Privacy policy

Fabrykuj is an online manufacturing service that quotes and brokers laser cutting, 3D printing and CNC machining. The controller of your personal data, within the meaning of Article 4(7) GDPR, is the company below. Write to us at any time about anything on this page.

Questions about privacy: privacy@fabrykuj.pl

We collect only what the service needs in order to quote, produce and deliver your parts.

• Account data: email address, name, and — if you order as a business — company name, address and tax number (NIP).
• Order data: your quotes, orders, delivery addresses, payment status and correspondence with us.
• Uploaded files: the CAD geometry you submit (STEP, STL, DXF and similar) and everything we derive from it, such as volume, cut length and preview models.
• Technical data: IP address, browser type and server log entries, recorded for security and abuse prevention.
• Payment data: we never see or store your full card number. Card details go directly to our payment provider.

Every purpose below is tied to a lawful basis under Article 6(1) GDPR.

• To calculate quotes and perform the contract you enter into when you place an order — Article 6(1)(b).
• To issue invoices and keep accounting records, as required by Polish tax law — Article 6(1)(c).
• To pass your parts to the workshop that manufactures them and to the carrier that delivers them — Article 6(1)(b).
• To keep the service secure, prevent abuse of uploads and defend legal claims, which is our legitimate interest — Article 6(1)(f).
• To send you marketing messages, but only if you have asked us to — Article 6(1)(a). You can withdraw that consent at any time.

We treat uploaded geometry as confidential. It is used to quote and manufacture your order, and for nothing else.

• We do not sell, publish or share your files, and we do not use them to train machine-learning models.
• Files are shared with a partner workshop only after you place an order, and only with the workshop assigned to it.
• Preview and download links are tied to your session, so another customer cannot reach your files by guessing a URL.
• If you need a signed non-disclosure agreement before uploading, contact us and we will sign one.

We use a small number of suppliers who process data on our behalf, under written agreements required by Article 28 GDPR. They may use your data only on our instructions.

Where a supplier processes data outside the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses. We also disclose data to partner workshops that manufacture your order, and to public authorities where the law requires it.

We keep each kind of data for as long as it is needed, and no longer.

Traffic is encrypted with TLS, passwords are never stored (we sign you in by Google or a one-time email link), access to production systems is limited to named administrators, and uploaded files are served only through authenticated, expiring links.

If a breach ever puts your rights at high risk, we will notify you and the supervisory authority as Articles 33 and 34 require.

Under the GDPR you have the rights listed below. Exercising them is free, and we answer within one month.

• Access: to be told whether we process your data and to receive a copy of it (Article 15).
• Rectification: to have inaccurate data corrected (Article 16).
• Erasure: to have your data deleted, unless we must keep it — invoices, for example, we are legally obliged to retain (Article 17).
• Restriction: to have processing limited while a dispute about your data is resolved (Article 18).
• Portability: to receive your data in a machine-readable format, or have it sent to another controller (Article 20).
• Objection: to object to processing based on our legitimate interest (Article 21).
• Withdrawal: to withdraw any consent you have given, without affecting what was lawful beforehand (Article 7(3)).

You may also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw.

We keep this deliberately simple: we run no analytics, no advertising pixels and no third-party trackers.

Strictly necessary storage

A session cookie keeps you signed in, a short-lived cookie lets you get a quote before creating an account, and one entry in your browser's local storage remembers your cookie choice. These cannot be switched off — without them the service does not work — and they need no consent under Article 173 of the Polish Telecommunications Act.

Optional storage

There is currently none. If we ever add analytics, it will only load after you have accepted it in the banner, and this page will say so before it does.

Change your cookie choice

Use the form below to ask us to delete, send you a copy of, or correct your personal data. We handle every request within one month, as Article 12(3) GDPR requires.

Some data cannot be deleted on request: Polish tax law obliges us to keep issued invoices for five years. We will delete everything else and tell you exactly what was kept and why.

If we change how we handle your data, we will update this page and change the date at the top. If the change is significant, we will tell you by email before it takes effect.