Privacy policy

1. Controller

Stratum (sole trader)
Owner and postal address: see the legal notice
Email: office@3d-stratum.com

Stratum is my sole-trader business. I am not required to appoint a data protection officer. For any privacy question, write to me at the email address above.

2. The short version

No tracking, no analytics, no ads, no social media plugins, no embedded videos from YouTube or Vimeo. Fonts, scripts, images and videos are served from my own server. Just visiting the website sends your data to no third party.

I set exactly one cookie, which remembers your language (section 5). It doesn’t need a cookie banner.

My server and my mailboxes are in the EU. I don’t transfer your data to countries outside the EU. The only exception: a photo of your piece that you allow me to post on my social media profiles (section 8) is then also held by that platform.

3. Hosting and server log files

The website runs on WordPress on a server I manage myself (WordOps with Nginx). I rent the server from Wasabi Hosting, Netherlands (KvK 92968376). It is in a data centre in Amsterdam, so inside the EU. I have a data processing agreement with Wasabi Hosting under Art. 28 GDPR.

On every request, the web server automatically logs your IP address, date and time, the requested address, the status code, the amount of data sent, the page you came from (referrer) and your browser details (user agent). I need these log files to run the website securely and reliably and to spot attacks. The legal basis is my legitimate interest under Art. 6(1)(f) GDPR.

Log files stay on my server only and are deleted automatically after 14 days. I keep them longer only if a specific security incident has to be investigated, and only until it is resolved.

To make pages load fast, the server keeps ready-made pages in a cache (FastCGI cache). It holds only the public pages, no data about you.

The connection to the website is encrypted with TLS (https).

4. Fonts, scripts and media

The fonts Inter and JetBrains Mono, the 3D model on the home page with the three.js library, all images and all videos load directly from my server. There is no connection to Google Fonts, to a content delivery network or to any other third-party server. WordPress emoji and Gravatar profile images are switched off too, because they would send requests to third-party servers.

5. Language cookie

The website is in German and English. The Polylang plugin sets the cookie pll_language for this. It stores only the code of the language you last chose (de or en), so you land in your language on your next visit. It holds nothing that identifies you and is not sent to third parties.

Duration: 1 year. The cookie is strictly necessary for the language choice you asked for (§ 165(3) Austrian Telecommunications Act 2021). The legal basis is Art. 6(1)(f) GDPR. You can delete or block cookies in your browser at any time. The website still works; you just land on the language your browser prefers.

Light or dark: if you tap the sun or moon icon at the top, your browser remembers your choice in its local storage (localStorage, entry s3d-theme, value light or dark). This is not a cookie. The entry stays in your browser and is not sent to my server or to third parties. It is strictly necessary for the display you asked for (§ 165(3) Austrian Telecommunications Act 2021). Without a choice, the site stays dark and nothing is stored.

I set no other cookies for visitors. WordPress sets its own cookies only when logging in to the admin area, which only I use.

6. Request and contact form

When you ask for a quote through my request form, I process what you enter: your email address (required, otherwise I can’t reply), your name (optional), the type of piece, your description, size, quantity, where it will go and your deadline, for a reel the link and your note, the files you upload (photos, sketches, PDFs or STL files) and the language of the page.

I use this data only to check your request, send you a quote and carry out the order. The legal basis is Art. 6(1)(b) GDPR (steps before and performance of a contract).

The contact form only sends me a message: your email address (required), your name (optional), your text and the language you chose. You can’t upload files there. I treat the message like a request: same storage, same spam protection, same retention and the same short confirmation email without your text. The legal basis is my legitimate interest in answering your question (Art. 6(1)(f) GDPR), or Art. 6(1)(b) GDPR for questions about an order.

Photos of people: if I make a figure from a photo, please only send photos of yourself or of people who agree. I use these photos only for your order and never show them anywhere.

The form runs directly on my own server, with no third-party form service. Your details and files are stored there in a protected area that can’t be reached from the internet. Only I can access it, after logging in. The server re-saves photos, which removes metadata such as camera details and GPS location.

After you send the form, I get an email with your details, without the files. You get an automatic confirmation with your request number. It contains nothing you typed in.

Protection against abuse: to stop programs from misusing the form for spam, I use three measures. First, an invisible field and a minimum time for filling in the form. Second, I limit how many requests can come from one connection. For this the server turns your IP address into an encrypted short value that expires automatically after one hour. Your IP address is not stored with your request. Third, when the page loads, your browser fetches a small puzzle from my server and solves it in the background. No cookies are set, nothing is read from your device and nothing is sent to third parties. The legal basis is my legitimate interest in a secure form (Art. 6(1)(f) GDPR).

If you email me directly, section 7 applies.

7. Email

My email inboxes are hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. I have a data processing agreement with IONOS. Transfer is encrypted with TLS where your provider supports it. Please don’t send me particularly sensitive data by email.

Notifications and confirmations from the request and contact forms are sent by my website through a separate IONOS mailbox. I don’t send newsletters or advertising.

8. Orders, invoices, shipping and photos

If your request becomes an order, I also process your billing address and, for shipping, your delivery address. For delivery I pass your name and delivery address to the parcel service I ship your piece with. The parcel service only gets your email address if you ticked “Delivery updates from the parcel service” on the request form. It then sends you tracking updates directly (legal basis: your consent, Art. 6(1)(a) GDPR). You can withdraw it at any time by emailing me, for all later shipments. Without the tick I send you the tracking number myself. I don’t pass on a phone number. If you collect your piece, none of this applies. The legal basis is Art. 6(1)(b) GDPR, and for keeping invoices Art. 6(1)(c) GDPR.

Payment is by bank transfer in advance. I process the details of your transfer that reach me (name, IBAN, amount, reference). I don’t offer other ways to pay, such as cash or online payment services. No payment service is embedded on the website.

I only pass on invoices and accounting records where the law requires it, for example to the tax office during an audit (Art. 6(1)(c) GDPR).

Photos of your piece: I only show a photo of your finished piece on my website or on social media if you agree first (Art. 6(1)(a) GDPR). You can withdraw your consent at any time by email. I then remove the photo from the website and from my profiles. Anything published before you withdrew stays lawful. I never show your own photos or files.

9. How long I keep data

Server log files

14 days

Cookie pll_language

1 year, or until you delete it

Light/dark choice s3d-theme (only in your browser)

Until you delete it in your browser

Requests and files from the form without an order

90 days after they were last handled, then deleted automatically

Emails about requests without an order

6 months after my last message, then deleted

Encrypted short value of the IP address (spam protection)

1 hour

Requests, files and correspondence with an order

until the warranty period ends, usually 3 years after delivery

Invoices and accounting records

7 years (§ 132 Austrian Federal Fiscal Code, BAO)

Photos of your piece on the website and social media

until you withdraw your consent

If you want me to delete your request sooner, tell me. Anything I must keep by law, I block instead of deleting.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20).

Where I process data based on my legitimate interest, you can object at any time (Art. 21 GDPR). I then stop, unless I have compelling grounds, such as fending off an attack.

If you gave me your consent, you can withdraw it at any time (Art. 7(3) GDPR). The withdrawal applies from then on; what happened before stays lawful.

Write to office@3d-stratum.com. I reply within one month. So I don’t hand data to the wrong person, I may check that the request really comes from you.

There is no automated decision-making or profiling.

11. Complaints to the data protection authority

If you think I am not handling your data correctly, please write to me first. You also have the right to complain to the supervisory authority (Art. 77 GDPR). In Austria that is:

Österreichische Datenschutzbehörde (Austrian Data Protection Authority)
Barichgasse 40–42
1030 Vienna
Austria
Email: dsb@dsb.gv.at
Web: www.dsb.gv.at

12. Changes

When something changes on the website or in how I work, I update this policy. The version on this page applies. My legal notice is here.