Privacy Policy.

This Privacy Policy explains how Fabrixa B.V. (trading as “Fabrixa”, “we”, “us”) collects and uses personal data in connection with our website, platform, and services for business customers (“Customers”). This Policy is intended for business-to-business use, but it also covers personal data relating to Customer personnel and End Customers (e.g., shipping details) where applicable.

• Registered office: Markerkant 13 10, 1314 AN Almere, The Netherlands
• KvK: 74188445 · VAT: NL826071491B01
• Privacy contact: contact our team

1. Roles under GDPR (controller / processor)

1.1 Fabrixa as Controller (account & website data)

Fabrixa acts as a data controller for:

• Customer account administration (user profiles, login details)
• Billing and finance contacts
• Website analytics and security logs
• Support communications
• Sales/marketing communications (where permitted)

1.2 Fabrixa as Processor (fulfilment data)

Where Customers provide End Customer personal data for fulfilment (e.g., name/address, email/phone for carriers), Fabrixa typically acts as a data processor (or sub-processor) on Customer’s behalf. In that case, processing is governed by our Data Processing Addendum (“DPA”), which forms part of our Terms of Service, and by Customer’s instructions.

2. Personal data we collect

Depending on your use of the Services, we may collect:

2.1 Account and contact data

Name, business email, phone, job title, company name, address, login credentials (hashed), user permissions.

2.2 Billing and transaction data

Billing address, VAT number, invoices, payment status, wallet/prepaid events. We do not store full card details if a payment provider is used.

2.3 Support and communications

Support tickets, emails, chat logs, attachments you send to us.

2.4 Technical data

IP address, device/browser info, event logs, timestamps, API usage logs, error logs, security logs.

2.5 End Customer fulfilment data (received from Customer)

Recipient name, delivery address, country, postal code, and where needed by carriers: phone/email.

2.6 Content / design data

Artwork files or references may contain personal data if you include it; avoid submitting sensitive data in designs.

3. Purposes & legal bases (controller processing)

We process personal data as controller for:

4. End-Customer data (processor processing)

When we process End Customer data on Customer’s behalf for fulfilment:

• We process only as necessary to produce, package, ship and support the order.
• We act on Customer’s documented instructions.
• We may use tooling from our listed sub-processors, including an AI assistant operated for Fabrixa staff, to answer questions and resolve issues about orders; this is covered by the DPA and the sub-processor list.
• We do not sell End Customer data.
• We retain End Customer data only as long as needed for fulfilment, support, disputes, and legal requirements (see retention).

5. Sharing of personal data

We may share personal data with:

We require appropriate contractual safeguards and confidentiality for all providers. Our current sub-processor list names every provider that processes personal data for us, with location and transfer mechanism, and explains how Customers are notified of changes.

6. International transfers

If personal data is transferred outside the EEA/UK, we use appropriate safeguards such as:

• Adequacy decisions, or
• Standard Contractual Clauses (SCCs) plus supplemental measures where required.

We rely on SCCs for transfers to our US-based service providers: Apollo, Inc. (B2B visitor identification), Cloudflare, Inc. (CDN / DDoS protection), Microsoft (Clarity), Intuit (Mailchimp) and Anthropic, PBC (AI assistant), and for our engineering partner in Ukraine. For Apollo, Cloudflare, Microsoft and Mailchimp the data shared is limited to what is technically necessary to deliver the service: IP address, user-agent, referring URL and pages viewed, and for Mailchimp the name and e-mail address you subscribe with. No order data, account credentials or End Customer personal data is shared with these four providers. Anthropic is different: authorised Fabrixa staff may submit account, order and support data to the AI assistant to answer questions and resolve issues. This can include End Customer names and delivery addresses contained in an order. It never includes payment card data or passwords. Anthropic processes this data under our commercial agreement and Data Processing Addendum, does not use it to train its models, and retains it only for the limited period set in that agreement. Our engineering partner accesses production data only when needed for support and fixes, under confidentiality and SCCs.

7. Data retention

We retain personal data only as long as necessary for the purposes described:

8. Security

We implement reasonable technical and organisational measures to protect data, including:

• Access controls and least privilege
• Encryption in transit (TLS)
• Logging and monitoring
• Secure credential handling

No method is 100% secure; Customers must also secure their systems and API credentials. Where we act as processor we notify the affected Customer without undue delay and in any event within 48 hours after becoming aware of a personal data breach, so the Customer can meet its own 72-hour duty; where we act as controller we notify the supervisory authority within 72 hours as required by Article 33 GDPR.

9. Your rights (controller data)

Individuals may have rights under applicable laws (GDPR), including access, rectification, deletion, restriction, objection, and data portability:

• For Customer account users: contact us.
• For End Customers: please contact the merchant/platform you purchased from (the Customer). Fabrixa typically acts as processor and will assist the Customer as required by the DPA.

10. Cookies and tracking

We may use cookies and similar technologies for:

• Essential site functionality and security
• Analytics and performance (Google Analytics 4 after consent; Microsoft Clarity — see the Cookie Policy)
• B2B visitor identification. We use Apollo.io to identify the company associated with a visitor’s IP address (firmographic enrichment) so our sales team can prepare relevant follow-up. This is company-level only — we have not enabled person-level identification. Apollo’s tracker collects IP address, user-agent, referrer, and pages viewed. See Apollo’s Privacy Policy and Cookie Policy for details.

Full details — including which cookies are set, by whom, for how long, and how to manage them — are in our Cookie Policy. Visitors in the EEA/UK can object to non-essential processing via our contact page.

11. Changes to this policy

We may update this Policy by publishing a new version and changing the “Last updated” date. Continued use of the Services after changes become effective constitutes acceptance where permitted by law.

12. Contact

Data protection questions: privacy@fabrixa.com or contact our team. If applicable, you may lodge a complaint with your local supervisory authority. In the Netherlands that is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).