Privacy Policy & UK GDPR Statement

The data controller responsible for your personal data is NovaLab 3D Ltd, a company registered in England and Wales under Company Number 16528152.

• •ICO Registration Number: ZC285933

For any privacy or data protection question or request, contact us at:

• •Email: support@novalab3d.com (please use the subject line "Data Protection Request")
• •Production Facility: 11 Levin Drive, Pickering, North Yorkshire, YO18 7UF, United Kingdom
• •Registered Office: 128 City Road, London, EC1V 2NX, United Kingdom

• •Identity Data: first name, last name, job title, and company or organisation name.
• •Contact Data: billing address, delivery address, email address and telephone number.
• •Financial Data: We do not store your full payment card details. Card payments are processed securely by third-party PCI-DSS compliant payment providers (for example Stripe or PayPal). For BACS bank transfers, we receive the payer name and payment reference that appear on our bank statement.
• •Transaction Data: details of quotations, invoices, payments to and from you, and the specifications of parts or services you have ordered.
• •Communications Data: emails and messages you send us, including any acknowledgements or confirmations you give about an order.
• •Marketing Data: your preferences for receiving newsletters or technical updates from us.

• •Project Data: the 3D model files (.STL, .STEP, .STP, .OBJ, .3MF, .IGES), engineering drawings and project notes you upload or email to us. These files are usually not personal data in themselves, but we protect them to the same standard because they are commercially confidential to you.
• •Technical Data: IP address (used for security, rate limiting and abuse prevention), browser type and version, operating system and time zone setting.

We do not knowingly collect any special category data (such as health information). Please do not include it in project notes or files.

You give us your Identity, Contact and Project Data when you:

• •submit our Request a Quote or Contact form;
• •email or phone us;
• •accept a quotation or place an order; or
• •subscribe to our updates.

If you order on behalf of an organisation, we may also receive your details from your colleagues, for example in a purchase order.

When you use our website, we automatically collect limited Technical Data. We do this through strictly necessary security logs and privacy-focused, cookieless analytics (Vercel Analytics and Speed Insights). The analytics measure aggregate site performance and do not identify you personally.

We use your Project Data only to:

• •assess manufacturability;
• •prepare your quotation; and
• •fulfil your order.

We never sell or publish client CAD files, and we never use them to train AI models. See also §5 of our Terms & Conditions (Intellectual Property & Confidentiality).

We use appropriate technical and organisational measures to protect your personal data and CAD files from accidental loss, alteration or unauthorised access. These include:

• •HTTPS/TLS encryption in transit;
• •restricted access controls;
• •cryptographic session signing; and
• •rate-limited endpoints.

Access to your files is limited to the people who need it to handle your quotation or order.

CAD files you send by email are deleted on the same schedule as uploaded files.

These providers process data on our behalf, under contracts that require them to protect it:

• •Payment providers: for example Stripe and PayPal.
• •Transactional email: Resend.
• •Cloud hosting and database: Vercel and Supabase.

These organisations use your data for their own legal purposes:

• •Couriers: Royal Mail, DPD, Parcelforce or DHL. They receive the recipient's name, delivery address, and email or phone number so they can deliver and send tracking notifications.
• •Professional advisers: our accountants, insurers and legal advisers, where needed.
• •Authorities: HM Revenue & Customs and other authorities, where the law requires it.

When you request a quote, we only ask for:

• •your name;
• •your email address;
• •your project notes; and
• •an optional CAD file.

We only ask for billing and delivery addresses once you decide to go ahead with an order. We process all personal data lawfully, fairly and transparently, only for the purposes set out in this policy, and keep it accurate, secure and no longer than necessary, in line with Article 5 of the UK GDPR.

When you select a 3D file on our quote form to preview its dimensions and volume, the calculation runs entirely in your web browser. The file is not uploaded until you submit the form. We do not make any decisions about you using solely automated processing, including profiling, that produce legal or similarly significant effects.

If a personal data breach is likely to pose a risk to your rights and freedoms, we will report it to the Information Commissioner's Office (ICO) within 72 hours of becoming aware of it. If the risk to you is high, we will also tell you without undue delay.

Our services are intended for adults and businesses. We do not knowingly collect personal data from anyone under 18.

Email support@novalab3d.com with the subject line "Data Protection Request".

• •Fee: Requests are normally free.
• •Response time: We will respond within one month of receiving your request. If a request is complex, or you make several requests, we may extend this by up to two further months. If we do, we will tell you within the first month and explain why.
• •Identity checks: We may need to confirm your identity before acting on a request.

Updated file retention: quote files 60 days, completed-order CAD files 12 months.

Added registered company name and ICO registration; lawful-basis table; full retention schedule; split processors from other recipients; named international transfer providers; corrected request response times; added PECR soft opt-in, complaints handling and children sections.

Initial publication of Privacy Policy & UK GDPR Statement.