Last updated: 31 August 2026

H-Masters ("we", "us") designs and sells precision milling instruments direct to customers. This policy explains exactly what personal data we handle, why we handle it, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR). It applies to hmasters.com and to any order, support request or affiliate application you send us.

Who Is Responsible for Your Data

H-Masters is the data controller for the personal data described here. For any privacy question, request or complaint, write to Info@hmasters.com with "Privacy" in the subject line. We answer privacy requests within 30 days.

What We Collect and Why

Order data. When you buy a Miller we process your name, email address, shipping and billing address, phone number (when you provide one), the items ordered and your order history. Legal basis: performance of our contract with you. Without this data we cannot ship your order or handle a return.

Payment data. Checkout and payment are handled by Shopify and its payment providers. Card numbers never reach our servers — we only receive a confirmation that payment succeeded, the payment method type and the last digits of the card for reconciliation and fraud checks. Legal basis: contract and our legitimate interest in preventing fraud.

Support and email data. If you email us, we keep the message and our reply so we can follow up on warranty claims, returns and questions. Legal basis: contract and legitimate interest. If you opt in to product news, we store your email and consent record until you unsubscribe. Every marketing email contains a one-click unsubscribe link.

Affiliate applications. If you apply to our affiliate program we store the name, email, social or website links, audience information and message you submit, so we can assess the application and contact you. Legal basis: your consent and our legitimate interest in running the program. Applications are stored in our secured backend and are not publicly readable.

Technical and usage data. Our servers and analytics record your IP address, approximate location (country/city level), browser and device type, referring page, and the pages you view. We use this to keep the site secure, fix errors and understand which pages are useful. Legal basis: legitimate interest for security and error logging; consent for analytics and marketing cookies.

Who We Share Data With

We do not sell your personal data and we never rent or trade our customer list. We share data only with the processors we need to run the store: Shopify (e-commerce, checkout and order management), payment providers used by Shopify, our carriers for delivery (name, address and contact details are passed so your parcel can be delivered), our email provider for order and support messages, our hosting and backend provider, and our accountant for statutory bookkeeping. Each processor is bound by a data processing agreement and may use the data only on our instructions. We also disclose data where the law requires it, or to establish or defend legal claims.

Some of these providers operate outside the European Economic Area. Where that happens we rely on the European Commission's Standard Contractual Clauses, or on an adequacy decision, as the transfer safeguard.

How Long We Keep It

Order and invoice records: seven years, because EU and Dutch tax law requires it. Support correspondence: three years after the case closes. Marketing consent and email address: until you unsubscribe, then a suppression record so we do not contact you again. Affiliate applications: 24 months after the decision, unless you become a partner. Server and security logs: up to 12 months. Analytics data: 14 months at most.

Cookies

We use necessary cookies to keep your cart and session working, and — only with your consent — analytics and marketing cookies. You can change or withdraw your choice at any time. Full detail is in our Cookie Policy.

How We Protect Your Data

The site is served over HTTPS, payment pages are PCI-DSS compliant through Shopify, our backend uses row-level access rules so records cannot be read by other visitors, and access to customer data is limited to the people who need it for support and fulfilment. We keep encrypted backups and review access rights regularly. No system is perfect: if a breach ever affects your rights, we will inform the Dutch Data Protection Authority within 72 hours and notify you directly where the law requires it.

Your Rights

Under the GDPR you may request access to your data, correction of inaccurate data, deletion, restriction of processing, a portable copy of the data you gave us, and you may object to processing based on legitimate interest. Where processing rests on consent, you can withdraw that consent at any time without affecting past processing. To exercise any right, email Info@hmasters.com. We may ask for confirmation of your identity before acting, and we will not charge you for a reasonable request. If you are unhappy with our response, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or with the supervisory authority in your country of residence.

Children

Our products and store are intended for adults. We do not knowingly collect data from anyone under 18. If you believe a minor has given us personal data, contact us and we will delete it.

Changes to This Policy

When we change this policy we update the date at the top of the page. If a change materially affects how we use your data, we will announce it on the site and, where required, ask for fresh consent.