Privacy Notice
Last updated: 29 October 2026.
1. Who we are
Uravia OÜ (“Sparehawk”, “we”, “us”), of Tornimäe tn 5, 10145 Tallinn, Estonia (registry code 17631710), is the controller responsible for the personal data described in this notice. Contact us at hello@sparehawk.com for any privacy question, or to exercise the rights in Section 6.
2. What we collect
- Search activity: the part numbers, keywords, and filters you search for, and which results you view. We use this to run and improve the search itself, and to understand which parts buyers need that we do not yet have supplier coverage for.
- RFQ / contact details: when you request a quote, the contact information you provide (typically name, company, email, and the part(s) you need), plus anything you write in a free-text message.
- Supplier account data: if you register as a supplier, your company details, contact person, and the inventory data you submit (see the Supplier Terms for how that data is used).
- Technical data: IP address, browser/device information, and basic usage logs, collected automatically for security, rate-limiting, and diagnosing issues.
We do not knowingly collect any special category of personal data, and the Service is not directed at children.
3. Why we process it (purposes and legal basis)
| Purpose | Legal basis |
|---|---|
| Operating and improving search and the catalogue | Legitimate interest in running the Service |
| Forwarding your RFQ contact details to a supplier you are matched with | Performance of your request (contract) |
| Fraud prevention, rate-limiting, abuse detection | Legitimate interest |
| Sending you a reply about an RFQ or support request | Performance of your request (contract) |
| Aggregated, de-identified demand analytics (e.g. “no supplier coverage for X”) | Legitimate interest |
4. Forwarding your data to suppliers
When you submit an RFQ, we share the details you provided (and the part you asked about) with the supplier(s) we match you to, so that supplier can contact you directly with a quote. Each supplier that receives your enquiry becomes an independent controller of the data we forward to them, governed by their own privacy practices for anything they do with it afterwards (see our Supplier Terms for the obligations we place on suppliers regarding this data, including a restriction on using it for unrelated marketing without your consent).
We do not sell your personal data, and we do not share it with suppliers other than the one(s) relevant to your specific request.
5. Retention
We retain RFQ and contact data for as long as reasonably necessary to fulfil the request and resolve any related support issue, and in any case no longer than 24 months after your last interaction, unless a longer period is required by law. Aggregated search/demand analytics that no longer identify you may be retained indefinitely.
6. Your rights
Subject to applicable law (including the GDPR, if you are in the EU/EEA/UK), you may have the right to: access the personal data we hold about you; correct it; request its deletion; restrict or object to certain processing; and receive a copy in a portable format. To exercise any of these, contact hello@sparehawk.com. If you are in the EU/EEA/UK, you also have the right to lodge a complaint with your local data protection authority. Our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee).
7. Sub-processors
We use the following third-party processors to run the Service:
- netcup GmbH, Germany (application hosting and database infrastructure; all data is stored on servers in Germany).
- Resend (transactional and RFQ-notification email delivery).
- Stripe (supplier subscriptions and billing; card details go directly to Stripe and never reach our servers).
- OpenAI (drafting replies, translating text and reading photos you upload to photo search).
- TypeSafe (automated classification and moderation of listings, messages, reviews and requests; it returns labels and scores, never text).
- Google Ireland Limited (Google Analytics; cookies and full measurement only with your consent — see section 8; and Google Workspace, the mailboxes our business outreach is sent from — see section 9).
- Instantly (Instantly.ai, United States: sends our business outreach e-mails and records replies, bounces and unsubscribes — see section 9).
Signing in with Google or GitHub. If you choose “Continue with Google” or “Continue with GitHub”, that provider confirms your email address to us. We receive and keep only that verified address; we do not receive your password and do not store your name, photo or any token from the provider. Google and GitHub act as independent controllers for your account with them. A short-lived cookie (sh_oauth, 10 minutes) links the provider’s answer to your browser and is deleted when sign-in finishes.
Processors outside the European Economic Area receive data only under the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework.
We only share the minimum data necessary with each processor for the purpose above, under a data processing agreement.
8. Cookies
The Service uses the cookies/local storage strictly necessary to run search and remember your language, currency and basket. These need no consent.
Google Analytics (cookies only with your consent). If you click “Allow” in the cookie banner, Google Analytics 4 (Google Ireland Limited) measures how the Service is used — pages viewed, approximate location derived from your IP address, device and browser type. Google Analytics sets its own cookies (_ga, _ga_*, kept up to 14 months). Advertising features, ad personalisation and data sharing for ads are switched off. The legal basis is your consent (Art. 6(1)(a) GDPR); Google may process the data in the United States under the EU–US Data Privacy Framework. Before you answer, and if you click “Decline”, the Google tag runs in Google’s Consent Mode with analytics storage switched off: it sets and reads no cookie and sends Google only cookieless signals that a page was viewed, without any identifier, which Google uses for aggregate, modelled statistics; Google Analytics 4 does not log or store IP addresses. You can change your choice at any time through “Cookie settings” at the bottom of every page.
We do not use advertising cookies.
Our own visit statistics (“Pulse”). To see where the site helps and where people give up, the Service records which of its pages each visitor opens and which of its main buttons they click (for example “search”, “send request”, “change language”). We record the page’s address without anything after ?, with secret link codes removed, the language, a coarse referrer type (search engine, social, email, direct), the country if the network provides it, and a code derived from your IP address that changes every day, so a visitor cannot be followed from one day to the next. We do not record what you type, your IP address itself, your name or your email, and we set or read nothing on your device for it. The data stays on our servers in Germany and is deleted after 90 days. The legal basis is our legitimate interest in running and improving the Service (Art. 6(1)(f) GDPR), which does not need the cookie banner. You can object at any time: a browser that sends “Do Not Track” or “Global Privacy Control” is not recorded, or write to us (section 1).
9. Business outreach to companies
We write to companies that sell spare parts to invite them to list their stock on Sparehawk.
- Where the address comes from. Only from public business listings and directories: a company’s own website, manufacturers’ dealer and distributor lists, trade association member directories, trade-show exhibitor lists, OpenStreetMap and similar public business directories. Every e-mail says which source your address came from.
- What we keep. The company name, its published business (role) address such as sales@ or info@, its website and country, the kind of parts it sells, and the source with the date we collected it. We do not look for private addresses, and we do not buy contact lists.
- Legal basis. Our legitimate interest in offering a business service to companies whose business it concerns (Art. 6(1)(f) GDPR). We send at most three e-mails, and none after you reply or object.
- Who handles it. The e-mails go out from separate Sparehawk mailboxes on Google Workspace through Instantly (section 7); Instantly is in the United States and receives the data under the Standard Contractual Clauses.
- Retention. If you do not answer, we delete your company’s outreach data 12 months after our last e-mail. If you object, we keep only your address (or a one-way code derived from it) and the date on our suppression list, indefinitely, so that we never write to you again.
- Your right to object. You can object at any time, free of charge and without giving a reason (Art. 21 GDPR): reply “stop” to any of our e-mails or use the unsubscribe link at its end, and we stop for good. Your other rights are in section 6.
10. Changes to this notice
We may update this notice from time to time; the “Last updated” date above will change accordingly. Material changes will be highlighted on this page.