HexoParts Privacy policy

Quote and account:

• Data: email, buyer type, Files (may contain data in metadata and the drawing title block), IP address, login links and codes (stored only as a hash).
• Legal basis: Art. 6(1)(b) GDPR.
• Period: a draft quote without an email address 48 hours; a quote sent by email is valid for 7 days, and its Files and data without an Order are kept for 12 months from the last change; the account until it is deleted.

Concluding and performing the contract:

• Data: name, company, tax ID, address, phone, delivery address, purpose of the Part, declarations, measurement reports and photos.
• Legal basis: Art. 6(1)(b) GDPR.
• Period: the term of the contract, then as for claims.

Inspection reports and batch data (product traceability):

• Data: measurement report, photos, Production partner, date, File version, material batch number.
• Legal basis: Art. 6(1)(f) GDPR (identifying the maker and defending claims, including product liability).
• Period: 10 years from shipping the batch.

Payments and fraud prevention:

• Data: transaction data, IP address, device data, the payment operator's risk assessment, the result of checking the tax ID and bank account on the VAT White List.
• Legal basis: Art. 6(1)(b) and (f) GDPR.
• Period: [24 months] from the transaction.

Invoices, accounting and VAT:

• Data: invoice and register data.
• Legal basis: Art. 6(1)(c) GDPR.
• Period: 5 years from the end of the tax year.

Complaints and claims:

• Data: Order data, correspondence, reports, Files.
• Legal basis: Art. 6(1)(f) GDPR.
• Period: until claims are time-barred.

Proof of acceptance of the terms and declarations:

• Data: document version, date and time, IP address.
• Legal basis: Art. 6(1)(f) GDPR.
• Period: as for claims.

Checking prohibited items and sanctions:

• Data: Customer data, File, purpose of the Part, result of the check.
• Legal basis: Art. 6(1)(c) and (f) GDPR.
• Period: [5 years] from the Order.

Message moderation and order confidentiality:

• Data: content of messages and text fields, attachments, result of the automatic contact-data filter, moderation decisions.
• Legal basis: Art. 6(1)(f) GDPR (anonymity of the parties, protection of trade secrets, abuse prevention).
• Period: until claims from the Order concerned are time-barred.

Contact and enquiries:

• Data: data from the message; we do not record calls.
• Legal basis: Art. 6(1)(f) GDPR, and for reports of illegal content Art. 6(1)(c) GDPR (Digital Services Act).
• Period: [12 months] from closing the matter.

Information about our own services for Customers:

• Data: email, phone.
• Legal basis: Art. 6(1)(f) GDPR and consent under Art. 398 of the Polish Electronic Communications Law.
• Period: until objection or withdrawal of consent. We currently send no newsletter or email advertising.

Analytics and advertising:

• Data: cookie identifiers, data on use of the Service.
• Legal basis: Art. 6(1)(a) GDPR and Art. 399 of the Polish Electronic Communications Law (consent in the cookie banner).
• Period: until consent is withdrawn, periods as in the Cookie policy.

Cookie consent register:

• Data: decision identifier, banner version, chosen categories, date and time, IP address hash.
• Legal basis: Art. 6(1)(c) GDPR in connection with Art. 7(1) GDPR (demonstrating consent).
• Period: 24 months from the decision.

Security of the Service:

• Data: server logs, IP address, country derived locally from the IP address, login and file download logs, reCAPTCHA result.
• Legal basis: Art. 6(1)(f) GDPR.
• Period: [90 days] for server logs, 12 months for the login log; entries on access to Customer files until claims from the Order are time-barred.

Cooperation with Production partners:

• Data: partner contact persons, notes from the verification call, certificates, test part reports, liability insurance policy.
• Legal basis: Art. 6(1)(b) and (f) GDPR.
• Period: the term of cooperation and the limitation period; if admission to the network is refused, up to 12 months.

The legitimate interests of HexoParts are: pursuing and defending claims, fraud prevention, security of the Service, checking the lawfulness of ordered Parts, contact with Customers and marketing of its own services.

IT service providers, Production partners and advisers process data on behalf of HexoParts under data processing agreements, unless they act as separate controllers (payment operator, carriers, Google, the Ministry of Finance, banks).

Some providers (Google, Stripe, Sentry, [Cloudflare]) may process data in the USA; Sentry stores error data in the USA. The basis is the European Commission decision on the EU-US Data Privacy Framework or standard contractual clauses. A copy of the safeguards can be obtained on request sent to info@hexoparts.com.

Everyone has the right to access their data, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest. An objection to marketing is always effective.

Consent can be withdrawn at any time, without affecting the lawfulness of earlier processing. Cookie consent is changed with the Cookie settings button in the footer of the Service.

Everyone may lodge a complaint with the President of the Polish Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland) or with the supervisory authority in their EU country.

HexoParts replies to requests within one month. It may ask for information needed to confirm that the request comes from the data subject.

Emails about jobs, payments and messages can be switched off in the account settings or with the link in the email footer. Account and security emails (address confirmation, login codes) are always sent.

Providing data is voluntary, but without the form data it is not possible to get a Quote or place an Order. Invoice data is required by tax law.

The instant Quote price and the decision whether a Part goes to a tender are calculated automatically from the File geometry and parameters, not from the Customer's characteristics. Messages held by the contact-data filter are always assessed by a person.

The payment system automatically assesses fraud risk and may decline a payment. The Customer may request a manual re-check by HexoParts, present their position and contest the decision.

HexoParts uses encrypted connections, encryption of Files and personal data (AES-GCM, key outside the database), a log of access to Files, removal of the file name, STEP header author fields and photo EXIF data from partner copies, and login without passwords stored in plain text (passwords only as argon2 hashes).

This policy applies from [publication date]. HexoParts informs about significant changes in the Service and by email to Customers with an account.