Privacy.

In just 5 points

Who are we?

Al-Mar Técnicas Ortopédicas S.L. (hereinafter, “3DS / 3DSquad”) is the party responsible for processing your personal data. This means that we decide how and for what purposes we use your data, undertaking to process it in a lawful, transparent and secure manner.

What do we use your data for?

We will use your personal data to manage your registration as a user, process your online orders and purchases, manage payments, shipments, returns and warranties, respond to your enquiries and quotation requests, as well as to send you commercial communications where you have authorised us to do so or where there is a legal basis for it.

Why may we use your data?

We process your data because it is necessary to perform the sales contract when you place an order, to comply with legal obligations, to handle requests made by you and, in certain cases, because you have given us your consent or because there is a legitimate interest that supports such processing.

With whom do we share your data?

We may share your data with providers that supply services necessary for the operation of our business (technology platforms, payment gateway, transport companies, financial institutions, web hosting providers, etc.), as well as with Public Authorities where there is a legal obligation.

Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability of your personal data, as well as withdraw your consent at any time where the processing is based on it.

1. Data controller

In compliance with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD) and other applicable regulations, we inform you that the data controller is:

• Holder: Al-Mar Técnicas Ortopédicas S.L.
• Trade name: 3DS / 3DSquad
• Tax ID (CIF): B-81368656
• Registered office: Calle Río Tajuña, 22-24 — 28500 Arganda del Rey (Madrid)
• Email: almar3ds@gmail.com
• Website: https://3dsquads.com

2. For what purpose do we process your personal data?

Depending on how you interact with our website, we may process the following categories of data:

• Identification and contact data: name, surname, address, telephone, email, company name, tax IDs (CIF/NIF/VAT), etc.
• Financial and transactional data: payments, orders, returns, invoicing, etc.
• Technical order data: CAD files (STL, STEP, OBJ, 3MF) submitted for quotation or production, reference images for the “Image→3D” modelling service, technical specifications and associated notes.
• Browsing data and use of the website.
• Commercial information when you request to receive communications.
• Curricula vitae submitted through the channels enabled for this purpose.

As regards payment data, the full card details and payment methods are processed directly by the payment gateway (Stripe); 3DS / 3DSquad does not store the full card details.

Your data will be processed for the following purposes:

• Manage your registration as a user of the website, where such functionality exists.
• Manage the purchase of products and services made through our online store.
• Manage payments, shipments, deliveries, returns and warranties.
• Manage enquiries, quotation requests, information requests and customer service.
• Send communications relating to your orders or contracted services.
• Comply with legal, tax, accounting and consumer obligations.
• Manage applications in selection processes.
• Send commercial communications where there is consent or a legal basis.
• Improve the quality, operation and security of the website.
• Prevent fraudulent use, unauthorised access or security incidents.

Automated decisions. The website performs an automated technical analysis of the CAD file you upload (volume, mesh integrity and dimensions) for the sole purpose of providing you with an indicative quotation. This operation is purely technical, runs in your own browser and produces no legal effects on you, nor does it involve profiling. The final acceptance of any order always requires human intervention by our team.

Special categories of data (health data) — art. 9 GDPR. Our manufacturing service is a technical processing of geometry and is not intended to collect health data. We ask that you do not include personal health data (nor third-party personal data) in the files, images, file names or notes you send us, unless it is essential for the commission. If, due to the nature of a custom-made part (for example, an orthosis or an element of anatomical adaptation), it were necessary to process data that could be considered health data, such processing will be limited to what is strictly necessary to carry out your commission and will be based on your explicit consent (art. 9(2)(a) GDPR), which you give by voluntarily sending us that information and confirming the order. You may withdraw that consent at any time by writing to almar3ds@gmail.com.

3. Social media

3DS / 3DSquad maintains corporate profiles on various social networks. Users’ interaction with these profiles entails the processing of personal data in accordance with the privacy policies of each social network and with this Privacy Policy. The purpose is to manage the company’s corporate presence, provide information about products and services, respond to enquiries and maintain the relationship with users and followers.

4. Legal basis for processing

The processing of your personal data is based on the following legal grounds:

• Performance of a contract (art. 6(1)(b) GDPR): to manage orders, payments, shipments, returns, warranties and contracted services, as well as pre-contractual measures requested by the data subject (e.g. quotation requests).
• Compliance with legal obligations (art. 6(1)(c) GDPR): tax, accounting, commercial, consumer and any other applicable legal obligations.
• Consent of the data subject (art. 6(1)(a) GDPR): for sending commercial communications, contact forms, newsletter subscriptions or any processing that requires prior authorisation.
• Legitimate interest (art. 6(1)(f) GDPR): to ensure the security of the website, prevent fraud, improve our services and send commercial communications about products or services similar to those previously contracted, in accordance with article 21.2 of Spanish Law 34/2002 (LSSICE).

Where the requested data is mandatory for the provision of a service or the handling of a request, this will be expressly indicated. Refusal to provide it may prevent the proper handling of the request or the provision of the service.

5. Retention periods

Personal data will be retained only for the time necessary to fulfil the purposes for which it was collected and, thereafter, for as long as legal, contractual or any other type of liability may arise. In particular:

• Customer data: for as long as the business relationship exists and, once terminated, during the limitation periods applicable to tax, accounting and contractual liability obligations (generally, 6 years under the Spanish Commercial Code).
• Supplier and collaborator data: for the duration of the contractual relationship and, thereafter, during the periods required by tax, accounting and commercial regulations (generally 6 years).
• Candidate data (HR): a maximum of 1 year from receipt of the CV, unless there is express authorisation for a longer period or a request for withdrawal.
• CAD and design files provided by the customer: up to 24 months from the last production, in order to enable future reorders by the customer, unless there is a prior express deletion request.
• Data from enquiries and requests without a contract (leads): data from mere enquiries (chat, contact forms, quotation or information requests) that do not result in a contractual relationship will be retained for a maximum of 24 months from the last contact, unless there is a prior deletion request, after which it is deleted or anonymised.
• Commercial communications or newsletter data: until consent is revoked or an unsubscribe request is made, and thereafter blocked during the liability periods.
• Data collected through cookies: in accordance with the periods specified in the Cookie Policy.

6. Recipients and processors

Your data may be disclosed to:

• Public Authorities where there is a legal obligation.
• Financial institutions and the payment gateway for the management of collections and payments. In particular, payments are processed through Stripe Payments Europe, Ltd.
• Transport and logistics companies for the delivery of orders.
• Technology, web hosting, IT maintenance and ancillary service providers necessary for carrying out the business.

Specifically, we use the following processors (providers that process data on our behalf):

• Vercel Inc. (USA) — web hosting and aggregated usage analytics. International transfer covered by the EU-U.S. Data Privacy Framework and/or standard contractual clauses.
• Stripe Payments Europe, Ltd. (Ireland) — payment gateway. Certain data may be processed by Stripe, Inc. (USA) under the EU-U.S. Data Privacy Framework.
• Resend (Plus Five Five, Inc.) (USA) — sending of transactional emails (order confirmations, replies to enquiries). Transfer covered by standard contractual clauses.
• Neon Inc. — database where orders and messages are stored, hosted in the EU region (Frankfurt, Germany).
• Microsoft Ireland Operations Ltd. (Microsoft Clarity) — only if you accept analytics cookies: anonymised recording of browsing sessions and heat maps to improve the website. We do not disclose your email or identifying data in clear form (a pseudonymised identifier is used). Transfer covered by the EU-U.S. Data Privacy Framework.
• Google Ireland Ltd. (Google Analytics 4) — only if you accept analytics cookies: statistical and aggregated measurement of website use (pages visited, traffic source, conversions). It runs with “Consent Mode” and with IP anonymisation signalling; it is not used for personalised advertising. Data may be processed by Google LLC (USA) under the EU-U.S. Data Privacy Framework.
• Vercel Inc. (Vercel Blob) (USA) — encrypted and private storage of the CAD files and images you provide for quotation or production. Transfer covered by the EU-U.S. Data Privacy Framework and/or standard contractual clauses.

All providers that access personal data will act as processors, under a contract in accordance with art. 28 GDPR and following our instructions. Where international data transfers take place, the appropriate safeguards required by the GDPR will be adopted (e.g. standard contractual clauses approved by the European Commission or the EU-U.S. Data Privacy Framework).

7. Rights of the data subject

You may exercise the following rights free of charge:

• Access to your personal data.
• Rectification of inaccurate or incomplete data.
• Erasure of your data where applicable.
• Objection to processing.
• Restriction of processing.
• Data portability.
• Withdrawal of consent where the processing is based on it.

To exercise your rights you may contact us by email at almar3ds@gmail.com. Where necessary to verify your identity, we may request supporting documentation.

You also have the right to lodge a complaint with the Agencia Española de Protección de Datos (https://www.aepd.es) if you consider that the processing does not comply with the applicable regulations.

8. Third-party data and minors

If you provide personal data of third parties, you warrant that you have previously informed them of the content of this Privacy Policy and that you have sufficient legitimacy for such disclosure.

Our products and services are aimed at businesses and adults. The website is not directed at children under 14 years of age and we do not knowingly collect their data. If we detect that we have processed data of a child under that age without the consent of the holders of parental authority or guardianship, we will proceed to delete it (art. 7 LOPDGDD).

9. Confidentiality and security

3DS / 3DSquad adopts the technical and organisational measures necessary to guarantee the security, integrity and confidentiality of personal data, preventing its alteration, loss, unauthorised processing or access. These measures include, by way of example, encryption in transit (HTTPS), role-based access control, activity logging and the performance of regular backups. All personnel authorised to access personal data are subject to confidentiality and professional secrecy obligations.

10. Changes to the Privacy Policy

3DS / 3DSquad may modify this Privacy Policy where necessary to adapt it to legislative or case-law changes or to criteria of the supervisory authorities. Amendments will be published on this same website and will apply from their date of publication.