Privacy Policy

1. Scope and Introduction

1.1 This Privacy Policy describes how 3D Spark GmbH, Klaus-Groth-Str. 88, 20535 Hamburg, Germany, registered with the commercial register of the local court of Hamburg under HRB 171102, VAT ID DE346182597 (“3D Spark,” “we,” “us”) processes personal data in connection with the “Voluminate — powered by 3D Spark” application and associated account services (the “Service”).

1.2 This Privacy Policy covers the Voluminate application itself and its account, billing, and support functions. It does not cover the separate 3D Spark marketing website or the separate 3D Spark manufacturing-analysis platform (platform.3dspark.de), each of which maintains its own privacy documentation.

1.3 This document is drawn up and legally authoritative in the English language only, consistent with the Voluminate General Terms and Conditions (“GTC”), which this Privacy Policy accompanies and is referenced by.

2. Controller, Data Protection Officer, Supervisory Authority

2.1 The controller responsible for the processing described in this Privacy Policy is 3D Spark GmbH, represented by its managing directors Ruben Meuth and Fritz Lange, at the address stated in Section 1.1.

2.2 3D Spark has voluntarily appointed a Data Protection Officer, reachable at datenschutz@3dspark.de, for any question regarding this Privacy Policy or the exercise of the rights described in Section 12.

2.3 The competent supervisory authority is the Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit). You have the right to lodge a complaint with this or any other competent supervisory authority.

3. Data We Collect

3.1 Account data. When you register, we collect your email address, password (stored in hashed form), and name. You may optionally add a company name in your profile settings.

3.2 Billing data. Billing address, VAT information, and payment details are collected directly by our payment processing infrastructure at checkout and do not pass through or get stored in 3D Spark's own systems. 3D Spark never sees or stores raw payment card data.

3.3 Usage data. We record account activity necessary to operate the Service, including conversion runs, credit balance and transaction history, ratings and feedback you provide, and support communications.

3.4 Content you upload. Files, briefs, and descriptions you submit for conversion (“Content”), and the models and results generated from them, are processed and stored as described in Sections 4, 8, and 11.

4. Personal Data Contained Within Uploaded Content

4.1 Content you upload may itself contain personal data belonging to third parties who have no direct relationship with 3D Spark — for example, the name of an individual engineer recorded in a technical drawing's title block.

4.2 For any such personal data contained within Content, 3D Spark acts solely as a processor, processing it only as necessary to perform the Service on your instructions, consistent with the data processing terms incorporated into the GTC. 3D Spark does not independently determine the purposes of processing such data and does not use it for any purpose beyond delivering the Service to you.

4.3 As set out in the GTC, you are responsible for ensuring you have a lawful basis to include any third-party personal data within Content you upload, and for meeting any transparency obligations you may owe to the individuals concerned.

5. Purposes and Legal Bases of Processing

We process personal data for the following purposes:

6. AI Processing and Model Training

6.1 Content is processed by artificial intelligence and automated processing services engaged by 3D Spark to generate the models and results delivered through the Service, as described in the GTC.

6.2 3D Spark does not use Content for AI training or model improvement purposes in a form that identifies you or any individual, and does not use personal data contained within Content for such purposes. Our AI/ML processing sub-processors are engaged under contractual terms that exclude the use of your Content for their own model training.

7. Automated Decision-Making

7.1 The Service includes an automated mechanism that may restrict an account's ability to run new conversions concurrently where usage shows a pattern indicative of abuse (for example, a disproportionate rate of abandoned results relative to accepted results), as described in the GTC.

7.2 This is an automated account restriction, not an irreversible or purely automated decision producing legal or similarly significant effects: it can be reviewed and lifted upon request by contacting support@3dspark.de.

8. Human Access to Content

8.1 Where you request the optional Hi-Fi CAD reverse-engineering service, your uploaded Content and accompanying brief are reviewed directly by human personnel — either 3D Spark staff or a third-party reverse-engineering provider engaged by 3D Spark for that request — in addition to any automated processing.

8.2 Independently of Hi-Fi CAD, 3D Spark development and Customer Success personnel may access Content on a strict need-to-know basis, limited to what is necessary for customer support, debugging, or improving the Service. Such access is not routine or unrestricted review.

9. Sub-processors

9.1 3D Spark engages third-party service providers, falling into the following categories, to perform or support the Service:

(a) Cloud hosting and infrastructure (application platform, database, authentication, and file storage);

(b) AI/ML processing providers (used for automated analysis and generation of 3D models and related content from Content);

(c) Workflow orchestration infrastructure;

(d) Payment processing;

(e) Internal communication tools (used for internal operational notifications, not customer-facing);

(f) Transactional email delivery;

(g) CRM and scheduling tools;

(h) Third-party reverse-engineering service providers, engaged case-by-case for Hi-Fi CAD requests; and

(i) Consent management, web analytics and advertising measurement providers, used on our publicly accessible pages only and only with your consent (see Section 11).

9.2 A current list of the categories of sub-processors, including their processing regions and transfer mechanisms, is published at https://voluminate.3dspark.de/subprocessors and carries the date of its last update. Details of the specific providers within each category are available upon written request to datenschutz@3dspark.de.

9.3 General authorisation and changes. You generally authorise the engagement and the replacement of sub-processors within the categories listed above and on that page, without separate notification. Only the addition of a new category is notified separately — by updating that page and by email to active customers — and may be objected to on reasonable data-protection grounds within 30 days of the notice.

10. International Data Transfers

10.1 Certain sub-processor categories are located, or process data, outside the European Economic Area. Where this occurs:

• Our cloud hosting and infrastructure provider stores Content and account data on infrastructure located in the United Kingdom, covered by the European Commission's adequacy decision for the UK (renewed December 2025, valid until 27 December 2031), under which no additional safeguards are currently required for that data-at-rest location. That provider's contracting entity is incorporated in the United States; the resulting transfer is safeguarded by Standard Contractual Clauses under our data processing agreement with that provider.

• Other transfers to the United States, where they occur, are safeguarded by Standard Contractual Clauses and/or reliance on the EU-US Data Privacy Framework, where the recipient is certified under it.

• Processing carried out by our workflow orchestration and internal communication infrastructure takes place within the European Union (Germany), without a third-country transfer.

• Where you consent to analytics and advertising cookies, data may be transferred to Google LLC in the United States, safeguarded by Standard Contractual Clauses and Google's certification under the EU-US Data Privacy Framework (see Section 11).

10.2 Details of the specific transfer mechanism applicable to a given sub-processor are available on request, as described in Section 9.2.

11. Cookies, Local Storage and Analytics

11.1 The Service sets the following strictly necessary cookies and browser storage items. No consent is required for these under § 25(2) no. 2 TTDSG, as they are required to provide the service you requested.

11.2 Analytics and advertising cookies. On our publicly accessible pages (in particular the landing page, pricing page, these legal pages and the sign-in/sign-up page) we use Google Analytics 4 and Google Ads conversion tracking, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. These technologies set cookies and similar identifiers (for example _ga, _ga_<container-id>, _gcl_au) with a typical lifetime of up to 24 months, and process information such as pages viewed, approximate location derived from a truncated IP address, device and browser data, referral source and click identifiers, in order to measure reach, understand how the Service is found and used, and to measure the effectiveness of our advertising.

11.3 These technologies are loaded only after you have given your consent through our consent banner. Until consent is given, no analytics or advertising scripts are loaded and no corresponding cookies are set. The legal basis for the storage of and access to information on your device is § 25(1) TTDSG, and for the subsequent processing of personal data Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time with effect for the future via the cookie settings link in the banner or the website footer; withdrawal does not affect the lawfulness of processing carried out before withdrawal.

11.4 Consent is managed by our consent management platform (Clickskeks / CCM19) and is shared across 3dspark.de and its subdomains, so that a choice made on our main website also applies here.

11.5 These technologies are not used inside the signed-in application area. Part numbers, uploaded files, briefs, generated models and other Content are never transmitted to Google. The conversion events we measure are limited to: completion of sign-up, confirmation of an email address, clicks on pricing call-to-action buttons, and completed credit purchases; they are transmitted without any Content and without file or part identifiers.

11.6 Google may process the data described above also in the United States. Google Ireland Limited acts as our processor, with onward transfers to Google LLC safeguarded by Standard Contractual Clauses and Google's certification under the EU-US Data Privacy Framework. Data collected via Google Analytics is retained by Google for a maximum of 14 months. Further information is available in Google's privacy policy at https://policies.google.com/privacy.

11.7 The authentication session is stored in your browser's local storage rather than as an HttpOnly cookie, consistent with the underlying authentication infrastructure we use.

12. Data Retention

12.1 Content and generated results are retained for the duration of your account and for a reasonable period thereafter, currently targeted at 12 months after the last activity on a given part, and 30 days following account closure, after which such data is deleted absent a legal obligation to retain it.

12.2 Diagnostic materials submitted with feedback (such as screenshots) are retained for a shorter period, currently targeted at 90 days.

12.3 Billing and invoice records are retained for the statutory periods required under German commercial and tax law (currently up to ten years), independent of and surviving any other deletion request. Support or feedback correspondence that qualifies as commercial correspondence under German commercial law is retained for the corresponding statutory period (currently up to six years); other correspondence is deleted together with the account.

12.4 Dormant accounts. If an account shows no activity (no sign-in, upload, conversion or purchase) for 24 months, it is closed and deleted. We notify you by email approximately 90 days and again 14 days before that happens, and any activity resets the period. After the notice period the account enters the same 30-day offboarding window as a self-requested deletion, during which you can still sign in and export your data.

12.5 3D Spark reserves the right to adjust these operational retention targets from time to time, consistent with applicable data protection law.

13. Marketing Communications

13.1 Where you have given consent, or where permitted on the basis of a legitimate interest in direct business-to-business marketing under applicable German law, contact data collected in connection with the Service (including through demo-booking functionality) may be used to send you marketing communications about 3D Spark's products.

13.2 You may withdraw consent or object to such use at any time, free of charge, using the unsubscribe link included in every such communication, or by contacting datenschutz@3dspark.de.

14. Your Rights

You have the right to:

• request access to the personal data we hold about you;

• request rectification or erasure of that data;

• request restriction of processing;

• receive your data in a portable format;

• object to processing based on legitimate interest;

• withdraw consent at any time with effect for the future, without affecting the lawfulness of processing before withdrawal; and

• lodge a complaint with the supervisory authority named in Section 2.3.

To exercise these rights, contact support@3dspark.de. We will respond within the timeframe required by applicable law.

15. Data Security

3D Spark applies technical and organizational measures appropriate to the risk, including encryption in transit, access controls, and short-lived signed URLs for file access, to protect personal data against unauthorized access, loss, or misuse.

16. Children

The Service is intended for use by businesses and professionals and is not directed at children. We do not knowingly collect personal data from children.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to the Service or to applicable law. The current version is available within the Service at all times.

18. Contact

Questions about this Privacy Policy: datenschutz@3dspark.de

General support and data subject requests: support@3dspark.de