This Privacy Policy explains how MECHPLY j.d.o.o. processes personal data when you use this website, contact us, or submit a request for quotation, benchmarking assessment, or BOM costing proposal. This document must be reviewed together with the company details and processor information before publication.
1. Data controller
Controller: MECHPLY j.d.o.o.
Registered address: Čakovec 123
OIB: HR32283736673
Official email: info@mechply.com
Privacy contact: info@mechply.com
2. Personal data we process
Depending on how you interact with MECHPLY, we may process your full name, company name, business email address, telephone number, inquiry content, RFQ project information, manufacturing specifications, quantities, materials, delivery requirements, uploaded technical drawings and CAD files, BOM documents, and benchmarking purchase prices.
The RFQ security controls use a one-way derived hash of the submitting IP address for rate limiting and duplicate-submission protection. The raw IP address is not saved in the RFQ record by the theme. The web server or hosting provider may separately keep IP addresses and technical security logs; those hosting log practices must be verified before this policy is published.
3. Why we process personal data
We use the relevant information to respond to inquiries; take steps requested before a possible business relationship; prepare manufacturing quotations; evaluate sourcing opportunities; provide benchmarking assessments; prepare paid, project-based BOM costing proposals; communicate about a project; coordinate suitable manufacturing partners; protect the website and submission systems; keep necessary business records; and comply with applicable legal obligations.
4. Legal bases
- Article 6(1)(b) GDPR: processing necessary to take steps at your request before entering into a contract, or to perform a contract, where this basis applies to the individual making the request.
- Article 6(1)(f) GDPR: MECHPLY’s legitimate interests in answering B2B inquiries, evaluating sourcing opportunities, coordinating relevant partners, preventing abuse, securing systems, and maintaining appropriate business records, provided those interests are not overridden by your rights and freedoms.
- Article 6(1)(c) GDPR: processing needed to comply with a legal obligation, such as applicable accounting, tax, or lawful authority requirements.
- Article 6(1)(a) GDPR: consent only when MECHPLY asks for specific, optional consent for a separate purpose. The acknowledgement beside the inquiry and RFQ forms confirms that the privacy information was read; it is not presented as consent to all processing.
5. Technical documents and confidential project information
Technical drawings, CAD files, BOM documents, prices, and specifications are collected so MECHPLY can understand the requirement, evaluate manufacturability and sourcing options, and prepare or coordinate the requested service. Relevant information may be made available to authorized MECHPLY administrators and, where necessary for the requested evaluation, to suitable manufacturing partners or technical service providers.
RFQ files submitted through this website are stored outside the public WordPress Media Library using unpredictable stored filenames. The local deployment stores them outside the public web root. Downloads use an authenticated, capability-checked, nonce-protected administrator endpoint. File extension, size, signature, path, and archive safety checks are applied. Every production host must independently verify that the configured storage path remains outside the public document root and that backup and server access controls are appropriate.
You must be authorized to provide all submitted documents and information. Do not upload information that you are not permitted to disclose. Submission through the website does not by itself create a non-disclosure agreement; any separate confidentiality terms should be agreed in writing where required.
6. Recipients and service providers
Personal or project data may be disclosed, on a need-to-know basis, to suitable manufacturing partners involved in evaluating or delivering the requested work; hosting and infrastructure providers; email delivery providers; IT and security service providers; professional advisers; and courts, regulators, or public authorities where disclosure is legally required.
The identities, processing locations, contractual roles, and retention practices of production hosting, email, IT, and manufacturing partners must be verified and documented before publication.
7. International transfers
The production processor locations and any transfers outside the European Economic Area have not yet been verified. Before publication, MECHPLY must identify any such transfers and document the applicable GDPR Chapter V mechanism, such as an adequacy decision or appropriate safeguards including Standard Contractual Clauses, where required.
8. Retention
No final RFQ retention period has been approved. Automatic RFQ deletion is disabled until an authorized retention policy is configured. Administrators can permanently delete RFQ records, and permanent deletion removes the associated private files from the active storage directory. WordPress personal-data erasure tooling can locate requests by email and permanently delete the matching RFQ records and files.
Before publication, MECHPLY must approve documented retention periods for inquiries, active and closed RFQs, quotations, contractual and statutory records, security rate-limit data, email records, server logs, and backups. Backup copies may persist until the verified backup rotation expires even after deletion from the active website.
9. Your rights
Subject to the conditions and exceptions in the GDPR, you may request access to your personal data, rectification, erasure, restriction of processing, and data portability where applicable. You may object to processing based on legitimate interests. Where processing is based on consent, you may withdraw that consent at any time without affecting earlier lawful processing.
To exercise a right, contact info@mechply.com. MECHPLY may need information necessary to verify the request and protect data from unauthorized disclosure.
You also have the right to lodge a complaint with the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka — AZOP). Current complaint information is available at azop.hr.
10. Security
The website applies server-side validation and sanitization, request-origin and session checks for RFQs, nonces, honeypot fields, rate limiting, duplicate-submission protection, restricted RFQ administration, protected file storage and downloads, and cleanup of private files when an RFQ is permanently deleted. No Internet transmission or storage system can be guaranteed completely secure. Production TLS, hosting permissions, backups, access management, monitoring, and email security remain deployment responsibilities.
11. Changes and contact
This policy may be updated when processing activities, service providers, legal requirements, or security arrangements change. An approved revision date will appear at the top of this page. Questions or privacy requests may be sent to info@mechply.com.