Privacy policy

1Who we are

Formr is a sole proprietorship based in the Netherlands and is the data controller for the data processed through this website. Privacy questions? Email us at info@formr3d.nl.

Formr — Tommeakker 7, 5463 MZ Veghel, the Netherlands, Chamber of Commerce (KVK) 69705232.

2What data we process

• Order data — name, email address, delivery address and the contents of your order.
• Request & contact data — name, email address, delivery address, optional phone number and the content of your message or print request.
• Uploaded files — the 3D files (STL, 3MF, STEP, OBJ) you submit through the Print Service, plus any notes you add. We use these files solely to assess your request and carry out the job; they aren't used for any other purpose and aren't shared with third parties unless necessary to perform the job.
• Payment data — your payment is handled by Stripe. We only receive the status of your payment (succeeded or not), never your full account or card details.
• Technical & statistical data — anonymous, cookieless visit statistics (see §4). We don't build profiles.

3Purposes and legal basis

• Assessing your print request — to assess your request and uploaded files and prepare a no-obligation quote (taking steps at your request prior to entering into a contract).
• Fulfilling your order — to produce and deliver your order (performance of the contract).
• Contact — to answer your questions and messages (legitimate interest).
• Records — to meet our legal (tax) retention obligation (legal obligation).
• Improving the website — based on anonymous, cookieless statistics (legitimate interest).

4Cookies and statistics

We keep this deliberately simple. We don't use tracking cookies or advertising or social pixels.

• Functional storage — we don't use cookies for your shopping cart: its contents are stored locally in your browser (localStorage) so it persists when you refresh. This is strictly necessary for the shop to work and is never sent to us.
• Cookieless statistics — we measure visitor numbers with Vercel Web Analytics, without cookies and without identifying you. No personal profiles are built.
• Payment — during checkout Stripe places functional cookies in its own environment that are needed for a secure payment.

5Who we share data with

We never sell your data. We do rely on a few trusted processors to run the website. Where legally required, we have concluded a data processing agreement or equivalent data-processing arrangements with these processors.

• Stripe — payment processing (iDEAL).
• Vercel — website hosting and storage of uploaded files (in a private store in the EU).
• Resend — sending confirmation and service emails.
• Supabase — storage of request and order data in our secure admin database (EU region, Ireland).
• Sanity — managing our product catalogue. No customer data is stored in it.

Transfers outside the EEA. Some of our service providers are based outside the European Economic Area or use infrastructure outside it. Where personal data is processed outside the EEA, this only happens with appropriate safeguards, such as certification under the EU-US Data Privacy Framework or the standard contractual clauses approved by the European Commission.

6How long we keep data

The 7-year tax retention period follows from the law. Uploaded files are automatically and permanently deleted 30 days after a request is completed or declined, in line with our retention policy. Contact data that doesn't lead to an order is cleaned up after twelve months. These periods apply unless a longer retention period is legally required or necessary for an ongoing dispute.

7Your rights

You have the right to access, correct or delete your data, to object to or request restriction of processing, and to data portability (a copy of your data in a common, structured format). Where processing is based on consent, you can withdraw that consent at any time.

Send your request to info@formr3d.nl; we'll respond as soon as possible and within one month at the latest.

Do you have a complaint about how we handle your data? Please contact us first so we can look for a solution together. You always also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

8Minors

Our website is not aimed at children under 16. We don't knowingly collect personal data from children without the consent of a parent or legal guardian.

9Security

We take appropriate technical and organisational measures to protect your data: traffic is encrypted (HTTPS), uploaded files are kept in a private store accessible only via temporary signed links, payments run through Stripe's secure environment, and our admin database is accessible only via authentication with row-level security (deny by default). We review our security measures regularly and adjust them where necessary.

10Changes

We may update this privacy policy from time to time, for example when we engage a new processor. The date at the top shows when the policy was last updated.