Privacy Policy

This policy describes how Twin Layer 3D s.r.o. processes the personal data you provide when requesting a quote, placing an order or communicating with us. We take protecting your data seriously and only process data we actually need.

Who is the data controller

The data controller is Twin Layer 3D s.r.o., Company ID: 24897507, with registered office in Mnichovo Hradiště, Czech Republic.

For data-protection matters, contact us at info@twinlayer3d.cz or on +420 737 358 171.

We have not appointed a Data Protection Officer (DPO) — we do not meet the conditions in Article 37 GDPR (we are not a public authority, we do not carry out large-scale systematic monitoring, nor large-scale processing of special categories of data).

What data we process

We only process data you provide yourself or that arises from our cooperation:

• Identification and contact data — name, e-mail, phone.
• Data from your inquiry or message — order description, your question.
• Company data (for business orders) — name, company ID, possibly VAT ID.
• The content of communication between you and us.
• Billing and payment data.
• Delivery address, where we ship the order via a carrier.
• 3D models and files you upload for printing — via the contact form or via the business portal after signing in. We store the files encrypted (AES-256-GCM) and scan them with antivirus software (ClamAV) before storing.

3D models and CAD files — special care

A purely geometric model of an object (a bracket, a part, an accessory) is generally not personal data. It becomes personal data where it is linked to an identifiable person — for example a name in the file name, metadata, or where it is a model of a specific person or a part of their body.

We therefore handle the files with care and assume they may contain personal data.

Where the file is a scan of a person or a part of their body, it may constitute a special category of personal data under Article 9 GDPR. We therefore accept such orders only by individual arrangement and on the basis of your explicit consent, which we will ask for in advance. Without it we do not process the scan.

Why we process data and on what legal basis

• Handling your inquiry and communicating with you — Article 6(1)(b) GDPR (steps taken at your request prior to entering into a contract). For questions not aimed at a contract, our legitimate interest in replying applies — Article 6(1)(f) GDPR.
• Carrying out the order — Article 6(1)(b) GDPR (performance of a contract).
• Processing uploaded 3D models and files — Article 6(1)(b) GDPR (performance of a contract). After the order is completed we retain them on the basis of our legitimate interest in defending potential legal claims during the liability-for-defects period — Article 6(1)(f) GDPR.
• Issuing and keeping invoices and accounting records — Article 6(1)(c) GDPR (compliance with a legal obligation under the Accounting Act).
• Debt recovery and defence of legal claims — Article 6(1)(f) GDPR (legitimate interest).

We use consent under Article 6(1)(a) GDPR only where we have no other legal basis. We do not need your consent to handle your inquiry or carry out your order — we rely on performance of a contract.

How long we keep data

• Invoices and accounting records — 5 years (Section 31 of Act No. 563/1991 Coll., on Accounting). We are not VAT payers; for a VAT payer the period for tax documents would be 10 years.
• Inquiries that did not lead to an order — 6 months from the last communication, then deleted.
• Data on completed orders — 2 years from handover of the work; this matches the period for notifying defects (Section 2618 of the Civil Code).
• Uploaded 3D models and files — for consumers, 2 years from handover of the work; for business orders, for the period agreed in the contract. After the period expires we delete the files.

Where a complaint or dispute is under way, we keep the related data until it is resolved.

We do not keep personal data longer than is necessary for the given purpose — the storage limitation principle under Article 5(1)(e) GDPR.

Who has access to the data

Only Twin Layer 3D s.r.o. — the founder and any future employees — has access, and only to the extent needed to handle your order. Access to the business portal is protected by two-factor authentication and access is logged.

Other recipients may be:

• WEDOS Internet, a.s. — hosting and e-mail provider (a processor under Article 28 GDPR).
• The carrier you choose for delivery (Zásilkovna, Czech Post, a courier service).
• An accountant, where our bookkeeping is handled externally.
• Public authorities, where required by law.

We do not sell personal data and do not pass it to anyone for marketing purposes.

Data location — no transfers outside the EU

For running the website and company e-mail we use the Czech provider WEDOS Internet, a.s. Your data is stored on servers in the Czech Republic / European Union.

We do not transfer personal data to countries outside the European Union, nor to international organisations.

Cookies and analytics

The public pages of the website set no cookies at all.

After signing in to the business portal or the administration, we use only technically necessary cookies required for the sign-in and its security. These cookies do not require consent — they fall under the exemption in Section 89(3) of Act No. 127/2005 Coll., on Electronic Communications (they are necessary for a service you explicitly requested).

We do not run any analytics — we do not track visits. We do not use Google Analytics or any advertising or tracking cookies.

That is why you won't find a cookie bar on this site — no consent is needed. If we deploy analytics in the future, it will be hosted on our own server and privacy-friendly; should it require consent, we will ask for it in advance.

Your rights

With regard to your personal data you have the following rights:

• The right to access the data we process about you (Article 15 GDPR).
• The right to rectify inaccurate data (Article 16 GDPR).
• The right to erasure, the "right to be forgotten" (Article 17 GDPR).
• The right to restrict processing (Article 18 GDPR).
• The right to data portability (Article 20 GDPR).
• The right to object to processing based on legitimate interest (Article 21 GDPR).
• The right not to be subject to automated decision-making, including profiling (Article 22 GDPR) — we carry out no such decision-making.
• The right to withdraw consent at any time, where consent is the legal basis.
• The right to lodge a complaint with the Office for Personal Data Protection (ÚOOÚ, uoou.gov.cz).

How to exercise your rights

Write to us at info@twinlayer3d.cz. We will respond without undue delay and at the latest within 1 month of receiving your request. For complex requests we may extend the period by a further 2 months — we will inform you of the extension and its reasons (Article 12 GDPR). Handling is generally free of charge.

Providing your data

Providing contact and billing data is a contractual requirement — without it we cannot carry out your order or issue an invoice. Any other data you provide voluntarily.

Changes to this policy

We may update this policy in the future (e.g. when we add further services). The current version is always available on this page.