Last updated: 20 August 2026
This page contains three documents: our Privacy Policy, our Terms of Service, and our Data Processing Agreement.
| Data | Where it comes from |
|---|---|
| --- | --- |
| Name, e-mail, phone | Contact and quote forms, e-mail, WhatsApp, Telegram, phone calls |
| Project files (DXF, STEP, DWG, images, sketches) | Upload fields in our forms, e-mail, messengers |
| Order and invoicing details | Placed orders |
| Website usage data | Google Analytics 4, cookies (see 1.7) |
We do not ask for and do not want special categories of data (health, beliefs, biometrics). Please do not send them to us.
We do not sell your data and we do not use subcontractors to carry out production. Your data is handled by the service providers we rely on to operate:
| Provider | What they hold | Where |
|---|---|---|
| --- | --- | --- |
| Tilda Publishing | Website hosting; form submissions pass through Tilda | EU |
| Google (Drive / Workspace) | Storage of project files and correspondence | EU / USA under Standard Contractual Clauses |
| Google Analytics 4 | Anonymous website usage statistics | EU / USA under Standard Contractual Clauses |
| Cloudflare | Website delivery and security | EU / global network |
| Shipping partners | Delivery address and phone, only when we ship your order | EU |
We also disclose data where we are legally required to — for example to tax authorities.
You may ask us to give you a copy of your data, correct it, delete it, restrict or object to its use, or transfer it to another provider. Write to [email protected]; we answer within one month.
If you believe we handle your data incorrectly, you may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee).
Our sites use strictly necessary cookies to work, and analytics cookies to count visits. Analytics cookies are set only after you accept them in the cookie banner. You can change your choice at any time by clearing cookies for our site in your browser.
These terms apply to every quote, order and delivery between Cutlab and you, unless we have signed a separate written agreement that says otherwise.
A quote is based on the files and information you provide. It is valid for 30 days unless stated otherwise. An order becomes binding when we confirm it in writing (e-mail or messenger counts) and the agreed first payment has been received.
You keep all intellectual property rights in the files, drawings and designs you send us. By sending them, you grant us the limited right to open, edit, nest and machine them for the purpose of producing your order — nothing more.
You confirm that you are entitled to send us those files and that producing them does not infringe anyone else's rights. If a third party makes a claim against us because of what you sent, you cover our reasonable costs of dealing with it.
We treat your files as confidential. We do not share them, sell them, publish them, or use them to produce anything for anyone else.
We store project files on Google Drive indefinitely, so we can repeat or repair an order later. Ask us and we will delete them within 30 days.
If your project needs it, we will sign a separate NDA before you send anything — just ask.
We may photograph, film and publish work we have produced, including on our website, social media and in advertising.
We will not do this where the design or its context would infringe your rights or reveal something confidential, and we will not identify you as a client without your agreement. In practice we ask before publishing, and if you tell us a project is not to be shown, it is not shown. A request to keep a project private can be made at any time, including after publication.
Prices are agreed individually for each project and stated in the quote, in euros. Quotes to business customers are stated excluding VAT. Quotes to consumers include VAT.
Typical arrangements:
Other schedules can be agreed in writing.
Lead times given in a quote are estimates based on our workload at the time and on receiving usable files. We tell you as soon as we know if a date is at risk.
Risk of loss passes to you when the goods are handed to the carrier or collected from our workshop. We deliver across the EU; shipping cost is quoted separately unless included.
Please read this if you are a consumer.
Everything we make is manufactured to your specifications or clearly personalised. Under EU consumer law — the Consumer Rights Directive as transposed into Estonian law — the 14-day right of withdrawal does not apply to goods made to a consumer's specifications or clearly personalised. Once production has started, an order cannot be cancelled for a refund.
This does not limit any of your other rights, in particular those in clause 2.8.
If what we deliver does not match what was agreed, tell us within a reasonable time of noticing it, with photos.
We will first repair or remake the affected parts. If that is not possible or proportionate, we will reduce the price or refund it.
We are not liable for defects caused by your own drawings or specifications, by material you supplied, by normal wear, by moisture and temperature outside normal indoor conditions, or by modifications made after delivery. Wood and plywood are natural materials: variation in grain, colour and small knots is not a defect.
We are liable for damage we cause through intent or gross negligence, and for anything the law does not allow us to exclude — including a consumer's statutory rights and liability for personal injury.
Otherwise our liability for any order is limited to the amount you paid for that order. We are not liable for indirect loss such as lost profit, lost production time or third-party claims.
Estonian law applies. We will always try to solve a problem directly — write to [email protected].
Consumers may turn to the Estonian Consumer Disputes Committee (Tarbijavaidluste komisjon) at the Consumer Protection and Technical Regulatory Authority. For business customers, disputes are settled by Harju County Court.
This agreement applies only where the files or information you send us contain personal data of other people — for example a list of names to be engraved, or a dataset for personalised products.
For everything else, including your own contact details, we act as controller and our Privacy Policy applies instead. Technical drawings without personal data are not covered here: they are protected by clause 2.3 on confidentiality.
Where it applies, this agreement forms part of our contract and no separate signature is required, though we are happy to sign your own DPA if your procurement process needs one.
You are the controller. Cutlab is the processor, acting only on your documented instructions. Your order and the files you send are those instructions.
| --- | --- |
| Subject matter | Producing the goods you ordered |
| Duration | Until you ask us to delete the data (see 3.7) |
| Nature and purpose | Storage, and reproduction of the data onto physical products |
| Types of data | Whatever you include — typically names, and occasionally other identifiers |
| Data subjects | The people identified in your files |
We will process the data only on your instructions; keep it confidential and ensure anyone with access is bound by confidentiality; apply the security measures in 3.6; help you respond to requests from data subjects and to the supervisory authority; and tell you without undue delay, and within 48 hours of becoming aware, if the data is breached.
We will not transfer the data outside the EEA except through the sub-processors named in 3.5.
You authorise the following:
| Sub-processor | Purpose |
|---|---|
| --- | --- |
| Google Ireland Ltd (Drive / Workspace) | File storage, under Standard Contractual Clauses |
| Tilda Publishing | Transit of files submitted through website forms |
We will tell you before adding another one, and you may object.
Files are stored in access-controlled Google Workspace accounts protected by two-factor authentication. Access is limited to the people who need it to produce your order. We use no external production subcontractors.
By default we retain project files indefinitely so we can repeat or repair an order. On your written request we delete the personal data within 30 days and confirm this to you, except where we must keep specific records to comply with accounting law.
On reasonable notice, and not more than once a year, we will provide the information you need to demonstrate our compliance with this agreement.
Questions about anything on this page: [email protected]