Welcome to PCBPath. We recognize that personal privacy, corporate confidentiality, and engineering intellectual property are of paramount importance to our customers. Whether you are uploading proprietary Gerber files, Bills of Materials (BOM), centroid pick-and-place data, or managing corporate procurement accounts, your trust is the foundation of our operations. We are fully committed to complying with international data protection laws, including the European Union General Data Protection Regulation (GDPR), and implementing rigorous technical and organizational security measures to ensure that your personal information and engineering assets remain secure and under your control.

To provide complete transparency, the operators and suppliers of PCBPath (hereinafter referred to as "PCBPath," "we," "us," or "our") have established this comprehensive Privacy Policy (hereinafter referred to as the "Policy"). This document explains in detail how we collect, process, use, share, store, and safeguard your personal and technical information across our digital manufacturing platform, and outlines how you can exercise your statutory data rights.

Before registering an account, submitting design files, or placing an order, please read this Policy carefully—paying particular attention to clauses highlighted in bold text. If you have any questions, comments, or compliance inquiries regarding this Policy, please contact our Data Protection Team through the official channels listed at the end of this document.

1. Definitions and Scope of Application

1.1 Core Definitions

• PCBPath Platform: Refers to the official PCBPath website (domain: PCBPath.com), web portals, APIs, and associated client-side applications.
• PCBPath Service Supplier: Refers to Shanghai Pangolin Electronics Co., Ltd., the enterprise internet information, software technology, and electronics manufacturing service provider operating PCBPath.
• Personal Information: Refers to any electronically or otherwise recorded information that can be used independently or in combination with other data to identify a specific natural person or reflect the online activities of an identifiable individual.
• Sensitive Personal Information: Refers to personal data that, if leaked or misused, could endanger personal safety, property security, or corporate reputation. This includes government-issued identification numbers, personal biometric data, bank account numbers, payment card credentials, financial transaction records, precise location tracking, and personal data of minors under the age of 16.
• Engineering Intellectual Property (IP) Data: Refers to CAD/CAM engineering files uploaded for quotation, Design for Manufacturability (DFM) verification, fabrication, or assembly, including Gerber RS-274X/X2 files, ODB++ archives, IPC-2581 data, NC drill files, BOM spreadsheets, and pick-and-place coordinates.
• Deletion of Personal Information: Refers to the permanent removal of personal data from active operational systems and production databases so that the data cannot be retrieved, reconstructed, or accessed.

1.2 Scope of Application

This Policy applies to all products, online quoting engines, DFM analysis tools, and manufacturing services provided by PCBPath across websites, client applications, and future digital interfaces. Where an affiliated entity provides services utilizing your PCBPath account without a separate privacy notice, this Policy governs that data processing.

Please note that this Policy does not govern third-party external services linked from our platform (such as independent logistics portals or external payment gateways), which operate under their own respective privacy frameworks.

2. How We Collect and Use Your Information

We collect and process personal and technical data strictly on lawful bases—including contractual necessity, legitimate business interests, legal compliance, and your explicit consent—to execute manufacturing orders, optimize platform functionality, communicate project updates, and protect system security.

2.1 Delivering, Improving, and Developing Manufacturing Services

We process your information to generate instant PCB/PCBA quotations, perform automated CAM/DFM checks, manufacture custom circuit boards, and conduct internal quality audits. Processing this data is based on our contractual obligation to fulfill your orders and our legitimate interest in maintaining high manufacturing yields and continuous service reliability. If you participate in promotional events, engineering sponsorship programs, or user surveys, we use the submitted details solely to administer those specific programs.

2.2 Account Registration and Membership Management

• Basic Account Creation: To access automated quoting, file uploads, and order tracking, you must register a PCBPath account by providing a valid email address, username, and encrypted password. You may browse public informational pages without registering, though interactive engineering tools require authentication.
• Enterprise Verification and Role Services: For corporate credit accounts, tax exemption processing, customs clearance, or supplier qualification, we may request business registration certificates, tax identification numbers (VAT/EIN), and authorized representative details.
• Optional Profile Customization & Third-Party Login: You may optionally provide your full name, company title, telephone number, and billing preferences to streamline checkout. With your explicit authorization, you may also authenticate using supported third-party OAuth providers, which share basic profile tokens within the scope of your permission.

2.3 Order Placement, Engineering Review, and Fulfillment

When you place an order for PCB fabrication, stencil production, component sourcing, or turnkey PCBA, our system generates a unique transaction record. To fulfill your order, we collect:

• Recipient and Logistics Data: The recipient's full name, shipping address, postal code, email address, and contact telephone number, along with customs clearance tax IDs or EORI numbers required for cross-border shipments.
• Transaction Metadata: Order numbers, technical specifications, layer counts, IPC class requirements, itemized pricing, timestamps, and engineering notes.
• Proprietary Design Files: Uploaded Gerber, BOM, and assembly files are processed exclusively by our automated CAM software and authorized production engineers to fabricate and inspect your boards. We never sell, publish, or reverse-engineer customer design files.

If you place an order for drop-shipment to a third-party recipient, you warrant that you have obtained lawful authorization from that recipient to provide their delivery details to PCBPath.

2.4 Payment Processing and Financial Security

To settle order invoices, you may select from integrated payment gateways (such as credit/debit cards, PayPal, or wire transfers). During payment processing, required billing parameters—including your account identifier, invoice amount, payment card number, expiration date, and anti-money laundering (AML) verification data—are transmitted via encrypted channels to licensed financial institutions. We synchronize payment status notifications with these processors to update your order workflow, issue tax invoices, and resolve billing inquiries.

2.5 Logistics Synchronization and Delivery

To ensure rapid, damage-free international delivery of your manufactured goods, we transmit necessary shipping labels and customs invoices to partnered global couriers (such as DHL, FedEx, UPS, or freight forwarders). Logistics partners are contractually restricted to using your delivery data solely for customs clearance and physical transport. We also receive real-time tracking telemetry from these carriers so you can monitor shipment progress directly within your account dashboard.

2.6 Customer Communications, Technical Support, and Dispute Resolution

When you place an order, our system sends transactional email notifications regarding DFM engineering holds (EQs), production milestones, and shipment dispatch. With your explicit consent, we may also send technical newsletters or promotional updates; you may withdraw this consent at any time via the unsubscribe link in any marketing email or by contacting us.

When you contact our engineering support or after-sales service teams, we verify your identity and retain communication transcripts, engineering queries, inspection photographs, and order records to diagnose technical issues, process RMAs, and continuously improve our quality management system.

2.7 Platform Interactive Features

When you save configurations to your shopping cart, bookmark components, or participate in public Q&A forums and product reviews, we record corresponding service logs. Please exercise caution when posting in public community areas: never upload confidential schematics, proprietary Gerber screenshots, or sensitive personal contact details in public comments.

2.8 Cybersecurity and Fraud Prevention

To protect our manufacturing infrastructure and user accounts against phishing, credential stuffing, distributed denial-of-service (DDoS) attacks, and payment fraud, our security systems collect device attributes, browser signatures, and network access logs. We analyze this telemetry to verify account authenticity, detect anomalous login attempts, and enforce platform security policies.

3. Summary of Data Collection, Legal Basis, and Retention

The table below provides a structured overview of the categories of data processed by PCBPath, the primary engineering or operational purpose, the applicable GDPR lawful basis, and our standard retention schedule:

4. Additional Rules for Processing Personal Information

• Third-Party Data Authorization: If you submit personal information belonging to another individual (such as a colleague, client, or end-recipient), you must ensure that you have obtained their lawful permission prior to submission.
• Secondary Purpose Restrictions: If we ever intend to process your personal data for a purpose incompatible with those specified in this Policy, we will notify you and obtain your prior explicit consent.
• Indirectly Obtained Data: When we receive personal information indirectly from an authorized third-party partner, we verify in writing that the partner lawfully collected the data and obtained authorization for transfer, and we apply identical encryption and access controls to safeguard it.
• De-Identified Statistical Research: In accordance with applicable privacy regulations, we may utilize irreversibly anonymized, de-identified aggregate metrics (such as overall board layer distribution or anonymous DFM pass rates) for capacity planning, statistical analysis, and algorithm optimization without separate notice.
• Service Discontinuation Protocol: Should any specific PCBPath service module be permanently discontinued, we will issue advance public notice, immediately halt data collection for that module, and permanently purge or anonymize associated personal records.

5. How We Use Cookies and Similar Technologies

5.1 Cookies

To ensure seamless session authentication, preserve items and custom PCB parameters in your shopping cart, and remember your language and currency preferences, we store small text files known as cookies in your browser's local storage. You may configure your web browser to block or delete cookies at any time; however, disabling essential session cookies may prevent you from logging into your account or completing online checkouts.

5.2 Web Beacons, Pixel Tags, and ETags

Alongside standard cookies, we utilize HTTP Entity Tags (ETags) and transparent pixel tags:

• Communication Pixels: Transactional and newsletter emails may contain pixel tags that indicate whether an email was delivered and opened, helping us reduce redundant messages. You can opt out of marketing emails at any time.
• HTTP ETags: ETags are standard protocol headers exchanged between your browser and our servers to validate cached resources, reduce bandwidth consumption, and accelerate page loading speeds. You may clear cached ETags through your browser settings.

6. How We Share, Transfer, and Disclose Information

6.1 Sharing Information with Third Parties

We strictly prohibit selling your personal data or engineering files to third parties. We share necessary data with external entities only under the following controlled circumstances:

• Legal and Regulatory Obligations: When mandated by applicable laws, court subpoenas, judicial proceedings, or lawful requests from governmental or customs authorities.
• Explicit User Consent: When you have granted prior, specific authorization to share your information with a designated third party.
• Manufacturing and Supply Chain Fulfillment: When necessary to complete your order, we share strictly required operational parameters with vetted sub-processors, including authorized fabrication facilities, electronic component distributors, financial payment processors, and international logistics couriers.
• Affiliated Corporate Entities: We may share necessary account and security data with corporate affiliates operating under Shanghai Pangolin Electronics Co., Ltd. strictly for unified account management, risk control, and order fulfillment under the protections of this Policy.
• Authorized Technical Partners: Where third-party service providers perform infrastructure hosting or security auditing on our behalf, they are bound by strict Data Processing Agreements (DPAs) and Non-Disclosure Agreements (NDAs) prohibiting any unauthorized use of data.

6.2 Corporate Transfers

We will not transfer your personal information to any unrelated company or organization except with your express consent, or in the event of a corporate merger, acquisition, reorganization, or liquidation. In such structural transitions, we will ensure the successor entity remains bound by this Privacy Policy, or require them to seek renewed consent from you.

6.3 Public Disclosure

We never publicly disclose your personal data or engineering files unless you provide express written consent (for example, featuring an approved customer case study) or where disclosure is strictly required by law to address severe platform fraud, counterfeit activities, or imminent threats to public safety.

7. How We Protect and Store Your Information

7.1 Technical and Cryptographic Safeguards

We implement enterprise-grade security architectures aligned with international information security standards to protect your data against unauthorized access, alteration, disclosure, or destruction:

• Encryption in Transit and at Rest: All data exchanged between your web browser and PCBPath servers is encrypted using Transport Layer Security (HTTPS/TLS 1.2 and TLS 1.3). Sensitive credentials and engineering archives are stored in encrypted enterprise storage clusters.
• Strict Role-Based Access Control (RBAC): Access to customer Gerber files, BOMs, and personal data is restricted strictly on a need-to-know basis to authorized CAM engineers and fulfillment staff bound by legally enforceable confidentiality obligations.
• Continuous Vulnerability Auditing: Our cloud infrastructure and production networks undergo routine penetration testing, firewall auditing, and automated malware scanning.

7.2 Organizational Data Governance

We maintain a comprehensive data lifecycle governance program overseen by a dedicated Data Protection Officer (DPO) and cybersecurity team. All employees undergo mandatory privacy and intellectual property security training upon onboarding and annually thereafter. Furthermore, we conduct regular Personal Information Security Impact Assessments (PISIA) on all new platform features.

7.3 Security Incident Response Plan

In the unlikely event of a physical, technical, or administrative security breach affecting your personal data, we will immediately execute our Emergency Incident Response Plan to contain the issue and mitigate risk. In compliance with GDPR Article 33 and Article 34 and other applicable laws, we will notify affected users and relevant supervisory authorities promptly, detailing the nature of the incident, remedial countermeasures deployed, and recommended precautions.

7.4 Your Responsibility for Account Security

Maintaining account security is a shared responsibility. We strongly advise you to use a complex, unique password for your PCBPath account and never share your login credentials over unencrypted channels. If you suspect that your account credentials or API keys have been compromised, please contact us immediately so we can suspend unauthorized access.

7.5 Data Storage and Log Retention Periods

To maintain platform stability and diagnose network faults, our web servers record standard request logs containing timestamps, IP addresses, referral URLs, and user-agent strings. Personally identifiable elements within server access logs are masked after 7 days, and raw web logs are permanently purged within 60 days. IP addresses logged during sensitive actions (such as account registration and checkout) for fraud prevention are also automatically deleted within 60 days.

8. Protection of Minors' Data

PCBPath's industrial PCB fabrication and PCBA services are designed exclusively for adult professionals, engineers, and commercial enterprises. We do not knowingly collect, process, or solicit personal information from minors under the age of 16 (or the equivalent minimum age in the relevant jurisdiction). If we discover that personal data from a child under 16 has been inadvertently submitted without verifiable parental consent, we will immediately purge that information from our servers. If you believe a minor has provided personal data to us, please notify our support team immediately.

9. Your Data Protection Rights (GDPR & Global Standards)

Regardless of your geographic location, PCBPath respects your statutory rights over your personal data. Under the EU General Data Protection Regulation (GDPR) and comparable international privacy frameworks, you hold the following rights:

1. Right of Access: You have the right to request confirmation of whether we process your personal data and to receive a copy of the personal data we hold about you.
2. Right to Rectification: You may update or correct inaccurate or incomplete account, billing, or shipping information directly in your user dashboard or by contacting us.
3. Right to Erasure ("Right to be Forgotten"): You may request the permanent deletion of your personal data and uploaded engineering files when the data is no longer required for the purposes for which it was collected, subject to statutory tax and accounting retention mandates.
4. Right to Restrict or Object to Processing: You have the right to restrict or object to the processing of your personal data for direct marketing or specific legitimate-interest operations at any time.
5. Right to Data Portability: You have the right to receive your personal and order history data in a structured, commonly used, and machine-readable format (such as CSV or JSON) and transmit it to another controller.
6. Right to Withdraw Consent: Where data processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.
7. Right to Lodge a Complaint: If you believe our processing of your personal data infringes applicable data protection laws, you have the right to lodge a formal complaint with your national Data Protection Authority (DPA).

To protect your account against unauthorized disclosure, we may request reasonable identity verification before fulfilling a data subject request. We respond to all verified privacy requests promptly and strictly within 15 to 30 calendar days.

10. Updates to This Privacy Policy

We review and update this Privacy Policy periodically to reflect technological advancements, new manufacturing capabilities, and evolving international data protection regulations. We will never diminish your rights under this Policy without your explicit consent. All revisions will be published on this page with an updated effective date, and material changes will be communicated via prominent platform notices or email alerts.

Material changes include, without limitation:

• Substantial changes to our service model, data processing purposes, or categories of personal information collected.
• Changes in corporate ownership or data controller identity resulting from mergers, acquisitions, or restructuring.
• Changes to the primary categories of third-party recipients with whom personal data is shared or transferred.
• Significant modifications to your statutory data rights or the procedures for exercising them.
• Updates to our Data Protection Officer contact details or official complaint escalation channels.

11. How to Contact Us

If you have any questions, suggestions, data access or deletion requests, or compliance concerns regarding this Privacy Policy or our intellectual property safeguards, please reach out to our Data Protection Team. We review all inquiries immediately and provide a substantive response within 15 calendar days:

• General Privacy & Data Rights Inquiries: Please email us at [email protected] or contact your dedicated PCBPath account representative.
• Security Incident & Vulnerability Reporting: If you suspect any unauthorized access or potential breach involving your personal information or engineering files, please report it immediately to [email protected].

If you are unsatisfied with our resolution and believe that our processing of your personal information has infringed upon your legitimate rights and interests, you retain the right to seek remedies through the competent data protection supervisory authority or file an action in the court of competent jurisdiction over the service supplier's registered domicile.