1. Introduction
TechSavy SL (we, us, our) operates a SaaS suite designed for CNC workshops. This Privacy Policy explains what personal data we collect, how we use it, and what rights you have under the EU General Data Protection Regulation (GDPR). It applies to all visitors of our website and all users of our ERP 4 CNC and CPQ 4 CNC products.
By using our services you confirm that you have read and understood this policy. If you do not agree with how we handle your data, please do not use the service. We may update this policy from time to time; the last revision date is shown above and we will notify active users by email when material changes occur.
2. Data we collect
When you create an account we collect your name, work email, company name and country. When you use the product we collect quotes, parts, machine configurations and other project data you upload — this content belongs to you and we process it only to deliver the service. We collect basic telemetry (page views, error reports, performance metrics) to keep the platform reliable.
We do not buy data from third parties. We do not run cross-site advertising trackers. We do not process card payments and we never collect or store card details: subscriptions are invoiced by TechSavy SL and paid by bank transfer, so the billing data we hold is your company name, billing address, VAT number where applicable, and the reference of the transfer.
3. How we use data
Account and project data are used to operate the service: authenticating you, rendering the dashboards, computing quotes and storing your files. Billing data is used to charge your subscription and produce invoices. Anonymous telemetry helps us prioritise the next bug fix or feature.
We will email you about service incidents, security advisories and material changes to our terms. Marketing emails (newsletter, product announcements) are opt-in and unsubscribable in one click.
4. Legal basis (GDPR)
Under Article 6 GDPR we rely on the following legal bases: (a) performance of the contract you sign when subscribing — this covers account, project and billing data; (b) legitimate interest for fraud prevention and security, balanced against your reasonable expectations; (c) explicit consent for marketing emails and any non-essential cookies, should we introduce them in the future (see our Cookie Policy).
Where we rely on consent you can withdraw it at any time without affecting the lawfulness of prior processing. Where we rely on legitimate interest you have the right to object — see Section 6.
5. Data retention
Your account data is retained for as long as your account exists, whether active, on a paused trial, or between subscriptions. If you cancel your subscription, your account and data are kept as-is (not deleted) so you can resume later — we do not currently run an automatic deletion schedule after cancellation. If you want your account and data permanently deleted, email dpo@techsavysl.com and we will action this within 30 days, except for records we are legally required to keep. Billing records are retained for the statutory 6 years required by Spanish tax law.
Support correspondence (emails to support@techsavysl.com or via our contact form) is retained for as long as reasonably needed to resolve your request and for a limited period afterwards for quality and dispute-resolution purposes.
6. Your rights
Under GDPR you have the right to: access your data, request correction of inaccurate data, request erasure (right to be forgotten), restrict or object to processing, request portability of your data in a structured machine-readable format, and lodge a complaint with the Spanish AEPD or your local supervisory authority.
To exercise any of these rights, email dpo@techsavysl.com from the address registered on your account. We respond within 30 days. For complex requests we may extend this by an additional 60 days as permitted by Article 12 GDPR and will tell you so within the first 30 days.
7. International transfers
Our production infrastructure is hosted in the European Union (Frankfurt and Madrid regions). Backups are encrypted and stored within the EU. Some subprocessors (e.g. error monitoring, transactional email) operate outside the EU — in those cases transfers are governed by the European Commission's Standard Contractual Clauses (2021/914) and supplemented by technical measures such as end-to-end encryption.
The subprocessors we currently rely on are:
- Hostinger — website and application hosting, and database storage, within the EU.
- Our transactional email provider — delivery of account and billing emails (welcome, password reset, notifications).
We will give 30 days' notice before adding a new subprocessor that has access to customer data. A Data Processing Agreement (DPA) compliant with GDPR Article 28 is available to business customers on request at dpo@techsavysl.com.
8. Contact our DPO
TechSavy SL has appointed a Data Protection Officer to oversee compliance with this policy and applicable data protection law. Reach the DPO at dpo@techsavysl.com or by post to our registered office in Castellón, Spain.
If you are not satisfied with our response, you may complain to the Spanish Data Protection Authority (Agencia Española de Protección de Datos, www.aepd.es) or the supervisory authority in your country of residence.