Privacy statement

1. Who is the controller?

IMPAKT Recycling Solutions B.V., trading as IMPAKT Wearparts, is responsible for personal data processed through this website and the business quotation and order flow. IMPAKT is established at Vlasakker 46, 7761 RD Schoonebeek, the Netherlands, and registered with the Dutch Chamber of Commerce under number 89217179. For privacy questions or a request concerning your data, email sales@impaktwearparts.com.

This statement applies to visitors, business contacts, applicants, quotation signatories, customer-account users, supplier contacts and other people with whom we communicate about a request or contract. Pure company data is covered by the GDPR only where it also relates to an identifiable person.

2. Which data do we process and where does it come from?

We receive data directly from you or your employer through the website, quotation portal, email or telephone. For repeat orders we may use data from a previous request, quotation, order or customer account. Our staff, producers, suppliers and carriers may add technical or logistical information.

• company and contact details, including company name, name, role, business email address and telephone number;
• billing and delivery details, VAT number, country, transport preference and payment status;
• machine, product, dimension and application data, technical notes, photographs, drawings and correspondence;
• request, quotation, order and customer-account history, including selected products, quantities and changes;
• digital acceptance data: name, role, company, business email, authority statement, dimension-check confirmation, terms version, recorded quotation version, time, IP address and user agent;
• account and security data, including verification status, session information and technical logs. Passwords are not stored in readable form;
• cookie and usage data as described in the cookie statement and, where required, after your consent.

Do not include unnecessary personal data in free-text fields. Share photographs, drawings or documents only when relevant and remove names or other unnecessary personal data where possible.

Required and optional data

Fields marked with an asterisk and information needed for identification, quotation, acceptance, invoicing or delivery are required to process your request or contract. Without them we may be unable to prepare a quotation, accept an order or deliver. Optional technical information may be left blank when unavailable.

3. Why do we process this data?

We do not ask for GDPR consent where data is necessary to prepare a quotation at your request or perform a contract. We inform you before you submit the request. Consent is requested separately only for an optional purpose with no other valid ground, such as optional analytics.

We do not sell request or order data and do not make solely automated decisions that produce legal or similarly significant effects.

4. How long do we retain data?

After expiry we delete or anonymise data unless retention remains necessary under law, an ongoing contract, a dispute or another demonstrable obligation.

• Unconverted quotation, custom-product and contact requests: no more than 24 months after the last substantive contact.
• Accepted quotations, digital acceptance, orders, invoices, payments and financial records: generally 7 years from the relevant order or accounting event, or longer where required by law or an ongoing dispute.
• Customer accounts: while active and no more than 24 months afterwards; order and invoice data remains subject to its own statutory period.
• Technical photographs, drawings and correspondence: for the request and no more than 24 months afterwards; if part of an order file, they follow that file’s retention period.
• Normal security and error logs: no more than 90 days. Relevant data may be kept longer for investigation of an incident, misuse or legal claim.
• Privacy requests and their handling: as long as needed to complete the request and demonstrate correct handling.

5. Who receives the data?

Within IMPAKT, access is limited to staff who need the data. We may also share necessary data with hosting and IT providers, email providers, account and quotation systems, accounting software, producers, suppliers, carriers, customs or export service providers, professional advisers and public authorities where legally required.

Producers and suppliers generally receive the technical information needed for pricing, production and delivery. A carrier receives necessary contact and delivery details. If the customer appoints a carrier or requests delivery outside the EU, data may also be provided to that party and relevant customs authorities.

Where a service provider processes data on our behalf, we use a processing agreement where required. Independent controllers, such as certain carriers, banks, advisers or authorities, process data under their own legal responsibility. We do not sell personal data.

Transfers outside the EEA

Where a provider or delivery involves processing outside the European Economic Area, we use a valid transfer mechanism and safeguards such as an adequacy decision or the European Commission’s standard contractual clauses. You may request information about the safeguard used.

6. How do we secure data?

We take appropriate technical and organisational measures. Access is role-based, connections are secured, customer accounts use verification and session protection, critical quotation and acceptance actions are logged and recoverable backups are maintained.

No system is entirely risk-free. Report a suspected data breach or account misuse promptly to sales@impaktwearparts.com. Do not send passwords or identity-document copies unless specifically requested through an appropriate route.

7. What are your rights?

Depending on the circumstances, you may request access, correction, erasure, restriction or portability and object to processing based on legitimate interests. You may withdraw consent for optional processing at any time. Email sales@impaktwearparts.com.

We normally respond within one month. For a complex request the GDPR permits an extension of up to two further months; we will notify you within the first month. We may request reasonable information to verify identity and authority but do not routinely request a full identity-document copy.

Erasure is not always possible, for example where data remains necessary for an ongoing contract, statutory records, fraud prevention or a legal claim. We explain any refusal or restriction.

If you are dissatisfied, you may lodge a complaint with the Dutch Data Protection Authority or another competent European supervisory authority.

8. Cookies, communication and changes

Strictly necessary cookies and local storage support language choice, secure customer login, the temporary request list and your cookie preference. Optional analytics loads only after consent, which can later be withdrawn.

Operational emails about a request, quotation, acceptance, account, delivery or privacy request are part of the communication you requested. We seek consent for separate electronic marketing where required and always provide an unsubscribe route.

We update this statement when our website, quotation flow, providers or legal duties change. The date above shows when this version was last updated.