Your data, handled with care

This privacy statement applies to this website of HMG Bedtextiel. The controller within the meaning of the General Data Protection Regulation (GDPR) is:

HMG Bedtextiel develops and manufactures bedding for business customers in retail, hospitality and professional markets. This website is aimed at business contacts, not at children.

For questions about this statement or about your data, contact us at [email protected] or on +31 (0)40 248 45 33.

We only process the personal data you give us yourself, and the technical data needed to run the website securely.

The contact form

Your name, e-mail address, the subject and your message, and — if you fill them in — your company name and phone number (contact form).

The production enquiry

Your company name, name, e-mail address, phone number and country, and — if you fill them in — your job title, website, VAT number and how you found us. Plus the project details you provide: products, specifications, quantities, timing, sales countries and channels, any target price and your notes (production enquiry). These are mostly business data; they become personal data where they say something about you as a person.

E-mail and phone

If you e-mail or call us directly, we process what you share: usually your name, your contact details and the content of your message.

Technical data

On every visit, our hosting provider’s server processes data your browser sends automatically: your IP address, the time, the page requested, the page you came from, and your browser and device type. These are kept in technical log files used only for security and troubleshooting.

Both forms also contain an invisible check field and note when you started filling them in. This lets us recognise automated spam; we do not keep these check data.

We do not ask for special categories of personal data, such as data about your health. Please do not include them in your message.

We only use your data for the purposes below, each with a legal basis under Article 6(1) GDPR.

Where we rely on legitimate interest, we have weighed it against your privacy, and you can always object. The tick box in the forms confirms that you know how we use your data, as described in this statement.

We do not use your data for newsletters or other direct marketing, we do not build profiles, and we make no automated decisions about you.

When you submit a form, our server checks the data and sends it over an encrypted connection to HMG’s own business system. There it is kept with your company’s details, and HMG’s sales team receives it by e-mail. When we reply, the reply goes straight to the e-mail address you gave.

If sending fails, you are told at once. The form then offers you a ready-made e-mail in your own e-mail program, and our phone number. In that case your details only reach us if you send that e-mail yourself.

The draft in your own browser

The production enquiry has several steps. So that you can continue later, the form keeps your answers as a draft in your own browser’s local storage (localStorage), under the name hmg:quote-draft:v1. The draft stays on your device: it is only sent to us when you submit the enquiry. It is then deleted, just as when you choose ‘Start over’. You can also delete it yourself in your browser (see the cookie statement).

The contact form does not keep a draft.

Within HMG, only the staff who handle your question or enquiry see your data, such as sales and account management.

We also work with service providers that process data on our behalf (processors):

• our hosting provider, which hosts the website and the technical log files;
• the hosting provider of our business system (Hetzner, Germany), where submitted forms are kept;
• the providers of our e-mail and IT environment, in which we receive and keep messages.

We agree security and confidentiality terms with them, as the GDPR requires. We do not sell your data or pass it on to others for their own marketing. We only disclose data where the law requires us to, for example to a supervisory authority.

What you send through a form is kept in our business system on a server in Germany, within the European Economic Area (EEA). Some service providers, such as those of our e-mail and IT environment, may also process data outside the EEA.

We only allow data to be processed outside the EEA with an appropriate safeguard under the GDPR: an adequacy decision of the European Commission — such as the EU-US Data Privacy Framework, for companies that take part in it — or the European Commission’s standard contractual clauses. To find out which safeguard applies, ask us at [email protected].

We keep personal data no longer than needed for the purpose we received it for:

This website uses no analytics tools such as Google Analytics, no advertising or social media cookies, no tracking pixels and no embedded third-party content such as videos or maps. The fonts are served from our own server. Your visit is therefore not tracked, not linked to a profile and not shared with anyone else.

The website only sets a cookie if you enter the password for the brand assets: a functional cookie that remembers you did so and holds no personal data. Apart from that, all it keeps in your browser is your choice in the cookie banner, the settings for the lite or full view and the draft of the production enquiry. Those settings stay on your device. The cookie statement has the details.

In the cookie banner you choose whether you allow statistics and marketing tools; you can change that choice at any time with Cookie settings, at the bottom of every page. It stays on your device: we do not receive it. We use no such tools today. Should we ever add them, it will only be after your consent — which would then be the legal basis (Article 6(1)(a) GDPR) and which you can withdraw at any time — and we will update this statement first.

The ‘Get directions’ link opens Google Maps in a new window. Only when you click it do you go to Google’s website, where Google’s privacy policy applies.

We take appropriate technical and organisational measures to protect your data against loss and unlawful use. Traffic between your browser and the website runs over an encrypted connection (HTTPS); the server checks every submitted field again before passing it on; only authorised staff have access to enquiries; and our service providers are contractually bound to keep data secure.

If you believe your data is not properly secured, or you see signs of misuse, please let us know at once at [email protected].

The GDPR gives you the following rights:

• Access — to know what data we hold about you and what we do with it;
• Rectification — to have inaccurate or incomplete data corrected;
• Erasure — to have your data deleted, unless the law requires us to keep it;
• Restriction — to have processing paused, for example while a correction is being assessed;
• Objection — to object to processing based on our legitimate interest;
• Portability — to receive the data you gave us in a common digital format, or have it sent on.

Send your request to [email protected] or by post to the address above. We will respond as soon as possible and within one month at the latest; for a complex request this period may be extended by two months, in which case we will tell you within the first month. Requests are free of charge.

To make sure we do not give data to the wrong person, we may ask you to confirm your identity. We will ask for no more than necessary.

Not happy with how we handle your data? Please tell us first; we will gladly look for a solution with you.

You always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): autoriteitpersoonsgegevens.nl, or with the supervisory authority of the EU country where you live or work.

We update this statement when the website or the way we work changes, for example if we start using other service providers. The date at the top shows when it was last updated; this version is dated 22 October 2026.