This Privacy Policy (hereinafter referred to as the «Policy») has been developed in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and sets out the procedure for the processing of personal data and the measures to ensure its security for the purpose of protecting the rights and freedoms of natural persons.
This Policy applies to users of the website located in the territory of the European Union (EU) / European Economic Area (EEA).
§ 1. Definitions
Personal Data – any information relating to an identified or identifiable natural person (data subject).
Processing – any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Controller – the natural or legal person which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Processor – a natural or legal person which processes personal data on behalf of the Controller.
§ 2. Information about the Controller and the EU Representative
The Controller of your personal data is Design Dosie LLC (Taxpayer Identification Number [INN] 7701725738, Primary State Registration Number [OGRN] 5077746858261), registered address: 121205, Moscow, Nikola Tesla Street, bld. 1, str. 1.
Email address for inquiries regarding personal data processing: office@3dday.ru
Since the Controller is not established in the EU but offers services to users in the EU, it has appointed its representative in the EU. Contact details of the representative: [ДЮ1] You may contact the representative regarding all matters related to the processing of your data and the exercise of your rights.
§ 3. Categories of Data and Data Subjects
The data subjects are users of this website located in the territory of the EU/EEA.
The following general data is subject to processing: first name, last name, phone number, email address (when filling out feedback forms).
Technical data: IP address, browser and device type data, cookies.
§ 4. Purposes and Legal Bases for Processing
The purpose of data processing is determined by the legal basis under Article 6 of the GDPR:
· Communication with users: processing of your name and contact details to respond to your inquiries. Legal basis: your consent (Art. 6(1)(a) GDPR) or steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
· Analytics and website improvement: processing of technical data and cookies to analyse usability. Legal basis: your legitimate interest in improving the service (Art. 6(1)(f) GDPR) or consent (Art. 6(1)(a) GDPR), depending on the type of cookie.
· Security: ensuring website security and fraud prevention. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
§ 5. Use of Cookies and Analytics
The website uses cookies and similar technologies. A cookie is a small text file stored by the browser to recognize repeated sessions (website visits).
· Strictly necessary cookies are used for the technical functioning of the service (authorization, security, sessions). They do not require consent.
· Analytical cookies are used exclusively for internal analytics: evaluating traffic, identifying errors, and improving usability. Data is collected in an anonymized form, is not transferred to third parties, and is not used for displaying advertisements or user profiling.
Analytical cookies are enabled only after obtaining your explicit consent via the cookie settings banner. The "Reject" button on the banner is as accessible as the «Accept» button. You can change or withdraw your consent at any time through your browser settings or the website interface.
Disabling analytical cookies does not affect access to the main functionality of the website.
§ 6. Disclosure of Data to Third Parties
The Controller does not sell, transfer, or disclose users' personal data to third parties for their own marketing purposes.
To ensure the technical functioning of the website, the Controller engages a hosting provider, which acts as a Processor in accordance with Article 28 of the GDPR.
The hosting provider:
· has no independent purposes for data processing;
· data exclusively within the scope and for the purposes determined by the Controller;
· is obliged to maintain confidentiality and ensure data security;
· is not entitled to transfer data to other persons without the Controller's instruction.
The Controller discloses personal data to public authorities only on legal grounds (e.g., upon a reasoned request from a court or an EU supervisory authority).
§ 7. Data Subject Rights
In accordance with Chapter III of the GDPR, you possess the following rights:
· Right of access (Art. 15): to request a copy of your personal data.
· Right to rectification (Art. 16): to request the correction of inaccurate or incomplete data.
· Right to erasure / «Right to be forgotten» (Art. 17): to request the deletion of your data if it is no longer necessary for the purposes of processing.
· Right to restriction of processing (Art. 18): to request the temporary suspension of processing of your data.
· Right to data portability (Art. 20): to receive your data in a structured, commonly used, and machine-readable format and to transmit it to another controller.
· Right to object (Art. 21): to object to the processing of your data based on legitimate interests.
· Right to withdraw consent: you may withdraw your consent to data processing at any time (this does not affect the lawfulness of processing based on consent before its withdrawal).
To exercise your rights, you may send a request to office@3dday.com or contact our EU Representative. We are obliged to respond to your request within 30 days (with the possibility of extension by 2 months if the request is complex).
You also have the right to lodge a complaint with a supervisory authority in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.
§ 8. Data Security Measures
The Controller takes necessary legal, organizational, and technical measures to protect personal data from unauthorized or accidental access, destruction, alteration, blocking, copying, or distribution.
Organizational measures:
· restricting the circle of persons with access to personal data and familiarizing employees with data protection legislation;
· internal control and audit of compliance of data processing with legal requirements.
Technical measures:
· use of secure communication channels (HTTPS) for data transmission;
· encryption of data during storage and transmission;
· data backup for recovery in the event of incidents;
· detection of unauthorized access and response to computer incidents.
In the event of a personal data breach that may pose a risk to the rights and freedoms of users, the Controller shall notify the supervisory authority (within 72 hours) and the affected users in accordance with Articles 33 and 34 of the GDPR.
§ 9. Cross-Border Data Transfers
Personal data of users located in the EU/EEA is stored and processed on servers located within the European Economic Area (EEA).
Should the need arise in the future to transfer data to a third country (outside the EEA), the Controller will ensure the existence of appropriate safeguards in accordance with Chapter V of the GDPR (e.g., Standard Contractual Clauses (SCCs) approved by the European Commission) and will conduct a Transfer Impact Assessment (TIA).
§ 10. Changes to the Policy
The Controller reserves the right to make changes to this Policy. The new edition enters into force upon its posting on the website. We recommend periodically checking this page to review the current version.
