Privacy Policy – RFQ, BOM and Customer Data

1. Who controls the information

2. RFQ information collected at submission

We collect your name, business email, delivery country, optional company and phone, requested manufacturer part numbers, quantities, commercial notes, and any BOM you choose to attach. We also retain pseudonymous HMAC identifiers derived from network and email values for abuse prevention; the rate-limit record does not store the raw IP address.

We use this information to validate the request, prepare and discuss a quotation, source requested components, prevent abusive submissions and maintain an auditable inquiry history. Processing needed to answer your request supports steps taken at your request before a possible contract. The checkbox records that this notice was shown and acknowledged; it is not consent to unrelated advertising.

3. Retention

• RFQ contact details, line items and status history: deleted 24 months after the latest recorded workflow status change.
• Accepted BOM files: deleted after 180 days, even when the surrounding RFQ remains.
• Pseudonymous submission-security records: deleted after 30 days.

If a quotation becomes an order, transaction, tax, warranty or legal-claim records may need a separate legally required retention period. Those records are outside the public RFQ form and should be documented before online ordering is enabled.

4. Service providers and international access

The production service uses the following narrowly scoped operators. A provider is not authorized to use RFQ or BOM information for its own advertising.

• netcup: European VPS infrastructure for the application, database, public media and private BOM storage.
• Cloudflare: domain, DNS, HTTPS proxy and security services, plus inbound routing for the published business email address.
• Resend: outbound RFQ receipts, internal RFQ notifications and account-security email. BOM files are never attached to these messages.
• Sentry: EU-region redacted application-error telemetry. Form bodies, BOM contents, cookies, request headers, email addresses and URL queries are removed before an event is sent.

A controller-operated monitor checks only public pages, the health response and the RFQ method boundary; it does not submit an inquiry or receive RFQ or BOM content. Encrypted operational backups are held on a controller-managed system separate from the VPS. Authorized sourcing or operations personnel may access an inquiry from China when needed to answer it. This can involve access outside the country where the requester is located. The controller maintains the applicable provider terms, transfer assessment and safeguards for this operating model.

MPNHarbor does not sell personal information and does not share it for cross-context behavioural advertising.

5. Your choices and rights

Depending on where you live, you may ask to access, correct, delete, restrict or receive a copy of your information, or object to certain processing. Send the RFQ reference and the email used in the request to the controller contact above. Identity must be verified before a request is fulfilled. You may also complain to your local data-protection authority where that right applies.

6. Cookies and automated decisions

The launch storefront does not use advertising or behavioural-analytics cookies. Essential authentication cookies are used only for the private administration area. RFQs are screened for file safety and submission abuse, but no solely automated decision determines component availability, pricing or whether a commercial order is accepted.

7. Changes

The version shown at the top is stored with each submitted RFQ. Material changes create a new version so the notice presented at submission remains auditable.