Privacy Policy
Effective date: February 23, 2024 Last updated: March 12, 2026
This Privacy Policy explains how Eigenvector, MB ("ChemObtain", "we", "us", or "our") collects, uses, stores, and shares personal data when you use the website chemobtain.com (the "Site") and our related services (together, the "Service").
We are established in the European Union and are subject to the General Data Protection Regulation (EU) 2016/679 ("GDPR"). We take your privacy seriously and are committed to handling your personal data lawfully, fairly, and transparently.
1. Who We Are (Data Controller)
The data controller responsible for your personal data is:
Eigenvector, MB Partizanu g. 61 LT-49282 Kaunas Lithuania Email: [email protected]
If you have any questions about this Privacy Policy or how we handle your data, please contact us at the address above.
2. What Personal Data We Collect
We collect personal data in the following ways:
2.1 Data you provide to us
- Account registration: username, email address, and password (stored as a hashed value — we never store your plaintext password).
- Supplier profile: company name, registered business address, contact phone number, website URL, company description, business type, country of operation, and any certifications or product listings you submit.
- Communications: any messages, inquiries, or feedback you send to us via email or through the Site's contact forms.
2.2 Data we collect automatically
When you visit or use the Site, we may automatically collect:
- Usage data: pages visited, search queries entered (CAS numbers or chemical names), timestamps, and navigation patterns.
- Device and technical data: IP address, browser type and version, operating system, referring URL, and time zone.
- Cookies and similar technologies: see Section 6 below.
2.3 Data we do not collect
We do not collect sensitive personal data (special category data under GDPR Art. 9) such as health information, racial or ethnic origin, political opinions, religious beliefs, or biometric data.
3. Legal Basis for Processing
We process your personal data on the following legal bases under GDPR Art. 6:
| Purpose | Legal Basis |
|---|---|
| Providing and managing your account | Performance of a contract (Art. 6(1)(b)) |
| Displaying your supplier profile to buyers | Performance of a contract (Art. 6(1)(b)) |
| Sending essential service communications (password reset, email verification) | Performance of a contract (Art. 6(1)(b)) |
| Improving Site functionality and security | Legitimate interests (Art. 6(1)(f)) |
| Complying with legal obligations | Legal obligation (Art. 6(1)(c)) |
| Analytics and understanding usage patterns | Legitimate interests (Art. 6(1)(f)) |
| Marketing communications (if opted in) | Consent (Art. 6(1)(a)) |
4. How We Use Your Personal Data
We use the personal data we collect to:
- Create and manage user accounts and authenticate logins.
- Display supplier profiles, product listings, and contact information to visitors and buyers searching for chemical suppliers.
- Send transactional emails such as email address verification, password reset links, and security notifications.
- Respond to your support requests, inquiries, and feedback.
- Detect, investigate, and prevent fraudulent, abusive, or illegal activity and enforce our Terms of Service.
- Analyse usage patterns and improve the Site's functionality, performance, and content.
- Comply with applicable legal obligations, court orders, or regulatory requirements.
- Send marketing communications about ChemObtain features, updates, or promotions, where you have given your consent and as permitted by applicable law. You may withdraw consent at any time.
5. Sharing of Personal Data
We do not sell your personal data. We may share your data with the following categories of recipients:
5.1 Supplier information visible to the public
If you register as a supplier, your company name, country, business type, contact information, and product listings will be displayed publicly on the Site. This is the core function of the Service. You are responsible for ensuring this information is accurate and that you have the right to publish it.
5.2 Service providers (data processors)
We engage trusted third-party service providers who process personal data on our behalf under data processing agreements, including:
- Hosting and infrastructure providers — to store and serve the Site.
- Email delivery services — to send transactional and notification emails.
- Analytics services — to understand how the Site is used (may include anonymised or pseudonymised data).
- Payment processors — if you purchase a paid subscription or listing tier, your payment data is processed directly by our payment provider; we do not store card details.
5.3 Legal and regulatory disclosures
We may disclose personal data to law enforcement agencies, courts, regulators, or other public authorities if required to do so by law, or if we have a good-faith belief that disclosure is necessary to protect our rights, prevent fraud, or protect the safety of any person.
5.4 Business transfers
If ChemObtain is involved in a merger, acquisition, asset sale, or insolvency proceeding, your personal data may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.
6. Cookies and Tracking Technologies
We use cookies and similar tracking technologies on the Site.
6.1 What are cookies?
Cookies are small text files stored on your device when you visit a website. They allow the Site to recognise your device and remember certain information about your visit.
6.2 Types of cookies we use
| Type | Purpose |
|---|---|
| Essential cookies | Required for the Site to function, including session management and authentication. Cannot be disabled. |
| Functional cookies | Remember your preferences (e.g. recently searched chemicals, display settings). |
| Analytics cookies | Help us understand how visitors use the Site (e.g., Google Analytics / Google Tag Manager). Data is aggregated or pseudonymised where possible. |
| Advertising cookies | Used by Google AdSense to display relevant advertisements. Google may use these to personalise ads across websites. |
6.3 Managing cookies
You can control cookies through your browser settings. Note that disabling essential cookies will affect the Site's functionality. For advertising cookies set by Google, you can manage your ad personalisation preferences at adssettings.google.com.
7. Data Retention
We retain your personal data only for as long as necessary for the purposes described in this Policy:
- Account data: retained for the duration of your account and for up to 3 years after closure (for fraud prevention and dispute resolution purposes), unless a longer retention period is required by law.
- Supplier profile data: retained while your profile is active. Upon deletion, profile data is removed from public display promptly, with residual copies deleted within 90 days.
- Server logs and usage data: retained for up to 12 months for security and diagnostic purposes.
- Email communications: retained for up to 3 years.
When data is no longer needed, we securely delete or anonymise it.
8. Your Rights Under GDPR
As a data subject in the EU/EEA, you have the following rights under GDPR:
- Right of access (Art. 15): You may request a copy of the personal data we hold about you.
- Right to rectification (Art. 16): You may ask us to correct inaccurate or incomplete personal data.
- Right to erasure / "right to be forgotten" (Art. 17): You may ask us to delete your personal data, subject to certain exceptions (e.g. legal obligations).
- Right to restriction of processing (Art. 18): You may ask us to restrict how we use your data in certain circumstances.
- Right to data portability (Art. 20): You may request your personal data in a structured, commonly used, machine-readable format.
- Right to object (Art. 21): You may object to processing based on legitimate interests. We will stop processing unless we have compelling legitimate grounds that override your interests.
- Right to withdraw consent (Art. 7(3)): Where we rely on your consent to process data (e.g. marketing emails), you may withdraw it at any time without affecting prior processing.
- Right to lodge a complaint: You have the right to lodge a complaint with the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija), our supervisory authority, or with the supervisory authority of your country of residence.
To exercise any of these rights, please email [email protected]. We will respond within 30 days. We may need to verify your identity before processing your request.
9. International Data Transfers
Some of our third-party service providers may process personal data outside the European Economic Area (EEA). When we transfer data outside the EEA, we ensure appropriate safeguards are in place as required by GDPR, such as:
- Standard Contractual Clauses (SCCs) approved by the European Commission.
- Transfers to countries recognised by the European Commission as providing an adequate level of data protection.
10. Security
We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include encrypted connections (HTTPS/TLS), hashed password storage (Argon2id), and access controls.
However, no method of transmission over the internet or electronic storage is completely secure. While we strive to protect your personal data, we cannot guarantee absolute security.
If you suspect your account has been compromised, please contact us immediately at [email protected].
11. Children's Privacy
The Service is not directed to children under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have inadvertently collected personal data from a child under 16 without appropriate consent, we will delete it promptly. If you believe we may have collected data from a child, please contact us at [email protected].
12. Links to Third-Party Websites
The Site may contain links to third-party websites, including supplier websites. We are not responsible for the privacy practices of those websites and encourage you to review their privacy policies. This Privacy Policy applies only to the Site and our Service.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the Service. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email or a prominent notice on the Site. We encourage you to review this page periodically.
Your continued use of the Service after changes are posted constitutes your acceptance of the updated Policy.
14. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:
Eigenvector, MB Partizanu g. 61 LT-49282 Kaunas Lithuania Email: [email protected]
We aim to respond to all privacy-related inquiries within 30 days.