Privacy Policy

1. Introduction

CPack Manufacturing, LLC (“CPack,” “we,” “us,” or “our”), located in Orem, Utah, operates the website cpackmanufacturing.com (the “Site”). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our Site or contact us about our contract manufacturing services.

This policy applies to all visitors globally, including individuals located in the European Economic Area (EEA) and the United Kingdom. Where we process personal data of EEA or UK residents, we act as the data controller and comply with the General Data Protection Regulation (GDPR) and UK GDPR as applicable.

If you do not agree with this policy, please discontinue use of the Site.

2. Data We Collect

Data You Provide Directly

We collect personal data you voluntarily submit through contact forms, quote request forms, or email correspondence, including:

• Name and job title
• Company name and business address
• Email address and phone number
• Project specifications, product formulations, or related manufacturing inquiries

Data Collected Automatically

When you visit the Site, we and our service providers may automatically collect certain technical data, including:

• IP address and browser type
• Pages visited, time spent, and referring URLs
• Device type and operating system
• Cookie identifiers and analytics data (see Section 6)

3. Legal Basis for Processing (GDPR)

For individuals located in the EEA or UK, we process your personal data only where a valid legal basis exists under Article 6 of the GDPR. The legal bases we rely on are:

• Legitimate interests (Art. 6(1)(f)): Responding to business inquiries, evaluating manufacturing project requirements, and operating the Site securely. We have assessed that our legitimate interests are not overridden by your rights and freedoms, given the B2B context of our services.
• Contractual necessity (Art. 6(1)(b)): Processing data necessary to take pre-contractual steps at your request, such as preparing a manufacturing proposal or quote.
• Legal obligation (Art. 6(1)(c)): Processing required to comply with applicable laws or regulatory requirements.
• Consent (Art. 6(1)(a)): Where we rely on consent (such as for non-essential cookies or marketing communications), we will request it explicitly and separately. You may withdraw consent at any time without affecting the lawfulness of prior processing.

4. How We Use Your Data

We use collected data for the following purposes:

• To respond to quote requests, inquiries, and customer service communications
• To evaluate project requirements and provide manufacturing proposals
• To send follow-up communications related to your inquiry or our services
• To improve Site content, functionality, and user experience
• To comply with applicable legal obligations
• To detect and prevent fraudulent or unauthorized use of the Site

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes.

5. Sharing of Data

Service Providers (Data Processors)

We engage third-party vendors who assist in operating the Site and conducting our business (such as web hosting, CRM, and analytics providers). Where these vendors process personal data on our behalf, they act as data processors under binding Data Processing Agreements (DPAs) that restrict them from using your data for any purpose other than providing services to CPack.

International Transfers

CPack is based in the United States. If you are located in the EEA or UK, your personal data may be transferred to and processed in the United States, which may not provide the same level of data protection as your home jurisdiction. Where such transfers occur, we rely on appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission, to ensure your data is protected in accordance with the GDPR.

Legal Requirements

We may disclose data when required by law, court order, or governmental authority, or when necessary to protect the rights, property, or safety of CPack, our customers, or the public.

Business Transfers

In the event of a merger, acquisition, or sale of all or a portion of our business assets, your data may be transferred. We will notify affected individuals via email prior to any such transfer where required by law.

6. Cookies and Tracking Technologies

The Site uses cookies and similar technologies. Cookies are small data files stored on your device. We categorize cookies as follows:

• Strictly necessary cookies: Required for the Site to function. These do not require consent.
• Analytics cookies: Used to understand how visitors interact with the Site (such as Google Analytics). These are set only with your consent where required by applicable law.
• Functional cookies: Used to remember your preferences. Set with consent where required.

EEA and UK visitors will be presented with a cookie consent banner. You may update your preferences at any time through your browser settings. Note that disabling certain cookies may affect Site functionality.

7. Data Retention

We retain personal data only as long as necessary to fulfill the purposes described in this policy or as required by applicable law. Our standard retention periods are:

• Contact form submissions and inquiry records: up to 3 years from last contact
• Analytics and technical logs: up to 14 months
• Contractual records (where a manufacturing agreement is executed): up to 7 years

After the applicable retention period, data is securely deleted or anonymized. You may request early deletion subject to our legal obligations (see Section 8).

8. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data. EEA and UK residents have these rights under the GDPR and UK GDPR:

• Right of access (Art. 15): Request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): Request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17): Request deletion of your personal data where it is no longer necessary for the purpose collected, or where you withdraw consent.
• Right to restriction of processing (Art. 18): Request that we limit how we use your data in certain circumstances.
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format where processing is based on consent or contract.
• Right to object (Art. 21): Object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds.
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior processing.
• Right not to be subject to automated decisions: We do not make solely automated decisions that produce legal or similarly significant effects on individuals.

To exercise any of these rights, contact us at:

We will respond to verified requests within 30 days. We may need to verify your identity before processing a request. If you are located in the EEA or UK and believe we have not handled your data in compliance with GDPR, you have the right to lodge a complaint with your local supervisory authority. In the EU, a list of supervisory authorities is available at edpb.europa.eu. In the UK, the relevant authority is the Information Commissioner’s Office (ico.org.uk).

California residents may also have additional rights under the California Consumer Privacy Act (CCPA). Please contact us to submit a CCPA request.

9. Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, or destruction. These include SSL/TLS encryption for data in transit, restricted internal access controls, and regular review of our security practices.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware, and where required, notify affected individuals without undue delay.

No transmission over the internet is 100% secure. While we maintain robust safeguards, we cannot guarantee absolute security.

10. Children’s Privacy

The Site is intended for business-to-business use by adults. We do not knowingly collect personal data from individuals under the age of 18 (or 16 where required by applicable law). If we become aware that we have inadvertently collected such data, we will delete it promptly.

11. Third-Party Links

The Site may contain links to external websites. CPack is not responsible for the privacy practices or content of those sites. We encourage you to review the privacy policies of any third-party sites you visit.

12. Updates to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or applicable law. The effective date at the top of this page reflects the most recent revision. Where changes are material, we will provide notice by posting a prominent notice on the Site or by emailing you directly. We will not reduce your rights under this policy without your explicit consent.

13. Contact and Data Controller Details

CPack Manufacturing, LLC is the data controller for personal data collected through this Site. For privacy inquiries, requests, or complaints: