01. Data Controller
This Privacy Policy governs the manner in which Mark & Trace ("we", "us", or "the platform") collects, processes, and protects personal data obtained through markandtrace.com.
We strictly adhere to the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation – GDPR) and applicable European Union data protection legislation.
02. Information We Collect
- Packaging Line Audit & Technical Inquiries: Contact person name, business email address, company name, line packaging type, operational line speed (PPM), regulatory compliance standards (e.g. EU FMD 2011/62/EU, US FDA DSCSA, GS1 EPCIS), and engineering setup notes submitted via our audit forms.
- Automatically Collected Technical Metadata: Anonymized / masked IP address, browser type and version, device profile, screen dimensions, and operating system (collected via Cloudflare network security and Google Analytics 4 subject to explicit consent).
- Marketing Attribution Data: First-touch UTM campaign parameters (source, medium, campaign, term, content) and referrer URLs to analyze the effectiveness of technical publications and industry outreach.
03. Purposes and Legal Bases for Processing
Art. 6(1)(b) GDPR — Preparing custom hardware blueprints, line audit reviews, and serialization engineering evaluations at your request.
Art. 6(1)(f) GDPR — Defending web forms and backend infrastructure against automated bot abuse via Cloudflare Turnstile and honeypot traps.
Art. 6(1)(a) GDPR — Processing privacy-preserving analytics and performance metrics via Google Analytics 4.
04. Third-Party Processors & Sub-processors
Personal data is disclosed strictly to vetted enterprise service providers bound by GDPR-compliant Data Processing Agreements (DPAs):
- Brevo (Sendinblue SAS, France / EU): Enterprise CRM and transactional communication platform. Data is hosted on servers located within the European Union.
- Google Analytics 4 (Google Ireland Limited, Ireland / EU): Web telemetry and aggregation insights. Configured with Google Consent Mode v2, ensuring analytics cookies remain disabled until explicit user consent is granted. IP addresses are masked at collection.
- Cloudflare, Inc. (USA / EU): Edge CDN delivery, DNS routing, and non-intrusive bot defense (Turnstile) operating without invasive captcha puzzles or cross-domain tracking.
05. Cookies & Consent Management
Our website uses a minimal footprint of browser storage, categorized as follows:
mt_cookie_consent) and preserves session attribution during active navigation. _ga, _ga_*). Initialized exclusively when you choose "Accept All". 06. Data Retention & Your GDPR Rights
Technical inquiry data is retained only for the duration necessary to conduct engineering evaluations and technical correspondence, up to a maximum of 24 months from the latest interaction, unless ongoing contractual obligations require further retention.
Under Chapter III of the GDPR, you have the following rights:
- Right of Access (Art. 15 GDPR): Request confirmation and copies of personal data processed.
- Right to Rectification (Art. 16 GDPR): Request correction of inaccurate or incomplete records.
- Right to Erasure (Art. 17 GDPR): Request permanent deletion ("right to be forgotten").
- Right to Restrict Processing (Art. 18 GDPR): Request restriction of processing under specified statutory grounds.
- Right to Data Portability (Art. 20 GDPR): Receive data in a structured, commonly used, machine-readable format.
- Right to Withdraw Consent (Art. 7(3) GDPR): Revoke cookie or communication consent at any time without affecting prior lawful processing.
- Right to Lodge a Complaint: You have the right to lodge a complaint with your competent EU Data Protection Supervisory Authority (e.g. CPDP or European Data Protection Board).