This Privacy Policy explains how HFM DOT PARTS (ABN 31 489 472 505) trading as HFM.Parts ("HFM.Parts", "we", "us", "our") collects, uses, discloses and protects your personal information when you visit hfm.parts, buy from us, or contact our support team.
We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Because we ship and advertise internationally, this policy also addresses the rights of customers in the EU/UK and California (see section 11).
1. Who we are
HFM.Parts is a Victoria, Australia based supplier of performance automotive parts.
- Email: help@hfm.parts
- Warehouse: 100 New Street, South Kingsville, VIC 3015, Australia
For any privacy request, contact us at help@hfm.parts with "Privacy" in the subject line.
2. Information we collect
You give us directly:
- Name, email address, phone number, billing and shipping address.
- Order and account details, and vehicle information you provide for fitment.
- Messages you send us via our contact form or live chat.
Collected automatically when you use the Site:
- IP address, device and browser type, operating system.
- Pages viewed, referring URLs, and on-site behaviour (via cookies and similar technologies; see our Cookie Policy).
- A hashed identifier and event data used for advertising measurement (see section 5).
- Your cookie consent choice, which we also record against your order when you buy.
From third parties:
- Payment confirmation and fraud-check results from our payment providers.
- Advertising and analytics platforms (Google, Meta) that help us measure and target advertising.
We do not collect full payment card numbers. These are handled directly by our payment providers.
3. How we use your information
We use your personal information to:
- Process, fulfil and deliver your orders and manage returns/warranty claims.
- Provide customer support, including live chat.
- Send order and transactional communications.
- Send marketing communications where you have opted in (you can unsubscribe at any time).
- Operate, secure and improve the Site.
- Measure, target and optimise our advertising on Google and Meta.
- Detect and prevent fraud, and meet our legal and tax obligations.
Where required by law, we rely on your consent (for example, non-essential cookies and direct marketing); otherwise we rely on the performance of our contract with you and our legitimate business interests.
4. Payment processing
Payments are processed by our providers: WooCommerce / WooPay, PayPal, and via bank transfer. When you pay, your details are shared with the relevant provider and handled under their privacy terms. We receive confirmation of payment and limited transaction details, not your full card data.
5. Advertising, analytics and server-side data sharing
We advertise on Google and Meta (Facebook/Instagram) and use analytics to understand how our Site performs. To measure conversions and reduce wasted ad spend, we use both browser-based tags and server-side conversion tracking (via our tag manager, Cloudflare Zaraz).
As part of this, we may share a hashed (irreversible) version of certain details, such as your email address, phone number and name, with Google (Google Ads Enhanced Conversions) and Meta (Conversions API) so they can match a purchase to an ad without us disclosing your details in readable form. This matching data is:
- Hashed before it is sent, so the platforms cannot read the underlying values;
- Used only to measure and improve advertising performance; and
- Limited by geography: we restrict the sharing of personal identifiers to customers in Australia and New Zealand.
Google and Meta act as independent controllers of the data they receive for these purposes. You can control much of this through cookie settings and the opt-outs in section 11 and in our Cookie Policy. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing.
6. Live chat and support
We use Crisp Chat to provide live chat and manage support conversations. When you chat with us, Crisp processes your message content, email (if provided) and technical data on our behalf. See Crisp's privacy policy for details on their processing.
7. Who we share your information with
We share personal information only as needed to run our business:
- Service providers: hosting, WooCommerce/WordPress infrastructure, payment providers (WooPay, PayPal), shipping and freight carriers, email and CRM tools, and Crisp Chat.
- Advertising and analytics partners: Google and Meta, as described in section 5.
- Professional advisers and authorities: where required by law, or to protect our rights, prevent fraud, or comply with a lawful request.
- In a business sale: if our business is sold or restructured, customer data may transfer to the new owner under equivalent protections.
We do not sell your personal information.
8. International transfers
We are based in Australia but use service providers and advertising platforms located overseas (including the United States and the EU). This means your information may be stored or processed outside your country. Where required, we use recognised safeguards such as the European Commission's Standard Contractual Clauses, and we take reasonable steps to ensure recipients handle your information consistently with this policy and applicable law.
9. Data retention
We keep personal information only as long as needed for the purposes above, including to fulfil orders, honour warranties, and meet tax, accounting and legal record-keeping obligations (generally 7 years for transaction records under Australian law). When no longer required, we securely delete or de-identify it.
10. Security
We take reasonable technical and organisational measures to protect your information, including encryption in transit (HTTPS) and access controls. No method of transmission or storage is completely secure; we cannot guarantee absolute security, but we work to protect your data and will notify affected individuals and the OAIC of any eligible data breach as required by law.
11. Your rights and choices
All customers can:
- Request access to, or correction of, the personal information we hold about you.
- Unsubscribe from marketing at any time via the link in our emails.
- Manage cookies and advertising tracking (see our Cookie Policy), including Google Ads Settings and Meta Ad Preferences, and opt-outs at youradchoices.com.au.
EU/UK (GDPR) customers additionally have rights to erasure, restriction, portability, and to object to processing based on legitimate interests, and may lodge a complaint with your local supervisory authority.
California (CCPA/CPRA) customers have rights to know, delete, and opt out of "sharing" of personal information for cross-context behavioural advertising. You can opt out using the "Do Not Sell or Share My Personal Information" link shown in our footer for California visitors, or by rejecting advertising cookies. We also honour the Global Privacy Control (GPC) browser signal as a valid opt-out.
Canadian customers have rights of access and correction under PIPEDA, and Quebec residents have further rights under Law 25, including withdrawing consent. We send marketing email only with your consent, and every message includes an unsubscribe link, as Canada's anti-spam law (CASL) requires.
To exercise any right, email help@hfm.parts. We will verify your identity and respond within the timeframe required by law. If you are in Australia and are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
12. Children
The Site is not directed at children under 18, and we do not knowingly collect their personal information.
13. Changes to this policy
We may update this policy from time to time. The current version is always published on the Site with the "Last updated" date above. Material changes will be highlighted where appropriate.
14. Contact
Privacy questions or requests: help@hfm.parts.
