Privacy policy

This privacy policy applies to the website metalsculpta.com and to the configurator with shopping cart and checkout at konfigurator.metalsculpta.com. It explains which personal data we process when you visit the website, send us an inquiry, create a design for your sculpture in the configurator or place an order – and which rights you have.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

fexon e.K.
Owner: Christian Fischer
An der Eisbahn 8
07973 Greiz
Germany
Telephone: +49 3661 4555881
Email: info@metalsculpta.com

Metalsculpta is a brand of fexon e.K. Full provider details are available in our legal notice.

2. Purposes and legal bases at a glance

We only process personal data where this is necessary to operate the website, answer inquiries, create your designs in the configurator, and to prepare, perform and invoice orders, or where you have given your consent. The legal bases are in particular:

• Art. 6(1)(b) GDPR: pre-contractual measures and performance of a contract, in particular design, inquiry, order, payment, manufacture and delivery
• Art. 6(1)(c) GDPR: compliance with legal obligations, in particular retention obligations under commercial and tax law
• Art. 6(1)(f) GDPR: our legitimate interests in secure and smooth operation, in preventing misuse and fraud, in traceable order processing and in establishing or defending legal claims
• Art. 6(1)(a) GDPR: your consent, where we expressly ask for it (for example for measuring advertisements)

Access to information on your device (for example cookies) is additionally governed by Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG): storage that is strictly necessary is based on Section 25(2) No. 2 TDDDG, all other storage on your consent under Section 25(1) TDDDG.

We need the details marked as mandatory to provide the respective function or to process your order. Without them we cannot answer your inquiry or carry out your order. Beyond that, you are not obliged to provide us with any data.

3. Website hosting with Vercel

The website metalsculpta.com is operated by Vercel Inc., USA (hosting and delivery). Server-side functions of the website, such as the inquiry form, run in the Vercel region Frankfurt am Main, Germany. Pages are delivered via Vercel's global network, usually from a location near you.

When you open a page, Vercel processes technically necessary connection and log data: IP address, date and time of access, requested address, amount of data transferred, HTTP status, referrer and browser and device information (user agent). We need this data to deliver the website, analyse errors and fend off attacks. The legal basis is Art. 6(1)(f) GDPR. Vercel processes the data on our behalf under a contract pursuant to Art. 28 GDPR. As Vercel is based in the USA, data may be transferred to the USA; this transfer is safeguarded by the European Commission's standard contractual clauses (see section 14). Log data is deleted as soon as it is no longer needed for these purposes; retention follows Vercel's specifications [retention period of Vercel logs to follow].

4. Fonts and external content

The fonts on this website are stored on our own server and loaded from there. No connection to Google Fonts or other font providers is established when you open a page. We only load external scripts with your consent (see section 6).

5. Cookies and your choice in the cookie banner

As of this policy, the cookie banner and the cookie `lto-consent` are not active. They will only be switched on once we measure advertisements (see section 6). Until then, the website itself does not set any cookies. In that case, the following applies:

On your first visit, a banner then asks whether we may measure advertisements. You have two equivalent options: "Essential only" and "Accept all". We store your decision in the cookie `lto-consent` (content: "granted" or "denied") for 180 days. The cookie applies to metalsculpta.com and all subdomains of this domain, including the configurator at konfigurator.metalsculpta.com, so you only need to decide once. The legal basis for this cookie is Section 25(2) No. 2 TDDDG in conjunction with Art. 6(1)(c) GDPR (proof of your decision).

You can then change your choice or withdraw your consent with effect for the future at any time via the "Cookie settings" link in the footer of every page.

Independently of this, the configurator at konfigurator.metalsculpta.com sets technically necessary cookies: a session cookie that links related requests, secures your design and your shopping cart and prevents unauthorised access to other people's designs or orders, and the cookie `lt_lang`, which only stores your language choice and is valid for one year. The legal basis is Section 25(2) No. 2 TDDDG; the subsequent processing is based on Art. 6(1)(b) or (f) GDPR.

6. Google tag and Google Ads (measuring advertisements)

As of this policy, the Google tag is not yet active on metalsculpta.com. We will only activate it once we run Google advertisements. In that case, the following applies:

We will then use the Google tag (gtag.js) of Google Ireland Limited, Ireland, to measure whether a visit via a Google advertisement led to a design or an order. The Google tag works in consent mode: as long as you have not consented, all storage and advertising functions are set to "denied" and Google does not set any cookies. In this state, cookieless signals and technical connection data (for example IP address, browser information, requested address) may nevertheless be transmitted to Google; this data is not automatically anonymous. Click identifiers from advertisements may be passed on from page to page in the address.

Only if you choose "Accept all" may Google set cookies (for example `_gcl_aw`) and attribute the click identifier of your advertisement to an order. The legal basis is then your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Your decision also applies in the configurator. Google may process data in the USA (see section 14). More information: how Google uses information from sites that use its services.

7. Inquiry form

On the pages Inquiry and For business you can send us an inquiry, for example for a sculpture over 2 m or for a company project. We process your name, email address and message and – if you provide them – company, telephone number, topic, desired height and an attached file (logo, photo or sketch, maximum 4 MB).

The form is processed on Vercel's servers (region Frankfurt am Main) and sent as an email via the Brevo service (see section 12) to our mailbox info@metalsculpta.com. We do not store the inquiry on the website itself. To prevent misuse, we check an invisible field against automated submissions and limit the number of inquiries per IP address; for this purpose the IP address is only held briefly in the server's memory.

The legal basis is Art. 6(1)(b) GDPR if your inquiry is aimed at a contract, otherwise Art. 6(1)(f) GDPR (our interest in answering inquiries); misuse prevention is based on Art. 6(1)(f) GDPR. We delete inquiries once they have been dealt with, unless statutory retention obligations apply; business letters are generally retained for six years.

8. Contact by email or telephone

If you contact us by email or telephone, we process the contact and content data you provide, including attached files, to answer your inquiry, prepare an offer or handle an existing order. The legal basis is Art. 6(1)(b) GDPR for pre-contractual or contractual matters and Art. 6(1)(f) GDPR for other inquiries. Section 7 applies accordingly to deletion.

9. Configurator: designs from your photo or description

The configurator runs at konfigurator.metalsculpta.com and is embedded on our home page. It is operated on a server of DigitalOcean, LLC; the server location we selected is in Germany. DigitalOcean processes the data on our behalf under a contract pursuant to Art. 28 GDPR. Each request generates technically necessary connection and log data (as described in section 3); we delete it as soon as it is no longer required for operation, error analysis and security.

What you enter. For a design we process your description of the animal (for example "Labrador, sitting upright"), a photo you upload (PNG, JPEG or WebP, maximum 8 MB; the website reduces larger photos in your browser beforehand), the selected form (figure or wall head), the height, the material and the version (fully welded or kit).

What is created from it. From your input we generate four concept images, a 3D model made of flat facets, the breakdown into individual sheet-metal parts and a price. When you approve the 3D model, we store the time, a checksum of the approved model and the version of the terms and conditions that applied at that time.

Misuse prevention. Creating designs incurs costs. We therefore store the IP address with each design and limit the number of designs per IP address within 24 hours.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures at your request); misuse prevention is based on Art. 6(1)(f) GDPR.

Please note: Only upload photos for which you hold the necessary rights, and preferably photos that show only the animal. If people, number plates or addresses are visible, this data is also processed and transmitted to the AI services in section 10.

Retention. Designs that do not lead to an order, including the photo and the generated images and models, are deleted after [retention period for designs not ordered to follow]. Designs you order are retained together with the order (section 11).

10. AI services for concept images and 3D model

We create concept images and the 3D model with the help of artificial intelligence. The concept images are AI-generated and serve as an illustration; the 3D model you approve is decisive for manufacture.

Concept images – Google Gemini API. For the four concept images we transmit your description, your photo (if uploaded) and the selected details to the Gemini API. For the intended paid use, the recipient is Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. According to the Gemini API terms, Google does not use prompts and responses of paid services to improve its products; time-limited logging to detect misuse and to comply with legal obligations may take place. Temporary processing outside the European Economic Area may occur in this context.

3D model – Tripo3D, alternatively fal.ai. We create the 3D model from the concept images via the interface of Tripo3D [company name and registered office of the provider to follow]. If this service is unavailable, we use the Hunyuan3D model via the fal.ai service [company name of the provider to follow], USA, as a fallback. The concept images are transmitted, not your contact details. These providers process the data outside the European Economic Area; the transfer only takes place under the conditions of Art. 44 et seq. GDPR [safeguard for the transfer to follow] (see section 14).

The legal basis is Art. 6(1)(b) GDPR, as AI processing is necessary for the design you requested. The AI does not decide on the conclusion of a contract; an employee personally reviews every order before manufacture begins (section 15).

11. Orders

When you place an order, we process in particular your name, email address, telephone number, customer type, where applicable company and VAT identification number, billing and delivery address, the ordered sculpture with design and version, prices, tax and shipping data, payment method, payment status, transaction references, IP address, browser information and the time at which you acknowledged the terms and conditions, the withdrawal information and the privacy policy.

This processing serves the conclusion of the contract, the review before manufacture begins, payment, manufacture, delivery, communication with you, invoicing and proof of proper order processing. The legal bases are Art. 6(1)(b), (c) and (f) GDPR. Orders are placed without a customer account.

We retain order and invoice data in accordance with commercial and tax law obligations: accounting records generally for eight years, commercial and business letters generally for six years, in each case from the end of the calendar year. Where data is required beyond that to establish or defend legal claims, we retain it until the limitation periods expire. We retain the design of your ordered sculpture (photo, concept images, 3D model, parts) for [retention period for designs of ordered sculptures to follow].

12. Payment processing, invoicing, email and shipping

Stripe. For payments by credit card, Klarna, Google Pay and Apple Pay we use Stripe. The contracting party for the Stripe services is Stripe Payments Europe, Limited, Ireland; for regulated payment services and their own legal purposes, other Stripe companies and involved payment service providers (for example Klarna) may be independent controllers. We transmit the order number, amount, currency, email address, selected payment method and payment status. You enter card or account details directly on Stripe's payment page; they are not stored on our server. More information: Stripe privacy policy.

PayPal. So that PayPal can be offered as a payment method, the payment page of the checkout on konfigurator.metalsculpta.com loads a script from PayPal. As soon as this page is opened – even if you pay by another method – technical connection data such as IP address and browser and device information is transmitted to PayPal; PayPal may also use this data for fraud prevention. The legal basis is Art. 6(1)(b) GDPR (providing the offered payment method) and additionally Art. 6(1)(f) GDPR. If you pay with PayPal, we transmit the order, contact and transaction data required for payment to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal partly processes data under its own responsibility and may involve service providers inside and outside the European Economic Area. More information: PayPal privacy statement.

The legal basis for the transmission to payment service providers is Art. 6(1)(b) GDPR; protection against payment fraud is additionally based on Art. 6(1)(f) GDPR.

easybill. For offers and invoices we transmit the required customer, address, order, item, price, tax and payment data to easybill GmbH, Düsselstraße 21, 41564 Kaarst, Germany, which processes it on our behalf pursuant to Art. 28 GDPR. The legal bases are Art. 6(1)(b) and (c) GDPR. More information: easybill privacy policy.

Brevo. We send emails such as order and payment confirmations, shipping information and inquiries from the form via Brevo (Sendinblue GmbH, Germany, in conjunction with Sendinblue SAS, France; which company is the contracting party depends on our contract). Recipient and sender address, subject, content, attachments, time of sending, delivery status and technical sending data are processed. Brevo is our processor pursuant to Art. 28 GDPR. According to the provider, the core infrastructure is located in the European Union; processing outside the European Economic Area by subcontractors cannot be completely ruled out. The legal bases are Art. 6(1)(b), (c) and (f) GDPR. More information: Brevo privacy policy.

Shipping. For delivery we pass on your name and delivery address and – where necessary to announce the delivery – your email address or telephone number to the transport company commissioned. We ship parcels with DPD; large sculptures are delivered by a freight carrier [freight partner to follow]. The legal basis is Art. 6(1)(b) GDPR.

13. Recipients and processors

Within fexon e.K., only those employees who need the data for design, review, customer service, manufacture, shipping, accounting or IT operations have access to it. External bodies only receive data where this is necessary for hosting, AI processing, payment, invoicing, email delivery, shipping, tax and legal advice or compliance with legal obligations. Service providers who act only on our instructions are engaged as processors under a contract pursuant to Art. 28 GDPR. Payment service providers, banks and authorities may be independent controllers for their own legal tasks.

14. Transfers to third countries

With Vercel, Tripo3D and fal.ai, data is processed outside the European Economic Area, or this must be expected. With Google, DigitalOcean, Stripe, PayPal, easybill and Brevo, processing by affiliated companies or subcontractors outside the European Economic Area, in particular in the USA, cannot be ruled out despite European contracting parties or server locations. Such transfers only take place if the requirements of Art. 44 et seq. GDPR are met, in particular on the basis of an adequacy decision of the European Commission (for the USA: the EU-US Data Privacy Framework, where the recipient is certified), approved binding corporate rules or the European Commission's standard contractual clauses including any necessary supplementary measures.

15. Automated price calculation and human review

The configurator calculates the price automatically from the 3D model, the number of parts, the height, the material and the version. This calculation alone does not lead to the conclusion of a contract: after you place your order, an employee checks feasibility and the plausibility of the price; the contract is only concluded by our order confirmation or by dispatch (see terms and conditions). No decision based solely on automated processing within the meaning of Art. 22 GDPR takes place.

16. Your rights

Subject to the statutory requirements, you have the following rights:

• Access to your personal data processed by us (Art. 15 GDPR)
• Rectification of inaccurate or completion of incomplete data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR), unless statutory retention obligations or other overriding reasons apply
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent at any time with effect for the future (Art. 7(3) GDPR); the lawfulness of processing carried out before the withdrawal remains unaffected

A message to info@metalsculpta.com is sufficient for all requests. To protect your data, we may ask for reasonable proof of your identity.

17. Right to lodge a complaint with a supervisory authority

Under Art. 77 GDPR you have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is:

Thüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheit (TLfDI)
Häßlerstraße 8
99096 Erfurt, Germany
Telephone: +49 361 57-3112900
Email: poststelle@datenschutz.thueringen.de
Website: tlfdi.de

18. Changes to this privacy policy

We update this privacy policy when the website, the configurator, the service providers we use or the legal situation change. The version published on this page applies.