Privacy policy

Last updated: 4 November 2026

1. Who is responsible for your data

The controller is Ximport Express LLC, 16192 Coastal Highway, Lewes, DE 19958, USA. Address in Romania: 71 Sf. Ilie, Vișan, Iași 707041, Romania. For any question about your personal data, or to exercise your rights, write to [email protected] or by post to one of these addresses.

2. Our principles

We process personal data lawfully, fairly and transparently; only for clear purposes; only as much as needed; accurately; for no longer than necessary; and securely, as required by the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”).

3. What we collect, why, and on what legal basis

• Order requests and orders: name, email, phone, delivery address, optional VIN, notes, the parts requested and, for companies, the company name and VAT number. We use them to prepare the quote, process the payment, order and deliver the parts, handle returns and warranty, and keep the accounting records. Legal basis: steps at your request before a contract and performance of the contract (Art. 6(1)(b) GDPR); legal obligations, for example tax and accounting (Art. 6(1)(c)).
• Messages sent through the contact form, by email or on WhatsApp: name, email or phone number and the content of the message, to answer you. Legal basis: our legitimate interest in answering enquiries (Art. 6(1)(f)), or steps before a contract.
• Technical data: IP address, browser and device type, pages requested, date and time. They are needed to deliver the website securely, prevent abuse and spam, and fix errors. For spam limits we store only a one-way hashed form of the IP address. Legal basis: legitimate interest in running and protecting the website (Art. 6(1)(f)).
• Cookies: see the Cookie policy. We use only cookies that are necessary for the website to work; statistics or marketing cookies would be used only with your consent (Art. 6(1)(a)).

We do not send newsletters or advertising unless you ask for them, and we do not make decisions about you based solely on automated processing or profiling. We do not sell personal data.

4. Who receives your data

Only the recipients needed for the purposes above, under data processing agreements or their own legal obligations:

• our hosting provider (Hetzner Online GmbH, servers in Germany) and our email provider;
• Cloudflare, Inc., which delivers the website quickly and protects it against attacks (it processes technical data such as your IP address);
• the courier that delivers your parcel (Packeta and its partner courier in your country) — name, address, phone and email, so they can deliver and notify you;
• our bank (for payments and refunds), our accountants and, where the law requires it, public authorities;
• Google, only to show our Google reviews on the home page: the reviewers’ profile pictures are loaded from Google’s servers, which therefore see your IP address;
• WhatsApp (Meta Platforms Ireland Ltd.), only if you choose to write to us on WhatsApp: your messages and phone number are then also processed under WhatsApp’s own terms and privacy policy.

Our suppliers in the USA receive only the order details they need to supply the parts; your contact details are passed to them only if a supplier needs them to process your order or a warranty claim.

5. Transfers outside the EU / EEA

Ximport Express LLC is a company registered in the USA. The website and its database run on servers in the EU (Germany), and orders are handled by our team in Romania. Where personal data is transferred outside the EU / EEA (for example to Cloudflare, Inc. or Google), it is protected by the appropriate safeguards required by the GDPR, such as the EU–U.S. Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

6. How long we keep it

• Orders, invoices and payment records: for the period required by tax and accounting law.
• Order requests that did not become an order: 24 months, then deleted.
• Contact messages: 12 months after the conversation ended, unless they relate to an order.
• Server logs: up to 14 days.

7. Security

We protect personal data with technical and organisational measures: encrypted connections (HTTPS), restricted access to the server and database, firewalls, updates and regular backups.

8. Your rights

You have the right to access your data, to have it corrected, to have it erased, to restrict its processing, to receive it in a portable format, to object to processing based on legitimate interest, and to withdraw your consent at any time (without affecting earlier processing). Write to [email protected]; we reply within one month. We may ask you to confirm your identity.

You can also lodge a complaint with the data protection authority of your country of residence. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro).

9. Minors

The website is intended for persons aged 18 or over. We do not knowingly collect data about minors.

10. Changes

We may update this policy, for example when we add a new service. The current version is always published on this page, with the date of the last update.