Privacy Policy

Who we are

This website and shop are run by Matrix3D.shop, a sole proprietorship (eenmanszaak) registered in the Netherlands. We decide how and why the personal data on this page is used, which makes us the controller under the GDPR (in Dutch: AVG). Our details:

Trade name

Matrix3D.shop

Address

De Harken 4
8423VL, Makkinga
The Netherlands

E-mail

contact@matrix3d.shop

Phone

+31649596704

VAT

No VAT charged (KOR)

Questions about your data or this policy? Contact us by e-mail at contact@matrix3d.shop, or call us on +31649596704. We have not appointed a data protection officer, because the law does not require one for our activities; the owner handles every privacy question personally.

In short

• We collect what we need to sell and deliver your order, answer your questions and keep the site safe.
• Payment and delivery partners (Stripe, PayPal, PostNL) receive what they need for your order.
• The site runs on our own server in the Netherlands, behind Cloudflare. Our e-mail and file downloads run on our own servers too.
• Statistics tools (Microsoft Clarity and Jetpack Stats) only run if you allow statistics in the cookie banner.
• A few services reach other companies without asking first, such as Google Fonts, the spam protection on our forms, PayPal’s fraud check and automatic translation for visitors whose browser uses another language (never on checkout, account or order pages). They are all listed below.
• Our software checks its licence key with our own licence server; what it sends and how long we keep it is under “Licence checks and updates”.
• We never sell your data, and you can ask us to see, correct or delete it.

What we collect and why

For each purpose below you find what we collect, why, and the legal basis under the GDPR. The legal bases are: contract (we need the data to carry out your order or request), legal obligation (for example tax law), legitimate interest (a reasonable interest of ours that does not outweigh your privacy) and consent (you said yes, and you can withdraw that at any time). How long we keep everything is in the table further down.

Visiting the website

Every visit passes through Cloudflare, which protects and speeds up the site, and then reaches our own server. Both process your IP address, the page you request, your browser and device type and the page you came from. Our proxy server keeps these access logs for about five weeks and its error logs for about ten weeks; the web server’s own log is overwritten automatically after a short time. Logins (successful and failed), new customer accounts and similar security events are logged with the IP address, the username and the country, to spot attacks. Legal basis: legitimate interest (a safe, working website).

Some small files are stored in your browser because the site needs them, for example your cart, your cookie choices and your chosen currency or language. See the cookie policy.

Recently viewed products: to show the products you looked at, our theme keeps the last 12 (name, link, picture and price) in your browser’s local storage (m3d_recently_viewed), without asking first, until you clear your browser data. This list is not stored on our server. Legal basis: legitimate interest (making browsing easier).

Orders and customer accounts

When you order, we store your name, billing and delivery address, e-mail address, phone number if you give it, what you ordered, the payment method and payment status, and the IP address and browser used for the order, to spot fraud. With an account we also store your login details and order history. We need these details to carry out your order; without them we cannot accept it. Your phone number is optional. Legal basis: contract; for invoices and bookkeeping, legal obligation; for the IP address and browser, legitimate interest (fraud prevention). To apply the right VAT rules and keep our tax records, our own tax tool, which runs on our own server, uses the country of your delivery address (for downloads, your billing address) and, if you buy as a business, your company name; legal basis: legal obligation.

Track my order: on our Track my order page you can see the status of an order by typing its order number and the e-mail address used for the order. We do not store what you type there. To stop people guessing, we count tries per connection and per order number, using scrambled (hashed) forms of your IP address and the order number that are deleted after at most an hour. The page shows the status, the items and the track & trace code, never your address or payment details. Legal basis: contract and legitimate interest (keeping your order details safe).

We have switched order attribution off and removed what it had stored with earlier orders and customer accounts (how the buyer reached us: source type, campaign tags and browser identification). Copies remain only in our backups, and are deleted with them at the latest about 12 months after the removal.

Gift cards: when you buy a gift card for someone else, we store the name and e-mail address of the recipient, your message, the send date and your first name (shown on the card as “from …”), so that we can e-mail the card on the date you chose and send the recipient one reminder a month before it expires if there is still money on it. If you send the card to yourself, we use your own details. We store the code of a card only in a scrambled (hashed) and an encrypted form, never as plain text. For each card we keep the amount, the balance and its history (when it was used, returned or changed, and for which order) as part of our bookkeeping. On our gift card balance page you type a code to see its balance; we do not store what you type there, and to stop people guessing we count tries per connection and per code, using scrambled forms that are deleted after at most an hour. Legal basis: contract (with the buyer), legitimate interest (getting the gift to the person it is for) and, for the history of the card, legal obligation.

Payments

Payments are handled by Stripe and PayPal. We never see your full card or bank details; we only receive the payment status and basic details such as the payment method used.

Through Stripe you can pay by card (also with Apple Pay or Google Pay), iDEAL | Wero, Bancontact, EPS, Przelewy24, Klarna, Link, Multibanco, Alipay and WeChat Pay. Through PayPal you can pay with PayPal or PayPal Pay Later.

To prevent fraud, Stripe’s scripts on the cart and checkout pages collect device and browser signals and set cookies such as __stripe_mid and __stripe_sid; as part of that check Stripe can run an invisible hCaptcha test (from Intuition Machines), which sets its own cookies on hcaptcha.com. PayPal’s scripts load on product, cart and checkout pages. They show the PayPal buttons and run PayPal’s fraud check, which collects details about your device and browser (a device profile) and your IP address, and PayPal may set its own cookies, even if you do not pay with PayPal. If you choose to pay later with Klarna, Klarna may check your creditworthiness; it does so as a controller under its own privacy notice. Legal basis: contract; for fraud prevention and the payment buttons, legitimate interest.

Delivery

PostNL delivers our parcels. It receives the name and address on the label and, if we add them, your e-mail address or phone number for delivery updates. The tracking link in our e-mail leads to PostNL’s website. For parcels abroad, PostNL passes the label and customs details to the postal service and customs in the destination country, also outside the EU; this is necessary to deliver your parcel. Legal basis: contract.

Downloads, software and licence keys

Download files come from our own servers (the website itself or our Nextcloud file server), which, like any web server, log the requests they receive, including the IP address.

For software we store your licence key with your order, the websites or devices where you activate it, and a history of activations; how the software checks the key is described under “Licence checks and updates” below. Before a yearly licence ends, we send you a reminder e-mail. Legal basis: contract.

Licence checks and updates

Our apps and WordPress plugins check their licence key with our own licence server, which runs on this website, and ask it whether a new version is out. What they send:

• Apps and WordPress plugins: the licence key, the product, the software version, a random device ID that the software creates and, for WordPress plugins, the website address. Plugins check at most about once an hour.
• Like any internet connection, every check also shows our server the IP address it comes from, and we note the time of each check.

We use this data to activate your licence and count its websites or devices, to show them to you under My account → Licence keys, to send update notices and fixes, and to spot keys that are shared. Without the online activation, a paid key does not unlock the paid features or the updates. Legal basis: contract for the activation, the count, the list in your account and the update checks; legitimate interest (preventing misuse of our licences) for the log of these checks. If a key looks shared, a person looks at it; nothing is blocked automatically on that basis, and you can object to this use (see “Your rights”).

The licence server is part of this website, so the data stays on our own server in the Netherlands; Cloudflare passes the requests on, as it does for every visit (see “Who receives your data”). We do not share or sell it. How long we keep it is in the table under “How long we keep data”. We add nothing to what our software sends without changing this policy first.

Found a security problem in our software? Please report it as our security page explains, or e-mail support@matrix3d.shop. Questions about this policy and your privacy rights go to contact@matrix3d.shop.

Proof of delivery for downloads and licence keys

When an order contains downloads or licence keys, we keep proof that we delivered them as agreed: your checkout confirmation that you wanted them delivered straight away (the exact text, the version of our terms, the date and time, and the IP address and browser of that request), when the order e-mails with that confirmation were sent, each download of your files (date, time and IP address), the activations and checks of your keys, and any refund, withdrawal or payment dispute. If one download link is used from many different networks within a few days, we get a private note so that a person can check whether it was shared; nothing is blocked automatically. In a payment dispute (a chargeback) we give Stripe or PayPal the proof they ask for, such as dates, the confirmation, downloads and activations, without your address or your full key. While a dispute or a legal claim about an order is open, we keep its proof, also if you ask us to erase your data. Legal basis: legitimate interest (proving delivery, defending legal claims and preventing fraud).

Contact and quote forms

Our contact form and print-service form ask for your name, e-mail address, subject and message, and let you upload files such as photos or 3D models. The form also stores your IP address. If we make you a quote, we keep it with your request. Legal basis: contract (a quote or order you ask for) or legitimate interest (answering your question).

Instant 3D print quote: when you upload a 3D model on our Instant 3D print quote page, we store the file on our own server, in a folder that cannot be opened from a browser, to work out the price and, if you order, to print it. The price is worked out on our own server: the slicer software runs there in a closed-off process without internet access, and your file is not sent to anyone else. We do not ask for your name on that page. If you ask us to e-mail you the quote, we keep your e-mail address with that quote and use it only for that e-mail. A file nobody gets a price for is deleted after a day; a file whose quotes are never ordered when those quotes expire (after 14 days); files and quotes of orders that are not paid, fail, are cancelled or are refunded 30 days after that — nothing you do not pay for is kept longer than 30 days. If you order, the quote stays with the order records and the file is kept until 24 months after delivery, so we can handle a guarantee claim. To stop misuse we count uploads, file sizes, prices, slicing time and quote e-mails per connection and per e-mail address, using scrambled (hashed) forms of your IP address and e-mail address that are deleted after at most two days; with an uploaded file we keep a scrambled form of your connection (so that uploading your own file again is not counted twice) until the file is deleted or you order. Legal basis: contract (the quote and the order you ask for) and legitimate interest (keeping the service safe).

To show your print in your cart and order, we draw a small picture of your model from the file; it has no public address and is deleted together with the file.

If you request a filament we do not have in stock, the type, colour and colour name or description you enter are kept with your quote and your order, to order that filament and to print it, for as long as the quote and the order are kept (see above).

The forms are protected against spam with Google reCAPTCHA v3. Its script loads as soon as a page with a form opens and sends Google your IP address, browser details and how you interact with the page, so Google can tell people from bots; Google may set or read its own cookies for this. Google acts as our processor for this: it may use the data only to provide and secure this protection against spam, fraud and abuse, not for its own purposes. Legal basis: legitimate interest (keeping spam out).

Returns, withdrawals and complaints

When you withdraw, return something or complain, we keep your message, the order it concerns and what we did about it. If you use our online withdrawal function, we store your name, e-mail address, order number, the items you name and the date and time you sent it, and we e-mail you a confirmation. Legal basis: legal obligation (consumer law) and contract. Kept with the order records.

Custom work and our portfolio

We may show photos of custom work in our portfolio, without your name or other personal details. Legal basis: legitimate interest; you can object at any time, and for anything that shows a recognisable person we ask first.

E-mail

Our e-mail runs on our own mail server. We send order and account e-mails, licence reminders and answers to your messages. About a week after we complete your order, we send one e-mail asking for a review, and our order e-mails may suggest a few other products. Those two are marketing, so each of them says how to stop it: reply “stop” and we send you no more review requests or product suggestions; you can also just tell us. The e-mails about your order and account themselves keep coming, because they are part of your order. We send no newsletters; new-version e-mails, back-in-stock e-mails and event-deal e-mails go only to people who ask for them (see below). Legal basis: contract; for the review request and the product suggestions, legitimate interest, within the Dutch rules for e-mail to existing customers.

New-version e-mails: on the page of one of our apps or plugins you can ask us to e-mail you when a new version comes out. We then keep your e-mail address, the product and when you confirmed. We send nothing else until you confirm with the link in our first e-mail; an address that is not confirmed within 7 days is deleted. After that you get one e-mail per new version of that product, each with a link that unsubscribes you at once, and unsubscribing deletes your address. Customers can also switch this on or off under My account → Licence keys. Legal basis: your consent, which you can withdraw at any time.

Back-in-stock and event-deal e-mails: on the page of a sold-out item you can ask us to e-mail you once when it can be ordered again, and on our home page you can ask us to e-mail you when our next event deal starts (a few times a year, during events, part of the shop goes on sale for a short time; this is a marketing e-mail). We then keep your e-mail address, the item (or “event deals”), when you asked and confirmed, when we last e-mailed you and which consent text you ticked — no name and no IP address. We send nothing until you confirm with the link in our first e-mail; an address that is not confirmed within 7 days is deleted. A back-in-stock e-mail is sent only once, and your address is then deleted from that alert; event-deal e-mails come once per event deal until you unsubscribe. Every e-mail has a link that unsubscribes you at once, and unsubscribing deletes your address. To stop misuse of these forms we count attempts per connection and confirmation e-mails per address, using scrambled (hashed) forms of your IP address and e-mail address that are deleted after at most a day. Legal basis: your consent, which you can withdraw at any time.

Our e-mails use a typeface from Google Fonts. If your e-mail program loads images and fonts, opening the e-mail makes it contact Google, which then sees your IP address.

Reviews

Customers who bought a product can review it while logged in to their customer account. With your review we publish the display name of your customer account (you can change it under My account → Account details), your star rating, your text, the date and a “verified owner” badge. Your e-mail address is never shown. We also store your e-mail address with the review, so we can contact you about it; it is not published. We check against our orders that you bought the product: that is what the “verified owner” badge means. Legal basis: legitimate interest (honest reviews that help other customers).

Review photos: you can add up to 3 photos to a review. Before we store a photo we remove the hidden data in it, such as the camera details and the place where it was taken (GPS), make it at most 2000 pixels on its long side and give it a random file name. A review with photos is published only after we have checked it; the photos are published with it, and are deleted when the review is deleted or when we erase your data at your request. To stop misuse we count uploads per connection, using a scrambled (hashed) form of your IP address that is deleted after an hour. Please do not upload photos of other people without their permission. Legal basis: legitimate interest (honest reviews that help other customers).

Like other site content, reviews, with the name and e-mail address stored with them, are copied to WordPress.com through Jetpack (see “Site management (Jetpack)” below). When a review is posted, our shop software (WooCommerce) also sends the reviewer’s name, the review text and the web address of their profile picture on Gravatar (which contains a scrambled form of their e-mail address) through WordPress.com (Automattic) as a notification to the owner’s WooCommerce app. Legal basis: legitimate interest (handling new reviews quickly).

Your review stays online until you ask us to remove it, or until we remove the product or stop offering reviews. If we refuse, hide or remove a review under section 17 of our terms and conditions, we e-mail you the reason.

If you report a review (section 17 of our terms), we keep your name, e-mail address and reason, the review concerned and our e-mails about it, as long as we need them to handle the report and at most 12 months. Legal basis: legal obligation (the EU Digital Services Act asks us to handle such reports) and legitimate interest.

About a week after we complete your order we may e-mail you once to ask for a review (see “E-mail” above). If you reply “stop” or tell us you do not want these e-mails, we put your e-mail address on a do-not-send list, which also stops the product suggestions in our order e-mails. We keep it only to respect your choice, as long as that is needed. When we erase your personal data at your request, we keep only a scrambled (hashed) form of your e-mail address on this list, so that no review e-mail reaches you afterwards. Legal basis: legitimate interest, and for the do-not-send list our legal obligation to respect your objection.

Statistics, only with your consent

If you allow statistics in the cookie banner, we use:

• Microsoft Clarity, which shows us how our pages are used: heatmaps and session recordings of clicks, scrolling and mouse movements, plus the pages you view, your device and browser and an approximate location derived from your IP address. It sets the cookies _clck (1 year) and _clsk (1 day) on our site, and Microsoft may set its own cookies on its Clarity domains. Clarity is never used on the checkout, order and account pages, and our server never reports your visits while you are logged in. With your consent, our server also tells Clarity the address of the other pages you open (without the part after the “?”), with your IP address and browser. We have switched off Clarity’s advertising features: Microsoft does not use this data for ads on our behalf.
• Jetpack Stats (Automattic, the company behind WordPress.com), which counts page views. It receives the page address, the page you came from, your browser and your IP address.

Without your consent neither tool runs for you. You can change or withdraw your choice at any time through the cookie settings (the “Manage consent” link in the footer) or on the cookie policy page. Legal basis: consent.

Separately, our server reports visits by known search-engine and AI crawlers to Clarity, so we can see how these automated programs use the site. This concerns bots, not people.

Fonts, translation and embedded media

Some parts of our pages load from other companies’ servers. Your browser then contacts those servers, which see your IP address and browser details:

• Fonts: our typefaces load from Google Fonts on every page.
• Translation: the language switcher (GTranslate) translates pages with Google Translate. If your browser language is one of the languages we offer other than English, for example Dutch or German, the page is translated automatically on your first visit; otherwise only when you pick a language. The page text is then sent to Google Translate, and your language is remembered in your browser (cookie googtrans, local storage gt_autoswitch). Translation is switched off on the checkout and on your account and order pages, so your personal details are never sent to Google Translate.
• Videos: product videos come from YouTube in privacy-enhanced mode (youtube-nocookie.com) and only play after you click. Preview images come from YouTube’s image server. After you press play, YouTube (Google) may set cookies.
• 3D viewers: interactive 3D models come from Sketchfab and only load after you click. The preview images come from Sketchfab’s servers.
• Flags: the currency switcher, shown on our pages, loads the flag of the selected currency from flagcdn.com.

Legal basis: legitimate interest (a consistent design and the site in your language); for playing a video or opening a 3D viewer, your click.

Currency and country

To show prices in your currency and estimate your country, our server uses the country Cloudflare already determined for your visit, or looks up your IP address in a local database (MaxMind GeoLite2). Nothing extra is sent to another company for this. Exchange rates come from the European Central Bank; that request contains no visitor data.

Seasonal games, site search and missing pages

For the small games during seasonal events, the games put a random ID in a cookie in your browser (m3d_visitor, 1 year). We store that ID, a scrambled (hashed) form of your IP address, the game result and any discount code you won, so plays are counted fairly. When you use the site search, we count the search words, without IP address or account, to improve the shop; please do not type personal details into the search box. When a page cannot be found, we log its address, the page you came from and your browser type, without IP address. Legal basis: legitimate interest.

Site management (Jetpack)

Our site is connected to WordPress.com (Automattic, USA) for management and login security. Jetpack copies site content, order summaries (city, postcode, country, totals and payment method, without names or e-mail addresses) and, for customer accounts, your username, display name and e-mail address to WordPress.com. At login, Jetpack also checks passwords against lists of known leaked passwords. Legal basis: legitimate interest (a secure, manageable site).

Tools on our own server

These run on our own server and share no customer data with anyone: the shop software, the forms, the cookie banner, the security log, our SEO tools, the licence manager, invoices and quotes, and the slicer that works out the price of a 3D model for the Instant 3D print quote. Our own AI server, which helps us write product and SEO texts, only receives product texts, never customer data. The product feeds for Google Merchant Center and Pinterest and our automatic product posts on X contain product information only.

No automated decisions

We do not take decisions about you based only on automated processing, and we do not build profiles of you. Payment providers may run automated fraud or credit checks under their own responsibility.

Cookies

The cookie banner offers two categories: functional, which is always on because the site needs it, and statistics, which stays off until you allow it. We use no advertising cookies or ad trackers, so the banner does not ask about marketing. YouTube videos and Sketchfab 3D viewers only start after you click them; the cookie policy lists them under marketing because YouTube and Sketchfab may then set their own cookies. Your choice is stored for 12 months in cookies in your browser (cmplz_…); we keep no copy on our server. You can change it at any time with the “Manage consent” link in the footer of our pages. The cookie policy lists the cookies in detail.

Without a choice in the banner, some services described above set or read cookies or keep data in your browser: the payment scripts, the spam protection on our forms, the translation switcher, the recently viewed products and the seasonal games.

Who receives your data

We share data only with the companies below, and only what they need for their task. We never sell your data. We also give data to authorities if the law requires it.

Company	What for	Where
Cloudflare, Inc.	Security, caching and speed for every visit and every licence check; hides e-mail addresses from spam bots	USA, with servers worldwide including the EU
Stripe (Stripe Payments Europe, Ltd.)	Card and local payment methods, fraud prevention; in a payment dispute, our proof of delivery	Ireland, with Stripe, Inc. in the USA
Klarna Bank AB	Paying later, only if you choose it; Klarna is its own controller	Sweden
Alipay and WeChat Pay (through Stripe)	Only if you choose these payment methods	China
PayPal (Europe) S.à r.l. et Cie, S.C.A.	PayPal payments and Pay Later; the button and fraud-check scripts on product, cart and checkout pages; in a payment dispute, our proof of delivery	Luxembourg
PostNL	Delivery and track & trace	The Netherlands; for parcels abroad also the postal service and customs of the destination country
Microsoft Ireland Operations Limited (Clarity)	Statistics, only with your consent. Microsoft also decides itself how it uses this data for its own purposes (independent controller); see the Microsoft Privacy Statement	Ireland, with Microsoft Corporation in the USA
Automattic Inc. (Jetpack, WordPress.com)	Jetpack Stats, only with your consent. The Jetpack connection for managing the site and login security: it copies site content (including reviews), order summaries (without names or e-mail addresses) and the username, display name and e-mail address of customer accounts, and checks passwords against known leaks. WooCommerce app notifications: the name and text of new reviews	USA
Google (Google Fonts, reCAPTCHA, Google Translate, YouTube)	Fonts on our pages and in our e-mails, spam protection on our forms, translation and videos	Ireland and the USA
GTranslate	The translation switcher script	USA
Sketchfab (Epic Games)	Interactive 3D viewers	France and the USA
flagcdn.com	Flag images in the currency switcher	Servers worldwide

Everything else, including the website and its database, our e-mail, the file downloads, the backups and our AI helper, runs on our own servers in the Netherlands.

Transfers outside the EU

Some of these companies are based in the United States or use servers there. For transfers to the US we rely on the EU-US Data Privacy Framework where the company is certified under it, or otherwise on the European Commission’s standard contractual clauses. PayPal uses binding corporate rules within its group. If you pay with Alipay or WeChat Pay, your payment data goes to China, and parcels to countries outside the EU carry your delivery details to that country, because that is needed to carry out the payment or delivery you chose. Ask us which safeguard applies to a specific company and we send you the details.

How long we keep data

Data	How long
Orders, invoices and payment records	7 years, as Dutch tax law requires
Gift cards: the name and e-mail address of the recipient, the message and the first name of the buyer	Until 12 months after the card has been used up, refunded or has expired; then they are deleted. The amounts and the history of the card stay with the order records (7 years)
Customer account	Until you ask us to delete it. Orders and licences linked to it stay as long as the order records
Licence keys, and the websites or devices they are activated on	As long as the licence exists; a website or device you release is removed straight away. When a licence ends, its key data is deleted at the latest 12 months later, apart from what the order records must keep
IP addresses of licence checks	The licence server does not keep them (it uses a scrambled form for about a minute to limit repeated requests); they are in the proxy logs (see below)
Update checks and the licence server log	At most 12 months
New-version e-mails	Until you unsubscribe; an address that is not confirmed is deleted after 7 days
Back-in-stock and event-deal e-mails	Back in stock: until we have sent you its one e-mail, or until you unsubscribe. Event deals: until you unsubscribe. An address that is not confirmed is deleted after 7 days
Proof of delivery for downloads and licence keys	With the order records; the IP addresses in it are shortened after 26 months, except while a dispute or legal claim about the order is open
Checks of keys or files that may have been shared	Until the check is closed
Contact and quote messages, uploaded files, and the IP address stored with them	Up to 24 months after our last contact about your request; if it leads to an order, as long as the order records. Ask us and we delete yours sooner
Instant 3D print quotes: the 3D model you uploaded, your choices and, if you asked for the quote by e-mail, your e-mail address	Not ordered: deleted after 1 day (no price made), when the quote expires (14 days), or 30 days after an unpaid, cancelled or refunded order — never longer than 30 days. Ordered: the quote with the order records (7 years); the model file until 24 months after delivery
Withdrawals, returns and complaints	With the order records
Reviews, with their photos and the e-mail address stored with them	Until you ask us to remove your review, or until we remove the product or stop offering reviews
Reports about reviews	As long as needed to handle the report, at most 12 months
Do-not-send list for review e-mails and product suggestions (“stop”)	As long as needed to respect your choice; after we erase your data at your request, only a scrambled (hashed) form of the address
Security log (logins and account events)	90 days
Counters against repeated tries on our forms (Track my order, alerts, review photos, instant print quotes): scrambled forms of the IP address, order number or e-mail address	At most a day
Proxy logs	Access logs about 5 weeks; error logs about 10 weeks
Backups	Up to about 12 months, then deleted
Your cookie choice	12 months, in your browser
Recently viewed products	In your browser until you clear your browser data
Clarity statistics (with consent)	Kept by Microsoft: recordings 30 days; heatmaps, and recordings marked as favourite or picked as a random sample, up to 9 months
Game plays (random ID, hashed IP, result, discount code)	Until the end of the event, and at most 12 months; the random-ID cookie stays in your browser for 1 year
Search words and missing-page log	Contain no personal data; the missing-page log keeps the last 100 entries

Security

The whole site uses HTTPS, and browsers are told to always use it (HSTS). Cloudflare filters attacks before they reach our server, the login page is not at the standard address, and failed logins are logged. Only the owner manages the admin area and the server. Our backups are encrypted. Payment details never reach our server.

No system is perfectly safe. If a data breach puts your data at risk, we inform you and the Autoriteit Persoonsgegevens as the law requires.

Your rights

You have the right to:

• see the personal data we hold about you and get a copy;
• have incorrect data corrected;
• have your data deleted, unless we must keep it by law (for example order records for the tax authorities);
• have the use of your data restricted;
• receive data you gave us in a common digital format, or have it sent to someone else;
• object to uses based on legitimate interest (see below);
• withdraw your consent at any time, without affecting what happened before.

Right to object. Where we rely on legitimate interest (for example security logs, spam protection, the review e-mail), you can object at any time. For e-mail we then stop immediately; for the rest we stop unless we have compelling reasons.

E-mail contact@matrix3d.shop to use these rights. We answer within one month and may ask you to confirm who you are. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the authority in the EU country where you live.

Children

Our shop is not aimed at children under 16. We do not knowingly collect their data. If you think we did, contact us and we delete it.

Changes

We update this policy when our shop or the law changes. The date at the top shows the latest version. For important changes we also inform account holders by e-mail.

Contact

Send questions, requests or complaints about privacy by e-mail to contact@matrix3d.shop, or call us on +31649596704. Our company details are at the top of this page.