Data Processing Agreement
Effective: 2026-08-01 · Version 1.0 · Applies to EU/UK customers whose procurement requires GDPR Article 28 terms.
1. Roles and Scope
PrecisionIndParts acts as a processor of personal data that appears in customer enquiries, drawings and order documentation (contact names, business email addresses, and any personal data embedded in uploaded files). The customer acts as controller. This agreement applies whenever the customer submits data through precisionindparts.com, email or direct file transfer.
2. Data We Process
Contact information (name, business email, phone, company, country), project descriptions, and CAD/drawing files submitted for quotation. We do not request or process special-category personal data; customers must not include such data (e.g. health information in medical-device drawings) without prior written agreement.
3. Lawful Basis and Purpose
Data is processed solely to prepare quotations, manufacture parts, provide quality documentation, and communicate about the customer’s projects. Newsletter data is processed under separate consent (double opt-in).
4. Security Measures
Data is stored on encrypted infrastructure (PostgreSQL at rest, TLS 1.2+ in transit). Access to uploaded drawings is limited to the assigned applications engineer and quality staff on a need-to-know basis. Uploaded CAD files are isolated by project and automatically deleted 90 days after the last activity, with deletion confirmation available on request.
5. Sub-processors
We use the following sub-processors: Railway (hosted infrastructure, EU/US regions), SendGrid (transactional email), Vercel (website hosting), and object storage for CAD files. A current list is provided on request; customers will be notified of material changes.
6. Retention and Deletion
Quotation records are retained for 7 years (tax and export-control record-keeping). Uploaded engineering files follow the 90-day deletion rule in Section 4 unless the project converts to an order, in which case files are retained for the order’s warranty period plus applicable statutory terms.
7. Customer Rights
At any time the customer may request: a copy of their data, correction of inaccuracies, deletion (subject to statutory retention), or a data-export in a structured format. Requests are actioned within 30 days.
8. Data Breach Notification
In the event of a personal-data breach affecting customer data, PrecisionIndParts will notify the customer within 72 hours of becoming aware, including the nature of the breach, affected data categories, and remediation steps.
9. Governing Law
This agreement is governed by the laws of the People’s Republic of China, without prejudice to the customer’s rights under the GDPR or UK GDPR where applicable.
10. Contact
Data protection enquiries: admin@precisionindparts.com. Written requests may also be sent to PrecisionIndParts, Changan Technology Industrial Park, Xi’an, Shaanxi 710100, China.