Privacy policy

3D-LabEq – 3D-Printed Lab Equipment 

Last updated: October 2026

The protection of your personal data is very important to us. In the following, we inform you in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and the Telecommunications Digital Services Data Protection Act (TDDDG) about the nature, scope, and purpose of the processing of personal data when using our online shop at 3D-LabEq.de.

This Privacy Policy applies to the website 3D-LabEq.de as well as all associated services, products (e.g. 3D-printed tube racks, tube holders, bottom plates, calibration plates, pipette tip rack holders, and laboratory materials) and services (e.g. aliquoting, assay setup, laboratory automation, 3D printing services, and the provision of JSON labware files and protocols).

1. Controller

The controller within the meaning of the GDPR is:

3D-LabEq
Sole proprietorship of Dr. Marco Grull
Rheinstr. 36
64665 Alsbach-Hähnlein
Germany

Email: info@3d-labeq.de
Phone: +49 151 5877 8704

A Data Protection Officer has not been appointed, as there is currently no legal obligation to do so. If you have any questions regarding data protection, you may contact us at any time via info@3d-labeq.de.

2. General Information on Data Processing

We process personal data only to the extent necessary to provide a functional online shop as well as our content and services.

Legal Bases

  • Art. 6(1)(a) GDPR – Consent
  • Art. 6(1)(b) GDPR – Performance of a contract and pre-contractual measures
  • Art. 6(1)(c) GDPR – Legal obligation
  • Art. 6(1)(f) GDPR – Legitimate interest (e.g. secure operation of our online shop, protection against fraud and misuse, optimization of our services)


3. Hosting and Shop Platform (Shopify)

Our online shop is operated via Shopify.

Provider:
Shopify International Ltd.
Victoria Buildings
1–2 Haddington Road
Dublin 4
Ireland

We have concluded a Data Processing Agreement in accordance with Art. 28 GDPR.

Further information:

Shopify Privacy Policy

4. Access Data and Server Log Files

When visiting our website, the following data is automatically collected:

  • IP address
  • Date and time of access
  • Accessed page or file
  • Referrer URL
  • Browser type and browser version
  • Operating system
  • Amount of data transferred

Legal basis: Art. 6(1)(f) GDPR (secure operation of the shop).

These access data are processed as server log files on the Shopify platform. They are used for security and troubleshooting, not for marketing, and are retained only for a short period as determined by Shopify’s platform operations. Shopify does not publish a fixed merchant-facing retention period for these logs; we do not store a separate long-term copy of the raw logs ourselves.

5. Orders in the Online Shop

For the performance of contracts, we process:

  • Name
  • Company name (for B2B customers)
  • Addresses
  • Email address
  • Phone number (optional)
  • VAT identification number / tax number (where provided for B2B invoicing)
  • Order data
  • Payment information

Legal basis: Art. 6(1)(b) GDPR; for VAT identification and invoicing details also Art. 6(1)(c) GDPR where tax law requires it. For deliveries outside the EU (for example to Switzerland or the United Kingdom), we additionally process data necessary for export and customs clearance (e.g. consignee details, goods description, value and weight) and may transmit them to shipping providers and, where required, to customs authorities (Art. 6(1)(b) and (c) GDPR).

6. Digital Content and Downloads

JSON labware files, protocols, and similar digital content are provided exclusively after purchase via customer account, download link, or email.

Legal basis: Art. 6(1)(b) GDPR.

7. Services (Laboratory Automation and 3D Printing)

Additional project-related data (technical requirements, parameters, configurations) is processed solely for the purpose of providing the requested service.

Legal basis: Art. 6(1)(b) GDPR.

7.1 3D print calculator

When you use our 3D print calculator, your STL file is first analysed only in your browser to calculate volume, dimensions and price. Only when you continue to checkout do we transmit the file together with the selected print options (for example material, colour, layer height, infill and quantity) to our service on Google Apps Script. There we store the file and a quote summary in Google Drive, log the request in a Google spreadsheet and create a draft order in Shopify. You then enter your customer details (for example email, company, name, billing and delivery address, payment data) in the Shopify checkout; they are processed as for other online-shop orders. The purpose is checking the file, preparing the quote and processing your order (Art. 6(1)(b) GDPR); abuse protection such as quantity and upload limits is based on our legitimate interest (Art. 6(1)(f) GDPR). Recipients are Google Ireland Ltd. (Google Workspace) and Shopify International Ltd. as processors; data may be transferred to the USA under the EU-US Data Privacy Framework or standard contractual clauses. We delete unfinished draft orders after 14 days and uploaded files after 30 days; for paid orders we keep the file and quote for 12 months, and invoice and order data for the statutory retention periods.

8. Customer Account

Creating a customer account is voluntary.

The following data may be stored:

  • Name
  • Email address
  • Addresses
  • Order history

Legal basis: Art. 6(1)(b) GDPR.

Deletion is possible at any time.

9. Contact Requests

When contacting us (for example via the contact form, email, phone or WhatsApp), we process:

  • Name
  • Email address
  • Phone number (if you provide it)
  • Message content

for the purpose of handling your request. Legal basis: Art. 6(1)(b) or Art. 6(1)(f) GDPR. Contacting us is voluntary.

If you contact us via WhatsApp using the number published in the shop (currently +49 151 5877 8704), the service is provided by WhatsApp Ireland Limited / Meta Platforms. Message content, your phone number and related metadata are processed by Meta; depending on Meta’s configuration, data may be transferred to the USA or other third countries (see Meta’s privacy information). We use WhatsApp only for voluntary communication you initiate; please do not send sensitive data (e.g. passwords or special categories of personal data) via WhatsApp.

9.1 Newsletter

In the shop footer you can subscribe to our newsletter with your email address (Shopify customer/email signup form). We use your email address to send information about our products, services and shop news. Legal basis: your consent, Art. 6(1)(a) GDPR and Section 7 UWG. The mailing is handled via Shopify (Shopify International Ltd.); we do not use a separate external email service provider such as Mailchimp or Klaviyo for this form. Shopify stores your marketing preference as documentation of your subscription. You can withdraw your consent at any time with effect for the future by using the unsubscribe link in each newsletter email or by contacting us at info@3d-labeq.de; withdrawal does not affect the lawfulness of processing before withdrawal.

10. Payment Service Providers

Data is transferred to payment providers such as:

  • Shopify Payments
  • Stripe
  • PayPal

solely for payment processing purposes.

Legal basis: Art. 6(1)(b) GDPR.

11. Shipping Service Providers

We transfer the following data to shipping providers as necessary for delivery:

  • Name
  • Address
  • Email address (if required for shipment tracking)

Legal basis: Art. 6(1)(b) GDPR.

12. Cookies, Consent Management and Analytics

Our online shop uses cookies and similar technologies (e.g. local storage, pixels). Technically necessary cookies (e.g. shopping cart, login session, checkout, security, storing your cookie choice) are set on the basis of Section 25(2) No. 2 TDDDG and Art. 6(1)(b) and (f) GDPR. Cookies and similar technologies that are not technically necessary, in particular for analytics, are only used after you have given your consent via our cookie banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). The integration of product reviews and appointment booking is described in sections 12.3 and 12.4.

12.1 Consent banner (Shopify)
We use the consent banner provided by Shopify to obtain and store your choices. Your decision is stored in a cookie. You can change or withdraw your consent at any time with effect for the future via the Cookie settings link in the shop footer (it reopens Shopify’s cookie preference dialog), or by deleting the cookies stored for our shop in your browser; the cookie banner will then be shown again on your next visit and you can make a new choice. You can also contact us at info@3d-labeq.de.

12.2 Shopify analytics
With your consent, Shopify collects statistical information about the use of our shop (e.g. pages viewed, products viewed, cart and checkout events, device and browser information, shortened or full IP address) so that we can evaluate and improve our offer. Legal basis: Art. 6(1)(a) GDPR.

12.3 Product reviews (Judge.me)
We use Judge.me (Judge.me Ltd, c/o Buckworths, 1–3 Worship Street, London EC2A 2AB, United Kingdom) to display product reviews. When product pages are loaded, your browser connects to Judge.me servers; your IP address and technical browser data are transmitted in the process. If you submit a review, we process your name, email address, the review content and the related order. If we send you an email after a purchase asking you to review the product, this may be based on Art. 6(1)(f) GDPR and, where applicable, Section 7(3) UWG (existing customer relationship for similar goods or services); you can object to this at any time, e.g. via an unsubscribe link or by sending a message to info@3d-labeq.de. With your consent, Judge.me also receives usage events from our shop (pixel). Legal bases: Art. 6(1)(f) GDPR (presentation of genuine customer reviews), Art. 6(1)(a) GDPR (pixel), Art. 6(1)(b) GDPR (submitted reviews). Judge.me acts as our processor.

12.4 Appointment booking (Calendly)
On the page "Book a Consultation" we offer the scheduling service Calendly (Calendly LLC, 115 E Main St, Ste A1B, Buford, GA 30518, USA). Calendly is not loaded automatically when you open the page. Your browser connects to Calendly servers only after you click “Load Calendly” (consent for this embedding) or if you have already allowed marketing cookies via our cookie banner. Only then may Calendly set cookies or similar technologies and receive your IP address and technical browser data. When you book an appointment, Calendly processes the data you enter (e.g. name, email address, company, desired date, message). Legal basis for loading the widget and non-essential Calendly technologies: your consent, Section 25(1) TDDDG and Art. 6(1)(a) GDPR; for processing booking data to arrange the appointment: Art. 6(1)(b) GDPR (pre-contractual measures). You can also open the booking page directly on calendly.com. Calendly is certified under the EU-U.S. Data Privacy Framework. You may withdraw cookie/marketing consent via Cookie settings.

12.5 No further tracking
We currently do not use Google Analytics, Hotjar, Meta (Facebook) Pixel or comparable third-party tracking or marketing tools.

13. Further Recipients and Processors

  • Email: Strato GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany – hosting of our email mailboxes (Art. 6(1)(b) and (f) GDPR).
  • Accounting and invoicing: sevDesk GmbH, Hauptstraße 115, 77652 Offenburg, Germany – creation of invoices and bookkeeping (Art. 6(1)(b) and (c) GDPR).
  • 3D print calculator / Google Workspace: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland – Google Apps Script, Google Drive and Google Sheets for file and quote handling as described in section 7.1 (Art. 6(1)(b) and (f) GDPR). Whether a separate Art. 28 data processing agreement is in place is a contractual matter with Google and is not created by this notice.
  • Payment: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg; Shopify Payments including Shop Pay (payment processing involving Stripe Payments Europe Ltd., Dublin, Ireland); for other payment methods offered in the checkout, the respective provider. For Shop Pay and platform fraud-prevention checks, Shopify may process data under its own responsibility as described in section 18 and Shopify’s privacy policy.
  • Shipping: the shipping company we commission for your order (see section 11); the specific carrier depends on destination and shipment and is shown with the tracking information where available. We do not list a fixed carrier here.
  • Tax advisor, authorities and courts, where we are legally obliged or this is necessary to assert or defend legal claims (Art. 6(1)(c) and (f) GDPR).

Where service providers process data on our behalf as processors, Art. 28 GDPR requires an appropriate data processing agreement; concluding and maintaining those contracts is our responsibility as controller and is not proven by this privacy policy alone.

14. Transfers to Third Countries

Some of our service providers process personal data outside the European Economic Area (EEA):

  • Shopify: Data may be transferred to Shopify Inc. in Canada and to Shopify group companies and sub-processors, among others in the USA. Transfers to Canada are based on the European Commission's adequacy decision; transfers to the USA and other third countries are based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, where a recipient is certified, on the EU-U.S. Data Privacy Framework (Art. 45 GDPR).
  • Calendly (USA): EU-U.S. Data Privacy Framework (Art. 45 GDPR), additionally Standard Contractual Clauses.
  • Judge.me (United Kingdom): adequacy decision of the European Commission for the United Kingdom (Art. 45 GDPR); sub-processors outside the EEA on the basis of Standard Contractual Clauses.
  • Google (Google Workspace / Apps Script / Drive, see section 7.1): data may be processed in the USA or other third countries under the EU-U.S. Data Privacy Framework where certified and/or Standard Contractual Clauses (Art. 45 / Art. 46 GDPR).
  • Meta / WhatsApp: if you contact us via WhatsApp, Meta may transfer data to the USA or other third countries; details are set out in Meta’s / WhatsApp’s privacy information.
  • PayPal and other payment providers may transfer data to third countries, e.g. for fraud prevention; details can be found in their privacy policies.

You can request a copy of the safeguards used by contacting us.

15. Storage Duration

We store personal data only for as long as necessary for the respective purpose or as required by statutory retention obligations:

  • Contract and order data: for the duration of the contract and the limitation period for claims (generally 3 years from the end of the year in which the claim arose, Section 195 BGB).
  • Commercial and business letters (e.g. order and email correspondence relevant for the business): 6 years (Section 257 HGB, Section 147 AO).
  • Invoices and accounting vouchers: 8 years; books, annual financial statements and other accounting records: 10 years (Section 257 HGB, Section 147 AO).
  • Customer account: until you delete the account or ask us to delete it; data subject to retention obligations is then restricted and deleted at the end of the retention period.
  • Contact requests: deleted once your request has been fully processed, unless retention obligations apply.
  • Product reviews: as long as the review is published or until you request deletion.
  • Server log files (section 4): short-term retention for security and error analysis on the Shopify platform, as determined by Shopify; not used for marketing. Shopify does not publish a fixed merchant-facing retention period for storefront access logs.
  • 3D print calculator drafts and uploads: as stated in section 7.1 (unfinished drafts 14 days, uploads 30 days, paid orders 12 months for file/quote, statutory periods for invoices).
  • Newsletter subscription: until you unsubscribe or we delete the marketing preference; evidence of consent is kept as long as needed to demonstrate compliance.
  • Cookies: according to the respective storage duration shown in the cookie banner; your consent choice is generally stored for 12 months.

16. Your Rights

You have the following rights with regard to your personal data:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to withdraw your consent at any time with effect for the future (Art. 7(3) GDPR); the lawfulness of processing carried out on the basis of the consent until its withdrawal remains unaffected.

Right to object (Art. 21 GDPR): Where we process your data on the basis of Art. 6(1)(f) GDPR, you have the right to object to the processing at any time on grounds relating to your particular situation. If you object to processing for direct marketing purposes, we will no longer process your data for these purposes.

To exercise your rights, an informal message to info@3d-labeq.de is sufficient.

17. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Gustav-Stresemann-Ring 1
65189 Wiesbaden
Germany

18. Obligation to Provide Data and Automated Decision-Making

The provision of personal data is neither legally nor contractually required. However, the data marked as mandatory in the order process (e.g. name, company, billing and delivery address, email address, payment data) are required to conclude and perform the contract; without them we cannot process your order. Providing data in the contact form, for a customer account, for reviews or for appointment bookings is voluntary. We do not use automated decision-making including profiling within the meaning of Art. 22 GDPR that produces legal effects concerning you without human involvement. To protect against payment fraud and misuse, Shopify and our payment service providers carry out automated checks (Art. 6(1)(f) GDPR). For Shop Pay and related fraud-prevention measures, Shopify may act as an independent controller for those security/fraud purposes under Shopify’s own privacy policy; we remain controller for performing your order.

19. Changes to this Privacy Policy

We may adapt this privacy policy if our services or the legal situation change. The current version is always available at www.3d-labeq.de/policies/privacy-policy.