Privacy and personal data

1. Who is responsible for your data

The controller is AnOL OÜ, registry code 12315625, Paldiski mnt 167-6, Haabersti linnaosa, Tallinn, 13518 Harju maakond, Eesti. For questions about your data or to exercise your rights, contact 3dprint@decords.com or +372 5874 3963. The seller handles data protection requests through these contacts.

2. Information we receive

We receive the name, email, telephone number, task description, files and photographs you provide, the model’s technical parameters, quantity, material, color, delivery method and address, billing details, order number, payment status, correspondence and complaints. For a withdrawal notice, we receive your name, email, contract identifier and the notice’s content and time.

Website operation may involve processing your IP address, request time, device and browser information, technical logs and session identifiers for security, owner sign-in and preventing misuse. The current enquiry form does not collect bank card details. Uploaded files may contain personal information; remove anything that is unnecessary for the task before sending them.

3. Purposes and legal bases

Preparing a quote at your request, checking the model, communicating, manufacturing and delivery are based on steps towards a contract and its performance (GDPR Article 6(1)(b)). Creating and retaining accounting documents, mandatory record-keeping, handling statutory consumer claims and acknowledging a withdrawal are based on legal obligations (Article 6(1)(c)).

Protecting the website, limiting misuse, preserving file integrity and defending rights in a dispute are based on AnOL OÜ’s legitimate interests in operating a secure service and demonstrating contract performance (Article 6(1)(f)). We take customers’ rights into account and limit processing to what is necessary. Separate voluntary use of materials in a gallery or marketing may rely on separate consent (Article 6(1)(a)) or another appropriate legal basis explained in advance. The current form does not request that permission.

4. Who may receive the data

Access is available to authorized AnOL OÜ staff and the providers needed to carry out the work. Technical providers include OpenAI Sites and Cloudflare infrastructure for the website, database and private file storage; the protected WordPress mail gateway at decords.ee and email providers for notifications; and Google Drive for the working archive of order files and documents. These systems are not a public gallery.

Information needed for carriage is shared with the selected carrier, such as Omniva, SmartPosti or UPS, only to the necessary extent. Banks and accounting providers receive the payment and bookkeeping information they need. Public authorities receive data where there is a lawful basis. Some recipients, including banks and carriers, may act as independent controllers under their own privacy notices.

Models are not published automatically. If a particular job needs an external production provider and transfer of the file, its use is limited to fulfilling the order. The customer receives the necessary information if there is a material change in processing. We do not sell personal data.

5. International processing

Some infrastructure and email providers may process data outside the European Economic Area. Such transfers are allowed only under Chapter V of the GDPR: an applicable EU adequacy decision or appropriate safeguards, such as standard contractual clauses together with any necessary supplementary measures. The mechanism depends on the provider and the processing terms in force.

You may ask 3dprint@decords.com for information about the recipients, countries and safeguards applicable to your data, and an available copy of the relevant safeguards, subject to protection of commercial confidentiality and other people’s data.

6. How long we keep the data

Accounting source documents and the necessary related information are retained for 7 years from the end of the relevant financial year unless the law requires a different period. Contract records and significant correspondence are retained for performance and applicable claims, normally for up to 3 years after fulfilment. Where there is a dispute, the necessary records are kept until it is resolved and the decision has been implemented.

Working models, photographs and production attachments are retained to fulfil the order and for the justified period needed to check quality and deal with customer claims, normally no longer than 2 years after completion. Longer retention for repeat orders requires a separate agreement. Enquiries and attachments that do not result in a contract are normally deleted within 6 months after discussions end, unless there is a dispute or another legal basis.

Technical logs and security identifiers are kept for a justified security period within the relevant provider’s technical policy. We consider the need to investigate incidents and minimize data when determining the period. These periods also apply to working copies. Backups are removed through their replacement cycle and are not used for new purposes. Deleting a working file does not mean deleting a mandatory accounting document.

7. Your rights

Within the limits of the GDPR, you can access and obtain a copy of your data, have it corrected, request erasure or restriction, object to processing based on legitimate interests, and receive portable data processed automatically on the basis of a contract or consent. You may withdraw consent for the future without affecting the lawfulness of earlier processing.

Write to 3dprint@decords.com. To protect your data, we may make a proportionate identity check. We normally respond within one month. If a lawful extension is needed, we explain it and the reasons within the original period. Erasure does not apply to information that must be retained by law or for justified legal claims.

You can complain to Andmekaitse Inspektsioon, the Estonian Data Protection Inspectorate (aki.ee), or the competent authority in the country where you live, work or believe an infringement occurred. You retain the right to seek a judicial remedy.

8. Required information, decisions and cookies

Information marked as required is needed to process the enquiry, prepare a document or arrange delivery. Without it, the relevant action may not be possible. Optional comments and photographs need not be provided where they are not needed for a technical assessment.

The calculator calculates a price automatically from the selected parameters. This is a preliminary estimate subject to review, not a solely automated decision producing legal effects within the meaning of GDPR Article 22. The form does not carry out advertising profiling.

The website uses the platform’s technically necessary session, sign-in and security mechanisms. We have not added our own advertising pixels or optional analytics to the application. If optional trackers are introduced later, information and consent choices must be provided before they operate. Following an external link opens a service governed by its own rules.

9. Protection and changes

We use HTTPS, restricted owner access to order files, private storage and verifiable document links. An email acceptance status means that the message was handed to a mail server; it does not guarantee arrival in the inbox. Do not put passwords, card details or other unnecessary secrets in models or comments.

This notice is dated 2 November 2026. If the purposes or material conditions of processing change, we provide updated information and obtain separate consent where required.