Draft for legal review. This text is visible only in local and preview builds. Do not publish it before a legal professional has reviewed it and every [bracket] is filled in.
Privacy policy
Last updated
This policy explains which personal data ExportShift collects when you visit this website or send us a form, why we collect it, how long we keep it and what rights you have.
Version: draft of 25 October 2026.
Who is responsible
The controller for the data described here is:
[Legal company name]
[Address]
[Registration / VAT number]
Email: [email]
We have not appointed a data protection officer. [To confirm with legal advice whether one is required.]
What we collect and why
Visiting the website
When you open a page, our hosting provider processes technical data such as your IP address, the page you requested, the date and time, and your browser type, in order to deliver the page and to keep the site secure and stable. We do not use this data to identify you.
This website does not use analytics or advertising cookies at the moment. [If analytics is added later, describe it here, name the provider, and state that it is used only with your consent.]
The free audit form
If you request a free audit, we collect the details you enter: name, company, website, work email, country, what you manufacture, industry, target market, main buyer type (optional) and any notes. We use them to prepare and send you the audit and to contact you about it.
- Legal basis: steps at your request before a contract, and our legitimate interest in answering business inquiries. You also confirm the purpose by ticking the consent box. [Confirm with legal advice which basis applies.]
- Retention: [X] months after the last contact, unless you become a client. [To decide.]
The contact form
If you write to us through the contact form, we collect your name, company, work email, website (optional), topic and message. We use them to answer you.
- Legal basis: steps at your request before a contract, and our legitimate interest in answering business inquiries. [Confirm with legal advice.]
- Retention: [X] months after the last contact. [To decide.]
If you email us, we process your email address and the content of your message to reply. The same legal basis and retention apply as for the contact form.
Booking a call
[Complete when a booking tool is in use: provider, data collected, legal basis, retention.]
Confirmation emails
When you send a form, you receive an automatic confirmation email, and we receive a notification. These emails contain the details you entered.
Spam protection
Our forms use Cloudflare Turnstile and a hidden field to tell people from automated programs. Turnstile checks signals from your browser and your IP address. Our legitimate interest is to keep the forms free of spam and abuse.
Who receives your data
We use service providers who process data on our behalf, under written agreements.
| Provider | Purpose | Data |
|---|---|---|
| Cloudflare, Inc. | Hosting of the website, storage of form submissions (Cloudflare D1), spam protection (Turnstile) | Technical data of visits, form submissions, signals used by Turnstile |
| Resend, Inc. | Sending the notification and confirmation emails | Email addresses and the content of the emails, including the details you entered |
| [Booking tool] | [Booking calls] | [To complete when in use] |
| [Analytics provider] | [Statistics, only with consent] | [To complete when in use] |
We do not sell your data and we do not share it for advertising. We may disclose data where the law requires it.
Transfers outside the European Economic Area
Cloudflare and Resend are companies based in the United States. Your data may be processed in the United States or other countries. [To complete after checking each provider's current data processing agreement and transfer mechanism, for example the EU–US Data Privacy Framework or standard contractual clauses.]
How long we keep data
- Form submissions and related emails: [X] months after the last contact, unless a business relationship exists. [To decide.]
- Records we must keep by law, such as invoices: for the period the law requires.
- Technical logs at the hosting provider: according to the provider's settings. [To confirm.]
Your rights
You have the right to:
- ask us for access to your personal data,
- have incorrect data corrected,
- have your data deleted,
- restrict how we use it,
- receive your data in a common format (portability),
- object to processing based on our legitimate interests,
- withdraw a consent you have given, at any time, without affecting what was done before.
To use these rights, write to [email]. You also have the right to complain to your data protection authority. [Name the competent authority.]
Security
We use encrypted connections (HTTPS), restrict access to submissions to the people who need them, and choose providers with established security practices. No system is completely secure, so please do not send us sensitive personal data you do not need to share.
Changes to this policy
We may update this policy, for example when we add a service. The date at the top shows the current version.
Contact
Questions about this policy: [email].