Privacy policy
Last updated: November 9, 2026
This page explains in plain language what personal data MatConnect collects, why we need it, who can see it and what you can do about it.
Who we are
MatConnect is run by [LEGAL NAME], [REGISTERED ADDRESS], VAT number [VAT NUMBER] ("we"). We are the controller of the personal data described on this page, under the EU General Data Protection Regulation (GDPR) and Greek Law 4624/2019.
For anything about your data, email privacy@matconnect.gr.
What we collect
We only collect what we need to run the platform:
- When you request access: your name, email, phone, company, city, website, VAT number, team size, project types, material categories, how you heard of us and your language. We also keep a hashed (unreadable) form of your IP address and your browser type, to stop spam.
- Your account: name, email, phone, company, city, address and your role. Suppliers also add their business details and the categories they supply.
- Your work: projects, requests for quotation (RFQs) and the materials in them, files you upload, quotes, messages, orders and deliveries.
- Suppliers designers add: designers can save a supplier's company and contact details (name, job title, email, phone) in their vendor list.
- Technical records: a log of changes made in the platform, security and rate-limit records, email delivery status, and your email preferences.
We don't collect payment card or bank details.
Why we use it
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating your account and running projects, RFQs, quotes and orders | Contract (art. 6(1)(b)) |
| Reviewing your access request and contacting you about it | Steps you asked for before a contract (art. 6(1)(b)) |
| Sending designers' RFQs to the suppliers they chose, and inviting those suppliers | Legitimate interest (art. 6(1)(f)) |
| Keeping the platform secure, preventing spam and abuse, keeping a record of changes | Legitimate interest (art. 6(1)(f)) |
| Anonymised, aggregated statistics, such as typical price ranges per material category, that never identify you or your company | Legitimate interest (art. 6(1)(f)) |
| Product news, only if you opt in | Consent (art. 6(1)(a)), which you can withdraw at any time |
| Meeting legal obligations, such as tax records or requests from authorities | Legal obligation (art. 6(1)(c)) |
Who can see it
Your data is seen only by the people who need it:
- Other users, as part of the workflow: suppliers see the RFQs sent to them (never your project budget), designers see the quotes sent to them, and members of your company see its projects and vendor list.
- Our team: only for support, verifying suppliers and keeping the platform running.
- Service providers that work for us: Supabase (database, sign-in and file storage), Vercel (website hosting), Resend (sending emails) and Cloudflare Turnstile (checking that sign-in and request forms are used by a person, not a bot). They may use your data only to provide their service to us.
- Authorities: only when the law requires it.
We never sell your data, and we don't use advertising or tracking services.
Where your data is stored
Our database and files are stored in the European Union. Vercel, Resend and Cloudflare are US companies, so some data (such as email addresses and IP addresses) may be processed in the US. Those transfers are covered by the EU-US Data Privacy Framework or by the European Commission's Standard Contractual Clauses.
How long we keep it
- Your account: as long as it exists. If you ask us to close it, we delete your personal data within 30 days, unless the law requires us to keep something longer.
- Work you shared: RFQs, quotes and orders also belong to the other side's records (your company, the designer or the supplier), so they stay available to them.
- Access requests: if we don't invite you, we delete your request within 12 months.
- Email opt-outs: we keep your address on our opt-out list, so we never email you again.
- Backups: deleted data can stay in our backups for a short time until they are overwritten.
If a designer invited you as a supplier
If you received an email because a designer added you to their vendor list:
- Where we got your details: from the designer, who added your company and contact details to MatConnect.
- Why we use them: to send you that designer's requests for quotation and invite you to answer them on MatConnect. Our legal basis is legitimate interest: the designer's, and ours, in running their purchasing with suppliers they already work with.
- How long: as long as the designer keeps you in their list. Each invitation link expires after 7 days.
- Your right to object: every email has an unsubscribe link. If you unsubscribe from all emails and never set a password, the account created for you is deleted and we won't email you again. You can also complain to the Hellenic Data Protection Authority (see below).
Your rights
Under the GDPR you can ask us to:
- give you a copy of your personal data;
- correct it (you can also edit most of your details yourself in Settings);
- delete it;
- limit how we use it;
- export it in a common, machine-readable format;
- stop using it where we rely on legitimate interest;
- withdraw your consent to marketing emails, at any time.
Email privacy@matconnect.gr. We reply within one month, and it's free.
If you think we handle your data unlawfully, you can complain to the Hellenic Data Protection Authority (Kifisias 1-3, 115 23 Athens, www.dpa.gr).
Cookies and local storage
We don't use advertising or analytics cookies. Your browser stores only what the site needs to work: your sign-in session, your language, the time of your last activity (so we can sign you out automatically) and a few display choices. Because these are strictly necessary, we don't ask for consent (Greek Law 3471/2006, art. 4(5)).
Our fonts are served from our own site, so your browser doesn't contact Google to load them. Cloudflare Turnstile runs its bot check only on the sign-in and request-access pages.
Security
All traffic is encrypted (HTTPS). Database access rules make sure each user sees only what they are allowed to. You can turn on two-factor authentication in Settings. Only team members who need personal data for their work can access it.
Children
MatConnect is a business tool for professionals and is not meant for anyone under 18.
Changes to this policy
If we change this policy, we update the date at the top of this page. If a change matters, we'll email you before it applies.