Governance & Compliance -- Policy Document
Privacy Policy &
Data Handling Reference
Material Primer is an independent reference for sustainable materials. This policy explains what data we collect, why we collect it, and the rights you hold under the GDPR. We collect as little as possible and publish everything we do.
Data We Collect From Visitors
We operate a strict data-minimisation policy. We do not sell contact data, we do not run retargeting ads, and we do not build behavioural profiles for marketing. The following is an exhaustive list of what we collect and the legal basis for each.
Server Access Logs
IP address, browser user-agent, requested URL, timestamp. Retained for 14 days for security monitoring and abuse prevention. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
Download Requests (Compliance Tables)
Email address and organisation name when you voluntarily request a downloadable compliance table. Used solely to deliver the document and send occasional updates if you opt in. Legal basis: consent (Art. 6(1)(a) GDPR).
Technical Audit Submissions
Material spec sheets, supplier claims, and contact details submitted through our verification desk. Used exclusively to process your audit request. Legal basis: performance of a pre-contractual step (Art. 6(1)(b) GDPR).
We do not collect: payment card details (we have no checkout), precise geolocation, biometric data, or any special-category data under Art. 9 GDPR. We have no e-commerce functionality.
How We Use Your Data
Every data point we hold has a defined purpose. No data is repurposed, sold, or shared with third parties for their own marketing. The table below is the complete map of our processing activities.
Delivering the Reference
Server logs are used to deliver the site, diagnose technical faults, and block abusive traffic. No log data is used for analytics dashboards or user tracking.
Fulfilling Download Requests
Email addresses from download requests are used only to send the requested compliance table or checklist. If you tick the opt-in box, we may send updates on regulatory changes relevant to that document.
Processing Audit Requests
Spec sheets and supplier claims you submit are used solely to benchmark against our test archive and EU regulations. We do not add you to any mailing list without explicit consent.
Cookies & Local Storage
We use a minimal set of cookies. No advertising cookies, no cross-site tracking pixels, and no third-party profiling cookies. The table below lists every cookie or storage mechanism used on this domain.
| Name | Type | Purpose | Lifespan |
|---|---|---|---|
| mp_consent | Cookie (1st party) | Stores your cookie consent preference | 12 months |
| mp_download_optin | Cookie (1st party) | Remembers if you opted into download updates | 12 months |
| local_pref | Local Storage | Stores UI preference (e.g. dark/light mode) | Persistent |
Strictly Necessary
The mp_consent cookie is required for GDPR compliance. It cannot be disabled. No consent is needed for this cookie under ePrivacy Directive Art. 5(3).
No Advertising
We do not use advertising cookies, social media pixels, or fingerprinting. Your browsing on this site is not shared with any advertising platform.
Your Rights Under the GDPR
As a data subject in the EU/EEA, you hold the following rights over the personal data we process. All requests are handled free of charge within 30 days, as required by Art. 12 GDPR.
Right of Access
You may request a copy of all personal data we hold about you, along with details of how it is processed (Art. 15).
Right to Rectification
You may ask us to correct inaccurate or incomplete personal data without undue delay (Art. 16).
Right to Erasure
You may request deletion of your personal data where it is no longer necessary or where consent is withdrawn (Art. 17).
Right to Restrict Processing
You may ask us to limit how we process your data while a complaint is being resolved (Art. 18).
Right to Data Portability
You may request your data in a machine-readable format to transfer to another controller (Art. 20).
Right to Object
You may object to processing based on legitimate interest, including for direct marketing (Art. 21).
How to exercise your rights: Send an email to [email protected] with the subject line "GDPR Request". We will verify your identity before processing any request. You also have the right to lodge a complaint with your local supervisory authority (Art. 77).
How Long We Keep Your Data
We retain personal data only as long as necessary for the purpose it was collected, or as required by law. Our retention schedule is reviewed annually. After the retention period, data is securely deleted or anonymised.
| Data Category | Retention Period | Rationale |
|---|---|---|
| Server Access Logs | 14 days | Security monitoring only |
| Download Request Data | 24 months | To deliver updates if opted in |
| Audit Submission Files | 36 months | To reference past audits for repeat clients |
| Cookie Preference | 12 months | Cookie lifespans as per table above |
Anonymisation: Where retention is no longer justified, we anonymise the data so it can no longer be linked to you. Anonymised data may be kept for research and editorial purposes.
Questions or Requests?
Our data protection officer is reachable at [email protected]. We respond to all GDPR-related inquiries within 72 hours. For urgent deletion requests, please include "URGENT ERASURE" in the subject line.
This policy is reviewed annually or upon material changes in processing activities. The last review was conducted on 15 February 2026. The next scheduled review is February 2027.
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA). Complaints may be lodged at [email protected].
Governance & Compliance -- Policy Document
Privacy Policy &
Data Handling Reference
Material Primer is an independent reference for sustainable materials. This policy explains what data we collect, why we collect it, and the rights you hold under the GDPR. We collect as little as possible and publish everything we do.
Data We Collect From Visitors
We operate a strict data-minimisation policy. We do not sell contact data, we do not run retargeting ads, and we do not build behavioural profiles for marketing. The following is an exhaustive list of what we collect and the legal basis for each.
Server Access Logs
IP address, browser user-agent, requested URL, timestamp. Retained for 14 days for security monitoring and abuse prevention. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
Download Requests (Compliance Tables)
Email address and organisation name when you voluntarily request a downloadable compliance table. Used solely to deliver the document and send occasional updates if you opt in. Legal basis: consent (Art. 6(1)(a) GDPR).
Technical Audit Submissions
Material spec sheets, supplier claims, and contact details submitted through our verification desk. Used exclusively to process your audit request. Legal basis: performance of a pre-contractual step (Art. 6(1)(b) GDPR).
We do not collect: payment card details (we have no checkout), precise geolocation, biometric data, or any special-category data under Art. 9 GDPR. We have no e-commerce functionality.
How We Use Your Data
Every data point we hold has a defined purpose. No data is repurposed, sold, or shared with third parties for their own marketing. The table below is the complete map of our processing activities.
Delivering the Reference
Server logs are used to deliver the site, diagnose technical faults, and block abusive traffic. No log data is used for analytics dashboards or user tracking.
Fulfilling Download Requests
Email addresses from download requests are used only to send the requested compliance table or checklist. If you tick the opt-in box, we may send updates on regulatory changes relevant to that document.
Processing Audit Requests
Spec sheets and supplier claims you submit are used solely to benchmark against our test archive and EU regulations. We do not add you to any mailing list without explicit consent.
Cookies & Local Storage
We use a minimal set of cookies. No advertising cookies, no cross-site tracking pixels, and no third-party profiling cookies. The table below lists every cookie or storage mechanism used on this domain.
| Name | Type | Purpose | Lifespan |
|---|---|---|---|
| mp_consent | Cookie (1st party) | Stores your cookie consent preference | 12 months |
| mp_download_optin | Cookie (1st party) | Remembers if you opted into download updates | 12 months |
| local_pref | Local Storage | Stores UI preference (e.g. dark/light mode) | Persistent |
Strictly Necessary
The mp_consent cookie is required for GDPR compliance. It cannot be disabled. No consent is needed for this cookie under ePrivacy Directive Art. 5(3).
No Advertising
We do not use advertising cookies, social media pixels, or fingerprinting. Your browsing on this site is not shared with any advertising platform.
Your Rights Under the GDPR
As a data subject in the EU/EEA, you hold the following rights over the personal data we process. All requests are handled free of charge within 30 days, as required by Art. 12 GDPR.
Right of Access
You may request a copy of all personal data we hold about you, along with details of how it is processed (Art. 15).
Right to Rectification
You may ask us to correct inaccurate or incomplete personal data without undue delay (Art. 16).
Right to Erasure
You may request deletion of your personal data where it is no longer necessary or where consent is withdrawn (Art. 17).
Right to Restrict Processing
You may ask us to limit how we process your data while a complaint is being resolved (Art. 18).
Right to Data Portability
You may request your data in a machine-readable format to transfer to another controller (Art. 20).
Right to Object
You may object to processing based on legitimate interest, including for direct marketing (Art. 21).
How to exercise your rights: Send an email to [email protected] with the subject line "GDPR Request". We will verify your identity before processing any request. You also have the right to lodge a complaint with your local supervisory authority (Art. 77).
How Long We Keep Your Data
We retain personal data only as long as necessary for the purpose it was collected, or as required by law. Our retention schedule is reviewed annually. After the retention period, data is securely deleted or anonymised.
| Data Category | Retention Period | Rationale |
|---|---|---|
| Server Access Logs | 14 days | Security monitoring only |
| Download Request Data | 24 months | To deliver updates if opted in |
| Audit Submission Files | 36 months | To reference past audits for repeat clients |
| Cookie Preference | 12 months | Cookie lifespans as per table above |
Anonymisation: Where retention is no longer justified, we anonymise the data so it can no longer be linked to you. Anonymised data may be kept for research and editorial purposes.
Questions or Requests?
Our data protection officer is reachable at [email protected]. We respond to all GDPR-related inquiries within 72 hours. For urgent deletion requests, please include "URGENT ERASURE" in the subject line.
This policy is reviewed annually or upon material changes in processing activities. The last review was conducted on 15 February 2026. The next scheduled review is February 2027.
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA). Complaints may be lodged at [email protected].