Collect less. Explain what remains.

Controller and contact

NK Discount, operating Hartlow & Mill under the public operator name NK Discount, is the controller for the processing described here. Public establishment address: Oringerbrink 144, 7812JX Emmen, Netherlands. Privacy requests: [email protected]. General contact: [email protected]. KvK 80287239 · VAT NL003417428B78.

What we process

Cloudflare and hosting infrastructure may process technical request and security data needed to deliver and protect the site. If you contact us, we process the information in your message to answer it and keep proportionate support records. Current fabrication tools process uploaded files locally in your browser. The Fabrication Doctor pilot endpoint receives only allowlisted product-event fields and aggregate issue/result counts; it does not receive the uploaded SVG, file name, free-form text, cookies or a persistent visitor/session identifier.

Purposes and Legal basis

We process technical delivery/security data to operate and secure the service, and contact/support data to answer requests and manage necessary correspondence. The exact AVG legal basis depends on the processing: legitimate interests may apply to proportionate security/operation and correspondence, while legal obligations apply where records must be retained by law. We do not use this launch setup for advertising profiles or cross-site tracking.

Recipients and processors

Cloudflare supports website delivery/security, the privacy-minimized pilot Worker and email routing. Email is forwarded to the verified launch mailbox. We do not sell personal data. If a future provider is added for payments, marketing or other new processing, this notice and the processor review must be updated before that processing starts.

International transfers

Infrastructure providers can involve processing outside the EEA. Where that occurs, the applicable provider safeguards and transfer mechanism must apply. Hartlow & Mill reviews this when admitting processors and will update this notice if the actual setup materially changes.

Retention

We retain personal data no longer than necessary for the purpose or an applicable legal obligation. Support correspondence is kept only as long as reasonably needed for the request and necessary records. Pilot infrastructure logs are temporary operational evidence rather than customer profiles. Retention is reviewed when the production data flow changes.

Your rights

Depending on the processing, you may have rights of access, rectification, erasure, restriction, objection and data portability. Where processing relies on consent, consent can be withdrawn without affecting earlier lawful processing. Send privacy requests to [email protected]. We may need proportionate information to verify that a request concerns you.

Complaint

You can complain to the competent privacy supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens. You may also contact us first at [email protected].

United States residents

Where an applicable US state privacy law grants you rights such as access, correction, deletion, portability or opt-out rights, you may submit a request to [email protected]. Applicability and exact rights depend on your state, our scale and the processing involved. We do not currently sell personal information or use cross-context behavioural advertising in this launch setup.

Children

Hartlow & Mill is a general-audience service and is not directed to children under 13. We do not knowingly collect personal information from children under 13 through the current tools. A child-directed feature would require a separate privacy review before launch.

Changes

We update this notice when the actual processing changes. We do not enable payment, marketing tracking or server-side customer-file storage under this notice without completing the relevant Hartlow release gate first.