Privacy policy

1Who we are

Crimptech is the controller for the personal data described here. The registered office is Letterhout 23, 1507 EG Zaandam, Netherlands.

Chamber of Commerce number 95555927. VAT number NL867179624B01.

Write to info@crimptech.nl about anything in this policy.

No data protection officer is appointed. Requests reach the address above and are answered by the partners in the firm.

2What we collect, and why

Ten categories. What each of the companies that runs this application receives is set out further down.

• Contact enquiries. The requested service, correspondent's name, company where given, email address, phone number where given and message submitted through the marketing site's contact form or the engineering contact page. We store this information to answer the enquiry and retain a record of the correspondence. We send a confirmation email to the submitted address.
• Account identity. The name, the email address and its verification status held by the sign-in provider, and the account identifier it issues. These support authentication, quote ownership and email verification requirements. We keep a copy of the name with the account profile.
• Account profile. A copy of the account name, and an optional company name, phone number, delivery address and billing address. The name, company and delivery address prefill shipments created from a quote. We see these fields alongside the quote. The billing address remains in the account profile and is not shown on a quote. A name entered in the profile form before 7 October 2026 remains until a name is set in the account settings, or until its removal is requested at info@crimptech.nl.
• Quote content. Part specifications, request notes, requested certifications, any withdrawal reason, the staff decline reason displayed on the quote page, the quoted price, and uploaded .step, .stp, .dxf and .pdf files with their original filenames. Up to 50 parts and 100 files per quote. This is what a price and a production plan are made from.
• Order and shipment records, written by our staff. The customer name and email address, the company name, the real origin and destination addresses, the carrier and its tracking number, the timeline entries published to the tracking page with their location and note, and any documents attached to a shipment. This is what fulfils and tracks the order.
• Production checks. A customer's stage verdict and optional note, stored with the account identifier and shown to staff and the account holder. These checks are never shown to the manufacturing partner.
• Production correspondence. Plain-text customer and staff messages, author account identifiers, staff names where available, production order and stage, timestamps, conversation status and resolution events. These records support discussion of production evidence and retain the exchange about the order.
• Internal notes on a quote. Free text written by staff, with the name and email address of the staff member who wrote it. These are never shown to a customer.
• Message records. For every email this application sends, the recipient address and the subject are stored, along with staff-composed messages and production notification bodies. Delivery records track sending and provider responses. This is how we see what a customer has been told, and how the application avoids sending the same message twice.
• Tracking page opens. A shipment reference and a timestamp, up to 500 per shipment. No IP address, user agent or referrer is stored with them.

3Links, tokens and files

A quote carries a claim token and a shipment carries a tracking token. Each is a random string that opens one record and nothing else, and each travels in a link. A tracking link works without an account, so anyone holding it can open that shipment page.

The tracking page shows a sanitized view: the shipment title, the current stage, an estimated delivery date, city and country level locations, the client company, and the documents we have attached. The carrier, the raw tracking number and the real addresses stay internal.

Anyone holding a production link can view its published photographs and video without an account. Production correspondence and check history are available only to the signed-in account that owns the linked quote and to our staff. Forwarding a production link does not grant access to the discussion.

Uploaded files are never served from a permanent public URL. A quote file is served only to the signed-in account that owns it or to staff, a shipment document only through the tracking link it belongs to, and no email we send carries a link to a file.

4Production notification emails

Customer messages and production checks, including outcomes and any notes, are emailed to our staff inbox. Our messages are emailed to the contact address recorded on the linked quote. Each notification includes the production reference, stage and a link to the relevant discussion.

These emails are copies of correspondence outside the account-only discussion. The recipient can read the message in email. Customer access to the discussion and replies in the application require the linked account. Incoming email replies are not added to the discussion.

Account erasure can cancel queued notifications and remove notification content stored in the application. We cannot recall an email already accepted by a recipient's email provider. An email already in transit may still arrive.

5The legal basis for each purpose

6Who else the data reaches

Five processors run this application. Each row says what reaches that company.

Technology processors operate the application. Manufacturing partners receive the production information described in the following section.

7Manufacturing partners

Manufacturing partners receive the files required for production.

A manufacturing partner receives the drawing or model, part specification and quantity. Customer contact details remain with us. We disclose customer names, email addresses and company names to a partner only when the customer requests an introduction.

Manufacturing partners have no access to customer production correspondence and are not sent these email notifications.

Manufacturing partners also supply photographs and video of work in progress. We select individual files for publication on a customer production page, with a caption we write, the production stage and the stage date. Supplier identity, original filenames and our reviews are excluded.

Published files are copies with camera and location metadata removed. Files whose metadata cannot be removed are refused. Visible content in a photograph may still identify a person or premises.

A photograph may show a manufacturing partner's employee. Requests concerning a published photograph, including requests from a person shown in one, can be sent to info@crimptech.nl.

Which partner makes a given part is decided per order, so this policy names the category rather than a list of companies. Write to info@crimptech.nl to request the identities of partners holding data for a specific order.

The terms of use state the confidentiality obligation we require of each of them.

8What we do not send

The abuse-check widget connects directly from the browser to Cloudflare. The application verification request sends the challenge result and secret key to Cloudflare without forwarding the browser IP address.

The fonts are served from this application. No page requests a font from a third party while it loads. Two things are loaded from elsewhere and both are named in the table above: the sign-in code from Clerk, and the abuse check widget on the upload form from Cloudflare.

The application runs no analytics, no tag manager, no advertising pixel and no error reporting service.

9Where the data goes

All five of those companies are headquartered in the United States. Personal data described in this policy therefore leaves the European Economic Area.

The transfer rests on the safeguards each of those processors publishes for its European customers. Those differ from company to company, and this policy does not set out the mechanism one by one.

10How long we keep it

We store each contact enquiry in this application, and a daily cleanup deletes it once it is 30 days old. Each enquiry is also emailed to our staff inbox when it arrives. That email copy is kept with our correspondence and is outside the 30‑day deletion.

An unsubmitted quote becomes eligible for deletion after 24 hours.

A quote submitted without an account becomes eligible after 7 days if it remains unclaimed.

A claimed quote with an unconfirmed email address becomes eligible after 7 days.

These windows run from the last change of state. Hourly cleanup starts eligible deletions, which continue in batches until the record and its files are removed.

Commercial retention applies once we record a quote as won or link it to a shipment or production order. That protection survives later stage changes and removal of the link, and takes precedence over the shorter windows above.

The current policy retains submitted quotes and shipment and production records for seven years, through the end of the seventh full calendar year after the applicable event. For a protected quote, the event is its first recorded commercial event. For another submitted quote, it is submission or later confirmation of the email address. Linked records must finish their own retention and deletion before the quote can be removed.

A shipment period runs from its latest tracking update or creation, whichever is later. A production record uses its latest stage event, review, correspondence, cancellation or creation. New correspondence extends that record's retention period under the same calendar rule. Daily cleanup starts eligible deletions and records failed work for staff recovery.

Production photographs, video, documents, published copies, customer checks and correspondence are deleted with the production order under that period, subject to earlier customer-content erasure described below.

Staff-authored production correspondence and resolution events remain part of the commercial record until the production order is deleted under the current retention policy. Customer account erasure does not rewrite these staff messages, which may themselves mention personal data. Resolving a conversation does not start a separate deletion period.

The account profile has no time-based expiry. Fields can be changed or cleared from the profile page. Removal can also be requested at info@crimptech.nl.

11Data subject rights

The GDPR provides the following rights concerning the personal data described in this policy.

• Access: a copy of the personal data held about the data subject.
• Rectification: correction of anything inaccurate.
• Erasure: deletion of the data, subject to the limit in the next section.
• Restriction: a pause on processing while a question about it is settled.
• Portability: data provided by the data subject, in a machine-readable format.
• Objection: to processing we base on a legitimate interest, which is the abuse check and the tracking link counter.
• Complaint: to the Autoriteit Persoonsgegevens, the Dutch supervisory authority, at any time.

12How to exercise them

Email info@crimptech.nl. We answer within one month.

Deleting a sign-in account removes its profile, production checks, customer-authored production messages and quotes that never became orders, including their uploaded files. Quotes that became orders and their shipment and production records, evidence and published copies remain under the stated retention period.

Customer-authored production messages and checks are removed even from commercially retained orders or after the quote link has been removed. Erasure runs in recoverable batches. Queued notifications for erased customer content or the erased recipient are cancelled, and stored application notification bodies and sending details are removed.

We honour an erasure request except where a record has to be kept to meet a legal obligation. The seven year retention period for commercial and tax records is that case, and it covers a quote that became an order along with any shipment records belonging to it. A quote that never became an order carries no such obligation.

13Changes to this policy

The date at the top of this page is the date this version took effect.

We publish changes here with a new effective date.