Smart Factory Privacy Statement

We value your privacy and the privacy of everyone who works with our software. This statement explains, clearly and concisely, which personal data we process, why we do so, and what your rights are.

This statement covers personal data for which Smart Factory itself is the controller, such as account, contact and billing details. For personal data that you or your users enter into the software, for example about your employees, the Data Processing Agreement applies.

Data

We only process what is necessary to provide and secure our software.

Purpose

To manage your account, provide support, handle billing, and keep Smart Factory running reliably.

Security

Your data is encrypted and we never sell your information.

Control

You can ask us to access, correct or delete your personal data, to the extent permitted by law.

Have a question about this statement? Email us at privacy@smarfac.com.

1. Who we are

We are Smart Factory B.V., a Dutch private limited company with its registered office in Haaksbergen.

For data we process for our own purposes, such as your account or a contact request, we are the controller within the meaning of the GDPR. For data that you or your users enter into our software, we are processor on your behalf. The data processing agreement is part of your subscription.

2. What data we process

We keep this to a minimum. Specifically:

• Customer data in the software. Anything you or your users enter into Smart Factory, to the extent it contains personal data. You retain control over this data. We use it only on your instructions and to provide the service.
• Account data.
• Contact details.
• Invoicing and payment details.
• Technical and analytical service data. Data on the use and operation of Smart Factory, needed to keep the service safe, stable and reliable, and to improve it in a targeted way.

3. Why we process it

For each purpose we have a legal basis under the GDPR:

• Performance of the contract. Managing your account, providing support, billing, and making the software available.
• Legitimate interest. Securing our systems, ensuring availability, fraud prevention, error analysis and product improvement. We make sure this is always balanced with your interests.
• Legal obligation. For example, retaining invoices for tax authorities.

4. How long we keep it

We do not retain personal data longer than necessary for the purposes for which we process it, or as required by law.

5. Who we share it with

Only with parties needed to provide the service, and only to the extent necessary:

• Hosting. Customer data in the software is stored safely and encrypted at Microsoft Azure in the West Europe region.
• Payments. Our payment provider processes the data needed for payment.
• Customer communication. Service providers may process the data needed for contact and handling of questions, for email and support.
• Analytics and monitoring. To keep Smart Factory safe, stable and reliable and to improve it in a targeted way, we use analytics and monitoring tools. These process technical and analytical service data, not customer data in the software.
• External systems you connect yourself. If you set up an API connection through Smart Factory to a system of your choice, such as an ERP package or a dashboard tool, the data you send that way goes to that supplier. We facilitate the connection; your agreements with that party are then leading.
• Legal obligation. To regulators or law enforcement when the law requires.

With parties that process personal data on our behalf, we conclude data processing agreements or make appropriate privacy arrangements. We never sell your data to third parties.

6. Security

We take the security of personal data seriously:

• Encryption with TLS 1.2 or higher in transit and AES-256 at rest.
• Hosting at a provider with ISO 27001 and SOC 2 certifications.
• Regular reviews of our processes and software.

Access to customer data is strictly limited and only allowed when necessary for security, with the customer’s consent, or to resolve a serious incident.

If something goes wrong that constitutes a personal data breach, we act in accordance with the GDPR. For data where we are the controller, we report the breach within 72 hours to the Dutch Data Protection Authority where required, and inform data subjects when this is mandatory. For customer data we process on your behalf, we inform you without undue delay so you can determine the appropriate next steps.

7. Your rights

Under the GDPR, you have the right to:

• Know which personal data we process about you.
• Have incorrect data corrected or supplemented.
• Have your data deleted when permissible.
• Restrict processing or object to it.
• Receive your data in a commonly used format and transfer it to another party.
• Withdraw your consent, to the extent processing is based on consent.

Submit your request via privacy@smarfac.com.

8. Filing a complaint

Not satisfied with how we handle your data? We’d like to hear from you first via privacy@smarfac.com. If we cannot reach a resolution together, you may file a complaint with the Dutch Data Protection Authority via autoriteitpersoonsgegevens.nl.

9. Changes to this statement

We may update this statement, for example due to new legislation or new features. The current version is always available on our website. We will actively notify you of significant changes.

10. Contact