Privacy Policy

1. Who we are

1.1This policy explains how IPF Industry s.r.o. ("IPF", "we") processes personal data in connection with the website www.ipf-industry.com, the B2B storefront, and our business relationships with customers and suppliers. IPF is the controller of this personal data.

1.2Contact for all data-protection matters: ceo@ipf-industry.com, or by post to IPF Industry s.r.o., Ptácká 155/24, 293 01 Mladá Boleslav, Czech Republic. IPF has not appointed a data protection officer, as it is not required to.

2. What we process, why, and on what legal basis

2.1Contact persons of customers and suppliers. Name, business e-mail address, phone number, job role, and the company you work for, together with our correspondence with you. We receive this data from you or from your employer. We use it to conclude and perform contracts with your company: quotations, order confirmations, delivery notices, invoices and complaints. Legal basis: our legitimate interest in communicating with our business partners (Article 6(1)(f) GDPR) and, where you are a sole trader, the performance of a contract with you (Article 6(1)(b) GDPR).

2.2Storefront accounts. If your company is our customer and has registered you as a contact person, we create a storefront account for your business e-mail address. Self-registration is not available. We process your e-mail address, your company membership, and sign-in and session records, so that you can see your company's prices and place orders. We withdraw the account when your company tells us you have left or should no longer have access. Legal basis: our legitimate interest in providing the storefront to our customers (Article 6(1)(f) GDPR).

2.3Accounting and tax records. Invoices, orders and payment records can contain the names and contact details of the persons involved. We keep them because the law requires it (Article 6(1)(c) GDPR), in particular the Czech accounting and VAT acts.

2.4Enquiries. When you write to us by e-mail, including through the contact form on our website (which opens your own e-mail program), we use your message and contact details to answer you. Legal basis: our legitimate interest in answering enquiries and, where you ask about a purchase, steps taken at your request before entering into a contract (Article 6(1)(b) and (f) GDPR).

2.5Website operation and security. When you visit the website, our hosting provider processes technical data such as your IP address, browser type and the pages requested, to deliver the website and protect it against misuse. When an error occurs, we record a technical error report. We configure it so that it does not contain your IP address, cookies, form contents or account details. Legal basis: our legitimate interest in operating a secure website (Article 6(1)(f) GDPR).

2.6We do not use your personal data for automated decision-making or profiling. We do not use analytics or advertising tools on the website, and we do not sell personal data.

3. Cookies and similar technologies

3.1The website uses only cookies and browser storage that are strictly necessary for it to work. For that reason we do not ask for consent to them. They are:

• sign-in and session cookies set by our authentication provider, Clerk, which keep you signed in and protect the sign-in page against automated abuse (including a check by Cloudflare Turnstile);
• a cookie remembering the language you chose (NEXT_LOCALE);
• for IPF staff and authorised partners only, a session cookie remembering which customer account they are viewing (ipf_acting_as);
• browser storage of your cart (ipf_cart) and of your light or dark display preference (ipf-theme), which stays on your device.

3.2You can delete cookies and browser storage in your browser settings. Without the sign-in cookies, the storefront cannot be used.

4. Who receives your data

4.1We use the following service providers, who process personal data on our behalf and under our instructions:

• ABRA Flexi: our ERP system, which holds customer, supplier, order and invoice records;
• Clerk: storefront accounts and sign-in;
• Vercel: website hosting;
• Sentry: error monitoring, with data stored in the European Union (Germany);
• Resend: delivery of order, delivery and invoice e-mails;
• Microsoft: e-mail and document storage (Microsoft 365);
• Mistral AI: automated reading of documents our suppliers send us, such as invoices and price lists;
• Sanity: content management for the website, which holds the published contact details of IPF staff;
• Upstash: technical caching and rate limiting for the storefront.

4.2We also pass data to other recipients where this is needed: carriers (for example PPL, DHL, GLS, Zásilkovna and FedEx) receive the delivery address and a contact name and phone number; our bank processes payments; and public authorities, auditors and legal advisers receive data where the law requires it or to establish or defend legal claims.

4.3Some of these providers are established in the United States or may process data there, including Clerk, Vercel and Resend. For such transfers we rely on the EU–U.S. Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses (Article 46 GDPR).

5. How long we keep your data

5.1We keep contact-person data for as long as we have a business relationship with your company, and after that for as long as claims from the relationship can be raised, normally up to 4 years.

5.2We keep accounting and tax documents for the periods required by law, up to 10 years.

5.3We remove storefront access when your company tells us you have left, and delete the account when your company no longer has any contact persons with access.

5.4Our hosting and error-monitoring providers keep technical logs for limited periods set by their services.

6. Your rights

6.1You have the right to request access to your personal data, its rectification or erasure, and restriction of its processing. Where the processing is based on our legitimate interest, you may object to it. Where the processing is based on a contract and carried out by automated means, you have the right to data portability.

6.2To exercise your rights, write to ceo@ipf-industry.com. We will respond within one month. We may ask you to confirm your identity.

6.3You have the right to lodge a complaint with the supervisory authority: Úřad pro ochranu osobních údajů (Office for Personal Data Protection), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, www.uoou.gov.cz.

6.4You are not legally obliged to provide personal data to us. Without your business contact details, however, we cannot correspond with you, give you a storefront account, or process your company's orders.

7. Security

7.1We protect personal data with technical and organisational measures appropriate to the risk, including encrypted connections, access restricted to staff who need it, and authentication for all systems that hold customer data.

8. Changes

8.1We may update this policy. The current version is always published on our website, with its effective date.