Privacy Policy

1. General information

This privacy policy informs you how personal data is processed when you use the textileportal.eu website, the related web application and the Textile Portal mobile application for iOS and Android.

Textile Portal is a service provided by MachTech Digital OÜ.

This offering is made exclusively to entrepreneurs and commercial businesses (B2B), in particular textile manufacturers, subcontract workshops and fashion / ready-to-wear brands. It is not a service for consumers (B2C).

Textile Portal enables textile businesses to manage production stages such as cutting, sewing, finishing and quality control, as well as materials and stock, and to create a Digital Product Passport (DPP). Process management is carried out through the web application and the mobile application.

2. Controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:

MachTech Digital OÜ
Sepapaja tn 6
15055 Tallinn
Estonia

Phone:

+372 5832 4426

Email:

info@textileportal.eu

Questions relating to data protection and requests to delete a user account may be sent to info@textileportal.eu.

3. Scope of data processing

Depending on how Textile Portal is used, the following categories of data may be processed:

• Master inventory and company data (name of the authorised person, title, company name)
• Contact details (business email, company telephone number)
• Company operations and production data (orders, models, recipes, stage records)
• Data-access and user authentication data
• Contract and billing data
• Payment and transaction information
• Uploaded technical drawings, product photographs and fabric/material files
• Technical usage and log records
• Device and application information
• Push-notification identifiers (FCM token)
• Contact data in connection with support requests

4. Registration and user account

Registration for Textile Portal takes place only through the web application. Direct account registration is not available in the mobile application. The mobile application is used to manage on-site operational processes with account credentials created on the web.

During registration, the following data are processed: first name, last name, company name, email address, telephone number, address, postal code, city, country, tax/VAT number and password.

The data are processed to create a user account, authenticate users, perform contractual obligations and manage the B2B commercial relationship (GDPR Article 6(1)(b) and 6(1)(f)).

The account administrator may define separate sub-user accounts for processes such as cutting, sewing, finishing and quality control.

5. Management of production processes and models

Users may store and manage production models, lot numbers, order quantities, fabric/material types, operation stages and cost items in the system. This processing is carried out in order to provide the requested production-tracking service (GDPR Article 6(1)(b)).

6. Digital Product Passport (DPP) and unique links

Textile Portal offers the ability to create a Digital Product Passport (DPP) page for produced textile models via a unique identifier (Unique ID / QR code). Third parties who have this unique link can view the product’s technical specifications, raw-material composition and production details. These pages do not contain personal data of individuals; only product- and company-level technical data are made public.

7. No artificial-intelligence processing

No artificial intelligence (AI), OCR image analysis or automated decision-making model is used in the Textile Portal infrastructure. All data are entered manually by the customer or imported in Excel format.

8. Product images, technical drawings and Cloudflare R2

Users may upload model photographs, technical sheets, fabric images and company logos for use in the system.

Cloudflare R2 is used as the image and file storage infrastructure:

Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA.

Files are hosted in Cloudflare storage locations within the European Union (EU). Transfers are subject to the safeguards of the EU Standard Contractual Clauses and the EU–US Data Privacy Framework.

9. Camera and file permissions

The mobile application may request access to the camera and photo gallery on the user’s device for defect detection during production stages and for photographing products or labels. These permissions are used only for the relevant operation and can be turned off at any time in the device settings. Textile Portal does not request access to contacts, the microphone or location data.

10. Push notifications and Firebase services

Firebase Cloud Messaging (FCM): used to send notifications to the relevant teams when production stages are completed or an operational disruption occurs. Notification permission can be turned off in the device settings.

Google Firebase Analytics & Crashlytics: technical device identifiers and performance logs are processed to ensure the technical stability of the application and to detect crashes and errors.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

11. Payment processing via Stripe

Subscription payments are collected via Stripe Checkout. The user is redirected to the payment page; credit-card and bank data are processed directly by Stripe. No credit-card information is stored on Textile Portal servers.

Provider: Stripe Payments Europe, Limited (Ireland). (Legal basis: GDPR Article 6(1)(b) and 6(1)(c)).

12. Billing and commercial invoicing

Where bank transfer is chosen for annual subscriptions, or a corporate invoice is issued directly, the customer’s legal name, company address, tax/VAT identification number and transaction details are processed and stored in accordance with Estonian accounting and tax law.

13. Website and email infrastructure (GoDaddy)

Website hosting and the transmission of system emails (password reset, operational notifications, membership verification) are carried out technically via GoDaddy SMTP infrastructure. (GDPR Article 6(1)(f)).

14. Web application and database hosting (Hetzner)

The Textile Portal web application, administration panel, backend systems and operational database are hosted in the following data centre:

Hetzner Online GmbH
Server location: Helsinki, Finland (within the European Union).

15. Data backups

Regular daily backups of the system database are taken to prevent data loss. Backups are stored securely on Hetzner Finland infrastructure, rotated on a cyclical basis and retained only for disaster-recovery purposes.

16. Server log files

When servers and API interfaces are accessed, the IP address, time of access, requested URL, device information and HTTP status codes are stored for a maximum of 30 days in order to ensure system security and detect cyber attacks (GDPR Article 6(1)(f)).

17. Communication channels and support

Data shared in support requests made by email, contact form or telephone are processed solely to resolve the relevant request and to conduct the commercial relationship.

18. System and transactional emails

Textile Portal sends transactional emails that are necessary to perform the service (account opening, stage notifications, security codes, invoices). Unsolicited marketing newsletters or advertising emails are not sent to users.

19. Cookies and session management

The web application uses only the technical cookies that are strictly necessary to maintain login, user authentication and security settings. Third-party advertising cookies for tracking purposes are not used.

20. Compliance and cookie preference management

A standard compliance infrastructure is used to manage and document users’ cookie preferences technically.

21. Tag and script management

Only standard managers for executing technical scripts may run on the system. Marketing tags that profile users (Meta Pixel, Google Ads, etc.) are not used.

22. No end-user / consumer profiling

Textile Portal is a B2B production-management system. No reservation, membership, profiling or shopping-behaviour analysis is carried out in respect of end consumers who purchase the garments produced.

23. Recipients of data and sub-processors

Data are shared only with the technical partners that are necessary to provide the service:

• Servers and database: Hetzner Online GmbH (Finland/EU)
• Media storage: Cloudflare R2 (EU)
• Notifications and analytics: Google Firebase (Ireland/EU)
• Email transmission: GoDaddy
• Payments: Stripe Payments Europe (Ireland/EU)

Data are not sold or rented to unauthorised third parties.

24. Transfers of data outside the European Economic Area

Data are hosted primarily within the EU (Finland). Where a technical necessity arises through global infrastructure providers (Cloudflare, Google), transfers are carried out under GDPR Article 44 et seq. on the basis of the EU Standard Contractual Clauses (SCCs) and the Data Privacy Framework.

25. Retention period and account deletion

User accounts remain active for as long as the contractual relationship continues. Where an account-deletion request is sent to info@textileportal.eu, operational production data are removed from the system within 14 days. Invoice records subject to statutory tax and accounting rules are retained for the legally required periods.

26. Data security

All data transmissions are encrypted end-to-end with TLS/HTTPS. User passwords are stored in the database using strong cryptographic hashing algorithms. Access to the systems is limited to authorised personnel.

27. Automated decision-making and profiling

The platform does not contain any automated decision-making mechanism or profiling system that produces legal effects concerning the user within the meaning of GDPR Article 22.

28. Rights of data subjects

Users have the rights under the GDPR to obtain information (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and to object (Article 21). These rights may be exercised by contacting info@textileportal.eu.

29. Right to lodge a complaint with a supervisory authority

Users have the right to lodge a complaint with the Estonian Data Protection Inspectorate concerning data-processing activities:

Andmekaitse Inspektsioon (AKI)
Tatari 39, 10134 Tallinn, Estonia
Phone: +372 627 4135
Email: info@aki.ee
Web: https://www.aki.ee

30. Changes

This policy may be updated in line with legal requirements or technical infrastructure updates. The current text becomes effective upon publication at textileportal.eu.