Privacy Policy

1. Who is responsible for your data

Night Sky Auto Accessories Trading L.L.C, trading as PartMate (trade licence 823159, United Arab Emirates), is the controller of the personal data collected through partmate.ae. You can reach us using any of the contact details at the bottom of this page.

2. What we collect

We collect only what an order or an enquiry actually requires:

• Identity and contact details — your name, mobile number, email address and delivery address.
• Order information — the products you bought, the amounts, any discount code you used, and the delivery method and status.
• Account information — if you create an account: your name, email address and mobile number, and your password, which we store only as a salted one-way hash (we cannot read it). An account is also created for you when you first place an order, so that you can track it.
• Saved addresses — if you choose to save delivery addresses in your account, so that the checkout can fill them in for you next time.
• Vehicle details you send us — make, model, year, VIN or photographs, when you ask us to confirm fitment or source a part.
• Technical information — see the section on cookies and analytics below.

What we do not collect

We never see or store your full card number, expiry date or security code. Card, Apple Pay and Google Pay payments are processed by Stripe or Paymob, and instalment payments by Tabby; we retain only the payment reference those providers return to us, so that we can match a payment to an order and process a refund.

3. Why we use it, and on what basis

• To fulfil your order — process the payment, deliver the goods, and handle returns and warranty claims. This is necessary to perform our contract with you.
• To support you — answer questions about fitment, availability and order status.
• To meet legal obligations — keep tax and accounting records as UAE law requires.
• To improve the site — understand which pages are used and where visitors have difficulty. This is our legitimate interest, and the measurement we use for it is described below.

We do not sell your personal data, and we do not share it for anyone else’s marketing.

4. Who we share it with

We disclose personal data only to:

• Delivery partners (NasEX, Emirates Post, DHL) — the name, address and phone number needed to deliver your parcel;
• Payment providers (Stripe, Paymob, Tabby) — the details they need to take and, where applicable, refund the payment. For a Paymob payment that is your name, email address, mobile number, delivery address and the items and total of the order;
• Service providers who host or maintain the site under contract, and who may not use the data for their own purposes;
• Measurement and advertising providers (Google, and Meta or Microsoft where enabled) — the usage and purchase information described in section 5;
• Authorities, where we are legally required to disclose.

5. Cookies and measurement

Cookies are small files stored on your device. We use two kinds, and we treat them differently:

• Necessary cookies and local storage. These keep your basket and your signed-in session working, and remember the orders you placed on this device (a code per order, kept for 60 days and cleared when you sign out) so that you can open them on My account. If you choose a vehicle as “My car”, its make, model and year are kept in this browser too, so the shop can show the parts that fit. To count and suggest those parts the shop asks our catalogue for that make, model and year, the same way a search does: nothing that identifies you goes with it, and we do not store it. “Forget my car” removes it. The site cannot function without them, so they are set without asking.
• Analytics and marketing scripts (Google Analytics and Microsoft Clarity). These load when you use the site and set their own cookies, so that we can see how the shop is used and how well our advertising works. You can block them with your browser’s privacy settings or a content blocker; the shop keeps working without them.

Purchase measurement. When you complete an order, the site tells Google Analytics what was bought, the order total and the discount code used, if any, so that we can measure our advertising. With that event it sends a one-way encrypted (SHA-256 hashed) form of the email address and mobile number on the order — Google’s “enhanced conversions” — which lets Google match the purchase to an ad you saw without receiving the address or number itself. The same applies to a part request you send us.

Session recording. Microsoft Clarity records how our pages are used — clicks, scrolling and where visitors get stuck — so that we can fix what is hard to use. It is paused while a card payment form is open and resumes only after the payment is finished, and that form is marked so that it never appears in a recording. Card details themselves are typed into the payment provider’s own secure frame, which neither Clarity nor we can see.

We also run our own page-view counter. It stores no identity: instead of an IP address or a device fingerprint, it records a one-way hash that is re-salted every day, so yesterday’s visits cannot be linked to today’s or traced back to a person. Those records are automatically deleted after a short retention period.

You can block or delete cookies in your browser settings. Blocking necessary cookies will stop the basket and sign-in from working.

6. How long we keep it

• Order and invoice records — for as long as UAE tax and commercial law requires.
• Account details — until you ask us to delete the account.
• Saved addresses — until you delete them in your account, or the account is deleted.
• Account links we email you (set or reset a password, confirm an email address) — they expire after a short time and then stop working.
• Site analytics — a short retention window, after which the rows are deleted automatically.

7. How we protect it

The site is served only over encrypted HTTPS connections. Access to customer data is limited to staff who need it, back-office accounts are protected by individually hashed passwords and per-section permissions, and administrative actions are logged. Our error log deliberately records diagnostics only — never request bodies, headers, tokens or passwords.

No system can be guaranteed absolutely secure, but if a breach ever affects your personal data we will notify you and the relevant authority as the law requires.

8. Your rights

Under UAE data protection law you may ask us to give you a copy of the personal data we hold about you, correct it if it is wrong, delete it where we are not required to keep it, or restrict how we use it. You may also object to processing based on our legitimate interests.

Write to us using any of the contact details below. We will respond within 30 days. There is no charge, and we will only ask you to confirm your identity so that we do not disclose your data to someone else.

9. Children

This site is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

10. International transfers

The site and its database are hosted in the United Arab Emirates. Some of our service providers — payment gateways and, where enabled, analytics providers — process data outside the UAE. Where that happens we rely on those providers’ contractual data protection commitments.

11. Changes to this policy

If we change how we handle personal data we will update this page and change the review date shown at the top. Material changes will be announced on the site.

12. Governing law

This policy is governed by the laws of the United Arab Emirates, and any dispute concerning it is subject to the exclusive jurisdiction of the UAE courts.