Privacy Policy
Date last updated: 24 August 2026
This Privacy Policy describes how Papercraft-3D collects, uses and protects your personal data when you visit the website www.papercraft-3d.com, pursuant to the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the French « Informatique et Libertés » law of 6 January 1978, as amended.
1. Data controller
Data controller: SARL STRATINET, operating the website Papercraft-3D.com
Registered office: 1081 chemin de la Nartassière, 06370 Mouans-Sartoux, France
Registration: RCS Cannes 944 837 871, SIRET 944 837 871 00010, intra-Community VAT FR92944837871
Website: https://www.papercraft-3d.com/en/
Email: contact@papercraft-3d.com
Data Protection Officer (DPO): Alexandre Fuchs, contact@papercraft-3d.com
2. Personal data collected
We collect only the data that is strictly necessary for the purposes described below. Depending on your interaction with the website, the categories of data processed may include:
- Identification data: surname, first name, email address, postal address, telephone number (when creating an account or placing an order).
- Payment data: bank card number (processed directly by our payment service provider, never stored on our servers), transaction history.
- Order and delivery data: products ordered, amounts, delivery address, parcel tracking number.
- Browsing data: IP address, browser type, pages visited, time spent, source of arrival, cookie identifiers.
- Communication data: content of messages exchanged via the contact form or by email.
- Marketing data: newsletter subscription preferences, email opens and clicks.
3. Purposes of processing and legal bases
| Purpose | Legal basis | Retention period |
|---|---|---|
| Management of orders, delivery, invoicing | Performance of the contract (Art. 6.1.b GDPR) | 10 years (legal accounting obligation) |
| Creation and management of the customer account | Performance of the contract | 3 years after last login |
| Customer service (responses to questions) | Legitimate interest | 3 years after last contact |
| Newsletter and marketing communications | Consent (Art. 6.1.a GDPR) | Until unsubscribed, max 3 years after last interaction |
| Audience measurement and statistical analysis | Consent (cookies) | 13 months (CNIL recommendation) |
| Advertising personalisation (Pinterest, Meta, Google) | Consent | 13 months |
| Website security (anti-fraud, anti-spam) | Legitimate interest | 12 months |
4. Recipients of your data
Your data is never sold to third parties. It may be transmitted to the following recipients, strictly for the purposes set out above:
- Payment service providers: Stripe (Stripe Payments Europe Ltd., Ireland), PayPal (PayPal Europe S.à r.l., Luxembourg).
- Delivery service providers: Mondial Relay, Colissimo, and other carriers depending on the method chosen.
- Email marketing service providers: Brevo (Sendinblue SAS, France) for sending newsletters and transactional emails.
- Analytics and measurement service providers: Google Analytics (Google Ireland Ltd.), Google Tag Manager.
- Advertising service providers: Pinterest (Pinterest Europe Ltd., Ireland) via Pinterest Tag and Conversions API; Meta (Facebook Ireland Ltd.); Google Ads.
- Hosting and infrastructure service providers: Hetzner Online GmbH (Germany) for server hosting.
- Security service providers: Wordfence (Defiant Inc.) for protection against attacks.
- Verified reviews platform: Customer Reviews for WooCommerce (CusRev Ltd.).
- Administrative or judicial authorities: only upon legal request.
5. Transfers outside the European Union
Certain service providers (in particular Pinterest, Meta, Google) may transfer data to the United States. These transfers are governed by the Data Privacy Framework (DPF) or by Standard Contractual Clauses (SCCs) approved by the European Commission, in accordance with Articles 44 et seq. of the GDPR. You may contact us to obtain a copy of the applicable safeguards.
6. Cookies and trackers
The website uses several categories of cookies:
- Strictly necessary cookies (cart, session, security), placed without consent, basis: legitimate interest.
- Audience measurement cookies (Google Analytics 4), subject to consent.
- Advertising and personalisation cookies (Pinterest Tag, Meta Pixel, Google Ads), subject to consent.
- Functional cookies (display preferences, language), subject to consent.
You can accept, refuse or customise the placement of cookies via the consent banner displayed on your first visit, or change your choices at any time via the Cookie management link in the footer. You can also configure your browser to block cookies (Chrome, Firefox, Safari, Edge all offer this option in their settings).
7. Pinterest Tag and Conversions API
Our website uses the Pinterest Tag as well as Pinterest’s Conversions API to measure the performance of our posts and advertisements on Pinterest. These tools transmit information to Pinterest about your interactions with the website (pages viewed, additions to cart, purchases), associated with a cookie identifier or a hashed version of your email address when you are logged in to your account. These processing operations are subject to your prior consent, which may be withdrawn at any time via cookie management.
8. Your rights
In accordance with the GDPR, you have the following rights over your personal data:
- Right of access: to obtain confirmation that your data is being processed and to receive a copy of it.
- Right to rectification: to correct inaccurate or incomplete data.
- Right to erasure (« right to be forgotten »): to request the deletion of your data, except where there is a legal retention obligation.
- Right to restriction of processing: to temporarily suspend processing.
- Right to object: to object to processing based on legitimate interest or to direct marketing.
- Right to data portability: to retrieve your data in a structured, machine-readable format.
- Right to withdraw your consent at any time, without affecting the lawfulness of prior processing.
- Right to define instructions regarding the fate of your data after your death.
To exercise these rights, write to contact@papercraft-3d.com, specifying the subject of your request and attaching a copy of proof of identity if necessary. We respond within a maximum of 30 days.
9. Complaint to the CNIL
If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL):
CNIL - 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07
Telephone: 01 53 73 22 22
Website: www.cnil.fr
10. Data security
We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access: TLS/HTTPS encryption across the entire website, hosting on secure servers in the European Union, passwords stored in hashed form, regular backups, web application firewall, and access to data limited only to authorised persons.
11. Minors
The website is not intended for children under 15 years of age. We do not knowingly collect data concerning minors without the consent of the holders of parental authority. If you believe that a minor has transmitted data to us without authorisation, contact us at contact@papercraft-3d.com and we will erase it.
12. Changes to the Privacy Policy
We may need to modify this Privacy Policy to reflect legal, technical or service-related developments. The date last updated appears at the top of the page. In the event of a substantial change, we will inform you by email or via a banner on the website.
13. Contact
For any question relating to this Policy or to your personal data: contact@papercraft-3d.com.