Who is responsible for your data
The controller of your personal data is TBD: registered company name (d.o.o. / obrt) (trading as ZG3D Studio), TBD: street address of the registered office, 10000 Zagreb, Croatia, OIB TBD: OIB (personal identification number of the company).
For anything about your data, write to hello@zg3dstudio.com. We are not required to appoint a data protection officer; the owner of the studio answers these requests personally.
What data we collect
- When you order or ask for a quote: your name, e-mail address, phone number (optional), delivery address or chosen BOX NOW locker, company name, OIB or VAT number (if you want an invoice to a company), the items and settings you chose, your notes, and the 3D files you attach.
- When you write to us (contact form or e-mail): your name, e-mail address, your message and any files you attach.
- When you pay: the payment is handled by our payment provider. We receive the confirmation and the amount, never your full card number.
- When you browse: the hosting provider records technical data (IP address, browser, time, page requested) in server logs, to keep the site secure and working.
- Only if you accept analytics cookies: how you use the site (pages, clicks, the device type, an approximate location from your IP, and anonymised session recordings with every form field masked). See the cookie policy.
Files in the quote studio stay on your device. When you open a 3D file to get a price, it is read in your browser and kept in your browser's storage so it survives a reload. It reaches us only when you send an order or attach it to a message.
Why we use it and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Checking your files, preparing the price, printing and delivering your order, sending the payment link and updates | Performance of a contract or steps before it, at your request (Art. 6(1)(b)) |
| Issuing invoices and keeping accounting records | Legal obligation under Croatian tax and accounting law (Art. 6(1)(c)) |
| Answering your messages and questions | Steps before a contract (Art. 6(1)(b)) or our legitimate interest in replying (Art. 6(1)(f)) |
| Keeping the site secure, preventing fraud and abuse, defending legal claims | Legitimate interest (Art. 6(1)(f)) |
| Analytics and session recordings to improve the site | Your consent (Art. 6(1)(a)), which you can withdraw at any time |
We do not sell your data, we do not use it for automated decisions that affect you, and we do not send newsletters unless you ask for them.
Your 3D files
We use the files you send only to quote, check and print your order, or to do the modelling work you asked for. We never publish, share, sell or reuse them, and we don't use them to train any software.
We delete the files TBD: e.g. 90 days after the order is delivered, unless you ask us to keep them for repeat orders or the law requires otherwise. You can ask us to delete them sooner at any time. For confidential projects we sign a non-disclosure agreement before you send anything.
Who helps us (processors and recipients)
We use a few trusted providers, each bound by a data processing agreement and only for the purpose described:
- Hosting: Vercel Inc. (runs the website; servers in the EU and the USA).
- Transactional e-mail: Resend (delivers the order and contact e-mails between you and the studio).
- Studio mailbox: TBD: e-mail provider of hello@zg3dstudio.com, e.g. Google Workspace (where your orders and messages arrive).
- Analytics, only with your consent: PostHog, on its EU cloud (servers in Frankfurt, Germany).
- Payments: TBD: payment provider, e.g. Stripe, which processes your payment as an independent controller under its own privacy policy.
- Couriers: the carrier that delivers your parcel (TBD: e.g. DPD, GLS, BOX NOW, Hrvatska pošta) receives your name, address, phone and e-mail for delivery notices.
- Accounting: TBD: accounting service receives invoice data to keep the books.
Some providers are based in the United States. Where data leaves the EU/EEA, the transfer relies on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses (Art. 45 and 46 GDPR). Public authorities receive data only when the law requires it.
How long we keep it
- Invoices and accounting records: as long as Croatian accounting and tax law requires (currently 11 years).
- Order details and correspondence about an order: until the end of the legal guarantee period and any claims that may follow (in general 3 years after delivery), then deleted.
- 3D files: see «Your 3D files» above.
- Messages that did not lead to an order: up to 24 months after our last exchange.
- Server logs: a short period set by the hosting provider, usually up to 30 days.
- Analytics data: TBD: retention period set in the PostHog project, e.g. 12 months.
- Data in your browser (cart, files in the quote studio, preferences): until you delete it or clear your browser's storage.
Your rights
Under the GDPR you can ask us at any time to:
- see the data we hold about you and get a copy (access);
- correct data that is wrong or incomplete (rectification);
- delete your data when we no longer need it or you withdraw consent (erasure), except what the law requires us to keep;
- restrict how we use it while a question is being resolved (restriction);
- receive the data you gave us in a common, machine-readable format (portability);
- object to processing based on our legitimate interest (objection);
- withdraw your consent to analytics at any time, without affecting what happened before (use the button in the cookie policy).
Write to hello@zg3dstudio.com. We answer within one month; if a request is complex we may extend this by two more months and tell you why. We may ask you to confirm your identity first.
If you think we have not respected your rights, you can complain to the Croatian supervisory authority, the Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, www.azop.hr, or to the authority of the EU country where you live or work. We'd appreciate the chance to fix it first.
Security and minors
The site is served only over an encrypted connection (HTTPS), access to orders and files is limited to the people who work on them, and our providers apply recognised security standards. No system is perfectly safe; if a breach puts your data at risk, we'll tell you and AZOP as the law requires.
The site is not aimed at children. To place an order you must be at least 18 years old or have the consent of a parent or guardian.
Changes to this policy
If we change how we handle data, we update this page and the date at the top. For important changes affecting an ongoing order, we tell you by e-mail.