PRIVACY POLICY

PartsHub is a customer-facing digital commerce and sales platform operated by HKR Equipment Corporation (“HKR”). HKR is the organization responsible for the processing of personal information collected through the PartsHub website and related official customer-service channels, to the extent HKR determines the purposes and means of such processing.

PartsHub is a brand and digital sales channel. It is not presented as a separate legal entity.

This Privacy Policy explains what personal information PartsHub/HKR may collect, why it is collected, how it is used, with whom it may be shared, how long it may be retained, how it is protected, and the rights available to data subjects.

It is intended to support transparency and lawful processing under Republic Act No. 10173, the Data Privacy Act of 2012 (“DPA”), its implementing rules and regulations, and applicable National Privacy Commission (“NPC”) issuances.

Depending on how you interact with PartsHub, we may collect:

• Name and position/designation.
• Company/business name and business contact information.
• Email address and mobile/telephone number.
• Billing and delivery address.
• Account username, password and account-related information, where accounts are offered.
• Order history, RFQ details, product/part numbers, equipment models and customer support communications.
• Payment-related information such as payment method, transaction reference, payment status and billing information. Full card details may be processed directly by a payment provider and may not be stored by PartsHub/HKR.
• Documents, photographs or technical information submitted for RFQ, compatibility, warranty or support purposes where reasonably necessary.
• Information provided in complaints, return/refund requests and warranty claims.
• Device, browser, IP address, approximate location information, website usage information and cookie identifiers where applicable.
• Information necessary to comply with tax, accounting, audit, legal, regulatory, fraud-prevention and security requirements.

PartsHub does not intentionally collect sensitive personal information unless there is a specific lawful and necessary reason to do so.

• Directly from customers when they create an account, place an order, submit an RFQ, contact customer support or submit a complaint.
• Automatically through website technologies such as cookies, server logs and analytics tools, subject to the applicable cookie settings and notice.
• From payment providers, couriers/logistics providers and other transaction partners when necessary to complete or support a transaction.
• From authorized representatives of business customers.
• From publicly available business information where reasonably necessary for legitimate business purposes.

We may process personal information for the following purposes:

• To create and manage customer accounts.
• To receive, validate, process and fulfill orders.
• To process and respond to RFQs and technical inquiries.
• To verify product compatibility where customer-provided information is necessary.
• To arrange payment, delivery, tracking and proof of delivery.
• To issue invoices and maintain accounting, tax and transaction records.
• To administer returns, replacements, refunds and warranty claims.
• To respond to complaints and operate the internal redress mechanism.
• To provide customer service and technical support.
• To prevent fraud, unauthorized transactions, abuse, cybersecurity incidents and other unlawful activity.
• To comply with legal and regulatory obligations, including tax, accounting, audit, consumer-protection and lawful government requests.
• To maintain, secure, troubleshoot and improve the website and related systems.
• To analyze website performance and customer experience using appropriate safeguards.
• To send service-related communications, such as order confirmations, delivery updates and account notices.
• To send promotional or direct-marketing communications where permitted and subject to applicable consent/opt-out requirements.

Depending on the specific processing activity, HKR may rely on one or more lawful bases recognized under the DPA, including:

• Processing necessary to perform a contract with the data subject or to take steps at the data subject's request before entering into a contract.
• Processing necessary to comply with a legal obligation, including tax, accounting, invoicing and regulatory requirements.
• Consent, where consent is the appropriate legal basis.
• Legitimate interests of HKR or a third party, where lawful and where such interests are not overridden by the fundamental rights and freedoms of the data subject.
• Other lawful bases recognized by the DPA and applicable NPC issuances.

We may send transactional and service communications necessary to administer your account or transaction. Promotional communications will be handled in accordance with applicable law and may provide an appropriate method to opt out or withdraw consent where consent is the applicable basis.

Opting out of promotional communications will not necessarily stop essential transaction, security, account or legal communications.

PartsHub may use cookies and similar technologies for essential website functions, account/session management, security, analytics and, where applicable, marketing or personalization.

Where consent is legally required for a particular cookie or technology, PartsHub will provide an appropriate consent or preference mechanism. Customers may also adjust browser settings, although disabling certain cookies may affect website functionality.

HKR may disclose personal information only as reasonably necessary for legitimate and declared purposes and subject to applicable law. Potential recipients include:

• Authorized HKR personnel who need the information to perform their duties.
• Payment gateways, banks, acquiring institutions and payment service providers.
• Courier and logistics providers for delivery and proof-of-delivery purposes.
• Website hosting, cloud, software, cybersecurity, customer-service and technical service providers acting as processors or otherwise providing services to HKR.
• Professional advisers, auditors, insurers and legal counsel where reasonably necessary.
• Government agencies, courts, regulators or law-enforcement authorities when disclosure is required or authorized by law.
• Other parties where disclosure is necessary to establish, exercise or defend legal claims or to protect lawful rights and interests.

Where a third party processes personal information on HKR's behalf, HKR will implement appropriate contractual and organizational safeguards consistent with applicable data privacy requirements.

Some technology, payment, cloud, analytics or service providers may process information outside the Philippines. Where cross-border processing or transfer occurs, HKR will apply appropriate safeguards and contractual/organizational measures required by applicable law and NPC issuances.

HKR retains personal information only for as long as reasonably necessary for the declared purposes, including fulfillment of transactions, customer support, warranty administration, accounting, tax, audit, legal claims, regulatory obligations, security and legitimate business needs.

Some transaction and accounting records may need to be retained for periods required by tax, accounting or other applicable laws. When personal information is no longer required, HKR will implement appropriate disposal, deletion, anonymization or other lawful retention measures.

HKR implements reasonable and appropriate organizational, physical and technical measures designed to protect personal information against accidental or unlawful destruction, alteration, loss, unauthorized access, disclosure, misuse or other unlawful processing.

• Role-based access and authorization.
• Administrative account controls and, where appropriate, multi-factor authentication.
• Secure transmission technologies such as HTTPS/TLS.
• Reasonable system logging and monitoring.
• Access review and removal of unnecessary privileges.
• Backups and recovery controls appropriate to the system.
• Confidentiality obligations for personnel and authorized processors.
• Security procedures for payment, customer support and transaction systems.
• Incident response and breach-management procedures.

No method of transmission or electronic storage can be guaranteed to be completely secure. HKR will nevertheless maintain measures appropriate to the risks presented by the processing.

If HKR becomes aware of a personal data breach or security incident involving PartsHub information, HKR will assess and manage the incident in accordance with its internal incident-response procedures, the DPA, its implementing rules and applicable NPC requirements, including notification obligations where applicable.

Customers may report suspected unauthorized access, phishing, fraudulent payment instructions or other privacy or security incidents by emailing tsesales@hkr.com.ph for referral to the appropriate HKR personnel.

Subject to the DPA and applicable exceptions, data subjects may have rights including:

• Right to be informed about processing of personal information.
• Right to access personal information and relevant processing information.
• Right to correct inaccurate or incomplete personal information.
• Right to object to certain processing, including where applicable direct marketing or processing based on legitimate interests.
• Right to withdraw consent where consent is the applicable basis, without affecting processing lawfully performed before withdrawal.
• Right to data portability where applicable.
• Right to request blocking, removal or destruction where provided by law and applicable circumstances exist.
• Right to lodge a complaint with the National Privacy Commission.
• Other rights provided by applicable Philippine privacy laws and regulations.

Some rights are subject to legal limitations, exemptions, identity verification and other conditions under the DPA and NPC rules.

To exercise your privacy rights, email tsesales@hkr.com.ph with the subject line “PartsHub Privacy Request” for referral to the appropriate HKR personnel.

To protect customers from unauthorized disclosure, HKR may request reasonable information necessary to verify the identity and authority of the requester.

HKR will respond to valid requests within the periods required by applicable law and will explain where a request cannot be fully granted because of a legal, contractual, security or other lawful limitation.

If a data subject believes that their privacy rights have been violated or that their personal information has been processed unlawfully, they may contact HKR first through the privacy contact above and may also exercise the right to lodge a complaint with the National Privacy Commission, subject to applicable NPC procedures.

Official NPC information is available at https://privacy.gov.ph/.

PartsHub is intended primarily for commercial and business transactions and is not directed to children. We do not knowingly seek to collect personal information from children for purposes unrelated to lawful services. If information concerning a child is provided to us in circumstances requiring special handling, HKR will process it in accordance with applicable law.

PartsHub primarily serves businesses and organizations. However, individuals acting on behalf of businesses may provide personal information such as their name, position, mobile number, email address and signature. Such information remains personal information where an individual is identifiable and is processed under this Privacy Policy and applicable law.

PartsHub may contain links to manufacturer websites, payment providers, courier tracking pages, social-media services or other third-party sites. Those services may have their own privacy policies and terms. HKR is not responsible for the privacy practices of third-party websites outside its control.

HKR may update this Privacy Policy when website functions, processing activities, legal requirements or business practices change. The updated version will be posted on the PartsHub website with an updated effective date. Material changes will be communicated through appropriate means where required by law.

Website / Brand: PartsHub

Personal Information Controller: HKR Equipment Corporation

Business Address: 9705 Kamagong St., San Antonio Village, Makati 1203, Metro Manila, Philippines

Customer Service and Privacy Inquiries: tsesales@hkr.com.ph

Effective Date: October 6, 2026

Last Updated: October 27, 2026