Privacy Policy

1. Who is responsible for your data

The controller responsible for processing your personal data is:

HBX Parts Doo
Steve Jovanovića 33, 11272 Dobanovci, Serbia
Company registration number (MB): 22171557 · Tax ID (PIB): 115533876
Email: info@hbxparts.com · Phone: +381 65 5121981

We have not appointed a data protection officer. For any question about this policy or about your personal data, contact us at info@hbxparts.com or by post at the address above.

2. What data we process and why

Below, we describe each processing activity, the data involved, why we need it and the legal basis we rely on. References to the legal bases of Article 6(1) GDPR correspond to the equivalent legal bases in Article 12 ZZPL.

2.1 Visiting the Portal

When you visit the Portal, our hosting provider automatically processes the technical data that your browser sends: IP address, date and time of the request, the page or file requested, the referring URL, browser type and version, operating system and device type. We use your IP address to determine your approximate country, which selects the default language of the Portal. We need this data to deliver the Portal to you, to keep it secure and stable (for example to detect and block attacks) and to fix errors.

Legal basis: our legitimate interests in operating a secure, working website (Art. 6(1)(f) GDPR).

2.2 Applying for a business account

To open a customer account, you submit an application containing: company name, contact person's name, business address (country, city, postal code, street), tax identification number, email address, phone number and a password. We store the password only as a one-way cryptographic hash, so we cannot read it. Our sales team is notified of your application by email and reviews it before approving or declining it; we may check the company details against public business registers.

We use this data to assess your application, verify that you are a business, set up your account and contact you about your application.

Legal basis: steps taken at your request before entering into a contract, and performance of the contract (Art. 6(1)(b) GDPR), where you apply as a sole trader; otherwise our legitimate interests in establishing and managing business relationships with the company you represent (Art. 6(1)(f) GDPR).

2.3 Your customer account

Once your application is approved, we keep your account data: username (usually your email address), company and contact details, the password hash, the time of your last sign-in and account settings such as the price category assigned to your company. Signing in sets a session cookie that keeps you logged in (see our Cookie Policy). If you use the “My Product Codes” function, we store the item codes your company uses for our products.

If you forget your password, we email you a single-use reset link that expires after 45 minutes. For security, we record the time and IP address of each reset request and store only a hash of the link's token.

To resolve support requests, authorised HBX staff can view the Portal as your account sees it. Each such access requires a single-use token and is logged with the staff member and the time.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interests in operating a secure account system and providing support (Art. 6(1)(f) GDPR).

2.4 Order requests, orders and deliveries

When you send us an order request, or when we handle an order for you, we process: the products, quantities and prices; your purchase order reference and notes; delivery and invoicing addresses; contact persons and their contact details; and the related documents and correspondence, such as order confirmations, invoices, packing lists, shipping and customs documents. We send order confirmations and other order-related messages by email.

We use this data to review and confirm your order request, deliver the goods, invoice, handle payments, complaints and returns, and meet our accounting, tax and customs obligations.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR); compliance with legal obligations (Art. 6(1)(c) GDPR); and our legitimate interests in managing our business relationship with the company you work for (Art. 6(1)(f) GDPR).

2.5 Chat assistant

The chat assistant on the Portal is an AI system that answers questions about our products. When you use it, we process your messages, a random identifier for the chat session, the time, your approximate country and, if you are signed in, your customer number and company name. Your messages are sent to Google (Gemini API), which generates the replies on our behalf. We store the conversations so that we can follow up on questions, check the quality of the answers and improve the assistant.

Please do not enter personal data in the chat that is not needed for your question, and never enter sensitive data. Answers are generated automatically, may be inaccurate and are not binding offers; only our order confirmations are binding.

Legal basis: our legitimate interests in answering your questions efficiently and improving our service (Art. 6(1)(f) GDPR); where your question concerns a potential order, steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).

2.6 Analytics (only with your consent)

If you accept analytics in our cookie banner:

• we record product views, additions to the cart and search terms, together with your approximate country and, if you are signed in, your customer number. We store these as daily counts per product or search term, country and customer number. We do not build profiles of individuals;
• we use Vercel Web Analytics to measure page views. It records the page visited, the referring page, browser, operating system, device type and approximate location. It does not use cookies; visits are recognised using a hash derived from the request, which is discarded after 24 hours.

We use this information to understand which pages and products are of interest and to improve the catalogue and search. If you do not accept, none of this takes place.

Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time via “Cookie settings” at the bottom of every page. Withdrawal does not affect processing carried out before it.

2.7 Contacting us

When you contact us by email, phone or WhatsApp, we process your contact details and the content of your message in order to answer you and handle your request. WhatsApp is provided by WhatsApp (Meta), which processes your data under its own privacy policy. The WhatsApp button on the Portal is a plain link and sends no data to WhatsApp until you click it.

Legal basis: our legitimate interests in answering enquiries (Art. 6(1)(f) GDPR) or, where your request concerns a contract, Art. 6(1)(b) GDPR.

2.8 Legal obligations and legal claims

We also process personal data where necessary to comply with legal obligations, for example accounting, tax and customs record-keeping or requests from public authorities, and to establish, exercise or defend legal claims.

Legal basis: compliance with legal obligations (Art. 6(1)(c) GDPR) and our legitimate interests (Art. 6(1)(f) GDPR).

3. Where we get your data from

We collect most data directly from you. If you act for one of our customers, we may also receive your name and business contact details from your employer or colleagues, for example when they name you as a contact person or delivery contact. We may verify company details in public business registers, such as the register kept by the Serbian Business Registers Agency.

4. Who receives your data

Within HBX, only staff who need the data for their tasks (sales, order processing, logistics, accounting and support) have access to it.

We use the following service providers, who process personal data on our behalf and according to our instructions (processors):

• Vercel Inc. (USA): hosting and content delivery for the Portal and, with your consent, web analytics. The Portal's application servers run in data centres in the EU (Paris) and the USA (Washington, D.C.);
• Neon (USA): database hosting. Our database is located in the United States (Amazon Web Services, N. Virginia region);
• Google: business email (Google Workspace) and the AI model behind the chat assistant (Gemini API);
• Resend (USA): delivery of system emails, used as a backup channel;
• BunnyWay d.o.o. (bunny.net, Slovenia): storage and delivery of images and documents;
• IT service providers who develop, maintain and support the Portal for us.

Where necessary, we also share personal data with recipients who process it as independent controllers or where we are required to do so: carriers, freight forwarders and customs agents (to deliver your order); banks (to process payments); accountants, auditors and legal advisers (who are bound by professional confidentiality); and courts, tax, customs or other public authorities where we are legally obliged to disclose data.

We do not sell personal data, and we do not share it with third parties for their own advertising.

5. Transfers outside Serbia and the EEA

Some of our service providers are located, or process data, outside Serbia and the European Economic Area, in particular in the United States. Where the destination country does not ensure an adequate level of data protection, we transfer personal data only with appropriate safeguards, in particular standard contractual clauses (as adopted by the Serbian Commissioner for Information of Public Importance and Personal Data Protection and/or by the European Commission) or, for providers certified under it, the EU-U.S. Data Privacy Framework. You can request information about these safeguards by contacting us at info@hbxparts.com.

6. How long we keep your data

We keep personal data only for as long as we need it for the purposes described above, and then delete or anonymise it. In particular:

• Account and customer data: for as long as your company's account or business relationship with us exists and, after it ends, for as long as needed to deal with remaining questions and claims;
• Orders, invoices and related correspondence: for the retention periods required by accounting, tax and customs laws (generally up to ten years);
• Registration applications that are not approved: for as long as needed to process and document the decision, unless we need them to defend legal claims;
• Security records (password reset requests, logs of staff access to customer accounts): for as long as needed for security and accountability purposes;
• Chat conversations: for as long as needed to follow up on your questions and to improve the assistant;
• Analytics: daily counts for as long as they are useful to us; Vercel discards the visitor hash after 24 hours;
• Server logs: for short periods set by our hosting provider, unless we need them to investigate a security incident;
• Cookies and browser storage: as set out in our Cookie Policy.

7. Your rights

Subject to the conditions set out in the law, you have the right to:

• access your personal data and receive a copy of it;
• have inaccurate or incomplete data corrected;
• have your data erased, for example where we no longer need it;
• have the processing of your data restricted in certain cases;
• receive the data you provided to us in a structured, commonly used and machine-readable format and have it transmitted to another controller (data portability), where processing is based on consent or on a contract and is carried out by automated means;
• object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests;
• withdraw your consent at any time with effect for the future; for analytics, use “Cookie settings” at the bottom of every page.

To exercise your rights, email us at info@hbxparts.com. We will respond without undue delay and in any event within one month (30 days) of receiving your request. Where necessary, for example for complex or numerous requests, this period may be extended by up to two further months; we will tell you if this happens and why. We may ask you to confirm your identity before we act on your request.

You also have the right to lodge a complaint with a supervisory authority. In Serbia, this is the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti), Bulevar kralja Aleksandra 15, 11120 Belgrade, www.poverenik.rs. If you live or work in the European Union, you can also contact the data protection authority in your country.

8. Do you have to provide your data?

You do not need to provide personal data to browse the Portal. To open a customer account and place orders, we need the information marked as required in our forms; without it, we cannot approve an account or process orders. We do not make decisions based solely on automated processing, including profiling, that produce legal effects for you or similarly significantly affect you. Account applications are reviewed by our staff.

9. How we protect your data

We protect personal data with appropriate technical and organisational measures. These include encrypted connections (HTTPS/TLS), passwords stored only as salted hashes, single-use tokens stored only as hashes, role-based access for our staff and logging of staff access to customer accounts. No method of transmission or storage is completely secure, but we work to protect your data against loss, misuse and unauthorised access.

10. Children

The Portal is intended for businesses and is not directed at persons under 18. We do not knowingly collect personal data of children.

11. Cookies

For information about cookies and similar technologies on the Portal, and how to manage them, see our Cookie Policy.

12. Changes to this Privacy Policy

We may update this Privacy Policy when our services or the law change. The current version is always available on this page, with the date of the last update at the top. If we make material changes, we will inform registered customers by email or through the Portal.