Privacy notice

01

Who is responsible

Affix Labs Netherlands B.V., Toernooiveld 1, 6525 ED Nijmegen, Netherlands, registered with the Dutch Chamber of Commerce under KvK 84236140, is the controller for the processing described here.

For any question about this notice or about your data, write to info@affixlabs.com. We reply within 30 days as the GDPR requires, and sooner where we can.

02

What we collect and why

We collect only what a given interaction needs. Nothing on this list is sold, and none of it is used for automated decision-making that produces a legal effect for you.

• ·Enquiry and contact forms: name, company, email, telephone, market and the content of your message. Legal basis: our legitimate interest in responding to a business enquiry, or steps taken at your request before entering a contract.
• ·Trade account registration: company name, VAT number and its validation result, trading address, sector, and the name, email and role of each named user. Legal basis: performance of a contract, and compliance with our tax and accounting obligations.
• ·Sample kit requests: name, company, delivery address, setting and surfaces of interest. Legal basis: steps taken at your request before entering a contract.
• ·Orders: billing and delivery address, order contents, VAT treatment, payment status and invoice records. Legal basis: performance of a contract, and a legal obligation to retain accounting records.
• ·Account access: email address, authentication tokens and sign-in timestamps. Legal basis: performance of a contract.
• ·Analytics: pages viewed, referrer, approximate location derived from IP, device and browser type, and campaign parameters. Legal basis: your consent, given through the cookie banner and withdrawable at any time.
• ·Server logs: IP address, request time and user agent, kept briefly for security and troubleshooting. Legal basis: our legitimate interest in keeping the service available and secure.

03

Cookies and similar technologies

No analytics or marketing cookie is set before you consent. The cookie notice sets out each cookie, its purpose and its lifetime, and you can change or withdraw your choice at any time from the same banner.

Cookies that are strictly necessary for the site to work, such as the one that remembers your country and the one that keeps you signed in, are set without consent because the site cannot function without them.

04

Who processes data on our behalf

We use a small number of processors, each under a data processing agreement. Where a processor is outside the European Economic Area, transfers rely on the European Commission standard contractual clauses.

• ·Supabase: database and authentication hosting.
• ·Vercel: website hosting and delivery.
• ·Mollie: payment processing. Card and bank details are entered on Mollie's own systems and never reach ours.
• ·Resend: transactional email such as order confirmations and account notices.
• ·Google Analytics 4: website analytics, only after consent.
• ·Cloudflare: form protection against automated abuse.

05

How long we keep it

Enquiries and sample requests: 24 months from the last contact, unless a commercial relationship starts.

Trade accounts and orders: for the life of the account and then for the statutory retention period for accounting records, which in the Netherlands is seven years.

Analytics data: as configured in Google Analytics 4, and no longer than 14 months.

Server logs: 30 days.

06

Your rights

Under the GDPR you may ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular processing, object to processing based on legitimate interest, and receive data you gave us in a portable format. Where processing rests on consent, you may withdraw that consent at any time without affecting what was done before.

Write to info@affixlabs.com. We may ask for enough information to be sure who you are before we act, which is a protection for you rather than an obstacle.

If you are not satisfied with our answer you may complain to your national supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens.

07

Security

Access to personal data is limited to the people who need it. Data is encrypted in transit, the database is reached through a restricted role that can see only the website's own schema, and payment credentials never touch our systems.

No system is beyond compromise. If a breach is likely to result in a risk to your rights, we will notify the supervisory authority within 72 hours and, where the risk is high, tell you directly.

08

Changes

We will post any change on this page with a new date at the top. Material changes to how we use your data will be notified to account holders by email.