Controller and contact
MB Helmar, company code 307683092, with registered office and business address at Raudonbalės g. 16A, LT-14187 Vilnius, Lithuania, decides how and why this data is used. Email privacy@axleward.co.uk for privacy questions or to exercise a right.
We collect information directly from you, from your browser when permitted, from the payment processor’s status response, and from delivery or support providers involved in your order.
UK representative
MB Helmar is established in Lithuania and offers goods to people in the United Kingdom. Before public orders open, MB Helmar must either appoint a UK representative in writing where Article 27 of the UK GDPR applies and publish that representative’s contact details here, or retain documented professional advice that a specific exemption applies.
No UK representative is currently named. Public checkout remains blocked until this requirement is resolved and the approved contact details, if required, are added to this notice.
Data we process and why
Order data includes name, email, optional phone, delivery address, vehicle selection, fit decision, items, price, timestamps, payment status and order-access records. We use it to take steps at your request, perform the sales contract, deliver, provide support and handle returns.
We use transaction, VAT, accounting and safety-traceability data to comply with legal obligations. We use limited technical, fraud and security logs for legitimate interests in protecting customers, the service and payments. Optional analytics or marketing data is used only under the consent choice shown in the preference centre.
- Contract: checkout, payment status, fulfilment, account, support and returns.
- Legal obligation: tax, accounting, product safety, recalls and lawful requests.
- Legitimate interests: service security, fraud prevention, incident investigation and aggregated performance, balanced against your rights.
- Consent: optional analytics and marketing communications; consent can be withdrawn at any time.
Information needed to place and fulfil an order
The customer name, checkout email, accepted delivery address, vehicle and fitment selections, items, quantity and successful payment status are required to enter and perform the sales contract. The payment provider requires its own payment details. Without the required information, we cannot safely accept, deliver or support the order.
A telephone number is optional in the current checkout unless an approved carrier service later makes it necessary and that requirement is disclosed before collection. Analytics, marketing, an account profile and non-essential cookies are not required to buy.
Payment information
Card entry is hosted by the configured payment processor. AXLEWARD receives payment status, processor references and limited card descriptors where made available, but not the full card number or card security code.
Do not send card details in support, return, safety or privacy messages.
International transfers
MB Helmar is established in Lithuania and serves customers in Great Britain. Providers may process data in the United Kingdom, European Economic Area or another country. Before a transfer to a country without an applicable adequacy decision, we must put in place an approved safeguard such as standard contractual clauses or the UK International Data Transfer Addendum and assess supplementary measures where needed.
The production provider and transfer map is not yet approved. Public checkout remains blocked until the actual destinations, safeguards and customer information are verified. After approval, you may ask the privacy contact for information about the safeguard relevant to a specific provider.
How long we keep it
We retain data only for the purpose, legal obligation and claims period that applies. We then delete or irreversibly anonymise it, subject to backups that age out on a controlled schedule.
- Abandoned guest-cart link: approximately 2 hours in the browser; related server records age out under the commerce cleanup schedule.
- Order, invoice, VAT and payment-status records: up to 10 years where accounting or tax law requires it.
- Support, fitment evidence, returns and complaints: normally 6 years after resolution, longer only for an active claim, safety investigation or legal duty.
- Order and account browser-access cookies: 30 days, unless removed sooner.
- Consent choice and pseudonymous consent reference: 12 months in the browser; decision evidence retained as necessary to demonstrate compliance.
- Optional analytics: according to the configured provider retention, no longer than 14 months for user-level event data unless a shorter period is selected.
Fitment rules and automated decisions
The vehicle checker applies versioned fitment records and rules to the make, model, year and variant you select. The result can allow checkout, require a stated physical check, or block an Unknown or Unsupported selection. The order retains the decision and the dataset version used.
We do not use this storefront to make a solely automated credit, insurance or similar decision that produces legal or similarly significant effects. If you believe a fit result is wrong, contact support for a human review and correction route before ordering.
Children
The store and its products are intended for adults who can enter a sales contract. We do not knowingly invite a child to create an order, account or marketing profile.
If you believe a child has provided personal data without appropriate authority, contact the privacy address so we can investigate and take the action the law requires.
How access is protected
Checkout, order and account access use scoped, expiring browser sessions. Passwordless links are single-use and require deliberate confirmation so an automated email scanner cannot open the customer area. Payment-card entry remains inside the payment provider’s hosted fields.
No online service can promise absolute security. Keep private links and devices secure, sign out on a shared device and report suspected unauthorised access. We limit access, retain audit records and follow an incident process appropriate to the risk.
Your rights
Depending on the processing and applicable law, you may request access, correction, deletion, restriction or portability, object to processing based on legitimate interests, and withdraw consent without affecting earlier lawful processing.
You may object to direct marketing at any time. If you do, we stop using your personal data for that direct marketing. Use the unsubscribe control in a message or contact the privacy address.
Use the privacy controls in My account or email the privacy contact. We may need proportionate information to verify identity and protect the account. We normally respond within one month, subject to lawful extensions.
Complaints
Please contact us first so we can investigate. You may also complain to the Lithuanian State Data Protection Inspectorate, or to the UK Information Commissioner’s Office where UK data-protection law applies to the processing. You can complain in the country where you live or work or where the alleged infringement occurred.
Changes to this notice
We publish the current notice and revision date here. Material changes affecting an existing relationship may also be communicated through the order or account contact where appropriate.