1. Who is responsible for your data?

MorphiCustom is a trade name of Morphitoys B.V., located at Zuidlarenstraat 57, 2545 VP Den Haag, registered with the Dutch Chamber of Commerce under number 97076686. We are the data controller for the personal data you share with us via this website. For privacy questions, contact us at info@morphitoys.com.

2. Which data do we process?

We only process data that is needed to handle your request, fulfil your order and know which channel customers use to find us:

Contact details, name, email address and (optionally) phone number.
Address details, street, postcode and city, only if you choose shipping by PostNL.
Business details, company name and Chamber of Commerce number for a business request.
Uploaded files, your 3D files (STL, OBJ, 3MF, ZIP) and any reference photos. These may contain an original design; we treat them confidentially and never share them with third parties.
Request and order data, your description, chosen options, quotes, messages and the payment status. We do not see or receive any account numbers or payment details; payment is handled entirely by the payment provider.
Contact messages, the content of messages sent via the contact form.
Origin of your request, the kind of channel that brought you to us, such as an ad, a search engine or another site. With cookie consent for statistics also the campaign and keyword of the ad, the referring site and the landing page, and with "Allow all" the identifier of the ad click.
Technical log data, brief server logs (such as IP address and timestamp) for security and troubleshooting.

3. What do we use your data for?

Assessing your request and drawing up and sending a quote;
performing the agreement: printing, quality control, shipping or pickup arrangement;
communication about your request, such as status updates and the personal tracking link;
handling payment via our payment provider;
measuring which channels, such as ads and search engines, lead to requests and orders;
meeting legal obligations, such as the statutory tax retention period for our records.

The legal bases for this are the performance of the agreement (art. 6(1)(b) GDPR), legal obligations ((c)) and our legitimate interest in a secure, well-functioning website and in knowing which channels work ((f)). For measurement with cookies, the details of the origin and the identifier of an ad click, the basis is your consent ((a)), which you can withdraw at any time. We do not use your data for marketing emails, profiling or automated decision-making.

4. How long do we keep your data?

Request, quote and invoice data: 7 years, due to the statutory tax retention obligation.
Uploaded 3D files and photos: up to 90 days after your request is completed; after that we delete them permanently. This lets us quickly arrange a reprint or reorder within that period.
Contact messages: at most 1 year after handling.
Technical logs: at most 90 days.
Origin of your request: the kind of channel for as long as the request is kept; the identifier of an ad click 90 days; campaign, keyword, referring site and landing page 14 months.

5. Who do we share data with?

We never sell your data to third parties. We only share what is strictly necessary with parties that help us deliver the service (processors or independent controllers):

Hosting provider, for running this website and the secure storage of data and files;
Mollie B.V., our payment provider, for securely handling your iDEAL or credit card payment;
Microsoft (Microsoft 365), for sending our emails (confirmation, quote, invoice, status updates);
Exact Online, our accounting software, in which your invoice and business data are recorded for our records;
PostNL, name and address, solely for the delivery of your parcel;
Google Analytics and Google Ads, only if you consent via the cookie notice, for visitor statistics and to measure whether a click on our ad led to a request or payment. No personalised ads (see our cookie statement).

We enter into data processing agreements with processors. Your data is processed within the European Economic Area; if a party processes data outside it, this is done under appropriate safeguards (such as EU standard contractual clauses).

6. How do we secure your data?

The connection to this website is encrypted (HTTPS). Uploaded files are stored outside the publicly accessible web space and are only reachable by our administrators after logging in. Access to personal data is limited to staff who need it to fulfil your order.

7. Your rights

Under the GDPR you have the right to access, rectification and erasure of your data, the right to restriction of processing, the right to data portability and the right to object to processing. Would you like to exercise one of these rights? Email us at info@morphitoys.com; we respond within four weeks. We may ask you to prove your identity before we provide or delete data.

If you disagree with how we handle your data, we would like to hear about it first. You also always have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

8. Cookies

Besides functional cookies we use Google Analytics, but only if you consent. We then measure which pages are visited and whether a request or payment was completed, including the amount and the request number. If you choose "Allow all" and came through one of our ads, we also measure through Google Ads whether it led to a request or payment. Your name, email address, address and your files are never included. With a request we record in our own records which channel brought you to us, such as an ad or search engine. None of that is sent to Google. Google Ireland Limited processes this data for us and keeps user-level and event-level data for 14 months. How Google uses this data is explained at business.safety.google/privacy. If you decline, nothing is measured through Google. You can change or withdraw your choice at any time via Cookie settings at the bottom of every page. Read more in our cookie statement.

9. Changes

We may update this privacy statement, for example when new functionality is added or regulations change. The current version is always on this page; at the top you can see when it was last updated.

Privacy statement