Privacy policy

Railspare puts rail operators in touch with spare part suppliers. Doing that means handling personal data: who asked for a quote, and who wants to answer. This page says what we hold, why, who sees it and for how long.

Who is responsible

Emmanuel NICOLAS, Entreprise Individuelle (EI), 2 chemin du midi, 63960 Veyre-Monton, France (SIREN 752 754 192) is the data controller. Contact: contact@railspare.com.

Given the size of the business, no Data Protection Officer has been appointed. The publisher answers these questions directly.

If you post a request for quotation

We collect what you type into the form, plus a few technical details:

• your company name, the address the parts are to be delivered to, and your country;
• your name, job title, email address and telephone number;
• the part you need, the original supplier, the quantity and your description;
• any documents you attach;
• your IP address, kept to detect abuse of the form. It is also sent to Cloudflare, with the answer to the anti-robot check, for that check alone.

What we do with it

A supplier who pays to unlock the request receives your company name, your name, your email address, your telephone number, your address and everything you wrote or attached. That is the point of the platform: it is how they are able to quote you. More than one supplier may unlock the same request. We do not tell you which ones; they contact you directly.

The legal basis is our legitimate interest, and yours, in putting your request in front of suppliers who can answer it — which is the reason you submitted it. If you would rather it were withdrawn, write to us and we will delete it.

If you register as a supplier

• your company name, your name, your email address, telephone number and country;
• your password, stored only as a bcrypt hash — we never hold the password itself;
• the part categories you choose;
• We never see or store your card details — those go straight to Stripe.

The legal basis is performance of the contract between us: the account, the alerts, and the leads you buy.

We also record the email domain of your address. It is used for one purpose: refusing a second free account for a company that already has one.

Who else sees this data

Recipient	What for	Where
Suppliers who pay for your lead	Your request and your contact details, so they can quote you	Worldwide
Stripe	Taking payment. Card details go to Stripe directly, never through us	Ireland / United States
Resend	Sending the emails this service depends on	Ireland (EU)
Cloudflare	Telling a person from a robot on the request form. Sets no cookie and does not track you across sites	Worldwide
HostGator (Newfold Digital, Inc.)	Hosting the site and its database	Ashburn, Virginia, United States

We do not sell personal data to anyone, and we do not share it for advertising.

Data leaving the European Union

The servers that run this site and hold its database are in Ashburn, Virginia, United States. Everything described above is therefore stored outside the European Union, and Stripe may also process payment data in the United States.

Transfers of that kind need a legal framework — the EU–US Data Privacy Framework where the recipient is certified under it, or the European Commission's Standard Contractual Clauses. If you want to know exactly which applies to a given recipient, ask us and we will tell you.

How long we keep it

Data	Retention
Requests for quotation and their attachments	A request that was sent out to suppliers is kept as the record of what was released to whom. One that never was is deleted automatically after 12 months, attachments included. Either is deleted sooner on request.
Supplier accounts	For as long as the account exists, then deleted on request.
Registrations never confirmed	Deleted automatically after 30 days.
Payment records	Ten years, as French accounting law requires.
Sent emails	30 days. Failed ones, 90 days, so a delivery problem can be investigated.
Anti-abuse records (IP addresses)	24 hours — including the address recorded with a request, which is erased while the request itself is kept.
Server logs	Kept for security and troubleshooting, then deleted.

Cookies

This site sets one cookie, and only for people who sign in: a session cookie that keeps you signed in. It carries no identifying information beyond a random session identifier, and it is deleted when you close your browser.

There is no analytics, no advertising pixel and no third-party tracker. The banner you saw on your first visit records your choice so that the gate exists the day anything non-essential is added — your answer is stored in your own browser and never reaches our servers.

Your rights

Under the GDPR you may ask for access to your data, correction of it, deletion, restriction of its use, its portability, and you may object to our processing it. Write to contact@railspare.com. We answer within one month. Details already sent to a supplier who unlocked the request cannot be recalled.

If you believe your data has been mishandled you may complain to the CNIL, 3 place de Fontenoy, 75007 Paris — cnil.fr.

Security

The site is served over HTTPS only. Passwords are stored as bcrypt hashes. Confirmation and password-reset links are stored hashed, so a copy of the database would not let anyone use them. Documents attached to a request are stored outside the public web directory and are only served to the publisher and to a supplier who has paid for that request.

No system is perfect. If you find a weakness, please tell us at contact@railspare.com before telling anyone else, and we will fix it.

Changes

If this policy changes in a way that affects you, we will say so on this page and update the date at the top.