Last updated: 26 October 2026
1. Who is responsible
The controller for your personal data on dpcreator.eu is [company name], registration no. [registration number], [address], Latvia. Contact for data protection questions: [email].
2. What we collect and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Name, email, phone, delivery and billing address | To process and deliver your order, send order emails and handle returns and guarantee claims | Contract, Art. 6(1)(b) |
| Customer account (email, password stored only as a hash) | Your order history, downloads and firmware licences | Contract, Art. 6(1)(b) |
| Order and invoice data | Accounting and tax records | Legal obligation, Art. 6(1)(c) |
| Firmware flashing: account ID, purchased licence, time of access | To check that you may flash the firmware, and to protect it from unauthorised copying | Contract, Art. 6(1)(b), and legitimate interest, Art. 6(1)(f) |
| WebUI installs: your board's chip ID (kept as a keyed hash plus its last 6 digits), install dates | To install the licensed WebUI on your boards and keep the licence to 2 boards | Contract, Art. 6(1)(b) |
| WebUI update check: board ID, pendant ID, build numbers, and your IP address (about once a day, only while the check is switched on) | To tell you in the WebUI when a newer firmware or WebUI build, including a security fix, is available | Legitimate interest, Art. 6(1)(f) |
| Messages from the contact form or email | To answer you | Legitimate interest, Art. 6(1)(f) |
| Newsletter email address (only if you subscribe) | To send product news. You can unsubscribe at any time | Consent, Art. 6(1)(a) |
| Server logs (IP address, browser, time, page) | Security and fixing errors. Kept for 30 days | Legitimate interest, Art. 6(1)(f) |
3. Who receives your data
- Payment providers ([payment providers]) receive the data needed to take your payment. They process card data themselves under their own privacy policies.
- Carriers ([carriers]) receive your name, delivery address and, where needed for delivery, your phone or email.
- Hosting: the shop runs on servers of [hosting provider], [country], under a data processing agreement.
- AI assistant in our shop admin: when we use it to look up an order or a support question, the details needed for that question (for example your name, order contents or message) are sent to Anthropic PBC, USA, which runs the Claude AI model for us as a processor. Anthropic does not use this data to train its models. Your data is not used for automated decisions about you.
- Authorities and advisers such as the tax office or our accountant, where the law requires it.
We don't sell your data and don't use it for advertising profiles.
4. Cookies
The shop uses only the cookies it needs to work: a session cookie that keeps your cart and login, and cookies that remember language and currency. No tracking or advertising cookies are used, so no cookie consent is needed for these.
The page fonts are served from our own server. Opening the shop does not connect your browser to Google or any other font service.
5. WebUI update check
The dpCREATOR WebUI on your controller asks dpcreator.eu about once a day whether a newer build exists. It sends your board ID, your pendant ID and the build numbers over HTTPS; our server also sees the IP address of your network. It sends no cookies and nothing about your jobs or files. We use this only to answer the question and to keep the service secure; it is kept like our other server logs (see section 2). You can switch the check off with "update check" in the WebUI footer. See also Security.
6. Live demo
The SmartTabUI and WebUI demo runs entirely in your browser. What you do in it is not sent to us or to anyone else.
7. How long we keep data
- Order and invoice data: as long as Latvian accounting and tax law requires.
- Customer account: until you ask us to delete it. Your firmware licences end when the account is deleted.
- Contact messages: as long as needed to answer, then 12 months.
8. Transfers outside the EU
If a provider processes data outside the EU or EEA, we make sure there is an adequacy decision or standard contractual clauses in place. For Anthropic (USA) this is covered by its data processing addendum with the EU standard contractual clauses.
9. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, and to object to processing based on legitimate interest. Where you gave consent, you can withdraw it at any time. To use these rights, write to [email].
You may also complain to a data protection authority. In Latvia this is the Data State Inspectorate (Datu valsts inspekcija, dvi.gov.lv).