Privacy Policy

Heftman R&D Ltd. ("we", "us", "our") respects your privacy. This policy explains what personal data we collect through heftman-rd.com, why, on what basis, who we share it with, and your rights.

1. Who we are

Heftman R&D Ltd. (הפטמן מחקר ופיתוח בע"מ) is a contract manufacturer of reinforced tubing, components and sub-assemblies for the medical device industry, based in Israel. We are responsible for the personal data described in this policy.

2. What we collect

2.1 Information you give us. Through our contact form we collect your name, email address, an optional subject and your message. If you email us directly, we receive whatever you include. You are not legally required to give us any of this information; it is your choice. However, we need your name, email address and message in order to reply, and without them we cannot respond to your enquiry. Please do not send sensitive personal data (such as health information) or confidential third-party information through the form.

2.2 Information added when you submit the form. With your message we record the page you sent it from, the date and time, and the country your connection comes from (derived from your IP address by our hosting provider). When you submit the form, we send the Cloudflare Turnstile result, together with your IP address, to Cloudflare to verify that the submission was not made by an automated program.

2.3 Technical information. When you visit the site, our hosting provider processes technical data such as your IP address, browser and device type, the pages requested and the time of each request, to deliver the site and protect it against attacks and abuse. On pages that contain our contact form, Cloudflare Turnstile runs when the page loads and processes technical signals, including your IP address and characteristics of your browser and connection, to tell people from automated programs.

2.4 Analytics (only with your consent). If you click "Accept" in our cookie banner, Google Analytics collects information about how the site is used: pages viewed, approximate location, device and browser type, referring website, and whether a contact form was sent. If you click "Decline" or do not respond, Google Analytics is not loaded and no analytics data is collected.

3. How we use it

We use personal data to: respond to your enquiry and communicate with you about a potential or existing business relationship; operate and secure the website, including protecting our contact form against spam and abuse; understand how the site is used, if you have consented to analytics; and comply with our legal obligations. We do not use your data for advertising, and we do not make decisions about you based solely on automated processing.

4. Legal basis

4.1 Israel. We process your personal data with your informed consent, given when you choose to send us your details after reading this notice, and only for the purposes described in this policy, in accordance with the Protection of Privacy Law, 5741-1981, and its regulations.

4.2 EU / UK. Where the EU or UK General Data Protection Regulation applies, we rely on:

• Legitimate interests: to respond to enquiries, develop business relationships, and keep the website secure and protected against spam (including Cloudflare Turnstile). Where your enquiry concerns a potential order, processing may also be necessary to take steps at your request before entering into a contract.
• Consent: for analytics cookies (Google Analytics). You can withdraw consent at any time through "Cookie settings" at the bottom of every page. This does not affect processing carried out before withdrawal.
• Legal obligation: where we must keep or disclose data under applicable law.

5. Who we share it with

We do not sell your personal data. We share it only with service providers that process it on our behalf and are bound to protect it, for the purposes below:

• Cloudflare: website hosting, content delivery and security, including Cloudflare Turnstile spam protection on our contact form. Cloudflare may also use Turnstile signals, as an independent controller, to improve its bot-detection service (see Cloudflare's Turnstile Privacy Addendum).
• Google: Google Workspace hosts our business email, where your enquiry is received and kept; Google Analytics processes usage data, only if you consent.
• Resend (Plus Five Five, Inc., USA): sends each contact-form submission to our business mailbox as an email. It receives the contents of your submission (name, email address, subject, message, the page it was sent from, country and time) and stores this data in the United States.

We may also disclose data where required by law or legal process, or to protect our rights.

Our website links to our LinkedIn page. No data is shared with LinkedIn unless you follow that link, after which LinkedIn's own privacy policy applies.

6. Cookies and similar technologies

We do not use advertising cookies.

• Strictly necessary (no consent needed): we store your cookie choice in your browser's local storage (item "hrd-consent") so the banner is not shown again. On pages that contain our contact form, Cloudflare Turnstile processes technical signals needed to tell people from bots.
• Analytics (only after you click "Accept"): Google Analytics cookies "_ga" and "_ga_<ID>", which distinguish visitors and sessions and are kept for up to 2 years. Our site does not grant consent for advertising storage, advertising user data or ad personalisation; Google signals (which links analytics data to signed-in Google accounts) is turned off; and Google Analytics 4 does not log or store IP addresses. If you later decline, we remove these cookies.

You can change your choice at any time through "Cookie settings" at the bottom of every page, and you can block or delete cookies in your browser settings.

Open cookie settings

7. International transfers

We are based in Israel. Our service providers (Cloudflare, Google and Resend) may process personal data in the United States and other countries outside Israel and outside your own country. Any such transfer is made in accordance with applicable data protection law. For visitors in the European Economic Area, note that the European Commission recognises Israel as providing an adequate level of data protection.

8. How long we keep it

• Contact form enquiries: our website does not store contact form submissions. Each submission is sent to our business mailbox, hosted by Google Workspace, where it is kept as business correspondence. We retain it only for as long as reasonably necessary to handle your enquiry and any resulting business relationship, and to meet our legal, accounting and record-keeping obligations. You may request deletion of your enquiry, subject to applicable law and any legal or record-keeping obligations (see Section 9). Our email delivery provider, Resend, keeps the content and metadata of each sent message, together with delivery records and logs, for 30 days under our current plan; its backups are kept for 7 days.
• Analytics data: Google Analytics keeps user-level and event-level data for 14 months (our data-retention setting), after which it is deleted. Aggregated reports that do not identify you may be kept longer.
• Technical and security data: processed by Cloudflare to deliver and protect the website, in accordance with its own retention practices.

9. Your rights

You have the right to access (inspect) the personal data we hold about you and to ask us to correct it if it is inaccurate, incomplete, unclear or out of date. Depending on where you are, you may also have the right to request deletion, object to or restrict certain processing, receive a copy in a portable format, and withdraw consent at any time. To exercise these rights, contact us at info@heftman-rd.com. We may need to verify your identity, and we will respond within the period required by applicable law. You may also complain to a data protection authority: in Israel, the Privacy Protection Authority; in the EEA or UK, the supervisory authority where you live or work.

10. Security

The website is served only over encrypted HTTPS, and we apply reasonable technical and organisational measures to protect personal data. No method of transmission over the internet is completely secure, however, and we cannot guarantee absolute security.

11. Children

Our website is intended for a professional, business audience and is not directed at children. We do not knowingly collect personal data from children.

12. Changes

We may update this policy from time to time. The current version will always be posted on this page with its "Last updated" date.

13. Contact