Privacy Policy

Preamble

This privacy policy describes how Mehaka, publisher of the Did3D website (www.did3d.fr), collects, uses, stores and protects the personal data of its users, in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and French Data Protection Act No. 78-17 of 6 January 1978, as amended.

1. Data Controller

The controller of personal data processing is:

Company name : Did3D
Trade name : Did3D
Email : contact@did3d.fr
Website : www.did3d.fr

2. Personal Data Collected

We only collect data that is necessary for the proper functioning of the service and the processing of your orders.

When creating your account

First and last name
Email address
Password (stored in hashed form, never in plain text)
Phone number (optional)

When placing an order

Shipping and/or billing postal address
Payment data (processed directly by Stripe or PayPal — never stored on our servers)
Order and download history

During browsing

IP address
Browsing data (pages visited, duration, browser type)
Technical and analytics cookies (see dedicated section)

3. Purposes of Processing

Your personal data is collected and processed for the following purposes:

Management of your user account and authentication
Processing and tracking of your orders (payment, delivery of digital files)
Providing your STL files in your customer area
Communication related to your orders (confirmations, invoices, tracking)
Sending newsletters and promotional offers (only with your consent)
Website improvement and anonymised statistical analysis

4. Legal Basis for Processing

The processing of your data is based on the following legal grounds:

Performance of a contract : Processing necessary for the performance of your order and the provision of the service (Art. 6.1.b GDPR).
Consent : For sending newsletters and placing analytics cookies (Art. 6.1.a GDPR). You may withdraw your consent at any time.
Legitimate interest : For service improvement, fraud prevention and website security (Art. 6.1.f GDPR).
Legal obligation : Retention of billing data in compliance with accounting and tax obligations (Art. 6.1.c GDPR).

5. Data Retention Period

Your data is retained for the period strictly necessary for the purposes described above:

Account data : Retained for the duration of your account, then 3 years after the last contact.
Order data : Retained for 10 years in accordance with French accounting and tax obligations.
Prospecting data : Retained for 3 years from the last contact or last activity.
Connection logs : Retained for 12 months in accordance with the French Confidence in the Digital Economy Act (LCEN).

6. Data Recipients

Your personal data may be shared with the following processors, strictly within the scope of the purposes described:

PayPal : PayPal payment processing.
Hosting provider : Website and data hosting.
Email service : Sending transactional emails (order confirmations, password reset).

We never sell, rent or transfer your personal data to third parties for commercial purposes.

7. Data Transfers Outside the EU

Some of our processors (Stripe, PayPal) may transfer data to the United States. These transfers are governed by Standard Contractual Clauses approved by the European Commission (Art. 46.2 GDPR) or by the EU-US Data Privacy Framework. We ensure that any transfer provides an adequate level of protection.

8. Cookies

The Did3D website uses cookies to ensure proper functioning and improve your experience.

Essential cookies (strictly necessary)

These cookies are essential for the website to function. They do not require your consent (legal basis: legitimate interest).

PHPSESSID : User session — expires when the browser is closed.
did3d_cart : Cart contents — expires after 30 days.
did3d_locale : Language preference — expires after 1 year.

Analytics cookies

These cookies are used to measure website traffic and analyse browsing patterns in an anonymised manner. They are only placed with your prior consent.

Managing your preferences

You can accept or refuse non-essential cookies via the consent banner displayed on your first visit. You can also change your preferences at any time in your browser settings. Deleting essential cookies may affect the website's functionality.

9. Your Rights

In accordance with Articles 15 to 22 of the GDPR, you have the following rights regarding your personal data:

Right of access — Obtain confirmation that your data is being processed and receive a copy of it.
Right to rectification — Correct inaccurate data or complete incomplete data.
Right to erasure — Request the deletion of your data, subject to our legal retention obligations.
Right to restriction — Temporarily restrict the processing of your data in certain cases.
Right to data portability — Receive your data in a structured, machine-readable format.
Right to object — Object to the processing of your data for direct marketing purposes.

To exercise these rights, send an email to contact@did3d.fr specifying your request and providing proof of identity. We will respond within a maximum of 30 days.

You also have the right to lodge a complaint with the CNIL (French Data Protection Authority): www.cnil.fr.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or disclosure:

HTTPS/TLS encryption of all communications between your browser and our servers.
Passwords hashed with the bcrypt algorithm (never stored in plain text).
No banking data stored on our servers (processing delegated to Stripe and PayPal, PCI DSS certified).
Restricted access to personal data, limited to authorised personnel.

11. Changes to This Policy

We reserve the right to modify this privacy policy at any time. In case of a substantial change, we will inform you by email or by a visible notice on the website. The date of the last update is shown at the top of this page.

12. Contact Us

For any questions regarding the protection of your personal data or to exercise your rights, you can contact us at contact@did3d.fr.