- Home
- Privacy
We keep what you send for 36 months and sell none of it
A machine shop in Newark, Delaware needs your name, a phone number and the print. That is most of what this page is about. The rest covers the ad platforms that send people here and the switches that hold them back until you say yes.
Effective 27 September 2026 · Last updated 27 September 2026
| Who holds it | Duhadawaytool, trading at duhadawaytool.us as Hadaway Tool, 1 801 DAWSON DR, NEWARK, DE 19713, United States. |
|---|---|
| What we take | What you type into the inquiry form or chat, your IP address and browser string, and any ad click ID in the link you arrived on. |
| Where it sits | On the hosting provider that serves this site, and in the shop's inbox. Nothing is printed and filed except the job paperwork. |
| How long | Inquiries 36 months. Chat 12 months. Server logs 90 days. Your cookie choice 6 months. |
| Who else sees it | Google, Microsoft and Meta receive ad measurement signals only after you allow storage. The host and the mail provider carry the rest. |
| Is it sold | No. Not to anyone, for any price. A Global Privacy Control signal is treated as an opt-out of ad sharing without asking again. |
| How to get it out | Write, call or use the data request page. Answer inside 14 days. |
| Who to write to | [email protected] · +1 (302) 366-0113. A person at the shop reads it. |
When this notice applies
This notice took effect on 27 September 2026 and was last updated the same day. It covers duhadawaytool.us and every page on it: the service pages, the fit check, the contact form, the support chat and the legal pages. It does not cover what happens after a written quote turns into a job. Job paperwork (the print, the quote, the check sheet, the invoice) is kept as business records under the terms of work.
Who operates this site
The site is run by Duhadawaytool, trading at duhadawaytool.us under the name Hadaway Tool. We are a small job shop that builds welding fixtures, drill jigs, check gauges, frames and short-run metal parts to order.
Postal address: 1 801 DAWSON DR, NEWARK, DE 19713, NEWARK, DE, United States. Phone +1 (302) 366-0113. Email [email protected]. We are the party that decides what is collected here and why, which makes us the controller in GDPR terms and the business in California terms.
What we collect
Less than most sites. There is no account, no password, no payment and no card data, because nothing is sold on this site and no payment is taken here.
From the inquiry form
When you send the form, vibuf28.php writes down your name, phone, email, the address or company and city you give, the kind of inquiry you picked, your message, the specification you describe (material, size, quantity, date needed) and whether you ticked the consent box. Any file names you mention in the message come with it.
Alongside those fields the server records, automatically: your IP address, your browser's user-agent string, the referring URL, the moment the form was rendered and the moment it was sent. The two time stamps tell us whether a person or a script filled it in. A form sent in under two seconds is almost never a person.
From the support chat
bele238.php keeps the conversation itself, plus any name, phone or email you choose to give when you start it. A token is saved in your browser so that you can close the tab and come back to the same thread.
Technical and log data
Like every web server, ours writes an access log line for each request: IP address, time, page asked for, status code, referrer and user-agent.
Cookie and storage identifiers
Your consent choice is stored in your browser under site_consent_v2. Nothing else on this site persists a choice. If you allow storage, the Google, Microsoft and Meta tags set their own identifiers, listed with their lifetimes in the cookie statement.
Advertising click identifiers
If you reach us by clicking an ad, the link carries a click ID: gclid from Google, msclkid from Microsoft, fbclid from Meta. We read it from the landing URL. It says which ad was clicked. It does not tell us your name.
What each piece is used for
- Form fields and chat: to read your job, call you back with questions about the print, and write a fixed quote. The phone number is there because most prints raise a question the email doesn't answer.
- IP, user-agent and time stamps: to filter spam and scripted submissions, and to trace a fault if a form fails.
- Server logs: to keep the site running and spot abuse, such as repeated hammering of the form.
- Consent record: to remember your answer so the banner doesn't ask you on every page.
- Click IDs and ad tags: to tell whether an ad led to a real inquiry, so money is not spent on ads that bring nobody. Only after you allow storage.
We don't build profiles, we don't buy lists and we don't send newsletters. If you asked for a quote, you get a quote and the calls that go with it.
The legal basis for each use
For visitors covered by the GDPR, each use rests on one of four bases: contract, legitimate interest, legal obligation or consent. The table sets them side by side.
| Data | Purpose | Basis |
|---|---|---|
| Form fields | Answering the inquiry, quoting the job | Contract steps taken at your request before a contract |
| Chat transcript | Answering your question | Contract steps at your request |
| IP, user-agent, time stamps | Spam filtering, fault tracing | Legitimate interest keeping the form usable |
| Server logs | Running and securing the site | Legitimate interest |
| site_consent_v2 | Remembering your choice | Legal obligation proving consent |
| gclid, msclkid, fbclid, ad cookies | Ad measurement | Consent withdrawn at any time |
Where we lean on legitimate interest, you can object, and we stop unless the reason is keeping the site from being abused.
Advertising platforms that send traffic here
This site takes paid clicks. Google Ads, Microsoft Advertising and Meta Ads send traffic here today. Each one adds its own click identifier to the link you click:
- Google Ads attaches
gclid. - Microsoft Advertising attaches
msclkid. - Meta Ads attaches
fbclid, where a campaign runs there.
The ID arrives in the address bar whether or not you consent; the platform put it there. What we do with it depends on your answer to the banner. Declined: the ID is not stored in a cookie and is not sent back to the platform as a conversion. Allowed: the platform's tag stores it and reports back when an inquiry is sent, without your name, phone or message attached.
Consent Mode v2, and what starts switched off
The Google tags on this site run under Google Consent Mode v2. Before the page loads anything from Google, four signals are set to denied:
ad_storage, which covers advertising cookiesad_user_data, which covers sending user data to Google for adsad_personalization, which covers remarketing and personalised adsanalytics_storage, which covers analytics cookies
They stay denied until you press Allow. Only then do they update to granted. Press Decline, or withdraw later from Cookie settings in the footer, and all four go back to denied the moment you do. While they are denied, Google's tag may send a cookieless ping that counts a visit without identifying you; it sets no ad or analytics cookie. The Microsoft and Meta tags are held back on the same switch.
Who receives data, one by one
- Google Ireland Ltd / Google LLC, for Google Ads. Attaches gclid to a click and receives the consent signals. Google privacy policy.
- Microsoft Ireland Operations Ltd, for Microsoft Advertising. Attaches msclkid. Its handling is covered by the Microsoft privacy statement at privacy.microsoft.com.
- Meta Platforms Ireland Ltd, for Meta Ads. Attaches fbclid where a campaign runs there. Meta privacy policy.
- The hosting provider that serves this site and stores the inquiry database and chat transcripts.
- The mail provider that carries the notification of a new inquiry to the shop's inbox.
The ad platforms never receive your form fields or your chat. The host and mail provider handle data only to run the service for us. No one else gets anything, and nobody pays us for it.
Data crossing borders
The shop is in the United States. If you write to us from Europe or the UK, what you send comes to a US business, which is a transfer outside the country of collection. We rely on the necessity of the transfer to answer an inquiry you asked us to answer, and, for the ad platforms, on the EU-US Data Privacy Framework and the standard contractual clauses those companies use for their own transfers. You can ask us for a copy of the safeguard that applies to your data.
How long it is kept
| Category | Kept for | Why that long |
|---|---|---|
| Inquiries and their email copies | 36 months | Tooling comes back for rework. Three years covers the usual gap between a fixture and its first worn locator. |
| Chat transcripts | 12 months | Long enough to pick up a thread that turned into a quote. |
| Server and access logs | 90 days | Fault tracing and abuse checks. |
| Record of a consent choice | 6 months | After that the banner asks again. |
When a period runs out, the record is deleted, not archived. Ad platform identifiers follow the lifetimes in the cookie statement.
How it is protected
Every page and form travels over HTTPS. The inquiry store is reachable only by the people at the shop who answer inquiries, behind a login. Two hidden honeypot fields and the render-time check keep most bots out of it. We hold no card numbers and no passwords of yours, so there is nothing of that kind to lose. Logs roll over at 90 days. No system is perfect; if we learn of a breach that affects you, we tell you and the authorities that the law requires us to tell.
Your rights under the GDPR
If you reach the site from the European Economic Area or the UK, the GDPR gives you these rights, and we honour them from any country:
- Access: a copy of what we hold on you.
- Rectification: fixing anything wrong.
- Erasure: deleting it, unless we must keep a job record for tax.
- Restriction: freezing use while a dispute is settled.
- Portability: your form and chat data in a plain machine-readable file.
- Objection: to any use based on legitimate interest.
- Withdrawing consent: at any time, through Cookie settings in the footer, without affecting what was lawful before.
Your rights under US state law
Residents of California have rights under the CCPA as amended by the CPRA, and residents of other states with a privacy law in force have similar ones: to know what we collect, to get a copy, to correct it, to delete it, and to opt out of the sale or sharing of personal information for cross-context behavioural advertising. We don't sell personal information. Allowing the ad tags counts as sharing under the CCPA, so declining the banner, or sending a Global Privacy Control signal, is your opt-out. We don't treat anyone worse for using these rights, and we don't use sensitive personal information for anything beyond answering you.
Global Privacy Control
If your browser sends the Global Privacy Control signal (the Sec-GPC header), we honour it as an opt-out of sale and sharing without asking again. The ad tags stay off and the four consent mode signals stay denied, even if an old Allow is on record in your browser.
Children
This is a site for buyers of production tooling. It is not meant for children, and we don't knowingly take data from anyone under 16. If a child has sent us something, tell us and we delete it.
Complaining about us
Tell us first if you can; most things get fixed in one phone call. You also have the right to complain to a data protection authority. In the US that is the Attorney General of your state, and in California also the California Privacy Protection Agency. In Europe it is the supervisory authority where you live or work.
How to use these rights
Use the data request page, email [email protected], or write to 1 801 DAWSON DR, NEWARK, DE 19713, United States. Say what you want and give the email or phone you used with us, so we can find the record and confirm it is yours. We answer within 14 days. It costs nothing. If we need to check who you are, we ask for as little as will do, usually a reply from the same email address.
When this notice changes
A change goes up on this page with a new date at the top. If it changes what we collect or who receives it, the consent banner asks you again on your next visit. Old versions are kept and sent on request.
Reaching a person
Email [email protected] or call +1 (302) 366-0113. Post goes to Duhadawaytool, 1 801 DAWSON DR, NEWARK, DE 19713, United States. It is a small shop; the person who picks up the phone is the person who can answer. If you came here about a job instead, send the drawing.