Privacy Policy

Last updated: October 2026Version 48faa9e61ca3

1. Introduction

Dynamic Parts (“Dynamic Parts”, “we”, “us”, or “our”) operates the Dynamic Parts platform and related services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services, and on which legal basis we do so.

The controller responsible for this processing within the meaning of Art. 4(7) GDPR is Dynamic Parts GmbH, Max-Eyth-Str. 8, 72348 Rosenfeld, Germany, represented by its managing director Konstantin Sommer. For all privacy matters you can reach us at privacy@dynamicparts.eu.

2. Information We Collect

We may collect the following categories of personal information:

Account information: name, email address, and password when you register an account.
Orders without an account: if you order without an account, we store your email address and the name from the delivery address with the order, so that we can send you the acknowledgement, status updates and invoice. There is no password; you reach your order through a personal link in these emails.
Order and payment information: delivery and billing address, phone number if you provide one, order history, and payment details processed securely through Stripe. We do not store full card numbers.
Uploaded files: CAD files and design documents you upload to obtain a quote or place an order.
Usage data: IP address and browser type collected via server logs for security and abuse prevention purposes. IP addresses are never stored in our analytics records.
Communications: your name, email address and message when you contact us via the contact form or by email; your phone number and what you tell us when you call us; and your phone number, WhatsApp profile name and messages, including any files you send, when you write to or call us on WhatsApp (see “WhatsApp” in section 4).
Audience measurement data: for each page you load we record the page address, the referring website, any campaign tags in the link you followed, your browser and operating system family, device type, and language preference. This is recorded on our own servers from information your browser sends with every request. To tell visits apart within a single day, we derive a pseudonymous key from your IP address, your browser signature and a secret that changes every day. The IP address itself is not stored, no cookie is set or read for this, and the key cannot be linked across days, to your account, to your orders, or to data from any other website.
Sign-in with Google: if you sign in with Google, we receive your name, email address and profile picture URL from Google. Google’s own processing is governed by Google’s privacy policy.
Bug reports: when you submit a bug report from the part designer, we store your description, the drawing you were working on, technical error details, and, if you are signed in, a link to your account.

3. How We Use Your Information

We use the information we collect for the following purposes and on the following legal bases:

To create and manage your account and process your orders. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.
To generate instant quotes based on uploaded part geometry. Legal basis: steps prior to entering into a contract, Art. 6(1)(b) GDPR.
To process payments and send order confirmations, receipts and status updates for your orders. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.
To answer your enquiries and communicate with you about your account and our services. Legal basis: Art. 6(1)(b) GDPR where the enquiry relates to an order, otherwise our legitimate interest in responding to you, Art. 6(1)(f) GDPR.
To find and fix defects in the platform, in particular by investigating bug reports. Legal basis: our legitimate interest in a working product, Art. 6(1)(f) GDPR.
To detect, prevent, and address fraud, abuse and security incidents. Legal basis: our legitimate interest in the security of our systems, Art. 6(1)(f) GDPR.
To comply with legal obligations, in particular tax and commercial record-keeping. Legal basis: Art. 6(1)(c) GDPR.
To measure how the site is used, in aggregate, to understand which pages and referral sources are useful. Legal basis: our legitimate interest in operating and improving our own website, Art. 6(1)(f) GDPR. You may object to this at any time using the contact details in section 11.

Where processing rests on our legitimate interests, you may object at any time (see section 8). We do not use your data for automated decision-making or profiling, and we do not send marketing emails.

4. Sharing Your Information

We do not sell your personal data. We may share information with:

Processors that handle data on our behalf and on our instructions under data processing agreements pursuant to Art. 28 GDPR: Railway Corp. (hosting and database) and Resend (transactional email delivery, including contact form messages).
Manufacturing partners: when necessary to fulfil your order, your design files and shipping address are shared with our production partners under strict confidentiality agreements.
Legal authorities: when required by law, court order, or to protect the rights, property, or safety of Dynamic Parts, our users, or the public.
Independent controllers: Stripe (payment processing), Google (sign-in with Google, only if you use it) and WhatsApp (messages and calls, only if you contact us there) process the data needed for the payment, the sign-in or the conversation under their own responsibility and their own privacy policies. We pass on only what that step requires.

You can reach us on WhatsApp at the number on our contact page. We use the WhatsApp Business app, provided in the European Economic Area by WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. If you write to us or call us there, we process your phone number, your WhatsApp profile name and, depending on your settings, your profile picture, as well as your messages and any files you send, to answer your enquiry. Legal basis: Art. 6(1)(b) GDPR where the enquiry relates to an order or a quote, otherwise our legitimate interest in answering you on the channel you chose, Art. 6(1)(f) GDPR.

Messages and calls on WhatsApp are end-to-end encrypted, so WhatsApp cannot read or hear them. WhatsApp does receive metadata, such as your phone number, when messages are sent or calls made and information about your device, and processes it under its own responsibility, also within the Meta group of companies and in the USA (see “International transfers” below). Details are in WhatsApp's privacy policy.

Using WhatsApp is voluntary. If you would rather not share data with WhatsApp, write to us by email or through the contact form, or call us. We keep WhatsApp chats as long as other contact messages (see section 5) and then delete them; chats that become part of an order are kept with the order record.

International transfers

Some of these companies are based in the United States or process data there. Such transfers rest on the EU-US Data Privacy Framework where the company is certified under it, and otherwise on the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR). You can request a copy of the safeguards in place using the contact details in section 11.

5. Data Retention

Account and profile data is retained for as long as your account is active. When you delete your account, your profile, saved addresses, shopping carts, sign-in links, and design files not tied to an order are removed immediately, and the account record is anonymised.
Order and invoice records, including the name and delivery address that belong to the invoice, are kept for the statutory retention periods under § 147 of the German Fiscal Code (AO) and § 257 of the German Commercial Code (HGB), up to ten years from the end of the year in which the order was placed, and are then deleted. We are required by law to keep these records even after you delete your account; they are then no longer linked to a usable account.
Details of orders without an account (email address and name) are kept together with the order and invoice records. If an order that was started is not paid, we delete it and the details created for it after one to two days.
Authentication tokens (email verification, password reset) expire automatically (within 1–24 hours) and are purged from our database on a regular schedule.
Anonymous shopping carts are deleted after 30 days of inactivity.
Design files not associated with a placed order are deleted when you delete your account. Design files saved without an account are deleted 30 days after they were saved, or 30 days after the shopping cart holding them was last used, whichever is later.
Audience measurement records are kept in raw form for 90 days and then deleted. Only aggregate daily totals are retained beyond that, and those contain no identifier that can be traced back to a visitor.
Contact messages from the contact form, which reach our mailbox by email, and messages you send us by email or on WhatsApp are kept until your enquiry has been dealt with and then for up to three years, the general limitation period, unless they become part of an order record.
Quote requests you send us through the quote form, together with any drawings or specifications you attach, are kept until the enquiry is settled and then for up to three years, the general limitation period. If the enquiry becomes an order, the order record governs instead. The link to your account is removed when you delete your account.
Bug reports are kept until the reported issue has been resolved and for up to twelve months afterwards. The link to your account is removed when you delete your account.
Server logs containing IP addresses are kept by our hosting provider for a short period, at most 30 days, for security and troubleshooting purposes.

6. Cookies and browser storage

We use only what the platform strictly needs in order to work. § 25 TDDDG covers anything stored on or read from your device, not cookies alone, so this section lists both. None of it serves tracking, advertising or audience measurement, which is why no consent banner is required.

Session cookie (dynamic_parts_session) keeps your saved designs and your shopping cart across visits. It is set the first time you save a design or put something in your cart, not when you simply browse the site. If you order without an account, we keep its value with the order until payment so we can empty your cart afterwards; it is deleted from the order once you have paid. Expires after 12 months.
Authentication cookies are set by our sign-in provider, and only once you start signing in: with your email and password or with Google, including when you sign up with Google. If you cancel or the sign-in fails, they stay until they expire. __Host-authjs.csrf-token protects the sign-in against cross-site request forgery, and __Secure-authjs.callback-url remembers the page to return to afterwards; both expire when you close your browser. Signing in with Google adds __Secure-authjs.pkce.code_verifier, which matches Google's answer to your sign-in and expires after 15 minutes. The sign-in cookie itself (__Secure-authjs.session-token) is added once you are signed in, and expires after 30 days or when you sign out.
Stripe cookies (__stripe_mid, __stripe_sid) are set by our payment provider Stripe only on the payment page, to detect payment fraud. They are necessary for the payment you requested. __stripe_sid expires after 30 minutes and __stripe_mid after one year.
Local browser storage holds your cart, your saved designs and the sketch you are working on, so that none of it is lost on a reload or a closed tab. It stays in your browser, we never receive it as a whole, and you can clear it at any time in your browser settings.

Our audience measurement runs entirely on our own servers, stores and reads nothing at all on your device, keeps no IP address, and shares nothing with any third party. We use no marketing or advertising cookies. If this changes, we will update this policy and obtain your consent where required.

7. Security

We implement industry-standard security measures including HTTPS encryption, hashed passwords, and restricted access controls. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

8. Your Rights

Under the GDPR you have the right to:

Access the personal data we hold about you: use the “Export my data” button in your account settings.
Correct inaccurate data: update your profile in account settings at any time.
Erasure (right to be forgotten): delete your account via the Danger Zone in account settings. Everything except the order and invoice records we are legally required to keep (see section 5) is removed immediately.
Object to or restrict certain processing: contact us at the address below.
Data portability: download your data as a structured JSON file using the “Export my data” button in account settings.
Orders without an account: there are no account settings for these. For access, correction, erasure or data portability, write to us at privacy@dynamicparts.eu. Order and invoice records still have to be kept for the statutory periods (see section 5).

To exercise any right not covered above, or if you have a complaint, contact us at privacy@dynamicparts.eu.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany. You may also contact the authority at your place of residence.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a new “Last updated” date and, where appropriate, by email.

10. Job Applications

If you apply to us by email, we process the data in your application (name, contact details, CV, cover letter, certificates and anything else you choose to send) to run the application process and decide on your application. Legal basis: Art. 6(1)(b) GDPR and § 26(1) BDSG. Your application is read only by the people involved in hiring and is stored in our mailbox and on our own systems. It is not passed to third parties.

We keep application data for three months after the application process has ended and then delete it. We keep it longer only if you ask us to consider you for future openings, in which case we will ask for your consent, or if the application leads to employment, in which case it becomes part of your personnel file. You may withdraw an application at any time by emailing jobs@dynamicparts.eu; we then delete your data at once.

11. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us at privacy@dynamicparts.eu or by post at Dynamic Parts GmbH, Max-Eyth-Str. 8, 72348 Rosenfeld, Germany.