Data processing addendum
Last updated 29 September 2026
This addendum is part of the terms of service between [Registered legal name of the company that runs 3D Thing] ("we", the processor) and every customer who uses 3D Thing for their business ("you", the controller). It applies automatically; you do not need to sign anything. If you want a countersigned copy, write to [Legal notices email address (also the EU Digital Services Act point of contact)].
1. What it covers
It covers personal information we process on your behalf while providing 3D Thing to you ("customer personal data"), described in Annex 1. The information we collect about you as our own customer (your account, billing) is covered by our privacy policy instead, where we are the controller.
2. Your instructions
We process customer personal data only to provide 3D Thing as described in the terms, as you configure it, and on your other documented instructions, unless the law requires otherwise; in that case we tell you first unless the law forbids it. We tell you if we think an instruction breaks data protection law. You are responsible for having a lawful basis for what you collect through your links and for telling your clients about it.
3. Our people
Everyone we allow to access customer personal data is bound by confidentiality, and access is limited to what their job needs.
4. Security
We keep the technical and organisational measures in Annex 2, and may improve them but will not reduce the overall protection.
5. Sub-processors
You authorise us to use the sub-processors on the sub-processors page. We give each one data protection obligations at least as protective as this addendum and remain responsible for them. We update the page at least 30 days before adding one; you can object in that time on reasonable data protection grounds, and if we cannot resolve it you can end the affected service and receive a refund of prepaid fees for it.
6. Helping you
- Requests from individuals. The product lets you find, export and delete the feedback, designs and approvals on your projects. If an individual contacts us directly about customer personal data, we pass the request to you and do not answer it ourselves unless you ask us to or the law requires it.
- Assessments and regulators. We give you the information you reasonably need for a data protection impact assessment or a consultation with a regulator.
- Breaches. We tell you without undue delay, and within 48 hours of becoming aware of a personal data breach affecting customer personal data, with the details we have and updates as we learn more, so you can meet your own deadlines to notify regulators and people.
7. When the service ends
You can export customer personal data at any time. When you close your account or delete a project, we delete the customer personal data in it: an account 30 days after it is closed, and backup copies when the backups expire ([How many days database backups are kept before they are deleted]), unless the law requires us to keep something.
8. Showing that we comply
We make available the information needed to show we meet this addendum. If that is not enough, you may audit us, or have an independent auditor bound by confidentiality do so, once a year with 30 days' notice, during working hours, at your own cost, and in a way that does not expose other customers' data. A regulator may audit as the law allows.
9. International transfers
Where customer personal data about people in the EEA is processed in a country without an EU adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 apply and are incorporated by reference: Module 2 (controller to processor) where you are a controller and Module 3 (processor to processor) where you are a processor, with clause 7 included, option 2 of clause 9 (general authorisation, 30 days' notice), the optional wording in clause 11 left out, clauses 17 and 18 governed by and heard in the courts of Ireland, and the annexes completed by Annexes 1 and 2 below. For the UK, the International Data Transfer Addendum issued by the Information Commissioner applies to those clauses; for Switzerland, references to the GDPR are read as references to the Federal Act on Data Protection and the Federal Data Protection and Information Commissioner is the competent authority. If a clause in this addendum conflicts with the Standard Contractual Clauses, the clauses win.
10. Other laws
United States (CCPA and similar state laws)
We act as your service provider or processor. We do not sell or share customer personal data, retain, use or disclose it for any purpose other than providing 3D Thing to you (or outside our direct business relationship with you), or combine it with personal information from other sources except as those laws permit. We comply with those laws, give the same level of protection they require, and tell you if we can no longer meet them. You may take reasonable steps to stop unauthorised use. We certify that we understand these restrictions.
India (DPDP Act 2023)
We act as your data processor under a valid contract as section 8(2) requires. We process customer personal data only for the purposes you specify, keep the security safeguards section 8(5) requires, tell you of any personal data breach so you can inform the Data Protection Board and the people affected, and erase the data as you direct.
Brazil, and other countries
Where the LGPD or another data protection law applies to customer personal data, we process it as your processor (operador) on the same terms as this addendum, and follow any additional mandatory processor duties that law sets.
11. Liability and order of documents
Each party's liability under this addendum is subject to the limits in the terms, except where the law or the Standard Contractual Clauses do not allow a limit. If this addendum conflicts with the terms, this addendum wins for customer personal data.
Annex 1: the processing
| Parties | Controller (data exporter): you, the customer, with the contact details on your account. Processor (data importer): [Registered legal name of the company that runs 3D Thing], [Registered office address, in full], [Privacy email address for access, deletion and other data requests]. |
|---|---|
| People | Your clients and other people you send links to or invite; your team members; people named in files you upload. |
| Information | Names and email addresses given with feedback, approvals or invitations; feedback notes and attached photos; saved and approved design choices, including prices you set; the approval record; any personal information inside models and files you upload. No special category data is needed or requested. |
| Purpose and nature | Hosting, converting, displaying and delivering your content and the responses to it; sending notification emails you configure; security and support. |
| How often | Continuously, for as long as you use 3D Thing. |
| How long | Until you delete it or close your account, as set out in section 7. |
| Sub-processors | As listed on the sub-processors page, for the purposes shown there. |
| Supervisory authority | The authority of the EU member state where you are established, or of your EU representative, or the Irish Data Protection Commission where neither applies. |
Annex 2: security measures
- Encryption in transit (HTTPS/TLS) for every connection, and encryption at rest for stored model files and backups.
- Passwords, API tokens and link passwords stored only as one-way hashes (Argon2id for passwords).
- Sessions in HttpOnly cookies; scoped, revocable API tokens; closing an account revokes every token at once.
- Protected links deliver models as encrypted pieces with separately issued keys.
- Uploads checked for type and size; photos attached to feedback re-encoded, with location and camera data removed.
- Rate limits on sign-in and on public forms; access to production systems limited to the people who run them.
- Daily database backups kept in separate storage and deleted after [How many days database backups are kept before they are deleted].
- Unfinished uploads, expired sign-in links and orphaned files deleted automatically on a schedule.
- Visitors to published links are not tracked: view counts store no IP address or other identifier.