Privacy Policy
As of 27.10.2026
1. Introduction
Welcome to 3Dopname.2-excel.co.za (the "Website"). This privacy policy explains how we collect, use, store, and protect your personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.
2. What data do we collect and why?
We collect and process the following categories of personal data:
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, email address | Account management and notifications | Contract (Art. 6(1)(b)) | Until account deletion |
| Language, country, time zone, measurement units | Showing the service in your language, with dates in your time zone and values in your units | Contract (Art. 6(1)(b)) | Until account deletion |
| Email address entered by another user who invites you to a project or adds you to a user group | Giving you access to the shared projects; for a project invitation, an email about it if the inviting user chooses to send one | Legitimate interest (Art. 6(1)(f)) | Until account deletion |
| Password (hashed) | Authentication | Contract (Art. 6(1)(b)) | Until account deletion |
| Email verification status | Account security | Contract (Art. 6(1)(b)) | Until account deletion |
| Profile picture | Personalization | Consent (Art. 6(1)(a)) | Until deleted or replaced by the user, or upon account deletion |
| Uploaded files (panoramas, point clouds, CAD, etc.) | Service provision | Contract (Art. 6(1)(b)) | Until project deletion or account deletion |
| Comments in projects | Collaboration | Contract (Art. 6(1)(b)) | Until deleted by the user or upon account deletion |
| IP addresses, server logs | Security, abuse prevention and visitor statistics | Legitimate interest (Art. 6(1)(f)) | Application logs: deleted after 30 days at the latest; the processing log of a project is deleted with the project. Other server logs (web server, containers, operating system): rotated automatically according to the server's settings. |
| Last login date | Account security | Legitimate interest (Art. 6(1)(f)) | Until account deletion |
| Consent timestamp | Proof of consent (GDPR compliance) | Legal obligation (Art. 6(1)(c)) | Until account deletion |
Emails we send
Service emails about your account and projects (for example, processing results, invitations, comment notifications, plan and payment notices, password and security messages) are part of the service and cannot be turned off. To stop receiving them, you can delete your account.
Each automatic email we send states why you are receiving it.
3. How do we collect user data?
- Directly from you: When you register, create projects, upload files, or contact support.
- From other users: When a user invites you to a project or adds you to a user group, they enter your email address. If you are invited to a project and do not have an account yet, an account is created for this address so that you can accept the invitation. Users who add you to their project or group can see the name and email address of your account. When you comment in a project, your name is shown next to your comment to everyone who can open the project (for a public project, any visitor), unless the project owner hides comment authors.
- From authentication providers: If you sign in with Google or Microsoft, we receive your name, email address, and profile picture from the provider.
- Automatically: Our servers collect IP addresses and technical data in server logs for security purposes.
4. Third-party services and international data transfers
We use the following third-party services to operate the Website. Your data may be transferred to countries outside the European Economic Area (EEA). Where applicable, these transfers are protected by Standard Contractual Clauses (SCCs) or the EU-U.S. Data Privacy Framework.
| Service | Purpose | Data transferred | Location |
|---|---|---|---|
| Hetzner Online GmbH | Hosting of the Website and its backups | All data stored on the Website | Germany (servers), Finland (backups) |
| OpenStreetMap (OSMF) | Map tiles and geocoding (when georeferenced) | IP address; for the place search also the text you search for | UK |
| OpenTopoMap | Topographic map tiles (when georeferenced) | IP address | Germany |
| Esri ArcGIS Online | Map tiles (when georeferenced) | IP address | USA |
| Microsoft Bing Maps | Map tiles (when georeferenced) | IP address | USA |
| Standard marker icons of KML layers (when georeferenced) | IP address | USA | |
| SMTP email provider | All notifications | Email address, name, project details, etc. | EU |
The map services in this table (OpenStreetMap, OpenTopoMap, Esri, Microsoft Bing Maps and Google) are contacted only after you click "Show map" on the map. Your choice is stored in your browser (Art. 6(1)(a)); you can withdraw it at any time by deleting the data of this website in your browser.
We do not sell, rent, or share your personal data with third parties for marketing purposes. We do not use third-party analytics, advertising, or tracking services.
To suggest your country during sign-up and in your profile, we estimate your country based on your IP address using a local copy of the MaxMind GeoLite2 database stored on our own servers. Your IP address is not transmitted to MaxMind or any other third party for this lookup. This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
5. Cookies and tracking technologies
We use only essential first-party cookies required for login and session management. These cookies are strictly necessary for the functioning of our website. We do not use third-party cookies, tracking pixels, fingerprinting, or any other tracking technologies.
We honor Global Privacy Control (GPC) signals: when your browser sends one, we do not record the ad click ID. We neither sell nor share your personal data. Our machine-readable statement is published at /.well-known/gpc.json.
6. Data security
We implement appropriate technical and organizational measures to protect your personal data, including:
- Passwords are hashed using an industry-standard algorithm (scrypt)
- Two-factor authentication (2FA) is available for all accounts
- CSRF protection on all forms
- Content Security Policy (CSP) headers
- Rate limiting on authentication endpoints
- All cookies are set with Secure, HttpOnly, and SameSite attributes
- All resources are self-hosted (no external CDN dependencies), except the map services named in section 4 (map tiles and geocoding)
7. Your rights under GDPR
As a data subject, you have the following rights:
- Right of access (Art. 15): you can export all your personal data from your profile page at any time.
- Right to rectification (Art. 16): you can update your name, password, and other profile information at any time.
- Right to erasure (Art. 17): you can delete your account from your profile page. Your account data, your uploads, the projects only you own and your comments, together with the replies to them, are deleted at once. A project you own together with other users stays with them, including the files you uploaded to it, and your replies to other users' comments stay, shown without your name. Your email address remains in the upload records of projects and in the copies of the database the application makes before updates for up to 30 days.
- Right to data portability (Art. 20): you can export your data in machine-readable JSON format from your profile page.
- Right to restriction of processing (Art. 18): you have the right to request that we restrict the processing of your personal data in certain circumstances (e.g., while the accuracy of the data is disputed).
- Right to object (Art. 21): you have the right to object to processing based on legitimate interests (Art. 6(1)(f)), such as server log retention. We will stop such processing unless we have compelling legitimate grounds.
- Right to withdraw consent (Art. 7(3)): you can withdraw your consent at any time by deleting your account. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
- Right to lodge a complaint: you have the right to lodge a complaint with a supervisory authority if you believe your data is being processed unlawfully.
8. Data breach notification
In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, if required, inform affected users without undue delay.
9. Contact information
If you have any questions or concerns regarding data protection, or wish to exercise any of your rights, please contact us:
- by email: 3D-opname@2-excel.nl
10. Updates to this Privacy Policy
We may update this Privacy Policy from time to time. All changes will be published on this page, along with the date of the update. If we make significant changes that affect your rights, we will notify you via email or a notice on our Website. We encourage you to review this page periodically.