1. This Privacy Policy sets out the rules for processing personal data obtained via the online store operating at 3dforge.xyz (hereinafter referred to as the "Online Store").
2. The owner of the Online Store and the data controller is WARMONGER SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ with its registered office in Warsaw (02-591), ul. Stefana Batorego 33/95, entered into the Register of Entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw in Warsaw, XIII Commercial Division of the National Court Register under KRS number 0001025896, with a share capital of PLN 5,000, NIP: PL7712924299, REGON: 524767807, hereinafter referred to as WARMONGER SP. Z O.O.
3. "3DForge" is a trade name under which WARMONGER SP. Z O.O. operates the Online Store. It does not constitute a separate legal entity, and the personal data controller remains exclusively WARMONGER SP. Z O.O.
4. Personal data collected by WARMONGER SP. Z O.O. via the Online Store are processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the GDPR).
5. The Online Store offers both goods in the form of finished 3D prints and digital content in the form of files intended for self-printing. Data processing rules related to the sale of digital content, due to their distinct nature, are described separately in Section 3 of this Policy.
6. WARMONGER SP. Z O.O. exercises special care to respect the privacy of Customers visiting the Online Store.
Section 1 Type of Data Processed, Purposes, and Legal Basis
1. WARMONGER SP. Z O.O. collects information regarding natural persons performing a legal transaction not directly related to their business, natural persons conducting business or professional activities in their own name, and natural persons representing legal entities or organizational units without legal personality granted legal capacity by law, hereinafter collectively referred to as Customers.
2. Personal data of Customers are collected in the case of:
2.1. Account registration in the Online Store, in order to create and manage an individual account and provide the Customer with access to purchased digital content. Legal basis: necessity for the performance of a contract for the provision of the Account service (Article 6(1)(b) GDPR);
2.2. Placing an order in the Online Store to execute a sales contract for goods or a contract for the supply of digital content. Legal basis: necessity for the performance of a contract (Article 6(1)(b) GDPR);
2.3. Issuing an invoice and maintaining accounting books and tax documentation. Legal basis: legal obligation resting on the controller (Article 6(1)(c) GDPR) under the Accounting Act, the Value Added Tax Act, and the Tax Ordinance;
2.4. Handling complaints and declarations of withdrawal from the contract. Legal basis: legal obligation resting on the controller (Article 6(1)(c) GDPR) under the Consumer Rights Act and the Civil Code;
2.5. Fulfillment of obligations under regulations on general product safety, including ensuring product traceability and handling safety notices. Legal basis: legal obligation resting on the controller (Article 6(1)(c) GDPR) under Regulation (EU) 2023/988 of the European Parliament and of the Council;
2.6. Recording the Customer's request to begin the supply of digital content before the expiry of the withdrawal period and acknowledgment of loss of the right of withdrawal, together with date, time, IP address, and order number. Processing aims to establish and defend claims resulting from the sale of digital content. Legal basis: legitimate interest of the controller consisting in establishing and defending claims (Article 6(1)(f) GDPR) in connection with Article 38(1)(13) of the Consumer Rights Act;
2.7. Subscription to the information bulletin (newsletter). Legal basis: consent of the data subject (Article 6(1)(a) GDPR) in connection with Article 398 of the Electronic Communications Law;
2.8. Using the contact form or contacting via e-mail to answer the query sent. Legal basis: necessity for the performance of a contract for the provision of the contact form service (Article 6(1)(b) GDPR), and otherwise legitimate interest of the controller consisting in managing correspondence (Article 6(1)(f) GDPR);
2.9. Posting a product review. Legal basis: consent of the data subject (Article 6(1)(a) GDPR);
2.10. Monitoring compliance with license terms granted for digital content, including logging file downloads. Legal basis: legitimate interest of the controller (Article 6(1)(f) GDPR) consisting in protecting its economic copyrights;
2.11. Ensuring the security of the Online Store and preventing abuse and unauthorized access attempts. Legal basis: legitimate interest of the controller (Article 6(1)(f) GDPR);
2.12. Conducting direct marketing of its own products directed to Customers. Legal basis: legitimate interest of the controller (Article 6(1)(f) GDPR);
2.13. Conducting statistical analyses of traffic in the Online Store. Legal basis: consent of the data subject expressed via the consent management mechanism (Article 6(1)(a) GDPR).
3. In the case of registering an account in the Online Store, the Customer provides:
3.1. e-mail address;
3.2. first name and last name.
4. During account registration, the Customer independently sets an individual access password. Password management rules are described in Section 6.
5. The Customer may voluntarily supplement their profile with date of birth and title/salutation. These fields are not required, and failure to provide them carries no negative consequences.
6. When placing an order covering physical goods, the Customer provides:
6.1. first name and last name;
6.2. e-mail address;
6.3. telephone number;
6.4. address details: street with house/apartment number, postal code, city, voivodeship/region, and country.
7. When placing an order covering exclusively digital content, the Customer provides first name, last name, e-mail address, and address details necessary to issue an accounting document and determine the correct tax rate.
8. For Entrepreneurs, the scope of data specified in items 6 and 7 is additionally expanded to include company name and Tax ID (NIP).
9. Providing a telephone number is necessary in the case of delivery performed by a carrier or to an automated parcel locker, as these entities use it to notify about shipment status.
10. In the case of using the Newsletter service, the Customer provides an e-mail address. WARMONGER SP. Z O.O. also records the date and IP address from which the subscription was made to demonstrate proof of consent.
11. In the case of posting a product review, the Customer provides a signature with which the review is to be designated. WARMONGER SP. Z O.O. also records the IP address from which the review was submitted.
12. While using the Online Store, the store software automatically collects the following information:
12.1. IP address assigned to the Customer's device or external IP address of the internet service provider;
12.2. date and time of visit, list of visited subpages, order of display, and time spent on each;
12.3. website URL from which the Customer was redirected to the Online Store, and in the case of entering from a search engine — the search phrase used;
12.4. web browser type and version, operating system, screen resolution, color depth, language settings, and script support information;
12.5. search phrases entered by the Customer in the internal search engine of the Online Store;
12.6. shopping cart content, including abandoned cart details.
13. WARMONGER SP. Z O.O. informs that the set of information indicated in item 12.4 may allow distinguishing terminal devices, and is therefore treated as personal data and protected under the rules described in this Policy.
14. Navigation data referred to in item 12 are used to ensure proper operation of the Online Store, diagnose technical issues, prevent abuse, and improve the structure and content of the Online Store. Legal basis: legitimate interest of the controller (Article 6(1)(f) GDPR), and for statistical analysis — consent of the Customer (Article 6(1)(a) GDPR).
15. For the purposes of establishing, pursuing, and enforcing claims and defending against claims, personal data provided by the Customer within the use of the Online Store may be processed, in particular name, surname, address, contract data, and service usage data. Legal basis: legitimate interest of the controller (Article 6(1)(f) GDPR).
16. Providing personal data is voluntary, provided that failure to provide data marked as required prevents account registration, and in the case of placing an order — its placement and execution. Failure to provide data necessary for issuing an accounting document prevents concluding a contract with an Entrepreneur.
Section 2 Recipients of Data and Retention Periods
1. Customer personal data are transferred to service providers used by WARMONGER SP. Z O.O. in running the Online Store. Depending on contractual arrangements and circumstances, these providers either act on instructions from WARMONGER SP. Z O.O. as to purposes and methods of processing (processors) or independently determine purposes and methods (separate controllers).
2. Processors. WARMONGER SP. Z O.O. uses providers who process personal data solely on its instruction under data processing agreements. These include:
2.1. hosting provider operating the Online Store infrastructure — LH.pl Sp. z o.o. based at plac Wolności 6/4, 61-738 Poznań, Poland;
2.2. transactional messaging and newsletter delivery system provider — Sendinblue SAS (Brevo) based at 17 Rue de Salneuve, 75017 Paris, France;
2.3. invoicing software provider and accounting firm — TEKS JR Sp. z o.o. (Skanye) based at ul. Niccolo Paganiniego 2 lok. 143, 20-850 Lublin, Poland;
2.4. analytical and marketing tool providers — Google Ireland Limited based at Gordon House, 4 Barrow Street, Grand Canal Dock, Dublin 4, D04 V4X7, Ireland;
2.5. entities providing IT maintenance services for the Online Store.
3. Separate Controllers. WARMONGER SP. Z O.O. uses providers who do not act exclusively on its instructions and independently set purposes and methods of using Customer personal data. These are electronic payment providers, banking institutions, and courier/postal services.
4. In the case of purchasing physical goods in the Online Store, Customer personal data are transferred to Furgonetka sp. z o.o. sp. k. based in Warsaw, al. Księcia Józefa Poniatowskiego 1, 03-901 Warsaw, KRS 0000694708, NIP 1132567365, REGON 140220084, providing shipment brokerage services.
5. Furgonetka sp. z o.o. sp.k. does not deliver packages directly. Depending on the delivery method chosen by the Customer, necessary personal data are subsequently transferred to the courier or postal operator performing delivery, e.g., InPost Sp. z o.o. based in Kraków, ul. Wielicka 28, 30-552 Kraków, KRS 0000543759.
6. Both Furgonetka sp. z o.o. sp.k. and carrier/postal operators mentioned in item 5 are separate personal data controllers and process data in accordance with their own privacy policies.
7. If the Customer chooses payment via Stripe, personal data necessary to execute payment are transferred to Stripe Payments Europe, Limited based in Dublin, 3 Dublin Landings, North Wall Quay, Dublin 1, D01 C4E0, Ireland (company reg. 513174) and Stripe Technology Europe, Limited based in Dublin, The One Building, 1 Grand Canal Street Lower, Dublin 2, Ireland — an electronic money institution authorized by the Central Bank of Ireland (C187865).
8. Transferred data include name, surname, address, e-mail address, telephone number, IP address, and transaction details. Data are processed to handle payments, accounting, and fraud prevention. Stripe group entities act as separate data controllers.
9. WARMONGER SP. Z O.O. does not receive or store payment card numbers or electronic banking credentials.
10. In the case of issuing an invoice to an Entrepreneur, data contained therein are transferred to the National e-Invoicing System (KSeF) operated by the Polish Ministry of Finance.
11. Upon lawful demand, WARMONGER SP. Z O.O. discloses personal data to authorized state authorities, in particular Prosecutor's Offices, Police, Personal Data Protection Office (UODO), Office of Competition and Consumer Protection (UOKiK), and tax authorities.
12. WARMONGER SP. Z O.O. does not sell Customer personal data or share them with third parties for their own marketing purposes.
13. Service providers are mostly based in Poland and European Economic Area (EEA) countries. Some providers process data outside the EEA, notably in the United States. This applies to Stripe, Inc. (South San Francisco, USA) and Google LLC (USA).
14. For data transfers outside the EEA, appropriate safeguards are ensured through:
14.1. European Commission Implementing Decision (EU) 2023/1795 (EU–U.S. Data Privacy Framework) for certified providers, or;
14.2. Standard Contractual Clauses under EU Implementing Decision 2021/914, supplemented by technical safeguards for other providers.
15. Customer personal data are stored for:
15.1. consent-based processing — until consent is withdrawn, and thereafter for the statutory limitation period of potential claims;
15.2. contract performance — for the duration of execution and subsequently for the applicable claims limitation period (generally 6 years, or 3 years for business-related claims);
15.3. tax and accounting legal obligations — 5 years counting from the end of the calendar year in which tax payment was due;
15.4. product safety obligations — 10 years from placing the product on the market;
15.5. digital content download logs — 24 months from download date;
15.6. abandoned shopping carts — 12 months, after which they are deleted;
15.7. newsletter subscribers — until withdrawal of consent, and subsequently 3 years for claim defense;
15.8. product reviews — 10 years from posting;
15.9. contact form correspondence — 3 years from the last contact;
15.10. technical logs and navigation data — 12 months, except IP addresses and digital transaction metadata subject to EU Regulation 282/2011 Article 24b, stored for 10 years.
Section 3 Special Rules for Digital Content Sales
1. Products sold in the Online Store include files intended for self-printing (copyrighted works). Their sale involves specific data processing described separately here.
2. File access is provided via an individual, non-public download link sent to the Customer's e-mail. This link must not be shared with third parties — downloads made with it are attributed to the Customer's order and account.
3. WARMONGER SP. Z O.O. logs every file download (date, time, order number, account ID, IP address) to enforce download limits and detect license violations. Legal basis: legitimate interest in protecting economic copyrights (Article 6(1)(f) GDPR).
4. For digital content sales to Customers residing outside the EU, data necessary to determine tax jurisdiction (IP address, billing address, card info) are processed under legal obligations (EU Regulation 282/2011 Article 24b) and stored for 10 years.
5. WARMONGER SP. Z O.O. records the Customer's express request to begin digital content delivery before expiry of the 14-day withdrawal period via a dedicated checkbox during checkout.
6. The checkbox is unchecked by default and separate from general terms acceptance. Upon checking, WARMONGER SP. Z O.O. logs:
a) date and time of selection,
b) device IP address,
c) order ID,
d) declaration confirmation.
7. Confirmation is sent via e-mail. Records are kept for 6 years from selection to defend against legal claims (Article 118 Polish Civil Code).
Section 4 Cookies and IP Addresses
1. The Online Store uses text files ("cookies") stored on terminal devices if permitted by web browser settings.
2. WARMONGER SP. Z O.O. uses session cookies (deleted upon session end) and persistent cookies (retained until deletion or expiry).
3. Cookies do not access confidential device files. However, collected details may distinguish devices.
4. Essential Cookies. Used without consent for necessary services:
4.1. user authentication and session maintenance;
4.2. shopping cart content memory;
4.3. language and currency preferences;
4.4. consent choices memory;
4.5. form security;
4.6. payment fraud detection.
5. Main cookie content is stored in encrypted form.
6. Fraud detection cookies saved by payment providers include:
a) __stripe_mid — device recognition for fraud detection (stored ~12 months);
b) __stripe_sid — payment session linking (stored ~30 minutes).
7. Controller for Stripe cookies: Stripe Payments Europe, Limited (Dublin). Essential for secure transactions; blocking them may prevent payments.
8. Analytics & Marketing Cookies. Saved only after explicit consent via the banner mechanism.
9. External cookies used for:
9.1. traffic statistics via Google Analytics (Google Ireland Ltd);
9.2. interest-based ads via Meta Pixel (Meta Platforms Ireland Ltd);
9.3. abandoned cart emails via Brevo (Brevo SAS, France).
10. Full cookie lists are available via the "Cookies" footer link.
11. Users may modify consent anytime or adjust browser settings. Disabling essential cookies prevents order placement.
12. Cookie mechanisms are secure against malware.
13. IP addresses are collected for server diagnostic, statistical, administrative, and security purposes.
14. The store contains links to external sites; WARMONGER SP. Z O.O. is not liable for their privacy policies.
Section 5 Rights of Data Subjects
1. Right to Withdraw Consent (Art. 7(3) GDPR). Customers may withdraw consent at any time without affecting prior processing legality.
2. Right to Object (Art. 21 GDPR). Customers may object to processing based on legitimate interests. Objections to direct marketing require no justification and are always respected.
3. Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR). Customers may request data deletion unless retention is required by law or for legal claims.
4. Right to Restriction of Processing (Art. 18 GDPR). Customers may request processing restrictions in contested accuracy or unlawful cases.
5. Right of Access (Art. 15 GDPR). Customers may request confirmation and copies of their processed data.
6. Right to Rectification (Art. 16 GDPR). Customers may request immediate correction of inaccurate data.
7. Right to Data Portability (Art. 20 GDPR). Provided in CSV format.
8. Registered account holders can execute data downloads, profile corrections, or deletion requests directly via account settings.
9. Requests are handled within one month (extendable by two months for complex cases).
10. Standard Contractual Clauses copies can be requested via Section 7 contact.
11. Right to Lodge a Complaint with the Supervisory Authority: President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.
Section 6 Security Management — Password
1. WARMONGER SP. Z O.O. uses SSL encryption for data transmission and account logins.
2. Passwords are stored exclusively as irreversible cryptographic hashes.
3. Password resets can be initiated via the "Forgot Password" link on the login page.
4. WARMONGER SP. Z O.O. never sends emails requesting account passwords.
5. Credit card numbers and banking credentials are never stored.
6. No Data Protection Officer (DPO) has been appointed. Inquiries should be sent to Section 7 contacts.
Section 7 Final Provisions
1. Stripe automated fraud risk evaluations may reject high-risk transactions. Customers have the right to request human intervention and contest automated decisions by contacting info@3dforge.xyz.
2. Marketing profiling (Google, Meta) occurs based on cookie banner consent (Art. 6(1)(a) GDPR) and affects displayed recommendations only.
3. Payment operators may apply independent risk checks under their own policies.
4. Policy changes will be notified to account holders and newsletter subscribers 7 days in advance.
5. Privacy inquiries should be sent to: info@3dforge.xyz
Last modified date: August 5, 2026