadlines and valid deletion requests must cover relevant copies under our control, subject to lawful exceptions.

7. Cookies, analytics, advertising measurement and external content

Cookies are small browser files. Similar technologies include browser storage, identifiers and third-party requests. Cookie information and the privacy preferences supplement this notice. A cookie’s expiry is not necessarily the provider’s server-side retention period.

Necessary functionality: technology needed to deliver requested functions, remember privacy choices, process and protect forms and support authorised administration. Necessary security records are separate from optional advertising profiles.

Optional statistics: with your permission, Google Analytics measures page use and selected interactions, such as form steps and telephone or WhatsApp clicks. This can include online identifiers, device information, approximate location and referral or campaign information. Our measurement events must not include your name, email, phone number, VIN, photographs, enquiry message or private request references. A click is not proof of a conversation, qualified enquiry or sale.

Google receives technical connection information when contacted. Google says GA4 does not log or store individual IP addresses; this does not mean no IP information is processed to make the connection. See Google’s Analytics safeguards and Google’s Privacy Policy.

Optional Google Ads measurement: when you allow both website statistics and marketing, Google Analytics and the linked Google Ads account can use advertising-click identifiers, permitted public-page context, browser or device information and selected interactions to understand which advertising leads to a successfully saved parts enquiry. On advertising-tagged visits we wait for both choices before loading Google measurement. A form step, telephone click or WhatsApp click is not counted as a successfully saved website enquiry.

Google advertising personalisation, Google signals, customer-list uploads and enhanced conversions using customer contact details are not enabled by this website setup. We do not send your name, email address, telephone number, VIN, photo, enquiry text or private enquiry reference in our Google measurement events. Advertising identifiers can still be personal information; Google processes the information it receives under its own privacy terms. Earlier consent to Meta-only advertising measurement does not authorise this additional Google purpose: we ask for a fresh choice.

Optional Facebook and Instagram advertising measurement: if you allow the marketing category, the Meta pixel can send Meta technical connection information (including IP/browser information), online identifiers, permitted page context and selected website interactions. Meta may associate these with your Facebook or Instagram account and use them for measurement, advertising personalisation and its other purposes described in Meta’s Privacy Policy. This is separate from contacting us on WhatsApp.

Our pixel setup does not use automatic advanced matching, customer-list uploads or server-side Conversions API. We do not include your contact details, VIN, photographs, enquiry message or private request references in pixel events. Website measurement is not evidence that we have launched an advertising campaign. Read more in Meta’s Business Tools Terms.

External content: loading an embedded Google map connects your browser to Google and can disclose technical connection information and page context under Google’s policies. You can use the written address or call us without loading a map. Opening an external social or review link is your choice and takes you to that provider.

Your controls: select Reject optional, Accept optional or Preferences for a category-level choice. Optional categories start off. Reopen Privacy choices to change or withdraw permission. Refusal does not stop the parts form, telephone links or your choice to open WhatsApp. Clearing browser storage may cause the site to ask again. Withdrawal stops future consent-based activity; it does not automatically erase earlier lawful records or information already held by an independent provider. Contact us and, where appropriate, that provider about deletion.

8. WhatsApp, social platforms and reviews

A WhatsApp link opens WhatsApp or its website, not a private chat hosted solely on this website. If you choose a WhatsApp reply, staff use the number and relevant enquiry details you supplied. Authorised team members may see conversations on the business’s connected devices. WhatsApp handles platform, account and connection information under its own Privacy Policy.

Google Reviews, Facebook, Instagram and other external services have their own privacy rules and account controls. Public reviews may show your name, content and other details you choose to publish. Do not post private contact or order information in a review; contact us privately instead.

This policy does not authorise training AI on customer conversations, uploading enquiry contact lists to advertising platforms or materially different profiling. Such a use needs a separate assessment, appropriate notices and required permission before it begins.

9. Direct marketing

Responses about requested parts, quotes and existing orders are service communications, not an automatic marketing subscription. Unsolicited electronic direct marketing is subject to section 69 of POPIA. Where consent is needed, it must be obtained separately and recorded: silence, pre-ticked boxes and failure to opt out are not consent.

Any use of the limited existing-customer exception must meet all its requirements, including similar products/services and a free, straightforward opportunity to object at collection and in each communication. An unsuccessful enquiry alone does not establish that exception. Use the supplied opt-out or contact us to object. Minimum suppression information may be retained to respect your choice, not reused for marketing. Opting out does not stop necessary messages about a transaction you requested.

10. Who may receive information

• Authorised sales, administration and management staff.
• Owlytic, which assists with website, hosting and service administration, and relevant hosting/email infrastructure providers, including Verpex where applicable.
• Suppliers identifying or sourcing parts and providers arranging delivery, limited to the relevant information.
• Google and Meta for the optional services in section 7, and WhatsApp or another platform when you choose that channel.
• Professional advisers, insurers, courts, regulators and law enforcement where necessary and lawfully justified.

For providers acting on our instructions as operators, our requirements include confidentiality, appropriate security and authorised processing under a written agreement as required by POPIA. Some platforms independently determine purposes for their own processing; their policies also apply. Ask the Information Officer about relevant recipients and a particular disclosure.

11. Processing outside South Africa

Hosting, email, backups, support and online platforms can involve foreign systems or personnel. Information is not necessarily processed only in South Africa. Google operates worldwide infrastructure; WhatsApp/Meta processes information internationally, including in the United States. Locations depend on the service.

Foreign privacy laws and government-access rules may differ. A general GDPR statement or approval under another framework is not a POPIA guarantee. Transfers we arrange require a valid section 72 ground: for example, adequate protection through a qualifying law, binding corporate rules or binding agreement with onward-transfer protection; informed consent; or another applicable statutory ground such as genuinely necessary contractual steps.

Our policy is to assess and document the applicable ground and safeguards before authorising a transfer and limit the information involved. Ask the Information Officer about the provider, destination and safeguards relevant to your information. You can refuse optional services without losing the parts-enquiry service. See Google’s transfer information and the Meta/WhatsApp policies linked above.

12. Retention and deletion

• Unsuccessful enquiries and uploaded photographs: three calendar months after the enquiry is closed as unsuccessful. This is our business period, not a statutory POPIA minimum. Open or reopened requests are not treated as closed. A legal hold or other lawful exception must be justified separately.
• Active enquiries: while reasonably needed to resolve the request and follow-up, with review to avoid indefinite dormant records.
• Completed sales and related records: separately retained for applicable tax, accounting, contract, warranty, consumer-protection and claims requirements. The unsuccessful-enquiry period does not permit deleting invoices or make every photo mandatory invoice evidence.
• Measurement information: subject to configured analytics controls and the provider’s own retention. Meta’s Business Tools Terms state that event data is retained for a maximum of two years. This is separate from our enquiry period and browser cookie expiry. Ask us about current measurement settings.
• Security, consent, rights-request and suppression records: for the proportionate period needed to protect the service, respect choices, handle requests and demonstrate lawful compliance, subject to specific requirements or disputes.
• Backups: copies may remain until scheduled expiry, restricted to recovery rather than ordinary reuse. Following restoration, relevant deletion and objection instructions must be reapplied. Ask about the backup period relevant to your request.

When retention is no longer authorised, information must be securely deleted, destroyed or genuinely de-identified as soon as reasonably practicable. Hiding records or substituting identifiers is not necessarily de-identification. The three-month policy covers relevant staff-controlled copies as well as website records; it is not a promise that every platform deletes them automatically. We will explain any lawful limitation on a deletion request.

13. Security and incidents

The website uses HTTPS transmission, access-controlled administration and restricted enquiry/upload handling. Safeguards must be appropriate to the information and foreseeable risks and reviewed as those risks change. No website, device or transmission method is risk-free. Contact us promptly about suspected disclosure or suspicious messages claiming to be from us; never send passwords as proof.

Where there are reasonable grounds to believe information was accessed or acquired by an unauthorised person, POPIA requires notification to the Information Regulator and affected people as soon as reasonably possible after discovery, subject to the Act, including lawful delays or inability to identify affected people. Required notifications must explain relevant circumstances and protective steps.

14. Your rights and how to use them

Subject to POPIA and applicable access rules, you may ask whether we hold your information; request access and relevant recipient information; request correction or deletion of inaccurate, incomplete, misleading, outdated, irrelevant, excessive or unlawfully obtained information; and request deletion/destruction where retention is no longer authorised.

You may object to processing in the circumstances POPIA recognises, including applicable legitimate-interest processing and direct marketing; withdraw consent for future processing; request restriction where the Act requires it; raise concerns about solely automated decisions with legal or similarly substantial effects; and complain or seek another lawful remedy.

Contact the Information Officer in section 1. Describe the information, action requested, reason where relevant and reply method. A request reference can help. We may need proportionate identity verification or evidence of authority if you act for another person, but will not routinely require excessive identity documents.

Use the Regulator’s applicable Form 1 or Form 2, or a substantially similar accessible request, for objections and correction/deletion. Assistance with an appropriate accessible method is available. Relevant requests made by telephone must be recorded as required by the regulations, with the record or transcript available on request. You do not need to accept tracking or marketing to exercise a right.

Confirmation of whether we hold information, objections and applicable correction/deletion requests are free. Any lawful prescribed fee for another access request will be explained before charging. We will respond within applicable legal time requirements and a reasonable period, explain the outcome and any lawful refusal or limitation.

POPIA and the Promotion of Access to Information Act 2 of 2000 (PAIA) may overlap. Ask the Information Officer about the appropriate route and applicable PAIA arrangements. This notice is not a substitute for a required PAIA manual.

15. Children and automated decisions

This service is for people able lawfully to make the relevant request or transaction, not to collect children’s information. A parent, guardian or legally competent person should handle an enquiry where required. Contact us if a child’s information was supplied without the required authorisation.

Automated validation and anti-spam checks help operate the site, but staff review enquiries. The form does not itself make binding availability, fitment or pricing decisions. Telephone us if a check prevents a genuine request. Material profiling or solely automated decisions with significant effects require separate assessment and safeguards.

16. Complaints to the Information Regulator

You may contact us first, but doing so is not a condition of complaining to the Information Regulator (South Africa). Its current complaint instructions direct users to register and submit through the eServices portal. See the official complaints page for guidance and accessible alternatives.

• General enquiries: enquiries@inforegulator.org.za
• Telephone: 010 023 5200
• Current Information Regulator contact details

17. Changes to this policy

We update this notice when relevant practices or requirements change and show the last-updated date. Material new uses require appropriate explanation and, where necessary, a fresh choice before they begin. Publication does not retrospectively authorise processing that required its own lawful ground or consent.

Questions or requests: info@koreanpartsnmore.co.za · 053 050 9744.