Processing of personal data

We process your data for the purposes and on the legal bases below (Article 6(1) of Regulation (EU) 2016/679):

• Taking and fulfilling orders (modelling included), delivery, communication about orders and managing your account: the performance of the contract between you and 3D Coco, or steps taken at your request before entering into it (point (b)).
• Issuing and keeping invoices and accounting records: compliance with a legal obligation (point (c)).
• Answering the messages you send through the contact form or by email: our legitimate interest in answering you (point (f)) or, when the message is about an order, the performance of the contract (point (b)).
• The security of the site and the prevention of fraud and spam: the Google reCAPTCHA check on the contact, registration and modelling forms, the IP address recorded with orders, with the agreements you give and in the audit log (180 days), and the limits on the number of requests. The basis is our legitimate interest in protecting the site, our customers and the orders (point (f)); you may object to this processing (see Your rights).
• The cookies the site needs to work and those that remember the preferences you choose (language, theme): our legitimate interest in making the site work (point (f)); they are listed in the Cookies section.

Your contact and delivery details are needed to conclude and perform the contract: without them we cannot take, deliver or invoice the order. Some of them (for example, those on the invoice) are also required by law.

• Stripe: card payments. You enter your card details directly at Stripe; 3D Coco never sees them. For its own anti-fraud and anti-money-laundering checks, Stripe acts as an independent controller.
• Microsoft Azure, West Europe region (the Netherlands): hosting of the site, the database, the model files and the transactional emails; the weekly database copies are also kept in the paired North Europe region (Ireland).
• Zoho (EU data centre): the team@3dcoco.ro mailbox, which receives the messages you send us.
• Google: sign-in with a Google account (if you choose it) and Google reCAPTCHA, the protection of the site's forms against spam.
• FAN Courier, the courier company: your name, phone number and delivery address, to deliver your parcel and, for cash on delivery, to collect the payment.
• The company's external accountant: the invoices and accounting records, to keep the accounts.
• Public authorities, for example the National Agency for Fiscal Administration (ANAF), only when the law requires us to give them data.

Stripe and Google may process some data in the United States. These transfers rely on the EU-US Data Privacy Framework, under which these providers are certified, or on the standard contractual clauses approved by the European Commission. Microsoft keeps the site's data in the EU regions above and, under its EU Data Boundary commitment, processes it in the EU; in the limited cases where some data is accessed from outside the EU (for example, for security or technical support), the same safeguards apply.

Account data is kept for as long as your account exists, while financial and accounting documents (invoices) are retained for the periods required by applicable tax legislation. When you request account deletion, any data that does not need to be kept for legal reasons is deleted or anonymized.

• IP addresses: 180 days.
• The model files of an order: 90 days after the order is delivered, refunded or cancelled.
• Uploaded files that never became part of an order: 30 days.
• Cancelled orders that were never paid: the name, phone number, email, delivery address and modelling brief are removed after 180 days.
• Delivered and refunded orders, and orders abandoned after they were paid: the name, phone number, email, delivery address and modelling brief are removed after 3 years; the amounts and the invoices stay.
• The payment details Stripe sends us (name, email, address): removed after 180 days.
• Emails that could not be delivered: 90 days.
• Technical records of failed background tasks: 30 days. Expired order and quote links: 30 days after they expire. Password reset requests: deleted within a day after they expire.
• Invoices: 10 years, as required by tax law.
• Transactional emails that were sent: 30 days after sending.
• Backups: point-in-time database backups are kept for 35 days, and weekly database copies for 12 weeks, after which a deleted copy can still be recovered for 14 days (up to 14 weeks in all); deleted files can be recovered for 14 days. After that, an erasure takes effect there too.
• The reference images of a modelling request: deleted together with the order's data (after 180 days for a cancelled order that was never paid, after 3 years for one that was delivered, refunded or abandoned after it was paid); the images of a request that was never sent: 2 days.
• Messages received at team@3dcoco.ro, including those sent through the contact form: 1 year from receipt.
• Withdrawal statements sent through the online withdrawal function: 3 years from receipt, then deleted; the IP address kept with them falls under the 180-day period above.

• The right to access the personal data being processed.
• The right to rectification of inaccurate or incomplete data.
• The right to erasure of data ("the right to be forgotten"), under the conditions set by law.
• The right to restriction of processing, in the cases provided by law.
• The right to data portability, in a structured, commonly used format.
• The right to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (the security of the site, the prevention of fraud and spam, answering messages).
• The right not to be subject to a decision based solely on automated processing, including profiling.
• The right to withdraw your consent at any time, where the processing is based on consent, without affecting the lawfulness of processing carried out before the withdrawal.
• The right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP): B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, postal code 010336, Bucharest, Romania; anspdcp@dataprotection.ro; www.dataprotection.ro.

If you have an account, you can download your data and delete your account yourself from the Profile page of your account. If you ordered without an account, write to team@3dcoco.ro from the email address you ordered with, and we will send you your data or delete it. An account or an order cannot be deleted while an order is still in progress, and invoices are kept for 10 years.

We answer a request within one month of receiving it. If the request is complex or we receive many requests, this can be extended by two further months; we then tell you so within the first month.

We use only the cookies the site needs to work and cookies that remember the preferences you choose. We do not use analytics or advertising cookies, and 3D Coco keeps no other data in your browser. On the pages with forms (contact, registration, modelling), Google reCAPTCHA may also keep data in your browser (cookies and local storage), under Google's terms. The 3D Coco cookies do not need your consent; the banner shown on your first visit only informs you about them.

On the contact, registration and modelling pages, the site loads Google reCAPTCHA; Google processes the data it collects there under its own privacy policy (opens in a new tab).

We make no decisions based solely on automated processing, and we do no profiling.

We have not appointed a data protection officer (DPO), as the law does not require us to appoint one; for any question about your data, write to us at team@3dcoco.ro.

The site is meant for people aged 18 or over.

This policy was last updated on 21 October 2026.