1. Who is responsible for your data?

MorphiCustom is a trade name of Morphitoys B.V., located at Zuidlarenstraat 57, 2545 VP Den Haag, registered with the Dutch Chamber of Commerce under number 97076686. We are the data controller for the personal data you share with us via this website. For privacy questions, contact us at info@morphitoys.com.

2. Which data do we process?

We only process data that is needed to handle your request and fulfil your order:

Contact details, name, email address and (optionally) phone number.
Address details, street, postcode and city, only if you choose shipping by PostNL.
Business details, company name and Chamber of Commerce number for a business request.
Uploaded files, your 3D files (STL, OBJ, 3MF, ZIP) and any reference photos. These may contain an original design; we treat them confidentially and never share them with third parties.
Request and order data, your description, chosen options, quotes, messages and the payment status. We do not see or receive any account numbers or payment details; payment is handled entirely by the payment provider.
Contact messages, the content of messages sent via the contact form.
Technical log data, brief server logs (such as IP address and timestamp) for security and troubleshooting.

3. What do we use your data for?

Assessing your request and drawing up and sending a quote;
performing the agreement: printing, quality control, shipping or pickup arrangement;
communication about your request, such as status updates and the personal tracking link;
handling payment via our payment provider;
meeting legal obligations, such as the statutory tax retention period for our records.

The legal bases for this are the performance of the agreement (art. 6(1)(b) GDPR), legal obligations ((c)) and our legitimate interest in a secure, well-functioning website ((f)). We do not use your data for marketing emails, profiling or automated decision-making.

4. How long do we keep your data?

Request, quote and invoice data: 7 years, due to the statutory tax retention obligation.
Uploaded 3D files and photos: up to 90 days after your request is completed; after that we delete them permanently. This lets us quickly arrange a reprint or reorder within that period.
Contact messages: at most 1 year after handling.
Technical logs: at most 90 days.

5. Who do we share data with?

We never sell your data to third parties. We only share what is strictly necessary with parties that help us deliver the service (processors or independent controllers):

Hosting provider, for running this website and the secure storage of data and files;
Mollie B.V., our payment provider, for securely handling your iDEAL or credit card payment;
Microsoft (Microsoft 365), for sending our emails (confirmation, quote, invoice, status updates);
Exact Online, our accounting software, in which your invoice and business data are recorded for our records;
PostNL, name and address, solely for the delivery of your parcel;
Google Analytics, only if you consent via the cookie notice, for anonymous visitor statistics (see our cookie statement).

We enter into data processing agreements with processors. Your data is processed within the European Economic Area; if a party processes data outside it, this is done under appropriate safeguards (such as EU standard contractual clauses).

6. How do we secure your data?

The connection to this website is encrypted (HTTPS). Uploaded files are stored outside the publicly accessible web space and are only reachable by our administrators after logging in. Access to personal data is limited to staff who need it to fulfil your order.

7. Your rights

Under the GDPR you have the right to access, rectification and erasure of your data, the right to restriction of processing, the right to data portability and the right to object to processing. Would you like to exercise one of these rights? Email us at info@morphitoys.com; we respond within four weeks. We may ask you to prove your identity before we provide or delete data.

If you disagree with how we handle your data, we would like to hear about it first. You also always have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

8. Cookies

Besides functional cookies we use Google Analytics, but only if you consent on your first visit. We then measure which pages are visited and whether a request or payment was completed, including the amount and the request number. Your name, email address, address and your files are never included. Google Ireland Limited processes this data for us and keeps it for 14 months. If you decline, nothing is measured. Read more in our cookie statement.

9. Changes

We may update this privacy statement, for example when new functionality is added or regulations change. The current version is always on this page; at the top you can see when it was last updated.

Privacy statement