Privacy policy

1. Scope

This policy applies to gfigroep.com, operated by DFI GROEP B.V ("we", "us", "our"), registered at Galvanistraat 1, 6716 AE Ede, Netherlands. It covers what we collect when you use the website, send an inquiry, or save a profile. It does not cover information you send to us by email outside of this website, or third-party sites we link to (we link to none).

2. What we collect

• Contact form & inquiry submission: company name, contact name, email, phone, country, message body, IP address, and timestamp. Sent when you submit contact.html or checkout/index.html.
• Saved profile (local-only): if you use "Save on this device", we store the same fields in your browser's localStorage under the key gfi_account_v1. We have no server-side copy. We cannot retrieve it if you clear it.
• Inquiry history (local-only): if you send an inquiry through checkout/, we keep the order id, items, and your buyer details in your browser under gfi_orders_v1 so the account page can show them. Same local-only rule.
• Server logs: standard web server logs — IP address, request path, user-agent — retained for 14 days for abuse detection and rotated.

We do not use third-party analytics, advertising cookies, or session replay tools. We do not run Facebook Pixel, Google Analytics, or Hotjar.

3. Why we use it

• To respond to your inquiry within 24 hours.
• To prepare a written quote with origin, lead time, and Incoterms.
• To send shipment documentation when an order is confirmed.
• To operate the website (server logs, fraud prevention).
• To meet our legal obligations under trade, customs, and food-safety law.

Lawful basis under GDPR Art. 6: pre-contractual steps (Art. 6(1)(b)), legitimate interest in operating the site (Art. 6(1)(f)), and legal obligation (Art. 6(1)(c)) for shipment documentation and customs.

4. How long we keep it

• Inquiry submissions: 7 years for accounting and customs compliance. After 7 years, deleted unless a contract was signed, in which case we keep it for the contract duration + 7 years.
• Server logs: 14 days, then rotated.
• Saved profile (local): until you click "Clear profile" on account/index.html or clear browser site data. We cannot delete it for you because we don't have a copy.
• Inquiry history (local): until you clear browser site data.

5. Your rights under GDPR

If you are in the EU/EEA, you have the right to:

• Access (Art. 15) — ask us for a copy of the data we hold on you.
• Rectification (Art. 16) — ask us to correct inaccurate data.
• Erasure (Art. 17) — ask us to delete your data, subject to the legal-retention rules above.
• Restriction (Art. 18) — ask us to suspend processing while we investigate.
• Portability (Art. 20) — receive your data in a structured, machine-readable format.
• Objection (Art. 21) — object to processing based on legitimate interest.
• Complaint (Art. 77) — lodge a complaint with the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl) or your national DPA.

6. Who we share with

We share your data only with parties needed to operate:

• HACCP-audited suppliers — for confirmed orders, the relevant origin-side supplier receives buyer name, ship-to address, and product specification. They handle their own GDPR obligations for any data they process.
• Freight forwarders — for confirmed orders, the chosen forwarder receives ship-to details and consignee contact. Same rule applies to them.
• Email service — we send and receive email via standard SMTP. Email is not encrypted in transit by us; please don't include data you wouldn't put in a normal business email.
• Hosting — site files are served from our hosting provider's infrastructure in the EU.

We do not sell your data, and we do not share it with advertising networks or analytics companies.

7. International transfers

If you order goods with origin outside the EEA (Brazil, Turkey, India, etc.), your buyer name and ship-to address are shared with that origin supplier as part of the order. Standard Contractual Clauses (SCCs, the EU Commission's 2021/914 modules) cover any personal data flowing outside the EEA. We do not transfer special-category data.

8. Contact the data controller

For any data-related request, write to:

DFI GROEP B.V — Data Protection Officer
Galvanistraat 1, 6716 AE Ede, Netherlands
privacy@gfigroep.com

We respond to data requests within 30 days. If we cannot identify you from the request, we may ask for additional information.