Privacy Policy.

This Privacy Policy explains how Fabrixa B.V. (trading as “Fabrixa”, “we”, “us”) collects and uses personal data in connection with our website, platform, and services for business customers (“Customers”). This Policy is intended for business-to-business use, but it also covers personal data relating to Customer personnel and End Customers (e.g., shipping details) where applicable.

• Registered office: Markerkant 13 10, 1314 AN Almere, The Netherlands
• KvK: 74188445 · VAT: NL826071491B01
• Privacy contact: contact our team

1. Roles under GDPR (controller / processor)

1.1 Fabrixa as Controller (account & website data)

Fabrixa acts as a data controller for:

• Customer account administration (user profiles, login details)
• Billing and finance contacts
• Website analytics and security logs
• Support communications
• Sales/marketing communications (where permitted)

1.2 Fabrixa as Processor (fulfilment data)

Where Customers provide End Customer personal data for fulfilment (e.g., name/address, email/phone for carriers), Fabrixa typically acts as a data processor (or sub-processor) on Customer’s behalf. In that case, processing is governed by a separate Data Processing Addendum (“DPA”) and Customer’s instructions.

2. Personal data we collect

Depending on your use of the Services, we may collect:

2.1 Account and contact data

Name, business email, phone, job title, company name, address, login credentials (hashed), user permissions.

2.2 Billing and transaction data

Billing address, VAT number, invoices, payment status, wallet/prepaid events. We do not store full card details if a payment provider is used.

2.3 Support and communications

Support tickets, emails, chat logs, attachments you send to us.

2.4 Technical data

IP address, device/browser info, event logs, timestamps, API usage logs, error logs, security logs.

2.5 End Customer fulfilment data (received from Customer)

Recipient name, delivery address, country, postal code, and where needed by carriers: phone/email.

2.6 Content / design data

Artwork files or references may contain personal data if you include it; avoid submitting sensitive data in designs.

3. Purposes & legal bases (controller processing)

We process personal data as controller for:

4. End-Customer data (processor processing)

When we process End Customer data on Customer’s behalf for fulfilment:

• We process only as necessary to produce, package, ship and support the order.
• We act on Customer’s documented instructions.
• We do not sell End Customer data.
• We retain End Customer data only as long as needed for fulfilment, support, disputes, and legal requirements (see retention).

5. Sharing of personal data

We may share personal data with:

We require appropriate contractual safeguards and confidentiality for all providers. A current list of sub-processors is available on request via our contact page.

6. International transfers

If personal data is transferred outside the EEA/UK, we use appropriate safeguards such as:

• Adequacy decisions, or
• Standard Contractual Clauses (SCCs) plus supplemental measures where required.

Specifically, we rely on SCCs for transfers to our US-based service providers (currently Apollo, Inc. for B2B visitor identification and Cloudflare, Inc. for CDN / DDoS protection). Data shared with these providers is limited to what is technically necessary to deliver the service (IP address, user-agent, referring URL, and pages viewed). No order data, account credentials, or End Customer personal data is shared with these providers.

7. Data retention

We retain personal data only as long as necessary for the purposes described:

8. Security

We implement reasonable technical and organisational measures to protect data, including:

• Access controls and least privilege
• Encryption in transit (TLS)
• Logging and monitoring
• Secure credential handling

No method is 100% secure; Customers must also secure their systems and API credentials. If we ever experience a breach affecting your data, we will notify you and the supervisory authority within 72 hours as required under GDPR Article 33.

9. Your rights (controller data)

Individuals may have rights under applicable laws (GDPR), including access, rectification, deletion, restriction, objection, and data portability:

• For Customer account users: contact us.
• For End Customers: please contact the merchant/platform you purchased from (the Customer). Fabrixa typically acts as processor and will assist the Customer as required by the DPA.

10. Cookies and tracking

We may use cookies and similar technologies for:

• Essential site functionality and security
• Analytics and performance
• B2B visitor identification. We use Apollo.io to identify the company associated with a visitor’s IP address (firmographic enrichment) so our sales team can prepare relevant follow-up. This is company-level only — we have not enabled person-level identification. Apollo’s tracker collects IP address, user-agent, referrer, and pages viewed. See Apollo’s Privacy Policy and Cookie Policy for details.

Full details — including which cookies are set, by whom, for how long, and how to manage them — are in our Cookie Policy. Visitors in the EEA/UK can object to non-essential processing via our contact page.

11. Changes to this policy

We may update this Policy by publishing a new version and changing the “Last updated” date. Continued use of the Services after changes become effective constitutes acceptance where permitted by law.

12. Contact

Data protection questions: contact our team. If applicable, you may lodge a complaint with your local supervisory authority. In the Netherlands that is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).