Last updated: [DATE]
This policy explains how [FULL COMPANY NAME] ("Unbolt", "we") handles personal data on the Unbolt DPP website and platform. It covers data we decide about ourselves. Data our clients put into the platform, such as their staff and supplier contacts, is handled on their behalf under a separate data processing agreement, and the client's own privacy notice applies to it.
1. Who is responsible
Controller: [FULL COMPANY NAME], [ADDRESS], gaurav@unboltdpp.net
EU representative (GDPR Article 27): [NAME, ADDRESS, EMAIL]. You can contact our representative instead of us on any data protection question.
2. What we collect and why
| Situation | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Visiting the website | IP address, browser type, requested pages, time of access | Delivering the site, security, preventing abuse | Art. 6(1)(f), our interest in a secure, working website |
| Contact form or email | Name, work email, company, number of battery models, your message | Answering your request, preparing an offer | Art. 6(1)(b), steps before a contract; otherwise Art. 6(1)(f) |
| Platform account | Name, work email, role, company, login and security events | Providing the account and protecting it | Art. 6(1)(b), performing the contract |
| Sign-offs and audit log | Name of the person who confirmed, signed or published, with time and action | Keeping a verifiable record of passport and dismantling content | Art. 6(1)(b) and (f) |
| Billing | Billing contact, company details, VAT ID, payment status | Invoicing and accounting | Art. 6(1)(b) and (c) |
| Product communication | Work email | Service, terms and security notices | Art. 6(1)(b) and (f) |
We do not sell personal data, use it for advertising, or use client content for analytics, benchmarking or training AI models.
3. Cookies and similar technologies
The website and platform use only cookies and similar technologies that are strictly necessary: keeping you signed in, protecting forms against bots, and blocking attacks. These do not require consent. [IF ANALYTICS OR MARKETING TOOLS ARE ADDED, LIST THEM HERE AND ASK FOR CONSENT FIRST.]
4. Who receives data
We use service providers that process data on our behalf under contracts that meet GDPR Article 28:
| Provider | Service | Location of data |
|---|---|---|
| Hetzner Online GmbH | Servers and object storage | Germany |
| Ubicloud | Managed database in Hetzner data centres | Germany |
| Cloudflare, Inc. | DNS, content delivery, security, encrypted backups | Backups stored in the EU; a US company |
| [EMAIL PROVIDER] | Transactional email | [REGION] |
| [LLM PROVIDER] | Reading documents suppliers upload (platform only) | [REGION] |
| [ERROR TRACKING PROVIDER] | Error reports, without document content | [REGION] |
| [PAYMENT PROVIDER] | Payment processing | [REGION] |
We disclose data to authorities only where the law requires it.
5. Transfers outside the EU
[FULL COMPANY NAME] is established outside the EU, in [COUNTRY], and part of our team works from [COUNTRY]. Where personal data is transferred to us or to a provider outside the EU, we protect it with the European Commission's Standard Contractual Clauses or, where available, the EU-US Data Privacy Framework. You can ask us for a copy of the safeguards.
6. How long we keep data
- Website logs: [7–30] days, unless needed to investigate an attack.
- Contact requests: up to [12] months after the last contact if no contract follows.
- Account data: for the duration of the contract, then deleted or anonymised within [90] days, unless the client keeps an archive plan.
- Sign-off and audit records: as long as the related passport must remain available.
- Billing records: as long as tax and accounting law requires.
7. Your rights
You can ask for access to your data, correction, deletion, restriction of processing and a copy in a portable format. Where we rely on our legitimate interests, you can object at any time. Where you gave consent, you can withdraw it at any time. Write to gaurav@unboltdpp.net.
You also have the right to complain to a data protection supervisory authority, in particular in the EU country where you live or work.
8. Security
Data is encrypted in transit, client files are encrypted at rest with per-client keys, access is restricted by role, and every material action is logged.
9. Changes
We will update this policy when our services or providers change, and tell account users about material changes in advance.