Privacy Policy

Data Controller Information

Data Controller: Eksaria
Address: Maksimirska 40, Zagreb, Croatia
Email: contact@eksaria.com
IBAN: HR8623400091160819603
OIB (VAT ID): HR07499344328
Data Protection Officer: contact@eksaria.com

For any questions regarding your personal data or this privacy policy, please contact us using the information above.

Information Collection and Use

We collect several different types of information for various purposes to provide and improve our Service to you.

• Personal Data: While using our Service, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you ("Personal Data"). This includes your email address for account creation and your shipping information for order fulfillment.
• 3D Models: We temporarily handle the 3D model files (STL, OBJ, 3MF) you upload to provide a price estimate and to fulfill your printing order. These files are used only to provide quotes and fulfill your order, and access is limited to Eksaria systems and authorized staff. They are typically deleted within 30 days after order completion.
• Order Information: We collect information about the print settings you select (material, color, quality, etc.) and your order history. This is linked to your user account to provide the "My Orders" feature.
• Payment Information: We use Stripe to process payments. We do not store your full credit card information on our servers. The transaction is handled by the respective payment processor, and we only store a record of the transaction for order fulfillment and history.
• Coupon and reward codes: If you receive or redeem a coupon code (for example a Google review reward), we store the code, its status (pending, active, used, or disabled), validity dates, and linked order identifiers needed to operate the reward program and prevent reuse.
• Cookies and Similar Technologies: We use cookies and similar technologies to enhance your experience, provide essential functionality, and improve our services. You can manage your cookie preferences through our cookie consent banner or in your account settings. For detailed information about our use of cookies, please see our cookie policy below.
• Quoter usage analytics: When you use the online quoter, we may store limited technical usage data (such as basic request info, material choice, and a technical file reference) to understand usage, prevent abuse, and improve the service. This is separate from optional cookie-based analytics and is kept for about 35 days.
• AI chatbot: If you use the on-site AI assistant, your messages are processed to generate answers using Google AI (Vertex AI). Conversation data is kept for about 7 days and then deleted.
• Contact form: If you contact us, we receive your name, email, and message (and any files you attach) by email so we can respond. Large attachments may be stored temporarily for about 7 days, then removed.
• Shipping partners: To deliver orders we share necessary delivery details (such as name, address or locker details, and contact information) with shipping partners including EuroSender and BoxNow.

Legal Basis for Processing

Under the General Data Protection Regulation (GDPR), we process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to fulfill your orders and provide our services
• Legitimate Interest: Processing for business operations, security, fraud prevention, and service improvement, including basic website visit statistics from limited technical data. This visit logging is separate from optional analytics cookies.
• Consent: For optional cookies and marketing communications (where applicable)
• Legal Obligation: Processing required by law (e.g., tax records, fraud prevention)

Data Retention Periods

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy:

• Account Information: When you delete your account, we remove your account and related personal profile data promptly. Order records needed for legal and tax purposes are anonymized and kept for the order/payment retention periods below.
• Order History: Retained for 7 years for tax and legal compliance
• 3D Model Files: Deleted within 30 days after order completion
• Payment Records: Retained for 7 years for financial compliance
• Coupon Records: Retained for as long as needed to enforce single-use rules and for up to 2 years after a code expires or is used, unless a longer period is required for fraud prevention or legal compliance
• Communication Records: Contact emails we receive are handled as ordinary business email. Temporary large contact attachments are kept for about 7 days, then deleted. We do not claim a fixed multi-year archive for contact form messages.
• Cookie Preferences: Stored in your browser until you clear or change them; a signed-in copy may also be kept with your account.
• Visit Logs: About 35 days, then deleted. Used for security, abuse prevention, and traffic analysis. Separate from optional analytics cookies.
• Quoter usage analytics: About 35 days.
• AI chatbot conversations: About 7 days.
• Analytics Data: When analytics cookies are accepted, analytics data is processed by Firebase Analytics under Google's retention settings for that product.
• Marketing Data: When marketing cookies are accepted, Google Ads / tag measurement data is processed under Google's practices; order-related conversion records may also follow the payment and order retention periods above.

International Data Transfers

Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States, where our service providers (Firebase, Stripe, Google) are located. These transfers are made in accordance with GDPR requirements:

• Transfers to countries with adequate data protection levels
• Use of Standard Contractual Clauses (SCCs) for transfers to the US
• Ensuring our service providers maintain appropriate security measures

Use of Data

Eksaria uses the collected data for various purposes:

• To provide and maintain the Service
• To manage your account and fulfill your orders
• To process payments
• To communicate with you about your orders or inquiries
• To provide customer support
• To monitor the usage of the Service and improve its functionality

Data Security

The security of your data is our top priority. We implement industry standard security measures to protect your personal and payment information:

• Data in transit is protected using HTTPS. Our hosting and service providers apply their standard security measures for data they store.
• Secure authentication and access controls protect your account
• Payment processing is handled by certified providers (Stripe)
• Regular security updates and monitoring

Your Data Rights

Under the General Data Protection Regulation (GDPR), you have several rights regarding your personal data:

• Right of Access: You can request a copy of all personal data we hold about you. Use "Export my data" in your profile Account settings, or contact us at contact@eksaria.com.
• Right to Rectification: You can request correction of inaccurate or incomplete personal data. You can update some information directly in your profile settings, or contact us for other corrections.
• Right to Erasure: You can request deletion of your personal data and account. Use "Delete my account" in your profile Account settings, or contact us at contact@eksaria.com.
• Right to Data Portability: You can request your data in a structured, machine readable format. Use "Export my data" in your profile Account settings, or contact us at contact@eksaria.com.
• Right to Restrict Processing: You can request that we limit how we use your personal data. Contact us directly for this request.
• Right to Object: You can object to processing based on legitimate interests. Contact us directly for this request.
• Right to Withdraw Consent: You can withdraw consent for optional data processing at any time through your profile settings or by contacting us.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority if you believe we have not handled your data properly.

To exercise any of these rights, use your profile Account settings where available, or contact us at contact@eksaria.com. We will respond within 30 days of receiving your request.

Data Breach Procedures

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform you without undue delay, unless the breach is unlikely to result in a risk to your rights and freedoms.

Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page. You are advised to review this Privacy Policy periodically for any changes.