Privacy policy

Last updated: 7 October 2026

1. Who is responsible for processing your data

The controller for the processing described here is Lukas Emming, Lukas-3DWorld, An der Uerde 37, 46414 Rhede, Germany. You can contact us by email at info@lukas-3dworld.de or info.lukas3dworld@gmail.com, by telephone at +49 1777 004855 or by post at the address above.

This notice applies to visits to our online store, enquiries, orders and use of the functions offered. We explain in section 8 where Shopify processes data for its own purposes.

2. Technical operation of the store

Our store is operated using Shopify. When you open a page, data generated includes your IP address, time of access, URL accessed, browser and device information, and technical connection data. We and Shopify process this data to provide the website, cart and checkout, fix errors, and detect misuse or attacks. Article 6(1)(b) GDPR is the legal basis for requested functions; Article 6(1)(f) GDPR applies to security and functionality. Our legitimate interest is the reliable and secure operation of the store.

Strictly necessary cookies and comparable access to your device are needed for the store functions you request (section 25(2) of the German Telecommunications Digital Services Data Protection Act, TDDDG). Section 7 explains optional analytics and marketing functions. Technical logs are deleted when no longer needed for operation and security, unless a legal obligation or a specific security incident requires longer retention.

3. Orders, customer accounts, payment and delivery

When you place an order, we process your name, contact details, billing and delivery address, items and variants ordered, price, payment and delivery status, and your messages. We process a telephone number if you provide one or it is required for the chosen process. For personalised products, we also process your design preferences, such as requested colours or names, and any images or files you send us. We use this data to handle your order, production, communication, payment, delivery, returns and claims. The legal basis is Article 6(1)(b) GDPR. We cannot perform the contract without the information needed for the order, payment and delivery; voluntary design details are only needed for the corresponding personalisation.

If you use a customer account, we process the data needed for login and account management and the orders linked to your account (Article 6(1)(b) GDPR). You can use the public online withdrawal form without a customer account.

Depending on your checkout selection, payment is handled through Shopify Payments and the methods it offers, or through PayPal. The payment providers receive the information needed for payment and, where applicable, fraud prevention; we receive payment status and transaction information in particular. The legal basis is Article 6(1)(b) GDPR for payment processing, Article 6(1)(c) GDPR for legally required records and Article 6(1)(f) GDPR for necessary fraud prevention. The payment providers explain their further processing in their own privacy notices.

For delivery, we pass the necessary information, particularly your name, delivery address and shipment data, to the appointed carrier. Shipping labels are currently created outside Shopify. We pass on an email address or telephone number for delivery notifications only where necessary for the selected shipping process and legally permitted. The legal basis is Article 6(1)(b) GDPR.

We also process order and invoice records for accounting and tax documentation (Article 6(1)(c) GDPR). Depending on the document type, records relevant under commercial and tax law are generally kept for six, eight or ten years. We delete other order and account data once they are no longer needed for the contract, customer account or legitimate claims and no legal obligation prevents deletion (Article 6(1)(f) GDPR for necessary handling of claims).

4. Contact and individual 3D printing enquiries

If you contact us by form, email or telephone, we process your contact details, the content of your enquiry and any files or images to respond and prepare an offer. The legal basis is Article 6(1)(b) GDPR for an order or pre-contractual enquiry; for other matters it is Article 6(1)(f) GDPR (our interest in answering enquiries). Article 6(1)(c) or (f) GDPR also applies where retention obligations or claims exist. Please do not send sensitive information that is unnecessary for your enquiry.

5. Withdrawal and returns

If you use the online withdrawal form, we process your name, email address, details of the contract and affected items, your withdrawal declaration, and the date and time it is received; technically necessary connection data may also be processed. We use this information to receive and confirm your withdrawal, reverse the transaction and keep necessary records. The legal bases are Article 6(1)(c) GDPR together with section 356a of the German Civil Code (BGB), and Article 6(1)(b) GDPR for the reversal. We use “EU Widerruf Button” by 401layers UG for the form and acknowledgement of receipt. We handle withdrawals by email in the same way. We delete the data after completion unless retention obligations or necessary evidential interests prevent this.

6. Optional marketing emails

You can voluntarily sign up for email marketing on our website or at checkout. For this purpose, we process your email address, consent status and information needed to document consent. Confirmation by email is enabled for new subscriptions (double opt-in). The legal basis for marketing emails is your consent under Article 6(1)(a) GDPR. Retention of the consent record may be based on Article 6(1)(c) or (f) GDPR. You may withdraw consent for the future at any time through the unsubscribe link in each marketing email or by contacting us.

Shopify Messaging is configured to send reminders after an abandoned product view, cart or checkout. These emails are addressed to people who have subscribed to email marketing. For this purpose, we process the relevant store activity, any cart or checkout information, email address and marketing status. Information about opens and clicks may also be processed for delivery and performance measurement. Order and service messages needed to perform the contract do not depend on signing up for marketing emails.

7. Cookies, consent and measurement services

Our Shopify cookie banner distinguishes strictly necessary functions from the optional categories personalisation, marketing and analytics. Consent is generally required under section 25(1) TDDDG for non-essential storage on, or access to information from, your device. Where personal data are subsequently processed for analytics or marketing, the legal basis is Article 6(1)(a) GDPR. You can change or withdraw your choice for the future using “Cookie settings” in the footer. Necessary store functions may be based on Article 6(1)(b) or (f) GDPR and section 25(2) TDDDG.

Our “Google & YouTube” app sends product data to Google Merchant Center so that our products can appear in Google services. Conversion analysis is also enabled and a Google tag is embedded in the store. When the measurement function is used, page views, interactions, device and browser details, identifiers, and cart or purchase events may in particular be sent to Google to measure use and the results of product listings. The product feed containing item information alone must be distinguished from processing visitors’ personal data. Please see the Google Privacy Policy for information about Google’s processing.

A Pinterest app pixel with web and server components is also connected. It measures store events and attributes visits or purchases to Pinterest. Depending on the event, page and interaction data, technical identifiers, order information and, where applicable, contact details used for matching may be processed. In Shopify, the Pinterest pixel requires permission for marketing and analytics. According to Shopify, the store’s customer privacy and consent settings also apply to server pixels; the particular events transmitted depend on the configuration and your choice. Please see the Pinterest Privacy Policy for information about Pinterest’s processing. Links to social platforms merely lead to their websites, where their own privacy notices apply.

8. Shopify and Shopify Network Intelligence

Shopify hosts the store and processes data for the website, checkout, orders and other store functions. Depending on your use, this includes contact, order, payment and usage data. Shopify Network Intelligence is also enabled. For certain enhanced services, Shopify may combine data from your interactions with our store, other participating stores and Shopify, for example for analytics, personalisation or advertising. Shopify describes its responsibility for these own purposes in its Consumer Privacy Policy. You can find information and available privacy options in the Shopify Privacy Portal. Your rights against us remain in place.

According to Shopify, it takes the choice made in the Shopify cookie banner into account when using device data for non-essential purposes within Shopify Network Intelligence. Processing of store and order data necessary for our services is unaffected.

9. Recipients, international transfers and retention

Depending on the process, Shopify, payment providers, carriers, the online withdrawal form provider, and customer communication, IT and accounting service providers receive the data necessary for their tasks. Our Etsy seller account is connected through Shopify Marketplace Connect. Paid Etsy orders are imported into Shopify in accordance with the “All orders” setting. Etsy, the integration and Shopify process the product, order and customer data needed for the reconciliation. The legal basis for order processing is Article 6(1)(b) GDPR. Etsy’s privacy notices also apply to purchases on Etsy. Merely visiting our Shopify store does not constitute an Etsy purchase.

Shopify International Limited in Ireland may involve affiliated companies and subprocessors in other countries to provide its services. Under Shopify’s agreement, transfers to Shopify companies outside the EEA are safeguarded, among other things, by binding corporate rules and further third-country transfers by standard contractual clauses. Other providers named above may also process data outside the EEA; details of their recipients and transfer mechanisms are in the linked privacy notices. If we ourselves initiate a transfer to a third country, we do so only on a basis under Articles 44 et seq. GDPR, such as an adequacy decision or appropriate safeguards. You can request information from us about the safeguards applicable to a particular transfer.

We keep personal data only as long as the respective purpose, legal retention obligations or the handling of claims requires. The criteria set out in the respective sections apply to orders, marketing emails and withdrawals.

10. Your rights

Where the legal conditions are met, you have rights of access, rectification, erasure, restriction of processing and data portability (Articles 15–18 and 20 GDPR). You may object to processing based on legitimate interests on grounds relating to your particular situation; you may object to direct marketing at any time without giving reasons (Article 21 GDPR). You may withdraw consent at any time with effect for the future (Article 7(3) GDPR). Processing carried out up to that point remains lawful.

Send requests to the contact details in section 1. You may also lodge a complaint with a data protection supervisory authority (Article 77 GDPR). For processing for which Shopify itself is responsible, Shopify also provides the privacy portal mentioned above.

11. Changes

We will update this notice if our store, the services used or legal requirements change. The current version is available on this page; we will inform you separately of material changes where required.