Legal
Data protection information under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Last updated: July 2026. This document should be reviewed by a solicitor before you rely on it commercially.
This platform, Instant CNC Quoter, is operated by UK CNC Components Ltd (“we”, “us”, “our”), the controller of the personal data described here. We are registered in England and Wales under company number 13800667; our registered office is 15 Sir Alfred Owen Way, Caerphilly, CF83 3HU. For any data-protection question, or to exercise your rights, contact hello@cncquoter.co.uk. We have not appointed a statutory Data Protection Officer, as we are not required to; the above address reaches the person responsible for data protection.
Under the UK GDPR you have the right to: be informed about our use of your data; access a copy of it; have inaccurate data corrected; have your data erased in certain circumstances; restrict or object to certain processing; and receive your data in a portable, machine-readable format. Where we rely on your consent, you can withdraw it at any time without affecting processing already carried out. Where we rely on our legitimate interests, you can object for reasons relating to your particular situation.
To exercise any right, email hello@cncquoter.co.uk. We will respond within one month. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority, at ico.org.uk or 0303 123 1113 — though we would ask you to raise any concern with us first.
We only collect what we need. Below is each activity, the data involved, the purpose and our lawful basis.
Data: your IP address, browser type, device and the page you came from (referrer), captured in standard server logs. We run our own cookie-free, server-side analytics that record only the source of a visit (e.g. “Google”, “direct”) and a page count — no cross-site tracking, no advertising profiles, and no personal profile of you.
Purpose: to serve and secure the site, and to understand traffic at an aggregate level. Lawful basis: our legitimate interest in operating a stable, secure service. Hosting is provided by our cloud host (Render). Server logs are kept for a short period and then rotated.
Data: your name, email address and a password stored only as a one-way secure hash (we never see or store your password in readable form). Purpose: to create and secure your account, sign you in, and provide the service. Lawful basis: performance of our contract with you.
Data: the CAD models and DXF files you upload, and the part configurations you choose (material, quantity, tolerance, finish, etc.). Purpose: to measure your part and calculate a price, and — if you order — to manufacture it. Lawful basis: performance of our contract (and, before you have an account, our legitimate interest in letting you try the tool).
Your designs stay yours. Intellectual property in the files you upload remains with you. We treat them as confidential, use them only to quote and produce your parts, and share them only as described in section 4.4. If you obtain a price without signing in, the file is analysed in memory only and is not stored.
Data: the parts, quantities and specifications on your order, delivery details, order messages, and the order history. Purpose: to review, price, confirm and produce your order. Lawful basis: performance of our contract.
Where we sub-contract manufacture to a vetted partner shop, that partner receives only the technical data needed to make the parts (the model/drawing and specification). The partner is not given your identity, contact details, the price you paid, or your delivery address — finished parts are returned to us and we forward them to you. Every order is reviewed by a person before it proceeds.
Data: your plan/subscription status and payment records. Card payments are processed by Stripe; we do not receive or store your card number. Purpose: to take and reconcile payment. Lawful basis: performance of our contract and compliance with our legal (tax/accounting) obligations.
Data: your email address and the content of service messages (sign-up, quotes, order updates, password resets). Transactional email is sent through our email provider (Brevo); our own inbox is hosted on Microsoft 365. Purpose: to run the service and keep you informed. Lawful basis: performance of our contract. Any optional marketing email is sent only with your consent, which you can withdraw at any time.
If you apply to supply on the platform we collect your company name, contact details, region and capabilities, to assess and manage your partnership. Lawful basis: steps taken at your request prior to a contract, and our legitimate interest in vetting suppliers.
We share the minimum necessary, and only with:
We never sell your personal data, and we do not use it for third-party advertising.
Some of our processors are based outside the UK. Where personal data is transferred abroad, we rely on an adequacy decision where one exists, or otherwise on the UK’s International Data Transfer Agreement / the EU Standard Contractual Clauses with the UK Addendum, so your data keeps an equivalent level of protection.
We keep your account and order data while your account is active and for a reasonable period afterwards. Financial and transaction records are kept for at least six years to meet UK tax and accounting law. Uploaded files are retained while needed to quote and fulfil your orders, then deleted or anonymised. Server logs are short-lived. You can ask us to delete your account data sooner, subject to any records we must keep by law.
The instant quote is generated automatically from the measurements of your file and the options you choose. This is not a decision that produces legal or similarly significant effects about you — it simply prices a part — and every order is reviewed by a person before it is accepted. We do not carry out profiling of individuals.
We do not use advertising or third-party analytics cookies, so no consent banner is required under PECR. The only item stored in your browser is a single sign-in token (in local storage) that keeps you logged in; it is strictly necessary for the service and is removed when you sign out. Stripe may set its own cookies during checkout — see Stripe’s privacy policy.
Passwords are stored only as secure hashes, the site is served over HTTPS, access to order data is role-restricted, and we take regular backups. No system is perfectly secure, but we apply appropriate technical and organisational measures to protect your information and will notify you and the ICO of a qualifying breach as required by law.
The service is intended for businesses and adults (18+). We do not knowingly collect data from children.
We may update this policy from time to time; the “last updated” date above shows the current version. Material changes will be notified through the service.