How we handle personal data of individuals in the EU and EEA

Last reviewed and updated: October 2026

This statement explains how Datamation Systems, Inc. (“DSI,” “we,” “us,” or “our”) collects, uses, protects, and transfers the personal data of individuals in the European Union (EU) and European Economic Area (EEA) under the EU General Data Protection Regulation (GDPR). It should be read together with our Privacy Policy at datamationsystemsinc.com/privacy-policy, which applies to all visitors and customers.

1. Who We Are

DSI is the controller of the personal data collected through our websites and our business dealings with you. DSI is a United States company based in South Hackensack, New Jersey.

For questions about how we handle personal data, contact us at info@datamationsystemsinc.com.

2. Personal Data We Collect

• Contact and business details: name, job title, organization, email address, phone number, and billing and shipping addresses.
• Order and transaction information: products purchased, quotes, purchase orders, invoices, and payment status. Payment card details are processed by our payment processors.
• Communications: emails and messages you send us, and records of support, return, and warranty requests.
• Website usage data: information collected through cookies and Google Analytics, as described in our Privacy Policy.

We do not intentionally collect special categories of personal data (such as health, religious, or biometric data).

3. Why We Use Personal Data and Our Lawful Bases

• To process and fulfill orders, quotes, returns, and warranty claims. Lawful basis: performance of a contract (Art. 6(1)(b)).
• To respond to inquiries and provide customer support. Lawful basis: steps taken at your request before entering a contract, and our legitimate interest in serving our customers (Art. 6(1)(b) and (f)).
• To send newsletters and marketing emails. Lawful basis: your consent (Art. 6(1)(a)), which you can withdraw at any time using the unsubscribe link in every email.
• To set analytics cookies on our websites. Lawful basis: your consent (Art. 6(1)(a)), given and managed through the cookie settings on our websites.
• To keep accounting, tax, and audit records and to comply with the law. Lawful basis: legal obligation (Art. 6(1)(c)).
• To protect our systems, prevent fraud, and enforce our terms. Lawful basis: our legitimate interests (Art. 6(1)(f)).

4. Where Your Data Is Stored and International Transfers

DSI is a US company, so personal data we collect is stored and processed in the United States, mainly in Google Workspace and in our website and order systems hosted by third-party providers in the US. When we transfer personal data from the EU/EEA to the US, we rely on:

• the EU-U.S. Data Privacy Framework, for transfers to service providers certified under it (such as Google); and
• the European Commission’s Standard Contractual Clauses, where the Data Privacy Framework does not apply or ceases to be available.

5. How We Protect Your Data

• Our email, documents, and internal messaging run on Google Workspace, which encrypts data in transit and at rest and provides security, access, and data loss prevention controls.
• All of our websites, public and internal, use HTTPS.
• Company computers are fully encrypted, password-protected, and regularly checked for performance and security.
• Access to personal data is limited to staff who need it for their work, and all staff contracts include a confidentiality clause.
• Our email and online domains are monitored 24/7 for availability and security incidents.
• We keep audit logs of administrator activity and important user events in our email and messaging systems for five years.

6. Service Providers (Processors)

We use service providers that process personal data on our behalf, including Google (email, documents, and messaging), website hosting providers, payment processors, accounting, order-processing and automation tools, and customer service tools. They may process personal data only on our instructions and under written terms that require them to protect it. A current list of our service providers is available on request at info@datamationsystemsinc.com.

7. Data Minimization and Retention

We collect only the personal data we need for the purposes above. We keep personal data for no longer than five years after our last interaction with you, unless a longer period is required by law, tax rules, or contract obligations (including government purchasing contracts). After that, it is deleted from our systems.

8. Your Rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• rectify inaccurate or incomplete personal data;
• erase your personal data (“right to be forgotten”);
• restrict our processing of your personal data;
• object to processing based on our legitimate interests, and to direct marketing at any time;
• data portability: receive personal data you provided to us in a structured, commonly used, machine-readable format (such as CSV or XML), or have it sent to another organization;
• withdraw consent at any time, without affecting processing carried out before you withdrew it; and
• lodge a complaint with the data protection supervisory authority in your country.

To exercise any of these rights, email info@datamationsystemsinc.com. We may ask you to verify your identity. We respond within one month of receiving your request. We may extend this by up to two further months for complex or numerous requests, and we will tell you if we do. Requests are free of charge.

Some data may need to be kept where required by law or for ongoing legal proceedings, and we will explain if this applies. On request, we can also delete all contact information we hold for your organization.

9. Marketing Emails and Tracking

Every newsletter and marketing email includes an unsubscribe link. We may measure whether our marketing emails are opened and which links are clicked, to improve our communications. We do not sell personal data, and we do not use it for profiling or automated decisions that produce legal or similarly significant effects.

10. Data Breaches

If a personal data breach is likely to result in a risk to individuals’ rights and freedoms, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. If the breach is likely to result in a high risk to you, we will also notify you without undue delay.

11. Contact Us

For questions about this statement or about how DSI complies with the GDPR, contact:

Datamation Systems, Inc., South Hackensack, NJ 07606

Email: info@datamationsystemsinc.com  |  Phone: 201-329-7200