Payments from Poland only for now: BLIK, fast online transfer and bank transfer to a Polish account. We ship within Poland. Payments for customers outside Poland are coming soon.

Privacy Policy

What data we collect, why, how long we keep it and what rights you have. Version of 9 November 2026.

About this translation

This English version is a translation provided for convenience. In case of any discrepancy, the Polish version (Polityka prywatności) is binding.

1. Who is the data controller

  1. The controller of your personal data is Patryk Wołosowicz, who runs the Rubikon 3D shop as unregistered business activity (działalność nierejestrowana), ul. Świerzawska 4/229, 60-321 Poznań (hereinafter: "we").
  2. For matters concerning personal data, write to druk@rubikon3d.com or call +48 609 692 311. We have not appointed a data protection officer.

2. What data we collect and why

Price calculator

  • We process a file uploaded to the calculator only to calculate the price. We do not store it: it is deleted once the price has been calculated.
  • We store a hash of the IP address (a string of characters created from the IP address, not the address itself), the chosen material and use, the file type and size, and the quote result.
  • Purpose: protecting the calculator against abuse, that is a daily limit of quotes per person and a monthly limit of all quotes, and attaching the quote result to your inquiry if you send one. Legal basis: our legitimate interest (Article 6(1)(f) of the GDPR, in Polish: RODO).
  • Retention period: 40 days.

Custom printing inquiry

  • Data: e-mail address and, if you provide them, also your first and last name, phone number and the content of your message. In addition, the files (up to 10 in one inquiry), and for each of them the chosen material and colour, use, number of copies, model dimensions and price estimate, as well as a hash of the IP address.
  • Purpose: preparing a quote and contacting you about the order. Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR). The IP address hash is used for the limits on files in inquiries, that is protection against abuse (Article 6(1)(f) GDPR).
  • The form is protected by Cloudflare Turnstile, which checks whether the inquiry is being sent by a human. To do this, it uses, among other things, the IP address and browser data.
  • After you send an inquiry, we send a confirmation to the e-mail address you provided, with the inquiry number and a summary (file names, chosen options, estimated price), without the files themselves and without the content of your message.
  • Retention period: the data and file on the shop server are deleted automatically 30 days after the inquiry is sent. A notification of the inquiry, with the data and file, goes to our e-mail inbox. If no order follows, we delete it no later than after 30 days, unless we are still corresponding about the matter. If the inquiry leads to an order, we keep the data in the same way as order data.

Orders in the shop and on sales platforms

  • Data: first and last name, delivery address or the chosen Paczkomat (InPost parcel locker) or DPD Pickup point, e-mail address, phone number, ordered products, amounts, payment information and tracking number. If you pay by ordinary bank transfer, we also see the transfer details: the sender's first and last name or name, account number, amount and transfer title. When you buy through a sales platform, e.g. OLX or Allegro Lokalnie, also your username and the data the platform passes on to us.
  • Purposes and legal bases: concluding and performing the contract, including shipping (Article 6(1)(b) GDPR); obligations under tax and consumer law, e.g. sales records, bills, handling withdrawal from the contract and complaints (Article 6(1)(c) GDPR); pursuing and defending against claims (Article 6(1)(f) GDPR).
  • Retention period: for the duration of the contract, and then until the limitation period for claims expires. Data needed for tax settlements is kept for 5 years from the end of the year in which the tax payment deadline passed (art. 70 § 1 (Article 70 § 1) of the Tax Ordinance (Ordynacja podatkowa)).
  • You place an order in the cart. The form is protected by Cloudflare Turnstile, which checks whether the order is being placed by a human (to do this, it uses, among other things, the IP address and browser data). We also store a hash of the IP address to limit the number of orders from one connection within a day - this is protection against abuse (Article 6(1)(f) GDPR).
  • We send an order confirmation to the e-mail address you provided, and then messages about payment, shipping or cancellation.
  • When you search for a Paczkomat, the postcode or Paczkomat code you enter is passed to the InPost point finder, without your personal data.

Cart in your browser

  • The contents of the cart (products, variants, colours, materials, quantities) are stored only in your browser's memory (localStorage), and the data entered in the order form until you close the tab (sessionStorage). They do not reach us until you place an order.
  • This is necessary for the cart you ask for to work, so we do not ask for consent (art. 399 ust. 3 (Article 399(3)) of the Electronic Communications Law (Prawo komunikacji elektronicznej)). You can delete the data by emptying the cart or clearing the site data in your browser.

Customer account

  • Data: e-mail address, the date the account was created and of the last login, and, if you save them, also your first and last name, phone number, delivery address, preferred delivery method and pickup point, and favourite products. At login, we store a hash of the login code (the code is valid for 15 minutes) and a hash of the IP address to limit the number of codes sent within an hour.
  • In the account we show orders placed with the account's e-mail address, including those placed before it was created - for this we use the order data described above.
  • Purpose and legal basis: maintaining the account you ask for (Article 6(1)(b) GDPR); the code limits are protection against abuse (Article 6(1)(f) GDPR). The login form is protected by Cloudflare Turnstile.
  • Retention period: account data until the account is deleted - you can do this yourself on the account page. Login codes are deleted after a day, and sessions after logging out or after 180 days. Deleting the account does not delete order data - we keep it as described for orders.

Contact by e-mail, phone and social media

  • Data: whatever you provide in a message or conversation, e.g. first name, e-mail address, phone number and content.
  • Purpose: replying to your message. Legal basis: our legitimate interest (Article 6(1)(f) GDPR), and where it concerns an order, also steps taken before entering into a contract (Article 6(1)(b) GDPR).
  • Retention period: until the matter is closed, and if a contract or a claim resulted from the conversation, until the limitation period for claims expires.
  • If you write to us via Facebook or Instagram, your data is also processed by Meta Platforms Ireland Ltd. under its own privacy policy.

Website operation and security

  • The hosting provider (Cloudflare) processes technical connection data, e.g. the IP address and browser data, to deliver the website and protect it against attacks. The technical log of our application is kept for up to 7 days.
  • Legal basis: our legitimate interest, that is the operation and security of the website (Article 6(1)(f) GDPR).

3. Who we share data with

  • Cloudflare, Inc.: website hosting, database, storage of files from inquiries, form protection (Turnstile) and sending e-mails from the inquiry form, from orders and with account login codes: notifications for us and messages for you. It processes data on our behalf.
  • Apple (iCloud+ service): the druk@rubikon3d.com mailbox runs on our private iCloud account, where we handle correspondence and receive notifications about inquiries. Apple processes this data under its own rules, described in the Apple privacy policy.
  • Google (Google Sheets and Google Drive): on our private Google account we keep records of orders and sales and store documents needed for settlements. Among other things, we record there the buyer's first name or username and the tracking number. Google processes this data under its own rules, described in the Google privacy policy.
  • HotPay: ePłatności Sp. z o.o. Sp. k. or HotPay B2B Sp. z o.o., ul. 27 Stycznia 9, 34-120 Andrychów, online payment operator. With regard to payments, it is a separate data controller.
  • InPost sp. z o.o.: delivery of parcels. We pass on your first and last name, phone number, e-mail address and delivery address or the chosen Paczkomat. It is a separate data controller.
  • DPD Polska sp. z o.o., ul. Mineralna 5, 02-274 Warszawa: delivery of parcels when you choose DPD delivery. We pass on your first and last name, phone number, e-mail address and delivery address or the chosen DPD Pickup point. It is a separate data controller, and its rules are described in the DPD privacy policy.
  • The bank where we hold our account, when you pay by ordinary bank transfer: it sees the transfer details (the sender's first and last name or name, account number, amount and transfer title) and processes them under its own rules.
  • Sales platforms, when you buy through them: each is a separate data controller under its own rules.
  • Backblaze, Inc. (Backblaze B2 service): stores an encrypted backup of our database in a data centre in the European Union. The backup is encrypted before it leaves our server, so Backblaze cannot see its content.
  • Authorities and other public bodies, where the law requires it, e.g. the tax office.

4. Transfers of data outside the European Economic Area

  1. Cloudflare, Apple, Google and Meta may also process data in the United States. This takes place on the basis of a European Commission decision finding an adequate level of data protection (EU-US Data Privacy Framework) or standard contractual clauses approved by the Commission.

5. Your rights

You have the right to:

  • access your data and receive a copy of it,
  • rectify your data,
  • erase your data,
  • restrict processing,
  • data portability for data we process on the basis of a contract by automated means,
  • object to processing based on our legitimate interest,
  • lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).

To exercise these rights, write to druk@rubikon3d.com. We will reply within one month.

6. Do you have to provide data

  1. Providing data is voluntary, but without an e-mail address we cannot prepare a quote, and without shipping details we cannot fulfil an order. The first and last name and phone number in the inquiry form are optional.

7. Automated decisions

  1. We do not make decisions about you that produce legal effects based solely on automated processing, and we do not profile you. The limits of the calculator and the inquiry form work automatically, but they only limit the number of quotes and inquiries. The price in the calculator is calculated automatically by the program, but it is only an estimated price: we give the binding price in the quote, after checking the file.

8. Cookies

  1. The website does not use analytics or advertising tools. The only cookie, r3d_s, is set after you log in to your account: it keeps you logged in for 180 days or until you log out. It is necessary for the account you ask for to work, so it does not require your consent (art. 399 ust. 3 (Article 399(3)) of the Electronic Communications Law).
  2. When you open the inquiry form, Cloudflare Turnstile loads, and it may store in your browser data needed to check whether you are a human. This is necessary for the form to work, so it does not require your consent (art. 399 ust. 3 (Article 399(3)) of the Electronic Communications Law).

9. Security

  1. The connection to the website is encrypted (HTTPS). Files from inquiries are available only through secured links and are deleted automatically.
  2. We copy the shop database (orders, customer accounts and inquiries) every night to our server, and from there in encrypted form to a network drive and to the Backblaze B2 service. We keep copies on the server for 30 days and encrypted copies for up to 12 months. Data deleted from the shop may therefore remain in backups for up to that time, after which it is deleted automatically.

10. Changes to the Privacy Policy

  1. When we change the rules for processing data, we will update this page and the version date at the top.