Privacy Policy

This Privacy Policy describes how 3D4U ("3D4U", "we", "controller") collects, uses and protects the personal data of visitors and users of the website 3d4u.hr (the "Site") and of people who contact us via the enquiry form, email, phone or social networks.

Personal data is processed in accordance with Regulation (EU) 2016/679 ("GDPR"), the Croatian Act on the Implementation of the GDPR (OG 42/2018), the Electronic Communications Act (OG 76/2022, 14/2024) and other applicable Croatian and EU legislation.

1. Controller

Name: 3D4U
Registered address: Josipovac Punitovački, Osijek-Baranja County, HR [to be completed with full street address]
OIB (tax ID): [to be completed]
Email: info@3d4u.hr
Phone: +385 97 666 7034

For any questions related to processing of personal data or the exercise of your rights, please contact info@3d4u.hr. Given the scope of processing, the controller is not obliged to appoint a Data Protection Officer (DPO).

2. Categories of personal data

Enquiry / contact form data: name, email, phone (optional), company name (optional), message body, attached files (STL/STEP models, sketches).
Order data: information required to issue a quote, invoice and delivery (address, tax ID of legal persons).
Technical visit data: IP address, browser type, operating system, referrer URL, visit time, pages viewed.
Cookie / similar technology data — only with your consent (except for strictly necessary). Details in the Cookie Policy.
Correspondence you exchange with us (email, chat, social media messages).

3. Purposes and legal bases

Purpose	Legal basis (GDPR)	Retention
Responding to enquiries, preparing quotes, communication	Art. 6(1)(b) — pre-contractual steps	Up to 12 months after last contact
Performing the contract (3D printing, modeling, service)	Art. 6(1)(b) — contract performance	Duration of contract + statutory periods
Issuing invoices, accounting	Art. 6(1)(c) — legal obligation (Accounting Act, VAT Act)	11 years
Newsletter / marketing communications	Art. 6(1)(a) — consent	Until consent is withdrawn
Analytics cookies, visit measurement	Art. 6(1)(a) — consent	Until cookie expiry / consent withdrawal
Site security, abuse prevention	Art. 6(1)(f) — legitimate interest	Up to 30 days (log files)
Establishing, exercising or defending legal claims	Art. 6(1)(f) — legitimate interest	Until statutory limitation

4. Recipients

We do not sell your personal data. Data may be disclosed only to the following categories of recipients, strictly to the extent necessary:

Our employees and external contractors (bound by confidentiality).
Accounting service provider (invoicing and tax reporting).
IT / cloud infrastructure providers (hosting of the Site and database).
Email service providers.
Delivery services (only data necessary for delivery).
Competent public authorities — when required by law (tax authority, courts).

Current sub-processors:

Supabase Inc. (database, authentication, file storage) — EU servers.
Cloudflare, Inc. (network infrastructure, CDN, abuse protection) — global network under standard contractual clauses.
Google Ireland Ltd. (Google Business profile, optional Analytics) — only with consent for analytics cookies.

5. Transfers to third countries

Data is primarily processed within the European Economic Area (EEA). Where a processor (e.g. Cloudflare, Google) processes data outside the EEA, transfers rely on:

Standard Contractual Clauses (Commission Decision 2021/914), or
Adequacy decision of the European Commission (e.g. EU-US Data Privacy Framework).

6. Your rights

Under the GDPR you have at any time the right to:

Access your personal data (Art. 15).
Rectification of inaccurate or incomplete data (Art. 16).
Erasure ("right to be forgotten") when there is no longer a legal basis (Art. 17).
Restriction of processing (Art. 18).
Portability in a structured, commonly used, machine-readable format (Art. 20).
Objection to processing based on legitimate interest or for direct marketing (Art. 21).
Withdrawal of consent at any time, without affecting prior lawfulness (Art. 7(3)).
Not to be subject to automated decision-making, including profiling (Art. 22). We do not perform such decisions with legal effects.

Requests can be sent to info@3d4u.hr. We will respond without undue delay and at the latest within one month, extendable by two further months for complex requests.

7. Right to lodge a complaint

If you believe we have processed your data in breach of the GDPR, you have the right to lodge a complaint with the supervisory authority:

Croatian Personal Data Protection Agency (AZOP)
Selska cesta 136, 10 000 Zagreb, Croatia
Tel: +385 (0)1 4609-000
Email: azop@azop.hr
Web: azop.hr

8. Security

We apply appropriate technical and organisational measures, including:

HTTPS encryption of all traffic (TLS 1.2+).
Encryption of data at rest (database and file storage).
Role-based access control (row-level security at database level).
Regular software updates and security patches.
Limited number of persons with access, bound by confidentiality.

In case of a personal data breach likely to result in a high risk to your rights and freedoms, we will notify you without undue delay and notify AZOP within 72 hours (Art. 33 and 34 GDPR).

9. Children

Our services are not directed to children under 16. We do not knowingly collect personal data from children without parental consent. If you believe we have collected such data by mistake, please contact us and we will delete it.

10. Cookies

Detailed information about cookies, their purpose, duration and consent-withdrawal procedure is available in the Cookie Policy.

11. Changes to this Policy

We reserve the right to change this Policy at any time. Changes take effect upon publication on the Site. The date of the latest revision is shown at the top of the document. Material changes that meaningfully affect your rights will be additionally communicated (e.g. by email or a prominent notice on the Site).

12. Contact

For any questions regarding this Privacy Policy or the processing of your personal data, please contact info@3d4u.hr.

Privacy Policy.