Privacy Notice

This notice explains how Threedy GmbH (“Threedy”, “we”, “us”) processes personal data when you use the Threedy Customer Portal (the “Portal”). It sits alongside the Portal Terms and Conditions. Where Threedy processes personal data on behalf of your organisation, the data-processing agreement between your organisation and Threedy also applies.

Who is responsible

The controller for the processing described here is:

Threedy GmbH
[Threedy GmbH registered address]

Data-protection contact / DPO: [privacy / DPO email placeholder]

What data we process

Account and identity data. You sign in through your organisation’s identity provider. Through that sign-in the Portal receives data such as your name, work email address, organisation, and role or group membership. Threedy does not receive or store your password.

Usage and telemetry data. We process data about how you use the Portal, such as pages viewed, actions taken, sign-in events, and technical data like browser type, device, and IP address. The Portal also displays your organisation’s instant3Dhub token-usage figures; that usage data is tied to your organisation’s entitlement.

Uploaded files. The Portal lets you upload files to preview them and run demo apps against your own data. Uploaded files are held in your browser session only and are not stored on Threedy servers. They are gone when your session ends. If an uploaded file contains personal data, that data stays in your session and is not retained by Threedy.

Support and communication data. If you contact us through the Portal or by email, we process the content of your message and your contact details so we can respond.

Lawful basis

We rely on the following lawful bases under GDPR Article 6:

• Contract (Art. 6(1)(b)) - to give you access to the Portal and provide the service your organisation has a relationship with us for.
• Legitimate interests (Art. 6(1)(f)) - to keep the Portal secure, prevent misuse, and improve the service. Our interest is running a secure and reliable service; we balance it against your rights.
• Legal obligation (Art. 6(1)(c)) - where we must process data to meet a legal requirement.
• Consent (Art. 6(1)(a)) - where we ask for it for a specific purpose; you can withdraw consent at any time.

[Legal to confirm the bases, in particular the split between processing as controller and processing on behalf of the customer organisation as processor.]

How long we keep data

We keep account and identity data for as long as your Account is active and your organisation maintains a relationship with Threedy, then delete or anonymise it within [retention period placeholder], unless a longer period is required by law.

We keep usage and telemetry data for [retention period placeholder] for security and service purposes.

Uploaded files are not retained. They exist only in your browser session and are gone when the session ends.

Support messages are kept for [retention period placeholder].

Who we share data with

We share personal data only where needed to run the Portal:

• your organisation’s identity provider, for authentication;
• service providers that host or support the Portal, acting as processors under contract;
• authorities, where the law requires it.

Where a provider is outside the EU or EEA, we use appropriate safeguards such as the European Commission’s standard contractual clauses. [Legal to confirm the list of processors and any transfer outside the EEA.]

Your rights

Under GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased in certain cases;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent where processing is based on consent;
• lodge a complaint with a supervisory authority.

The competent supervisory authority is the data-protection authority for [Threedy GmbH registered state / Bundesland]. You can also contact the authority in the EU country where you live or work.

To exercise any of these rights, contact us at [privacy / DPO email placeholder]. If Threedy processes your data on behalf of your organisation, we may direct your request to that organisation as controller.

Changes to this notice

We may update this notice as the Portal or the law changes. When we make a material change, we will update the “Last updated” date and, where appropriate, notify you through the Portal.

Contact

Questions about this notice or about how we handle personal data: [privacy / DPO email placeholder]