Privacy.

In just 5 points

Who are we?

Al-Mar Técnicas Ortopédicas S.L. (hereinafter, “3DS / 3DSquad”) is the party responsible for processing your personal data. This means that we decide how and for what purposes we use your data, undertaking to process it in a lawful, transparent and secure manner.

What do we use your data for?

We will use your personal data to manage your registration as a user, process your online orders and purchases, manage payments, shipments, returns and warranties, respond to your enquiries and quotation requests.

Why may we use your data?

We process your data because it is necessary to perform the sales contract when you place an order, to comply with legal obligations, to handle requests made by you and, in certain cases, because you have given us your consent or because there is a legitimate interest that supports such processing.

With whom do we share your data?

We may share your data with providers that supply services necessary for the operation of our business (technology platforms, payment gateway, transport companies, financial institutions, web hosting providers, etc.), as well as with Public Authorities where there is a legal obligation.

Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability of your personal data, as well as withdraw your consent at any time where the processing is based on it.

1. Data controller

In compliance with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD) and other applicable regulations, we inform you that the data controller is:

• Holder: Al-Mar Técnicas Ortopédicas S.L.
• Trade name: 3DS / 3DSquad
• Tax ID (CIF): B-81368656
• Registered office: Calle Río Tajuña, 22-24 — 28500 Arganda del Rey (Madrid)
• Email: almar3ds@gmail.com
• Website: https://3dsquads.com

2. For what purpose do we process your personal data?

Depending on how you interact with our website, we may process the following categories of data:

• Identification and contact data: name, surname, address, telephone, email, company name, tax IDs (CIF/NIF/VAT), etc.
• Financial and transactional data: payments, orders, returns, invoicing, etc.
• Technical order data: CAD files (STL, STEP, OBJ, 3MF) submitted for quotation or production, reference images for the “Image→3D” modelling service, technical specifications and associated notes.
• Browsing data and use of the website.
• Curricula vitae submitted through the channels enabled for this purpose.

As regards payment data, the full card details and payment methods are processed directly by the payment gateway (Stripe); 3DS / 3DSquad does not store the full card details.

Your data will be processed for the following purposes:

• Manage your registration as a user of the website, where such functionality exists.
• Manage the purchase of products and services made through our online store.
• Manage payments, shipments, deliveries, returns and warranties.
• Manage enquiries, quotation requests, information requests and customer service.
• Send communications relating to your orders or contracted services.
• Comply with legal, tax, accounting and consumer obligations.
• Manage applications in selection processes.
• We do not send commercial communications or newsletters. Should we do so in the future, we would ask for your consent or, if you are already a customer, give you the option to object when collecting your data and in each communication (art. 21 LSSICE).
• Improve the quality, operation and security of the website.
• Prevent fraudulent use, unauthorised access or security incidents.

Automated decisions. The website performs an automated technical analysis of the CAD file you upload (volume, mesh integrity and dimensions) for the sole purpose of providing you with an instantly calculated price. This operation is purely technical, runs in your own browser and produces no legal effects on you, nor does it involve profiling. The final acceptance of any order always requires human intervention by our team.

Special categories of data (health data) — art. 9 GDPR. Our manufacturing service is a technical processing of geometry and is not intended to collect health data. We ask that you do not include personal health data (nor third-party personal data) in the files, images, file names or notes you send us, unless it is essential for the commission. If, due to the nature of a custom-made part (for example, an orthosis or an element of anatomical adaptation), it were necessary to process data that could be considered health data, such processing will be limited to what is strictly necessary to carry out your commission and will be based on your explicit consent (art. 9(2)(a) GDPR), which you give by voluntarily sending us that information and confirming the order. You may withdraw that consent at any time by writing to almar3ds@gmail.com.

3. Social media

3DS / 3DSquad maintains corporate profiles on various social networks. Users’ interaction with these profiles entails the processing of personal data in accordance with the privacy policies of each social network and with this Privacy Policy. The purpose is to manage the company’s corporate presence, provide information about products and services, respond to enquiries and maintain the relationship with users and followers.

4. Legal basis for processing

The processing of your personal data is based on the following legal grounds:

• Performance of a contract (art. 6(1)(b) GDPR): to manage orders, payments, shipments, returns, warranties and contracted services, as well as pre-contractual measures requested by the data subject (e.g. quotation requests).
• Compliance with legal obligations (art. 6(1)(c) GDPR): tax, accounting, commercial, consumer and any other applicable legal obligations.
• Consent of the data subject (art. 6(1)(a) GDPR): for analytics cookies and for any other processing that requires prior authorisation, which will be requested from you specifically.
• Legitimate interest (art. 6(1)(f) GDPR): to ensure the security of the website, prevent fraud and improve our services.

Where the requested data is mandatory for the provision of a service or the handling of a request, this will be expressly indicated. Refusal to provide it may prevent the proper handling of the request or the provision of the service.

5. Retention periods

Personal data will be retained only for the time necessary to fulfil the purposes for which it was collected and, thereafter, for as long as legal, contractual or any other type of liability may arise. In particular:

• Customer data: for as long as the business relationship exists and, once terminated, during the limitation periods applicable to tax, accounting and contractual liability obligations (generally, 6 years under the Spanish Commercial Code).
• Supplier and collaborator data: for the duration of the contractual relationship and, thereafter, during the periods required by tax, accounting and commercial regulations (generally 6 years).
• Candidate data (HR): a maximum of 1 year from receipt of the CV, unless there is express authorisation for a longer period or a request for withdrawal.
• CAD and design files provided by the customer: up to 24 months from the last production, in order to enable future reorders by the customer, unless there is a prior express deletion request. Files are stored temporarily in cloud storage (Vercel Blob) and, after a verified daily backup, kept on the company’s own equipment in Spain with restricted access; they are deleted from cloud storage within a few days.
• Data from enquiries and requests without a contract (leads): data from mere enquiries (chat, contact forms, quotation or information requests) that do not result in a contractual relationship will be retained for a maximum of 24 months from the last contact, unless there is a prior deletion request, after which it is deleted or anonymised.
• IP addresses for abuse control: only during the request rate-limiting window (minutes), with no other use.
• Data collected through cookies: in accordance with the periods specified in the Cookie Policy.

6. Recipients and processors

Your data may be disclosed to:

• Public Authorities where there is a legal obligation.
• Financial institutions and the payment gateway for the management of collections and payments. In particular, payments are processed through Stripe Payments Europe, Ltd.
• Transport and logistics companies for the delivery of orders (name, delivery address, telephone and email).
• Technology, web hosting, IT maintenance and ancillary service providers necessary for carrying out the business.

Specifically, we use the following processors (providers that process data on our behalf):

• Vercel Inc. (USA) — web hosting and aggregated usage analytics. International transfer covered by the EU-U.S. Data Privacy Framework and/or standard contractual clauses.
• Stripe Payments Europe, Ltd. (Ireland) — payment gateway. Certain data may be processed by Stripe, Inc. (USA) under the EU-U.S. Data Privacy Framework.
• Resend (Plus Five Five, Inc.) (USA) — sending of transactional emails (order confirmations, replies to enquiries). Transfer covered by standard contractual clauses.
• Neon Inc. — database where orders and messages are stored, hosted in the EU region (Frankfurt, Germany).
• Microsoft Ireland Operations Ltd. (Microsoft Clarity) — only if you accept analytics cookies: pseudonymised recording of browsing sessions (with masking of form fields) and heat maps to improve the website. We do not disclose your email or identifying data in clear form (a pseudonymised identifier is used). Transfer covered by the EU-U.S. Data Privacy Framework.
• Google Ireland Ltd. (Google Analytics 4) — only if you accept analytics cookies: statistical and aggregated measurement of website use (pages visited, traffic source, conversions). It runs with “Consent Mode” and uses pseudonymised (not anonymous) identifiers. It is also used to measure the effectiveness of our advertising campaigns, without personalised advertising or remarketing. Data may be processed by Google LLC (USA) under the EU-U.S. Data Privacy Framework.
• Vercel Inc. (Vercel Blob) (USA) — encrypted and private storage of the CAD files and images you provide for quotation or production, for a few days until they are backed up. Transfer covered by the EU-U.S. Data Privacy Framework and/or standard contractual clauses.
• Google Ireland Ltd. (Gmail) — the almar3ds@gmail.com mailbox in which we receive and answer orders, enquiries and files. Data may be processed by Google LLC (USA) under the EU-U.S. Data Privacy Framework.
• Cloudflare, Inc. (Email Routing) (USA) — forwarding to our mailbox of emails sent to addresses on the 3dsquads.com domain. Transfer covered by the EU-U.S. Data Privacy Framework and/or standard contractual clauses.
• Upstash, Inc. — when enabled, anti-abuse request rate-limiting service: it processes the IP address transiently, only during the control window. Any transfer is covered by standard contractual clauses.

Providers that process data on our behalf act as processors in accordance with art. 28 GDPR and their data processing terms. Where a provider is located outside the European Economic Area or may access data from outside it, the international transfer is based on an adequacy decision (EU-U.S. Data Privacy Framework) or on the standard contractual clauses approved by the European Commission; you may request a copy of these safeguards at the email address given in section 1.

7. Rights of the data subject

You may exercise the following rights free of charge:

• Access to your personal data.
• Rectification of inaccurate or incomplete data.
• Erasure of your data where applicable.
• Objection to processing.
• Restriction of processing.
• Data portability.
• Withdrawal of consent where the processing is based on it.

To exercise your rights you may contact us by email at almar3ds@gmail.com. Where necessary to verify your identity, we may request supporting documentation.

You also have the right to lodge a complaint with the Agencia Española de Protección de Datos (https://www.aepd.es) if you consider that the processing does not comply with the applicable regulations.

8. Third-party data and minors

If you provide personal data of third parties, you warrant that you have previously informed them of the content of this Privacy Policy and that you have sufficient legitimacy for such disclosure.

Purchasing requires being of legal age. We do not collect data from children under 14: if we detect that we have processed data of a child under that age without the consent of the holder of parental authority or guardianship, we will delete it (art. 7 LOPDGDD).

9. Confidentiality and security

3DS / 3DSquad adopts the technical and organisational measures necessary to guarantee the security, integrity and confidentiality of personal data, preventing its alteration, loss, unauthorised processing or access. These measures include, by way of example, encryption in transit (HTTPS), role-based access control, activity logging and the performance of regular backups. All personnel authorised to access personal data are subject to confidentiality and professional secrecy obligations.

10. Changes to the Privacy Policy

3DS / 3DSquad may modify this Privacy Policy where necessary to adapt it to legislative or case-law changes or to criteria of the supervisory authorities. Amendments will be published on this same website and will apply from their date of publication.