Privacy Notice

Last updated: 10 September 2025

1. Who we are (Data Controller)

Millfield Autoparts (“we”, “us”, “our”) operates the website mapc.originsoftware.co.uk. We’re committed to protecting your privacy and handling your personal data fairly and lawfully.

Trading address: Unit 5, Bourges View Park, Maskew Avenue, Peterborough, PE1 2FG (our Peterborough branch)
VAT No: 463 1132 80
Phone: 01733 557457
Email for privacy queries: admin@millfieldautoparts.co.uk

2. Scope

This notice covers personal data we process when you browse our website, create an account, place an order (including Click & Collect), contact us, use live chat, use the Store Locator, or use the Number Plate Visualiser. It also applies to trade customers using our separate trade site (mapc.trade.originsoftware.co.uk) where relevant.

3. What we collect

Data you provide

• Account details – name, email, contact number, default addresses.
• Orders & fulfilment – billing/delivery addresses, order contents, delivery or collection preferences.
• Vehicle/fitment info – optional registration/fitment details to identify compatible parts.
• Support & live chat – messages you send via forms, email, phone or live chat (content and timestamps).
• Telephone enquiries – calls to our Peterborough phone centre may be recorded; we capture the audio, date/time, basic technical data (e.g. caller ID where provided) and agent notes.
• Trade accounts – if you set up a trade account (in-store or via the trade site), we’ll collect business contact details.

Data collected automatically

• Technical & usage data – IP address, device/browser, pages viewed and interactions (aggregated analytics), and cookie/consent preferences.
• Advertising/measurement identifiers (if you consent) – e.g. Google Analytics client ID and ad click IDs such as gclid/dclid used for conversion attribution (see 5E).
• Location (optional) – only if you choose Use my location in the Store Locator. If device location is unavailable and you request it, we may use an approximate IP-based location.

Number Plate Visualiser (no storage)

Our visualiser is a preview tool only. The registration characters you type are rendered locally in your browser to show how a plate could look and to calculate pricing options. We do not transmit the characters you type to our servers, and the tool does not set additional cookies. It does not place an order; number plates must be purchased in-store with the correct documents.

4. Why we use your data & legal bases

• Provide the service & perform a contract – manage accounts, process and deliver orders, and provide Click & Collect. Legal basis: Contract.
• Payments – processed by PayPal. We don’t store full card details. Legal basis: Contract & Legitimate interests.
• Customer support & live chat – respond to enquiries and operate chat (via Cue Helpdesk). Legal basis: Legitimate interests; Consent for non-essential chat cookies.
• Telephone support & call recordings – quality, training, and resolving queries/complaints. We play a notice at the start of calls; by continuing, you acknowledge recording. Legal basis: Legitimate interests. You may ask us to pause/stop recording where feasible or use email/live chat/in-store as alternatives.
• Improve and secure our website – troubleshooting, preventing fraud/abuse, analytics in aggregate. Legal basis: Legitimate interests.
• Analytics & advertising measurement – understand site usage, attribute conversions (e.g. from Google Ads), and improve ad performance. Legal basis: Consent (non-essential cookies/tags).
• Legal & compliance – e.g., tax/VAT records, responding to lawful requests. Legal basis: Legal obligation.
• Marketing – currently we do not run email or SMS marketing or abandoned-cart emails.
• Store Locator – to show nearby branches and open directions in your chosen maps app:
  • We process a postcode/address you enter to geocode it. Legal basis: Legitimate interests.
  • We may use precise device location only if you grant browser permission. Legal basis: Consent.
  • If device location isn’t available and you request it, we may use an approximate IP-based location. Legal basis: Legitimate interests.

5. Cookies & similar tech

We use cookies and local/session storage to make the site work and remember choices. You can control non-essential cookies via our banner.

• Essential – for security, basket, checkout, and account login.
• Functionality – remember preferences, improve forms.
• Analytics – we use Google Tag Manager and may use Google Analytics 4 via GTM. These only load with consent.
• Advertising & conversions – Google Ads tags (e.g. conversion/remarketing) may run with consent (see 5E).
• Live chat – our Cue Helpdesk widget sets its own cookies; it loads only after consent (see 5A).
• Store Locator – the interactive map and related libraries load only after consent (see 5B).
• Consent preference – we store a small flag in your browser (mapc_consent_all) to remember that you allowed non-essential cookies so features like the interactive map and live chat can load (see 5C).

You can change your choices any time via the banner or your browser settings. Disabling some cookies will affect features (e.g., live chat and the interactive map).

5A. Live chat (Cue Helpdesk) – privacy specifics

• The live chat widget loads only after you choose “Allow all cookies” in our banner. Until then, the chat button is disabled and no chat scripts are loaded.
• When chat is loaded and you use it, we process the messages you send (and any files you attach) plus basic metadata (timestamps, your browser type/version, and IP address for security/abuse prevention).
• Chat is provided by Cue Helpdesk acting as our processor. Transcripts are visible to our support staff to help with your query; please don’t share card details or other highly sensitive information over chat.
• We keep chat transcripts for up to 24 months (see “Data retention”).
• The chat widget may operate infrastructure outside the UK; where this occurs we rely on the safeguards described in “International transfers”.
• Chat cookies are non-essential and only set after consent; you can withdraw consent via the cookie banner, which will stop the widget loading on future visits.

5B. Store Locator – map & location specifics

• Map & geocoding providers – OpenStreetMap map tiles (via CDN), Leaflet (map library), Nominatim and postcodes.io for address/postcode lookup; ipapi.co for approximate IP location when requested.
• Directions – when you pick Google Maps, Apple Maps or Waze, you leave our site and use their services.
• What we keep – we don’t store your precise location on our servers; the consent preference noted below is kept only in your browser.

5C. Consent preference flag

To remember that you allowed non-essential cookies (so features like live chat and the interactive map can load), we store a small value in your browser’s local storage: mapc_consent_all. This does not identify you and remains only on your device until you clear it.

5D. Telephone support & call recordings – privacy specifics

• Our customer phone centre operates from the Peterborough branch. Calls may be recorded for training, quality assurance, and to help investigate/resolve problems.
• At the start of the call we play a notice. By continuing, you acknowledge recording. If you prefer not to be recorded, you can ask us to pause/stop recording where feasible or use alternative channels (email, live chat, or in-store).
• What we capture: call audio, date/time, duration, basic technical data (e.g., caller ID/number where provided), and agent notes.
• Retention: recordings are stored on our servers for 3 months and then deleted.
• Legal basis: Legitimate interests (quality monitoring, training, dispute resolution, and security). You may have the right to object (see “Your rights”).
• Sharing: access is limited to authorised staff. We may use a telephony/call-recording service provider acting under contract, and we may disclose recordings if required by law.

5E. Analytics & advertising (Google)

• We use Google Tag Manager (GTM) to load tags. GTM itself does not set cookies; it deploys other tags you’ve consented to.
• Google Analytics 4 (GA4) helps us measure visits and improve the site. GA4 may set identifiers such as _ga and _ga_* to distinguish browsers and attribute sessions. We do not use GA to identify you directly.
• Google Ads (conversion/remarketing) may run if you consent, so we can see which ads lead to visits or orders and show relevant ads. These tags may read/write ad identifiers (e.g. gclid) for attribution.
• Legal basis: Consent under the UK ePrivacy rules for non-essential cookies/tags.
• International transfers: Google may process data outside the UK/EU; we rely on the safeguards in Section 7.
• Your choices: You can change consent via our cookie banner, use Google’s Ads Settings at adssettings.google.com, and/or install the GA Opt-out add-on at tools.google.com/dlpage/gaoptout. See Google’s privacy policy at policies.google.com/privacy.
• Retention: Analytics event data is retained by GA4 per our settings (typically between 2 and 14 months for event-level data). We may adjust this in GA4 from time to time.

6. Who we share data with

• Hosting, e-commerce & platform – our website is provided via Origin Software.
• Payments – PayPal.
• Delivery – our own drivers for local deliveries and Click & Collect from our branches.
• Support/live chat – Cue Helpdesk.
• Telephony & call recording – our phone system and recording service provider (where used) acting as our processor.
• Analytics/Advertising – Google products (GA4/Ads) as described in 5E.
• Vehicle/fitment lookup – Autopart/Autocat integrations via our platform to identify compatible parts based on your inputs.
• Map & geolocation services – OpenStreetMap/Nominatim, postcodes.io, ipapi.co, Leaflet CDN (unpkg.com) for the Store Locator.
• Law enforcement/regulators – when required by law.

Service providers act on our instructions and are bound by contracts and confidentiality obligations.

7. International transfers

Some providers may store or process data outside the UK. Where this occurs, we rely on lawful safeguards such as the UK Addendum/Standard Contractual Clauses or equivalent mechanisms used by those providers.

8. Data retention

• Orders & accounts: kept as required for tax/legal purposes (typically up to 6 years).
• Support & live-chat transcripts: typically kept up to 24 months.
• Call recordings: kept for 3 months (see 5D).
• Analytics data: retained by Google Analytics per our GA4 settings (usually 2–14 months for event-level data).
• Marketing data: we’re not currently sending marketing; if enabled in future, we’ll keep marketing preferences and engagement data for up to 24 months from last activity.
• On-site conversation state: if you leave pages and return, previous conversation states may persist for up to 7 days or until you clear your browser cookies/site data.
• Store Locator/consent: the consent flag (mapc_consent_all) stays only in your browser until you clear it.

9. Security

We apply appropriate technical and organisational measures (e.g., encryption in transit, access controls, hashed passwords) to protect your data. No online service is 100% secure, but we work to safeguard your information.

10. CCTV at branches

We operate CCTV at our premises for safety and crime prevention. Footage is typically retained for up to 30 days unless we need to keep it longer in connection with an incident, investigation or legal requirement.

11. Your rights

Under UK data protection law you may have the right to: access your data; correct inaccuracies; erase data; restrict or object to processing; data portability; and withdraw consent where processing is based on consent. To exercise a right, contact us using the details below.

You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.

12. Automated decision-making

We do not use automated decision-making or profiling that produces legal or similarly significant effects about you. We may use basic fraud-prevention checks and aggregated analytics to keep the site secure and improve it.

13. Children

Our website is not intended for children under 16, and we do not knowingly collect their personal data.

14. Contact us

Email: admin@millfieldautoparts.co.uk
Phone: 01733 557457
You can also write to us at the address listed above.

15. Changes to this policy

If we change this policy, we’ll update the “Last updated” date and post the new version here.