Privacy policy

1. Controller

The controller is the operator named in the legal notice. Contact for data protection matters: [email address for data protection].

A data protection officer has not been appointed, as the legal requirements are not met. [To be reviewed by counsel]

2. Hosting and server logs

The platform runs on servers of Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) in data centres in Germany; encrypted backups are kept in a data centre in Finland. A data processing agreement is in place with Hetzner. [Date of DPA]

When you visit the pages, we process technically necessary data: IP address, time, requested address and browser identifier. This serves delivery and security (defending against attacks, throttling abusive requests). The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). Server logs are deleted after [number] days.

3. Account and sign-in

For an account we process name, email address, the password (only as a secure hash), passkeys, the second factor (stored encrypted) and session data. The legal basis is the contract for using the platform (Art. 6(1)(b) GDPR).

We log security-relevant events – such as sign-ins, account changes and access by our team – to protect your account (Art. 6(1)(f) GDPR). The log is kept in the database for 24 months and then archived in encrypted form without IP address and browser identifier. The “Security” page shows your signed-in devices with a shortened IP address.

4. Company profile and verification

For companies we process company data (name, address, locations, website, VAT ID, commercial register details), capabilities, certificates, products and images. Manufacturer profiles are – after our review – public on purpose so that buyers can find you. The full address is only shown if you allow it.

For verification we check the VAT ID via the European Commission’s VAT Information Exchange System (VIES) and review submitted evidence (e.g. register extract). The legal basis is the contract (Art. 6(1)(b) GDPR) and our legitimate interest in a trustworthy marketplace (point (f)).

5. Requests, quotes, messages and files

We store requests, quotes, messages and uploaded files confidentially. They are visible only to those involved: the requesting buyer and the invited or matching manufacturers. You decide in the request whether a manufacturer sees your company name.

Our team does not see this content as a rule. Only in justified individual cases (e.g. an abuse report) is access possible after documented approval; every such access is logged and shown to you under “Staff access”.

We scan uploaded files for malware on our own servers. Images are re-encoded in the process; embedded metadata such as location (GPS) and camera data is removed. The legal basis is the contract (Art. 6(1)(b) GDPR).

6. Search

We run the search ourselves on our servers; it only contains public manufacturer data. To improve it we count which filters are used – without search terms and without reference to persons or companies.

7. Machine translation

So that buyers can read manufacturer profiles in their language, we machine-translate public manufacturer texts (company description, product names and descriptions, notes on capabilities) with DeepL (DeepL SE, Maarweg 165, 50825 Cologne, Germany). Translated texts are labelled as such. Messages, requests, quotes and prices are not translated and not sent to DeepL. The legal basis is the contract (Art. 6(1)(b) GDPR). [DPA with DeepL – date]

8. Email

We send system messages (e.g. confirmations, notifications about requests) via Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France) on our behalf. If you write to us, we process your message in our mailbox at STRATO AG (Otto-Ostrowski-Straße 7, 10249 Berlin, Germany). [Add DPA details]

You can manage notifications in your account.

9. Pre-registration as a manufacturer

If you pre-register your profile before launch, we store company, country, website, industry, your manufacturing details, contact person, email and optionally phone in order to contact you at launch (consent, Art. 6(1)(a) GDPR). The pre-registration only takes effect after you confirm your email address. You can withdraw your consent at any time.

10. Cookies and browser storage

We only set technically necessary cookies; no consent is required for these (§ 25(2) no. 2 TDDDG). There are no tracking, analytics or advertising cookies, and therefore no cookie banner. We serve fonts ourselves; no connection to Google or other providers is made when you visit.

11. Retention and deletion

We store data as long as your account or company exists. If you delete your account or company, the data is permanently deleted or anonymised after 30 days. Transactions involving other companies (e.g. submitted quotes, messages) remain available to them without your name.

Statutory retention obligations (e.g. under commercial and tax law) take precedence. [Periods to be reviewed by counsel]

12. Recipients and transfers

We only pass data to the service providers named above, who process it exclusively on our behalf: Hetzner (hosting, storage, DNS), Brevo (email delivery), DeepL (translation of public manufacturer texts) and STRATO (mailbox). There are no transfers to countries outside the EU.

13. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future.

You can download your data as a file and delete your account yourself at any time in your account area.

You can lodge a complaint with a data protection supervisory authority, e.g. the authority responsible for our registered office: [supervisory authority].