Privacy Statement MDC Systems
For mdcsystems.nl and app.mdcsystems.nl
Version and date: 19 October 2026
Section 1. Who are we?
MDC Systems is a sole proprietorship based in Cuijk, the Netherlands, registered with the Chamber of Commerce under number 42143442.
Email: info@mdcsystems.nl
Website: https://mdcsystems.nl
Customer portal: https://app.mdcsystems.nl
We check and correct GPSR product information for webshops, including through Fix Sprint and Operational Care.
Section 2. Our role in relation to your personal data
MDC Systems is the controller for personal data that we use for our own customer relationship, account administration, invoicing, communications and security.
When we process personal data in product information, supplier requests or associated case files on behalf of a webshop, the webshop is our client and the controller. MDC Systems acts as a processor in this context, in accordance with the client's instructions and the data processing agreement. In supplier requests, we state on behalf of which webshop we are making contact.
This statement describes both situations. For processing for which the webshop is responsible, that webshop's privacy statement also applies.
Section 3. What data do we use and why?
Business data falls within the scope of the GDPR insofar as it relates to an identifiable natural person, such as a sole trader or a contact person.
| Data | Purpose | Legal basis or role |
|---|---|---|
| Name, business email address, company name, KVK number and necessary invoicing details | Creating and managing an account, fulfilling agreements and maintaining contact | Performance of the contract if you are personally a party to the contract. For contact persons at organisations: our legitimate interest in maintaining the business relationship |
| Invoices, payment references, payment status and payment data that we receive through Mollie | Processing payments and keeping our records | Performance of the contract or the legitimate interest in payment and record-keeping; legal obligation for tax records |
| Email correspondence, including through info@mdcsystems.nl and case@mdcsystems.nl | Answering questions, coordinating work and recording agreements | Performance of the contract or our legitimate interest in business communications. We process case file correspondence on behalf of a webshop on that webshop's instructions |
| Names and business email addresses of suppliers and manufacturers, their responses and any personal data in product and manufacturer texts | Checking product information, requesting missing information, and preparing and implementing corrections | Processing on behalf of the webshop; the webshop determines and accounts for the legal basis |
| API keys and data about the webshop connection | Securely reading and updating the agreed product data | Performance of the services; for personal data that we process on behalf of the webshop, we act as a processor |
| IP addresses and technical logs, such as timestamps, error messages and security events | Securing our systems, investigating faults and preventing misuse | Our legitimate interest in secure and reliable services |
| Delivery register (leveringsregistratie) for each delivered Final Report: engagement number, delivery date, description of the work and the record of your approval, without supplier or manufacturer data | Being able to demonstrate what work we delivered and when, including after the case file has been deleted | Our legitimate interest (Art. 6(1)(f) GDPR); we are an independent controller for this processing |
Where we rely on a legitimate interest, we weigh the necessity of the processing against your privacy interests. We limit the processing to what is necessary for that purpose.
The necessary account, invoicing and connection data is required to provide the relevant service. Without this data, we cannot create an account, process a payment or update product data in your webshop. You provide other information only insofar as it is relevant to your question or engagement.
Section 4. Where does the data come from?
We receive data from you, from your organisation, through the connected webshop and through Mollie. Technical data is generated when you use our website and the portal.
We receive business contact details of suppliers and manufacturers from our client, from previous business correspondence or from public business sources, such as supplier and manufacturer websites and product documentation.
If we do not receive personal data directly from you and we are the controller for that data, we inform you within the statutory time limit: in principle, no later than one month, and earlier at the first contact or the first disclosure to another recipient. A statutory exemption may apply. For supplier requests on behalf of a webshop, we assist the webshop with this obligation to provide information.
Section 5. Access to webshop data and use of AI
When connected to Shopify, WooCommerce and, once available, bol, we read and write product data only. We do not request or use order data or data about your webshop customers, even if the API key technically provides broader access.
We use Anthropic to prepare proposals based on product and manufacturer texts. We limit the input to the text needed for that proposal and the necessary data within it. API keys, payment data, order data and webshop customer data are not provided for this purpose.
We do not make decisions about individuals based solely on automated processing that produce legal effects or otherwise significantly affect them. AI is used to support work on product information.
Section 6. With whom do we share data?
We do not sell personal data. We disclose data only insofar as necessary for the services, our record-keeping and security, or to comply with a legal obligation.
| Service provider | Use and relevant data | Role and location |
|---|---|---|
| Supabase | Database, authentication and storage; account and case file data, and API keys stored in encrypted form | Processor or sub-processor. Primary project region: Frankfurt, Germany (eu-central-1), within the EU. Support and business operations may involve processing outside the EEA, including in Singapore and the US |
| Vercel | Website and portal hosting; technically necessary request data, IP addresses and logs | Processor or sub-processor. Configured hosting region: Frankfurt, Germany. Additional processing may take place outside the EEA, including in the US |
| Resend | Sending service and case file messages; email addresses, message content and sending data | Processor or sub-processor; data storage in the US |
| Mollie | Payment processing; necessary payment and transaction data | Independent controller for payment services; based in the Netherlands |
| Anthropic | AI proposals based on product and manufacturer texts, including necessary personal data within those texts | Sub-processor; US. Data processing arrangements and European Standard Contractual Clauses (SCCs) apply |
| Google Workspace | Email correspondence through info@mdcsystems.nl and case@mdcsystems.nl; contact details, messages and relevant attachments | Processor or sub-processor. Processing may take place within and outside the EEA, including in the US |
A service provider is our processor when it works on our own processing activities, and a sub-processor when it works through us on behalf of a webshop. We put the required data processing arrangements in place with these service providers. Mollie's privacy statement also applies to payment processing by Mollie.
For the engagement, we share necessary business contact and product information with the webshop, supplier or manufacturer concerned. When updating product pages, the product data designated by the webshop is transmitted to the connected platform and published in accordance with the engagement.
Section 7. Processing outside the EEA
EU hosting does not mean that all processing takes place within the European Economic Area (EEA). The international service providers mentioned above may process data outside the EEA or access it from there.
A transfer takes place only when Chapter V GDPR is complied with. For this purpose, we use an applicable adequacy decision or appropriate safeguards, such as the European Commission's SCCs. Where necessary, we assess the transfer risks and take supplementary measures. A data processing agreement and SCCs apply to Anthropic.
You can request information and a copy of the applicable transfer safeguards via info@mdcsystems.nl. Confidential information and data about others may be redacted.
Section 8. How long do we retain data?
| Data | Retention period |
|---|---|
| Our own account and administrative case file data, including agreements and correspondence about our customer relationship | For as long as your account is active and for up to 12 months after closure, insofar as still necessary for handling outstanding matters and accountability |
| Product and supplier case files that we manage solely as a processor | During the engagement. After termination: return or deletion within 30 days in accordance with the data processing agreement |
| Technical logs and IP addresses for security and misuse prevention | 12 months after recording |
| Delivery register for each delivered Final Report (engagement number, delivery date, description of the work, record of your approval) | 5 years after delivery; automatically deleted thereafter. The Final Report itself is deleted with the case file |
| Invoices and associated records required by tax law | 7 years, calculated in accordance with the applicable statutory tax retention requirement |
| API keys | For as long as the connection is necessary for the engagement. When the connection ends, we stop using the keys and delete stored keys within 30 days at the latest |
The period of 12 months after account closure does not entitle us to retain personal data that we manage solely as a processor for longer than the data processing agreement permits.
For data for which we are the controller, a specific statutory retention obligation or the necessary handling of an existing dispute may require a longer period. In that case, we retain only the data necessary for that purpose, with restricted access, for as long as that necessity exists. For data that we manage solely as a processor, the data processing agreement applies.
Back-ups. Insofar as separate deletion from back-ups is technically not possible, remaining copies disappear no later than 35 calendar days after deletion from the active systems. These back-ups are protected and are used only for necessary restoration. When restoring, we reapply earlier deletions before the data is used again.
Section 9. Security and cookies
We take appropriate technical and organisational measures. These include separate access for each customer through row level security, encrypted storage of API keys and login via a magic link. Within MDC Systems, only the owner has access to personal data, insofar as necessary for the work. Primary hosting is located in the EU; Section 7 applies to international service providers.
We use only functional cookies and session technologies for purposes including login, session management and security. We do not use marketing cookies or advertising tracking. These functional technologies remain active only for as long as necessary for their function. If you block them, the portal may not function properly.
In the event of a personal data breach, we act in accordance with the GDPR. If it concerns personal data that we process on behalf of a webshop, we inform that webshop without undue delay and no later than 48 hours after discovery.
Section 10. Your privacy rights
You may request access to, a copy of, rectification or erasure of your personal data, or restriction of its processing. You may object to processing based on a legitimate interest on grounds relating to your particular situation. We will then assess whether we must stop the processing.
You may request data portability where the processing is carried out by automated means and is based on consent or a contract with you. These rights apply subject to the conditions of the GDPR; a statutory retention obligation may, for example, limit erasure.
Send your request to info@mdcsystems.nl. We normally respond within one month. If an extension is necessary because of the complexity or number of requests, we will inform you within that month, stating the reason. The extension is a maximum of two additional months. We may request necessary additional information to establish your identity. We normally handle requests free of charge.
If your request concerns data that we process on behalf of a webshop, we forward it to that webshop without undue delay and assist with its handling.
You may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), via autoriteitpersoonsgegevens.nl. You do not have to contact us first.
Section 11. Website (mdcsystems.nl and mdcsystems.eu)
Forms. Through the forms on the website (Free Mini Screen, contact form, GPSR check), we process the data you enter: name, email address, company name, website address and your message. This data is delivered to us by email and retained in our business mailbox (Google Workspace); the website itself does not store form data in a database. Legal basis: fulfilment of your request (pre-contractual) and our legitimate interest in answering questions. Retention period: a maximum of 12 months after the last contact, unless it results in a contract.
WhatsApp. If you contact us via WhatsApp, WhatsApp (Meta Platforms Ireland) processes your telephone number and messages in accordance with its own privacy policy. We retain WhatsApp conversations for no longer than necessary to handle the matter and transfer relevant agreements to email.
Statistics. We use Vercel Web Analytics for anonymised visitor statistics (page views, country, device type). No cookies are set and no IP addresses are retained; individual visitors cannot be identified. We do not use advertising or tracking cookies.
Hosting and processors. The website is hosted by Vercel Inc. (servers in the EU, Frankfurt region); email runs through Google Workspace; transactional emails from the app run through Resend. Data processing agreements have been concluded with these parties; where data is processed outside the EEA, this takes place on the basis of the EU-US Data Privacy Framework or Standard Contractual Clauses.
Links to the app. The "Start the Readiness Check" buttons and the legal links take you to app.mdcsystems.nl; the provisions on the customer portal in this statement apply there.
Section 12. Business outreach to service providers
This section provides the information required by Article 14 GDPR for business contacts whom we approach without their having provided their data to us themselves.
Who is responsible? MDC Systems, a sole proprietorship based in Cuijk, the Netherlands, KVK number 42143442, is the controller for this processing. You can reach us at info@mdcsystems.nl. We do not have a data protection officer.
Purpose. We approach business service providers for webshops by email with a proposal to collaborate, for example e-commerce and web agencies, marketplace specialists, fulfilment companies, e-commerce consultants, accountancy firms, CRO and SEO agencies, feed and PIM specialists, AI automation agencies and customer service companies. We send no more than one email and one reminder per company.
What data. Company name, business email address, domain and website, country, language, legal form and category of the company, the source of the data, when we emailed you and whether you replied, and the delivery status of our email (delivered, undeliverable or reported as spam). We do not record a person's name, job title or telephone number and do not measure whether you open our email or click on links.
Source. We obtain business contact details through public company websites and public company profiles. In our first communication, we specify the source from which your data was obtained.
Legal basis. For selecting relevant business contacts, we rely on legitimate interest (Art. 6(1)(f) GDPR): acquiring suitable business customers and partners. We document the necessity and the balancing of interests. We send commercial email only where the applicable rules permit it.
Recipients. We do not sell this data. Our emails are sent through Resend. The data is stored with Supabase (Frankfurt, Germany) and the application runs on Vercel (Frankfurt region). Your reply is received in our business mailbox at Google Workspace. These service providers act as our processors.
Transfers outside the EEA. Resend stores data in the US; processing outside the EEA may take place at Vercel and Google Workspace. The safeguards in Section 7 apply to this.
Retention period. Without a substantive response, we delete prospect data no later than 90 days after the last scheduled email. Where there is substantive contact, we retain this data for a maximum of 12 months after the last substantive response, insofar as necessary. A reminder sent by us does not extend this period. If you object, we stop direct marketing immediately. We retain only the email address on a restricted-access suppression list for as long as necessary to prevent renewed contact.
Your rights. You have the right of access, rectification, erasure and restriction of processing, as described in Section 10. On request, we will also tell you the source from which your data was obtained.
Objecting to this outreach. You may object at any time and free of charge to the use of your data for this business outreach (direct marketing). Reply to our email or write to info@mdcsystems.nl, or use the unsubscribe link in our email. We will then stop immediately and will not contact you again.
Complaint. You may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), via autoriteitpersoonsgegevens.nl.
Section 13. Changes and contact
We may amend this privacy statement when our services or data processing change. The current version is available on our website and in the customer portal. We inform data subjects of material changes in an appropriate manner. A new statement does not, in itself, give us permission to use data for an incompatible new purpose.
For questions and privacy requests, you can write to info@mdcsystems.nl.