Privacy Policy

WITAL AB (org. nr. 559468-6254), Fosievägen 29A, 214 31 Malmö, is the data controller for the processing of your personal data described in this policy.

If you have questions about how we handle your data, you can reach us at [email protected].

We process the data you provide to us yourself, for example:

• Contact details — name, email address and phone number when you send an enquiry through the contact form or the quote tool.
• Account details — when you create an account: name, email address, phone number if you give one, address and, for a company, company name and organisation number, plus sign-in history. The account is only created once you have opened the link we email you; until then we keep only the email address and the link, which works once, for one hour.
• 3D files — the model files you upload to get a price, and what we derive from them: dimensions, volume, estimated weight and print time, and a generated preview image of the model.
• Quote choices — material, colour, quality and quantity, any purchase-order reference, and whether you chose delivery or collection and from which workshop.
• Order and billing details — the contents of the order, billing and delivery address, and company name and registration number if you order as a business.
• Payment details — for a Swish payment we store the payment reference from Swish, the amount, the time, and the phone number Swish reports as the payer. We never see your bank details. This is needed for your receipt, for bookkeeping, and to resolve a payment afterwards.
• Correspondence — emails and messages between you and us about your quote or order.
• Quote activity — whether and when you opened the quote link we emailed you. We use it only to know whether the quote reached you before we follow up.
• Technical data — IP address, browser type and device information collected automatically when you visit the site.
• Error reports and session recordings — when something goes wrong on the website we keep a technical error report: which page and feature it concerned, browser and device, and where relevant a case number. To be able to reproduce the error we also record a sample of visits, and every visit in which an error occurs. A recording shows where on the page you clicked and what the page did, but all text and everything you type is masked and images are blocked — it does not contain your name, your address or your prices. Your IP address is not sent.

• Contract — to be able to handle your order, prepare a quote and deliver our services.
• Legitimate interest — to respond to enquiries, improve the website, find and fix errors (error reports and masked session recordings) and protect ourselves against abuse (e.g. via Cloudflare Turnstile).
• Legal obligation — to comply with requirements under accounting and tax legislation.
• Consent — where required, for example for marketing via email.

We keep your data for as long as it is needed for the purpose it was collected for. Enquiries are normally deleted within 12 months. Order-related data is kept for up to 7 years to meet Swedish accounting law. Account data is kept for as long as the account is active.

Uploaded 3D files are deleted automatically around 30 days after the case closes — that is, when the quote is declined or expires, or when the order has been delivered. The measurements and calculated values stay on the quote as the basis for the price, but the file itself is removed. You can ask us to delete a file sooner at any time.

A registration link is deleted no later than a day after it expires. Error reports and session recordings are kept for up to 90 days and then deleted automatically.

We share your data only with trusted providers who help us run the service:

• Database hosting provider (within the EU)
• File storage provider for uploaded 3D models
• A slicing service that estimates weight and print time — it receives a time-limited link to your file
• Provider for sending transactional and account emails
• Cloudflare (Turnstile spam protection) — see Cloudflare Turnstile Privacy Policy
• Delivery provider for orders
• Website hosting provider
• Error reporting and session recording provider (Sentry) — the data is stored within the EU

All providers are bound by data processing agreements and process data in accordance with the GDPR. We process your data primarily within the EU/EEA. In the event of any transfer outside the EU/EEA, we ensure that approved safeguards are in place.

Under the GDPR you have the right to:

• obtain information about and access to your personal data,
• request rectification of incorrect data,
• request erasure (“the right to be forgotten”),
• object to or request restriction of the processing,
• request data portability where applicable,
• withdraw consent you have previously given.

Contact us at [email protected] to exercise any of these rights.

The site uses strictly necessary cookies only: one to handle sign-in and preserve your session, and one that remembers whether you want to see prices including or excluding VAT. We do not use cookies for tracking or advertising.

Error reporting keeps track of a visit with a random id in your browser's session storage (not a cookie). It is gone when you close the tab.

If you believe that we are processing your data in breach of the GDPR, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se.

We may update this policy. The latest version is always published on this page, with the date of the most recent change indicated.