1. Scope and Your Acknowledgement

This Privacy Policy applies to personal information collected through XLmotorcycleparts.com, our checkout, customer accounts, marketing communications, customer service, orders, returns, warranty claims, promotions, and related business activities.

By using the website, you acknowledge that you have had an opportunity to read this policy. Acknowledging this policy does not, by itself, create express consent to receive marketing communications where applicable law requires separate consent.

2. Personal Information We Collect or Process

“Personal information” means information that identifies, relates to, describes, or can reasonably be linked with an identifiable person. It does not include information that has been lawfully anonymized or de-identified so that it cannot reasonably identify or be linked with a person.

Depending on how you interact with us, where you live, the services you use, and what applicable law permits or requires, we may collect or process the following categories of personal information:

• Contact information: name, email address, telephone number, billing address, shipping address, and other delivery details.
• Order and transaction information: products viewed, searched for, added to a cart or wishlist, purchased, returned, exchanged, cancelled, or reviewed; order numbers; transaction dates; shipment and delivery information; discounts; refunds; and purchase history.
• Payment information: payment method, payment status, billing details, transaction identifiers, and limited payment-card details made available to us by payment providers. Complete card numbers are generally processed by Shopify and payment providers rather than stored directly by us.
• Account information: account identifiers, login details, saved addresses, preferences, settings, and account activity.
• Honda XL, XR and fitment information: model, model suffix, model year, market, engine, carburetor, ignition system, electrical system, original equipment configuration, road or off-road classification, modifications, part requirements, measurements, and other information supplied to identify or support a product application.
• Communications: emails, messages, telephone-call details, customer-service requests, Honda XL or XR fitment questions, technical information, return, warranty and fitment-guarantee information, photographs, reviews, survey responses, and other content you provide to us.
• Device and network information: IP address, browser, device type, operating system, language, approximate location, network connection, unique identifiers, and similar technical information.
• Website and marketing activity: pages viewed, links selected, search terms, referring pages, dates and times, session activity, cart activity, purchases, advertising interactions, email delivery, email opens, and email-link clicks.
• Fraud, security, and compliance information: risk scores, authentication results, transaction checks, suspected fraud indicators, chargeback information, blocked activity, consent records, unsubscribe records, and suppression-list information.
• Inferences: interests, likely product preferences, customer segments, purchase intent, and other conclusions created from the information described above.

Sensitive Personal Information

We do not ask customers to provide sensitive personal information that is not reasonably necessary for a transaction or service request. Please do not send health information, government identification numbers, account passwords, full payment-card numbers, or other highly sensitive information through ordinary email or website contact forms.

3. Sources of Personal Information

We may collect personal information from the following sources:

• Directly from you, including when you place an order, create an account, contact us, submit a form, enter a promotion, write a review, request a return, or otherwise provide information.
• Automatically from your browser, device, or use of the website, including through cookies, pixels, tags, scripts, local storage, server-side tools, log files, and similar technologies.
• From Shopify and other service providers, including ecommerce, payment, fraud-prevention, shipping, analytics, advertising, communications, customer-service, review, and technology providers.
• From business and marketing partners, advertising platforms, identity-resolution providers, data providers, referral partners, and other third parties where permitted by applicable law.
• From publicly available and lawful sources, where collection and use are permitted.

4. Cookies, Pixels and Similar Technologies

We and our service providers may use cookies, pixels, tags, scripts, local storage, software development kits, application programming interfaces, server-side technologies, browser or device identifiers, and technologies that do not rely on conventional cookies.

These technologies may be used to:

• Operate the website, cart, checkout, customer account, and security features;
• Remember preferences and maintain website sessions;
• Detect fraud, abuse, bots, and unauthorized activity;
• Understand website traffic and customer interactions;
• Measure website, advertising, and marketing performance;
• Personalize content and product recommendations;
• Create or measure advertising audiences;
• Recognize returning visitors or devices;
• Measure email delivery, opens, and clicks; and
• Support identity resolution and permitted marketing activities.

Cookie and Tracking Choices

Where the website displays a cookie or privacy-preference control, you can use that control to make available choices regarding non-essential cookies and similar technologies. You can also access available cookie preferences through the website footer where that option is provided.

Privacy choices may be specific to the browser, device, domain, or store where the choice is made. You may need to repeat the choice when using a different browser or device or after deleting cookies or browser storage.

Some technologies use server-side, browser, device, network, or other signals rather than conventional cookies. Our consent controls are intended to apply to compatible non-essential technologies where required by applicable law. Strictly necessary technologies may continue to operate where required for security, fraud prevention, checkout, order processing, consent recording, or another essential function.

If you believe a cookie or tracking preference was not honoured, contact us using the information at the end of this policy.

5. Identity Resolution and OpenSend

As a result, we may receive an email address or other basic identifier even when the visitor did not type that information into XLmotorcycleparts.com, complete a purchase, create an account, or directly subscribe through our website.

OpenSend represents to us that contact information supplied through its service comes from a network of U.S. consumer profiles whose users have consented or otherwise authorized their information to be used for partner marketing as described by OpenSend. This is OpenSend’s representation regarding its data sources and consent framework.

We may use information received through OpenSend to recognize website visitors, create or update a customer profile, understand website activity, measure marketing performance, prevent duplicate records, create marketing audiences, and send marketing emails where permitted by applicable law.

Receiving information through OpenSend does not mean that the person directly subscribed through XLmotorcycleparts.com. We do not describe an OpenSend-identified visitor as having directly signed up through our website unless that person actually completed a direct signup or another action that supports that description.

Information supplied or matched by an identity-resolution provider may be inaccurate, outdated, incomplete, or associated with the wrong person, household, browser, or device. If you believe information was matched incorrectly, contact us. We will investigate and, as appropriate and required by law, correct, delete, restrict, or suppress the information.

We do not treat a website visit or an identity match alone as consent to receive marketing text messages where applicable law requires express consent for text messaging.

6. How We Use Personal Information

Providing Products and Services

To operate the website; display products; process payments; accept, review, fulfill, ship, change, cancel, return, exchange, and refund orders; provide customer accounts; respond to Honda XL and XR fitment and technical questions; administer returns, warranties, and fitment-guarantee requests; and provide customer service.

Personalization and Improvement

To remember preferences, recommend products, understand how customers use the website, improve navigation and content, measure performance, develop products and services, and create a more relevant shopping experience.

Marketing and Advertising

To send marketing and promotional communications by email, text message, or postal mail where permitted; create and manage marketing audiences; deliver or measure advertising; attribute purchases and conversions; recognize returning visitors; and evaluate the effectiveness of campaigns.

Communications

To respond to questions, provide order and account notices, communicate about returns or warranty claims, send service and security messages, and maintain our business relationship with customers.

Security and Fraud Prevention

To authenticate users, protect accounts, screen transactions, prevent fraud and chargebacks, identify suspicious or unlawful activity, protect customers and the public, enforce website rules, and secure our systems.

Legal, Recordkeeping and Business Purposes

To comply with laws, tax and accounting requirements, subpoenas, court orders, regulatory requests, and lawful government demands; establish, exercise, or defend legal claims; enforce contracts and policies; conduct audits; preserve records; complete a business transaction; and protect our rights and property.

7. Legal Bases for Processing

Where applicable law requires us to identify a legal basis for processing, we may rely on one or more of the following:

• Contract: processing necessary to provide requested products or services, complete a purchase, manage an account, or take requested steps before entering into a transaction.
• Legitimate interests: operating and improving our business, protecting the website, preventing fraud, maintaining records, understanding customers, and conducting permitted direct marketing, provided those interests are not overridden by applicable privacy rights.
• Consent: where you have provided consent and applicable law requires or permits us to rely on it, including for certain cookies, tracking technologies, marketing messages, or optional activities.
• Legal obligations: processing required to comply with tax, accounting, consumer-protection, privacy, anti-spam, safety, legal process, and other applicable obligations.
• Vital or public interests: processing necessary to protect life, safety, or important public interests where recognized by applicable law.

Where consent is the legal basis, you may withdraw it subject to applicable law. Withdrawal does not affect processing already lawfully completed before the withdrawal.

8. Marketing Communications

We may send marketing emails when the recipient directly subscribes, when an existing relationship or another lawful basis permits the message, when a third-party provider represents that the contact information was authorized for applicable partner marketing, or when another basis permitted by applicable law applies.

Marketing messages will include sender identification, contact information, and an unsubscribe or preference mechanism where required.

Email Marketing

You may unsubscribe from promotional email at any time by using the unsubscribe link in the message or by contacting us. We will process the request as promptly as reasonably practicable and within the time required by applicable law.

After an unsubscribe request, we may retain the email address and limited related information on a suppression list. This helps us honour the request, demonstrate compliance, prevent accidental re-addition, and communicate the suppression instruction to providers that send marketing on our behalf.

Text Message Marketing

Where we offer text-message marketing, it is subject to the consent, disclosure, and opt-out requirements applicable to that program. You may opt out by following the instructions in the message, including replying STOP where supported.

Service and Transactional Communications

Opting out of promotional messages does not prevent us from sending non-promotional communications that are reasonably necessary for an order, account, payment, shipment, return, warranty claim, security issue, legal notice, or customer-service request.

Email Measurement

Marketing emails may contain pixels, tracked links, or similar technologies that record delivery, opens, clicks, device information, and related engagement. Available choices may be provided through the email, website privacy controls, or your browser and device settings.

9. How We Disclose Personal Information

We may disclose personal information when reasonably necessary for the purposes described in this policy, including to:

• Shopify, which hosts and operates the ecommerce platform, checkout, accounts, payments, fraud tools, analytics, and related services.
• Payment processors and financial providers that authorize, process, settle, or protect transactions.
• Fulfillment, shipping, and logistics providers that pack, transport, track, deliver, insure, or process shipments and returns.
• Technology and business service providers that provide hosting, security, data storage, customer service, analytics, reviews, website functionality, accounting, incident-response assistance, and professional services.
• Marketing and communications providers, including providers such as Klaviyo, OpenSend, Postscript, advertising platforms, audience providers, and email or messaging services that we use from time to time.
• Affiliates and businesses under common ownership or control where reasonably necessary for shared administration, customer service, security, or lawful business operations.
• Professional advisers, insurers, auditors, and legal representatives where reasonably necessary to operate or protect the business.
• Government authorities, courts, regulators, law enforcement, and other parties where required or permitted by law or reasonably necessary to protect rights, safety, customers, or the public.
• Parties to a business transaction involving a merger, financing, sale, restructuring, acquisition, bankruptcy, or transfer of all or part of the business or its assets.
• Other parties at your direction or with your consent.

10. MC Distributing Stores and Shared Administration

MC Distributing operates several motorcycle and powersports-parts websites, including VintageCB750.com, XS650Direct.com, OldBikeBarn.com, PartsNMore.com, GoldwingParts.com, and XLmotorcycleparts.com. These stores may use shared staff, systems, service providers, customer-service tools, fraud controls, accounting systems, and marketing-suppression records.

We may share limited personal information among MC Distributing stores when reasonably necessary to provide customer service, identify an order, administer a return or warranty claim, prevent fraud, maintain accurate records, comply with legal obligations, or honour an unsubscribe, deletion, correction, or other privacy request.

A purchase, account, inquiry, or marketing subscription at one MC Distributing store does not automatically enrol you in promotional marketing from every other MC Distributing store. Each store must have a lawful basis for its own marketing communications.

An unsubscribe or marketing complaint may be shared across MC Distributing stores and service providers to prevent the same address from being unintentionally re-added or contacted through another store. Transactional or customer-service communications may still be sent where reasonably necessary and permitted by law.

11. Targeted Advertising, Sale and Sharing

We may use or disclose identifiers, device information, website activity, purchase information, and inferences to provide or measure advertising and marketing. Depending on the jurisdiction and the technology involved, some of these activities may be defined as “targeted advertising,” “sharing,” or a “sale” of personal information even when no money is exchanged for the information.

Where applicable, you may use the “Your Privacy Choices,” “Do Not Sell or Share My Personal Information,” or similarly named control made available in the website footer or cookie banner. You may also contact us using the details below.

Where required by applicable law, we recognize the Global Privacy Control signal as an opt-out request for the browser or device transmitting the signal. Other browser “Do Not Track” signals may not be recognized because there is no uniform industry standard for those signals.

We do not knowingly sell or share the personal information of children under 16 as those terms are defined by applicable law.

12. Relationship With Shopify

The website and store are hosted by Shopify. Shopify collects and processes personal information about access to and use of the services in order to provide, secure, personalize, and improve Shopify’s services and the store. Information submitted through the store is transmitted to Shopify and may be processed by Shopify and its service providers in countries other than the country where you live.

We may use Shopify features that combine information from interactions with our store, Shopify, and other merchants to provide enhanced services such as security, personalization, analytics, advertising, and business insights. In circumstances where Shopify independently determines the purposes and methods of processing, Shopify is responsible for that processing and for responding to applicable requests concerning it.

More information about Shopify’s processing and available privacy rights is available in the Shopify Consumer Privacy Policy and through the Shopify privacy portal.

13. Third-Party Websites and Services

The website may link to third-party websites, social networks, payment services, financing providers, videos, tools, and other services that we do not control. Their privacy and security practices are governed by their own policies. We are not responsible for the privacy, security, accuracy, or content of independent third-party services.

Information you post publicly or through a public or semi-public third-party platform may be visible and used by other people or organizations. Consider the privacy settings and audience before posting personal information.

14. International and Cross-Border Processing

We are located in Canada and serve customers in Canada, the United States, and other countries. Personal information may be transferred to, stored in, or processed in Canada, the United States, or another jurisdiction where we or our service providers operate.

While information is in another jurisdiction, it may be subject to that jurisdiction’s laws and may be accessible to courts, regulators, law enforcement, or national-security authorities as permitted by law.

Where applicable law requires a transfer mechanism, we and our providers may use recognized contractual clauses, adequacy decisions, certifications, or other lawful safeguards.

15. Security

We use administrative, technical, contractual, and physical safeguards that are intended to protect personal information in a manner appropriate to the nature of the information and the risks involved. We also use service providers, access controls, fraud tools, and security measures provided by Shopify and other vendors.

No system, transmission method, storage method, or security measure is perfect or guaranteed to be completely secure. Do not send sensitive or confidential information through an unsecured channel.

You are responsible for maintaining the confidentiality of account credentials and for notifying us promptly if you believe an account or communication has been compromised.

16. Security Incidents and Breach Response

We maintain processes intended to identify, investigate, contain, document, and remediate suspected or confirmed security incidents involving personal information. Our response may include preserving evidence, limiting access, resetting credentials, working with Shopify or other service providers, reviewing affected systems, and taking reasonable corrective measures.

Where required by applicable law, we will notify affected individuals, privacy regulators, law-enforcement authorities, payment providers, or other appropriate parties. The timing, content, and recipients of a notice will depend on the nature of the incident, the information involved, the risk of harm, and applicable legal requirements.

We may retain records of a suspected or confirmed security incident and the steps taken in response when required or reasonably necessary for legal, security, insurance, auditing, and risk-management purposes.

If you believe personal information or an account associated with this website has been compromised, contact us promptly at help@xlmotorcycleparts.com.

17. Retention

We retain personal information for as long as reasonably necessary for the purposes described in this policy, including to provide services, maintain accounts, complete transactions, administer returns and warranties, comply with tax and accounting obligations, resolve disputes, enforce agreements, prevent fraud, and protect legal rights.

Retention periods vary according to the type of information, the customer relationship, legal requirements, operational needs, limitation periods, fraud and security risks, and whether information is needed to preserve a marketing suppression request.

When personal information is no longer reasonably required, we may delete, anonymize, aggregate, or securely isolate it, subject to applicable law and technical limitations.

18. Children’s and Minors’ Information

This website and its products are intended for an adult Honda XL and XR motorcycle-parts audience. The services are not directed to children or to persons who have not reached the age of majority in their jurisdiction.

We do not knowingly collect personal information from children under 13. We do not knowingly sell or share the personal information of individuals under 16 as those terms are defined by applicable law. We do not knowingly use identity-resolution services to identify minors or knowingly send them marketing communications.

If a parent, guardian, or other person believes that a minor has provided personal information to us, contact us. We will review the circumstances and take appropriate correction, deletion, restriction, or suppression steps where required or reasonably appropriate.

19. Your Privacy Rights and Choices

Depending on where you live and subject to applicable exceptions, you may have some or all of the following rights:

• Request access to or confirmation of personal information we hold;
• Request correction of inaccurate or incomplete information;
• Request deletion of personal information;
• Request a portable copy of certain information;
• Withdraw consent where processing is based on consent;
• Object to or restrict certain processing;
• Opt out of promotional email or text messages;
• Opt out of targeted advertising, sale, or sharing where applicable;
• Request information about categories of information, sources, purposes, and recipients;
• Use an authorized agent where permitted; and
• Appeal certain decisions concerning a privacy request where applicable.

Rights are not absolute and may apply only in certain circumstances. We may decline or limit a request where permitted by law, including when information must be retained for legal compliance, fraud prevention, transaction records, accounting, dispute resolution, warranty administration, security, or suppression of future marketing.

Submitting a Request

Submit a request by emailing help@xlmotorcycleparts.com or by using an applicable privacy-choice tool provided on the website.

We may take reasonable steps to verify your identity and authority before completing a request. An authorized agent may be required to provide proof of authority, and we may ask the individual to verify the request directly.

We will respond within the period required by applicable law. We will not unlawfully discriminate against a person for exercising an applicable privacy right.

Correcting an OpenSend or Identity Match

If you received an unexpected marketing email or believe an identity, household, browser, device, or email address was matched incorrectly, state that the request concerns an “OpenSend identity match.” We can then review the source, suppress marketing across applicable MC Distributing systems, and make appropriate correction or deletion requests with relevant providers.

20. Complaints

If you have a complaint about our privacy practices, contact us and identify the communication as a “Privacy Complaint.” Include enough information for us to understand the issue, but do not send unnecessary sensitive personal information.

We will review the complaint and respond as required by applicable law. Depending on where you live, you may also have the right to contact or lodge a complaint with an applicable privacy, data-protection, or consumer protection authority.

21. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to our practices, service providers, technologies, legal obligations, or business operations. The revised version will be posted on the website with an updated “Last updated” date.

Where required by law, we will provide additional notice or obtain consent before applying a material change to personal information already collected.

22. Contact Us