Privacy Notice

Publication date: 2 August 2026.

This Privacy Notice explains how SensNet Kft. processes personal data in connection with https://www.pcbnow.eu/, customer accounts, quotations, orders, payments, delivery, support and marketing.

1. Controller

Controller: SensNet Korlátolt Felelősségű Társaság
Short name: SensNet Kft.
Registered office: 1139 Budapest, Tahi utca 30, 2nd floor, door 4, Hungary
Company registration number: 01-09-180989
Tax number: 24762339-2-41
Email for privacy requests: info@pcbnow.eu
Telephone: +36 1 988 9039 (English-language customer service)

Privacy questions and requests should be sent to the email above. If SensNet appoints or becomes required to designate a data protection officer, the officer's contact details will be published here.

2. Data and processing purposes

2.1 Website operation and security

We process IP address, date and time, requested URL, referrer, browser and device data, session identifiers, security events and server logs to deliver the Website, maintain sessions and carts, prevent abuse, diagnose faults and protect accounts.

The legal basis is our legitimate interest in providing a secure and reliable online store (GDPR Article 6(1)(f)) and, where activity is necessary to take steps requested before a contract, Article 6(1)(b). Essential device storage is used under the applicable electronic-communications rules.

Security and server logs are retained for up to 30 days unless an incident requires longer preservation. Session data expires when the session ends or after the technical session timeout.

2.2 Registration and customer account

We process name, email address, telephone number, password hash, customer type, company, VAT numbers, billing and delivery addresses, invoice preferences, account settings, order history and communication preferences.

The purposes are to create and secure the account, prefill future orders, manage orders and provide account functions. The legal basis is taking pre-contractual steps and performing the contract (Article 6(1)(b)). Security monitoring is also based on legitimate interest (Article 6(1)(f)).

Core account data is retained until the account is deleted, subject to the separate statutory and claims periods below. Dormant accounts may be deleted after reasonable prior notice. Passwords are stored only in hashed form.

2.3 Quotations, orders and manufacturing

We process account and contact data, order identifier, product parameters, uploaded Gerber and related manufacturing files, filenames, notes, price, VAT treatment, production status, correspondence and quality records.

The purposes are to prepare a quotation, check manufacturability, conclude and perform the contract, manufacture and test goods, provide support and handle claims. The legal basis is Article 6(1)(b). Records necessary to establish, exercise or defend legal claims are processed on our legitimate interest under Article 6(1)(f).

PCBNow products are manufactured by specialist subcontract manufacturers outside the European Union, predominantly in the People's Republic of China. The production documents and technical order data necessary to make the PCB or stencil are disclosed to the manufacturer selected for the order. SensNet minimises the data sent and does not include billing, payment or account data unless strictly necessary. Customers must not include unnecessary personal data in production documents or filenames.

Contract and order evidence is normally retained for five years after performance or closure of a dispute, reflecting the general Hungarian civil limitation period. Data also forming part of accounting records is retained for eight years.

Production copies of Gerber and related manufacturing files are deleted within 90 days after completion of the order. Copies in rotating backups are deleted within a further 30 days. A file may be preserved longer where the Customer asks us to keep it for repeat production, a quality or legal dispute requires it, or law requires preservation. Customers should not place unnecessary personal data in manufacturing files.

2.4 Billing, tax and accounting

We process Customer name or company name, address, tax/VAT number, order and payment details, invoice data and related correspondence to issue invoices, keep accounting records and meet tax obligations.

The legal basis is compliance with Hungarian legal obligations (Article 6(1)(c)), including accounting and tax rules. Accounting documents and the personal data contained in them are retained for eight years under the Hungarian Accounting Act.

2.5 Payment and fraud prevention

We process order ID, amount, currency, payer information made available to us, payment method, status, transaction reference and refund information to collect payment, reconcile transactions, prevent fraud and handle refunds. The bases are contract performance (Article 6(1)(b)), legal obligations (Article 6(1)(c)) and fraud-prevention interests (Article 6(1)(f)).

Online payment is handled by Barion Payment Zrt. SensNet Kft. does not receive or store bank-card numbers, security codes or other payment credentials.

Barion Payment Zrt. is an independent controller for payment, regulatory and fraud-prevention processing:

Barion Payment Zrt.
1117 Budapest, Irinyi József utca 4-20, 2nd floor, Hungary
Company registration number: 01-10-048552
Central Bank of Hungary licence: H-EN-I-1064/2013
Privacy Notice: https://www.barion.com/en/privacy-notice/

PCBNow uses the Base Barion Pixel for payment-fraud prevention. It can process browser and device attributes, IP address, page and session events, and Barion identifiers. SensNet Kft. and Barion rely on legitimate interests in preventing payment fraud. Barion states that Base Pixel data collected without marketing consent is not used for marketing.

If Barion marketing functionality is activated, it is used only after the visitor gives marketing consent. The visitor can later withdraw that consent through Cookie Settings. See the Cookie Policy for the relevant identifiers and durations.

2.6 Delivery

We process recipient name, delivery address, email, telephone number, order identifier, package and customs information to arrange and track delivery. The legal basis is contract performance (Article 6(1)(b)) and compliance with customs or tax law where relevant (Article 6(1)(c)).

The selected carrier receives the data needed for delivery. Depending on the checkout option, this may be GLS for primary delivery within Hungary and the EU, Spring GDS for economy delivery within the EU, or a carrier independently selected by the Customer. Delivery records are retained with the order and claims records for the applicable periods.

2.7 Contact, support, complaints, returns and withdrawal

When a person contacts us or submits a return request, we process their name, email, telephone, order ID, date, product, quantity, reason, comments, attachments and correspondence.

When a Consumer uses the electronic withdrawal function, we process the withdrawal decision, name, contract/order identifier, requested electronic confirmation channel or address, statement content, date and time, receipt reference, technical delivery evidence and proportionate security logs. The purposes are to receive and prove the withdrawal, send the legally required durable-medium receipt, process the resulting return/refund, prevent misuse and defend legal claims. The legal bases are contract performance (Article 6(1)(b)), compliance with legal obligations under Government Decree 45/2014 (II. 26.) (Article 6(1)(c)), and security/claims interests (Article 6(1)(f)).

Pre-contractual and order support is based on Article 6(1)(b). General enquiries and defence of claims are based on legitimate interest (Article 6(1)(f)). Consumer-complaint handling is also required by law (Article 6(1)(c)).

General enquiries are retained for one year after closure unless linked to a contract or claim. Protocols of oral Consumer complaints, written complaints and copies of substantive responses are retained for three years under the Consumer Protection Act. Warranty and guarantee claim protocols under 19/2014 (IV. 29.) NGM Decree are also retained for three years. Withdrawal statements, receipts and related contract/claim evidence are normally retained for five years after performance or closure of the matter. Longer retention applies only where another legal obligation or an existing dispute requires it.

2.8 Newsletter and direct marketing

If a person separately chooses to subscribe, we process email address, name if supplied, consent record, language and engagement data to send PCBNow news and offers.

The legal basis is prior express consent (Article 6(1)(a)) and the applicable Hungarian electronic direct-marketing rules, including Act XLVIII of 2008. Subscription is optional and is not a condition of purchase or account creation. SensNet records the consent wording, source and time so that it can demonstrate consent. Consent can be withdrawn at any time, free of charge, through the unsubscribe link or by emailing info@pcbnow.eu. Withdrawal does not affect processing that was lawful before withdrawal.

Marketing-list data is kept until consent is withdrawn. A minimal suppression record may then be retained to ensure that no further marketing is sent.

2.9 Analytics and advertising

With the visitor's consent, PCBNow uses Google Analytics to measure Website use and Google Ads to measure and personalise advertising. Data can include online identifiers, IP-derived location, browser and device information, referral source, pages, clicks, conversions and consent signals.

The legal basis is consent (Article 6(1)(a)). These services and their non-essential scripts or storage must remain disabled until the visitor consents. Consent can be withdrawn through Cookie Settings.

Google Ireland Limited is the principal EEA provider. Further information: https://policies.google.com/privacy

2.10 reCAPTCHA

Google reCAPTCHA is used on registration and return forms to distinguish human use from automated abuse. It can process IP address, browser and device data, page interaction, security signals and Google cookies.

The basis is our legitimate interest in protecting forms, accounts and the Website from abuse (Article 6(1)(f)). reCAPTCHA should load only where necessary for the requested form. Google Ireland Limited and its group companies process data under Google's terms and privacy policy.

2.11 Fonts, embedded and social content

The Website serves Google Fonts locally. Twitter/X and other social-widget resources can disclose IP address, browser data and the page visited to the external provider, so they remain blocked until marketing consent is given. If enabled with consent, the relevant provider may act as an independent controller under its privacy policy.

3. Sources of data

We receive data directly from the visitor or Customer, from a person acting for a Business Customer, from payment and delivery providers, and from automated Website and security systems. A Business Customer must ensure that its employees and delivery contacts receive this Notice.

4. Required and optional data

Fields identified as necessary for registration, payment, billing, manufacturing or delivery are required to enter into or perform the contract. Without them we may be unable to create an account, accept an order, manufacture goods or deliver them.

Newsletter consent, analytics consent and marketing consent are optional. Refusing or withdrawing them does not prevent ordinary shopping, account or payment functions.

5. Recipients and processors

We disclose only the data needed for the relevant purpose to:

• website-hosting and related infrastructure provider BlazeArts Kft. (FORPSI Hungary), 1096 Budapest, Thaly Kálmán utca 39., Hungary, info@forpsi.hu, https://www.forpsi.hu/;
• Google Ireland Limited for business email, reCAPTCHA and, with consent, analytics and advertising;
• Barion Payment Zrt. for payment and fraud prevention;
• the carrier selected for the order;
• PCB and stencil manufacturing, testing and fulfilment subcontractors, predominantly located in the People's Republic of China;
• invoicing, accounting, tax, legal, IT-security and backup providers;
• banks, insurers and professional advisers where necessary; and
• courts, regulators, tax, customs, law-enforcement or other public bodies where disclosure is legally required.

Processors may use data only on our documented instructions and under a data processing agreement. Independent controllers process data under their own notices and legal obligations.

6. International transfers

The Website is hosted in the European Economic Area. Production documents and associated technical order identifiers are normally transferred to the selected PCB or stencil manufacturer outside the EEA, predominantly in the People's Republic of China. Some other providers, including Google and social-media providers, may also make data available outside the EEA.

Where a recipient is outside the EEA, we rely on an adequacy decision, including an applicable EU-US Data Privacy Framework certification, or on European Commission Standard Contractual Clauses with supplementary measures, as appropriate. Information on a relevant safeguard can be requested at info@pcbnow.eu.

For a Chinese manufacturing recipient and any production file or identifier that constitutes personal data, SensNet uses the applicable European Commission Standard Contractual Clauses, documents a transfer-impact assessment and applies proportionate supplementary technical and organisational measures. SensNet records the recipient, country, purpose and transfer mechanism before the transfer. A copy of the relevant safeguard, with confidential commercial terms removed where permitted, can be requested at info@pcbnow.eu.

7. Automated decisions

SensNet Kft. does not make decisions based solely on automated processing that produce legal or similarly significant effects on a person.

Barion may use automated fraud and regulatory controls as an independent controller. Details and available rights are described in Barion's Privacy Notice.

8. Data-subject rights

Subject to the GDPR's conditions and exceptions, a data subject may request:

• access to personal data and a copy;
• correction of inaccurate or incomplete data;
• erasure;
• restriction of processing;
• data portability for eligible consent- or contract-based processing;
• objection to processing based on legitimate interests;
• withdrawal of consent at any time; and
• information about relevant international-transfer safeguards.

Requests may be sent to info@pcbnow.eu or our registered office. We may ask for information necessary to verify identity. We normally respond within one month; the GDPR permits an extension by up to two further months for complex or numerous requests, in which case we will explain the extension.

A data subject may complain to:

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9-11, Hungary
Postal address: 1363 Budapest, P.O. Box 9, Hungary
Telephone: +36 1 391 1400
Website: https://www.naih.hu/
Email: ugyfelszolgalat@naih.hu

A data subject may also seek a judicial remedy before a competent court.

9. Security

We use proportionate technical and organisational measures, including access control, encryption in transit, password hashing, logging, backups and restricted subcontractor access. No online system is risk-free. Customers must use a unique password, protect account credentials and notify us promptly of suspected misuse.

10. Children

The Website and custom manufacturing services are not directed to children. We do not knowingly accept orders from persons under 18.

11. Changes

We may update this Notice when processing, providers or law changes. The current version and date will be published on the Website. If a change materially affects consent-based processing, we will request new consent where required.