← 3dconfig.co.uk

Privacy Policy

Information under Art. 13 / 14 GDPR

1. Controller

Vladislav Tongaliuk — 3D Config
Wuhlestraße 7a, 12683 Berlin, Germany
Phone: +49 152 06338007
E-mail: studio@3dconfig.co.uk

No data protection officer has been appointed; the statutory conditions (Art. 37 GDPR, § 38 BDSG) are not met for this sole proprietorship.

2. Hosting and server logs

This website runs on Cloudflare, Inc. (Cloudflare Workers, D1 database, R2 object storage). On access, technically necessary connection data is processed — in particular IP address, timestamp, requested resource, status code and user agent. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is the secure and stable operation of the site. A data processing agreement under Art. 28 GDPR is in place with Cloudflare.

Fonts are served exclusively from this server. There is no embedding of Google Fonts, and no advertising or tracking network is loaded on any page.

Two categories of static file are delivered by a content delivery network rather than from this server: the illustration image sequences used on the home page, and the 3D engine files of the configurator at /Demo/. These are delivered by BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia (bunny.net). When your browser requests one of these files, your IP address, the time of the request, the requested file and your user agent are processed by that provider in order to deliver the file to you. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is fast and reliable delivery of large static files. A data processing agreement under Art. 28 GDPR is in place. BunnyWay d.o.o. is established in the European Union, so this delivery involves no transfer to a third country.

3. Project request (form at /quote)

When you submit a project request, I process:

The purpose is to handle your enquiry and prepare a quote. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures). Uploaded files are stored in object storage (Cloudflare R2); the remaining data in a database (Cloudflare D1).

Retention: enquiries that do not lead to a contract are deleted after at most 24 months; uploaded 3D / CAD files are deleted automatically after 14 days unless a contract results. If a contract is concluded, commercial and tax retention periods apply.

4. Spam protection (Cloudflare Turnstile)

To protect the form from automated submissions I use Cloudflare Turnstile. Technical characteristics of the access and your IP address are transmitted to Cloudflare. The legal basis is Art. 6(1)(f) GDPR (prevention of abuse and spam). Turnstile works without user tracking and without advertising cookies; any storage access serves security only and is therefore exempt from consent under § 25(2) no. 2 TDDDG.

5. Abuse limitation

To limit bulk submissions, your IP address is stored only as a hash and only temporarily; reconstruction of the plain-text IP is not intended. Legal basis: Art. 6(1)(f) GDPR.

6. E-mail delivery

Confirmation and notification e-mails are sent via Resend (Resend, Inc., USA). The data required for delivery is transmitted (e-mail address, name, content of the enquiry). The legal basis is Art. 6(1)(b) GDPR. A data processing agreement is in place; transfer to the USA relies on the EU-US Data Privacy Framework or, in the alternative, standard contractual clauses. No counting or tracking pixels are used in the e-mails.

7. Contact by e-mail or phone

If you contact me, I process your details to handle your request. The legal basis is Art. 6(1)(b) GDPR for contract-related enquiries, otherwise Art. 6(1)(f) GDPR.

8. Business outreach and personalised demo links

I approach companies whose products a 3D configurator may suit. For this I process business contact data (company name, contact person, business e-mail, website) collected from publicly available sources — in particular the companies' own websites. This also serves as the notice under Art. 14 GDPR. The legal basis is Art. 6(1)(f) GDPR (interest in initiating business contact in a B2B context).

For outreach I sometimes use personalised links of the form /demo/<company>. When opened, the fact and time of opening are logged to gauge the relevance of the outreach. There is no cross-device tracking and no profiling for advertising purposes.

Objection (Art. 21 GDPR): You can object to the outreach and logging at any time, informally — a short message to studio@3dconfig.co.uk is enough. I will then delete the data and keep your address only on a suppression list so that you are not contacted again.

9. Local storage in the browser

This website uses no analytics, advertising or tracking cookies. Your browser's local storage only holds display settings if you choose them yourself; in the protected admin area, additionally a login key. Both are necessary for the function you requested or concern the operator only, so no consent under § 25 TDDDG is required. There is therefore deliberately no cookie banner. You can delete this data at any time via your browser settings.

10. Postal processing at the business address

My business and imprint address (Wuhlestraße 7a, 12683 Berlin) is operated as a postal and delivery address through a service provider. Incoming mail is received there, digitised (scanned) and made available to me in a customer portal; originals are forwarded on request. In doing so, the personal data contained in the items (in particular sender details and content) is processed. The legal basis is Art. 6(1)(f) GDPR (efficient and confidential business correspondence while protecting my private address) or Art. 6(1)(b) GDPR for contract-related mail. The provider is Rivus Media GmbH (brand Firmenadresse.com), Hamburger Allee 61, 30161 Hannover, which processes the mail as a processor under Art. 28 GDPR and subject to postal secrecy (§ 39 PostG, § 206 StGB).

11. Recipients and third-country transfer

Data processing agreements under Art. 28 GDPR are in place with these providers. Where data is transferred to the USA, the transfer relies on the EU-US Data Privacy Framework or on standard contractual clauses under Art. 46 GDPR.

12. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing (Art. 21 GDPR). You can withdraw any consent given at any time with effect for the future.

To exercise these, contact studio@3dconfig.co.uk. You also have the right to lodge a complaint with the data protection supervisory authority competent for the controller's place of establishment in Germany.

13. Effective date

This privacy policy is updated whenever the processing or the legal situation changes.

This English version is provided for convenience. The provider is established in Germany and German law applies.