Last updated · October 2026
Privacy Policy
Document D02 · Version 1.1
Published October 2026 · Effective October 2026 · Supersedes version 1.0
This document forms part of the DDDIMO Terms of Use and is published at dddimo.com. Previous versions are archived and available on request.
1. WHO IS RESPONSIBLE FOR YOUR DATA
1.1. DDDIMO: controller
| Item | Details |
|---|---|
| Controller | DDDIMO |
| Legal form | [TO COMPLETE] |
| Registered office | [TO COMPLETE] |
| Company registration number | [TO COMPLETE] |
| Privacy contact | privacy@dddimo.com |
| Data protection officer | [TO COMPLETE] |
| EU representative (if applicable) | [TO COMPLETE] |
1.2. Three parties, three roles
DDDIMO operates on the Cobuntu platform. Understanding who holds what matters for exercising your rights.
| Party | Role | What they hold |
|---|---|---|
| DDDIMO | Independent controller | Marketplace activity: listings, licences, moderation, risk classification, seller verification, reports, seller plan and fee records |
| Cobuntu | Independent controller and, for parts of the service, processor | Account and authentication, transaction records, subscription billing, escrow and payouts, platform logs |
| Seller | Independent controller | Order data received to fulfil your purchase |
| Stripe | Independent controller | Payment data, identity verification, fraud detection |
DDDIMO never sees or stores your full card details. Those are handled by Stripe.
Where purposes and means are determined jointly, principally seller onboarding, subscription records and transaction records, DDDIMO and Cobuntu act as joint controllers under Article 26 GDPR. The essence of that arrangement is set out in clause 8.4 below.
1.3. Sellers as controllers
When you buy, the Seller receives the data needed to fulfil the order. The Seller is an independent controller of that data and is contractually bound to: use it only to fulfil the order, meet legal obligations and provide after-sales support; not use it for marketing without your separate consent; not pass it to third parties without a legal basis; honour your rights requests; and notify DDDIMO of any breach within 24 hours.
Where you commission a Service, the Service Provider also receives the specification, the files you supply and any correspondence needed to perform the work, on the same terms.
If a Seller misuses your data, tell us at privacy@dddimo.com. We will investigate and may suspend the account.
2. WHAT WE COLLECT
2.1. Data you give us
| Category | Examples |
|---|---|
| Account | Name, username, email, password (hashed), profile image, biography |
| Identity (Sellers) | Legal name, address, company registration number, tax identification number, identity document, date and place of birth |
| Payment (Sellers) | Connected Stripe account identifier, financial account details |
| Listings | Product, file and service descriptions, images, technical data, licence selection, declarations of originality, criticality classification |
| Service commissions | Specification agreed, files supplied by the Buyer, milestones, acceptance records, correspondence between the parties |
| Product safety | Manufacturer details, responsible economic operator in the Union, safety warnings, technical documentation, insurance policy details |
| Communications | Messages, support requests, reports, complaints and appeals |
| Preferences | Language, notification and marketing settings |
2.2. Data generated by your use
| Category | Examples |
|---|---|
| Transactions | Purchase records, amounts, currency, refund status, licence type, License ID |
| Seller plan and billing | Plan held, billing frequency, subscription start and renewal dates, founding-member status and the date its two-year lock expires, plan changes, cancellations, invoices |
| Seller fees | The fee rate applied to each sale, the fee charged, and the category used to determine it |
| Downloads | Download events with date, time, file version and IP address |
| Consents | Acceptance of Terms and licences, with version, date and time; the two digital-content consents under Annex D of the Terms; consent to recurring subscription charges |
| Technical | IP address, browser type, device data, timestamps |
| Usage | Pages viewed, searches, listings viewed, cart interactions |
| Moderation | Reports made and received, decisions, appeals |
2.3. Data from third parties
From Cobuntu: account, authentication, subscription billing and transaction data. From Stripe: payment status, identity verification outcome, fraud signals, never full card numbers. From public registers: verification of company registration, tax numbers (including VIES) and legal representatives, for Seller onboarding.
2.4. Special category data
DDDIMO does not deliberately collect data revealing health, political opinions, religion, trade union membership, sex life or sexual orientation, biometric data or genetic data. Do not include such data in listings, service specifications, messages or profiles.
3. WHY WE USE IT, AND ON WHAT LEGAL BASIS
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Create and manage your account | Contract, Art. 6(1)(b) |
| Display listings and operate the marketplace | Contract, Art. 6(1)(b) |
| Process orders, licences and downloads | Contract, Art. 6(1)(b) |
| Administer a seller plan, billing and renewals | Contract, Art. 6(1)(b) |
| Apply and record the seller fee on each sale | Contract, Art. 6(1)(b) |
| Operate and record the founding-price lock | Contract, Art. 6(1)(b) |
| Record consent to recurring charges and send renewal reminders | Legal obligation, Art. 6(1)(c) |
| Issue and record License IDs | Contract, Art. 6(1)(b), and legal obligation, Art. 6(1)(c) |
| Record consents relating to digital content | Legal obligation, Art. 6(1)(c) |
| Determine refund eligibility | Contract, Art. 6(1)(b), and legal obligation, Art. 6(1)(c) |
| Manage a commissioned Service through to acceptance | Contract, Art. 6(1)(b) |
| Verify Seller identity (DSA Art. 30) | Legal obligation, Art. 6(1)(c) |
| Collect and report tax data (DAC7) | Legal obligation, Art. 6(1)(c) |
| Product safety, traceability and recalls (GPSR) | Legal obligation, Art. 6(1)(c) |
| Retain evidence for product liability defence | Legal obligation, Art. 6(1)(c), and legitimate interests, Art. 6(1)(f) |
| Moderate content and handle reports | Legal obligation, Art. 6(1)(c), and legitimate interests, Art. 6(1)(f) |
| Prevent fraud, abuse and money laundering | Legitimate interests, Art. 6(1)(f), and legal obligation |
| Detect circumvention of fees and off-Platform payment | Legitimate interests, Art. 6(1)(f) |
| Security, incident detection and diagnostics | Legitimate interests, Art. 6(1)(f) |
| Improve the service and analyse aggregate use | Legitimate interests, Art. 6(1)(f) |
| Handle complaints, appeals and disputes | Legal obligation, Art. 6(1)(c), and legitimate interests, Art. 6(1)(f) |
| Marketing emails | Consent, Art. 6(1)(a) |
| Personalised recommendations | Consent, Art. 6(1)(a) |
| Non-essential cookies | Consent (see Cookie Policy) |
Our legitimate interests, where relied on, are: keeping the marketplace safe and free from fraud; protecting Sellers' intellectual property; defending legal claims; and operating and improving the service. You may object at any time, see section 7.
What we do not do with plan data. Your plan, your fee rate and your founding-member status are never used as a ranking signal. They do not affect where your listings appear in search or browse results. This is a binding constraint, stated in clause 9.3 of the Terms.
4. HOW LONG WE KEEP IT
4.1. General
| Data | Retention |
|---|---|
| Account data | While the account is open, plus 12 months |
| Marketing preferences | Until withdrawn, plus proof of withdrawal for 5 years |
| Support and messages | 3 years after closure |
| Technical and security logs | 12 months |
| Usage analytics | 14 months, aggregated thereafter |
| Reports, moderation decisions and appeals | 5 years |
| Seller verification data (DSA Art. 30) | Duration of the relationship, plus a maximum of 6 months |
| Subscription records, consent to recurring charges, renewal notices | Duration of the subscription, plus 5 years, to evidence compliance with automatic renewal law |
| Seller fee records applied to each sale | 10 years, as accounting records |
| Service commission records, specification and acceptance | 5 years after acceptance, or longer where clause 4.2 applies |
| Tax and accounting records | 10 years, per tax law |
| DAC7 reported data | Per the retention period in the applicable tax law |
4.2. Product liability records: why some data is kept far longer
Directive (EU) 2024/2853 treats digital manufacturing files as products, with a liability longstop of 10 years from placing on the market, extended to 25 years where personal injury symptoms are slow to emerge.
The following are therefore retained for 10 years from the last date each version was available, and 25 years for categories carrying a risk of slow-emerging injury:
- verified identity of the Seller and of the responsible economic operator in the Union, with the verification history;
- file versions, with identifier, digital signature and timestamp, and the exact version associated with each download;
- a reproduction of the product page as displayed on the transaction date;
- the licence text and purchase flow in force on that date, including the consents under Annex D of the Terms;
- the specification agreed for a Service that produced a tangible object, and the record of its acceptance;
- conformity declarations and technical documentation;
- identification requests and the responses given.
This retention survives account closure. Deleting it would destroy the evidence needed to identify who is responsible for a product and to defend or resist a claim, including one brought against you. The legal basis is Article 6(1)(c) and (f) GDPR.
Where a record is retained on this basis but is no longer needed to identify you, we minimise it: identifiers are reduced to what is necessary to link the record to the transaction.
4.3. After deletion
When you delete your account we remove your profile and account data. We retain what the law requires us to keep, and the records in 4.2, and we restrict processing to those purposes alone.
5. WHO WE SHARE IT WITH
5.1. Recipients
| Recipient | Why | Role |
|---|---|---|
| Cobuntu | Platform operation, payments, subscription billing, escrow, payouts | Controller / processor |
| Stripe | Payment processing, identity verification, fraud prevention | Controller |
| Sellers | To fulfil your order, perform a commissioned Service and provide support | Controller |
| Hosting and infrastructure providers | Storage, delivery, backups | Processor |
| Email and messaging providers | Transactional and, with consent, marketing messages | Processor |
| Professional advisers | Legal, accounting and audit | Controller / processor |
| Authorities | Where legally required | Controller |
The current list of processors is published at [TO COMPLETE] and updated when it changes.
5.2. What we share with Sellers
Only what is needed for the order: your name, the delivery address for physical goods, the items purchased, the licence acquired and the License ID, and your contact email for support. For a commissioned Service, also the specification and any files you supply. Sellers do not receive your payment details.
5.3. What we never do
We do not sell your personal data. We do not share it with data brokers. We do not use it to train artificial intelligence models, our own or third parties', without separate, specific and revocable consent. We do not use your plan or your fee rate to influence where your listings appear.
5.4. Legal disclosure
We may disclose data where required by law, court order or a competent authority, to prevent fraud or serious harm, or to establish, exercise or defend legal claims. We assess each request and disclose only what is necessary.
5.5. Business transfer
If DDDIMO is reorganised, merged or sold, data may transfer to the acquirer, which remains bound by this Policy or a policy no less protective. You will be informed.
6. INTERNATIONAL TRANSFERS
Data is hosted in the European Union. Some processors operate outside the EEA, principally in the United States.
Transfers are made on one of the following bases:
- an adequacy decision of the European Commission;
- the EU–US Data Privacy Framework, where the recipient is certified;
- Standard Contractual Clauses approved by the Commission, with a transfer impact assessment and supplementary measures where needed.
Transfers from Brazil are made under the ANPD Standard Contractual Clauses (Resolution CD/ANPD No. 19/2024). See Annex B.
You may request a copy of the safeguards at privacy@dddimo.com.
7. YOUR RIGHTS
You have the right to: access your data; have it rectified; have it erased; restrict processing; object to processing based on legitimate interests or for direct marketing; receive your data in a portable format; withdraw consent at any time, without affecting the lawfulness of processing before withdrawal; and not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.
How to exercise them. Write to privacy@dddimo.com, or use your account settings where the option exists. We reply within one month, extendable by two further months for complex requests, in which case we tell you within the first month. Requests are free, unless manifestly unfounded or excessive.
Verification. We may ask for information to confirm your identity before acting, and no more than necessary.
Limits. We may decline where the law requires us to retain data, or where processing is necessary to establish, exercise or defend legal claims, in particular the records in section 4.2, and the subscription and consent records we must keep to evidence compliance with automatic renewal law. We will explain which exception applies.
Cancelling a subscription is not the same as deleting data. You may cancel a paid plan at any time, from account settings, through the same channel used to subscribe. Cancelling stops future charges. The record that the subscription existed, and the consent you gave to be charged, are retained under section 4.1.
Complaints. You may complain to your national supervisory authority. In Portugal: Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt. We would appreciate the chance to resolve it first.
8. AUTOMATED DECISIONS, MODERATION AND AI
8.1. Automated processing we use
| Where | What it does | Human review |
|---|---|---|
| Content moderation | Detects potentially unlawful content, prohibited items, file matching | Mandatory before any account suspension or termination |
| Risk classification | Suggests a criticality level for listings | Sample-checked; reclassification is reasoned and appealable |
| Fraud prevention | Flags unusual transaction and download patterns | Before any restriction |
| Fee calculation | Applies the published rate for the category and plan, and the minimum fee | Not a decision about you; the rate and the amount are shown on every transaction statement and may be queried |
| Search and recommendations | Orders results | Not applicable |
8.2. Your safeguards
For any decision that restricts your account, listing or content, you receive a statement of reasons stating whether automated means were used (Article 17 DSA), and you may request human review through the internal complaint procedure at appeals@dddimo.com, free of charge, for six months from the decision (Article 20 DSA), and refer the matter to a certified out-of-court dispute settlement body (Article 21 DSA).
8.3. Recommendations
Where results are ordered using a recommender system, the main parameters are described in clause 9 of the Terms. You may disable behaviour-based personalisation in your account settings. Your plan and your fee rate are not among those parameters.
8.4. Joint controllership: the essence of the arrangement
Where DDDIMO and Cobuntu determine purposes and means jointly, we have agreed that: DDDIMO is the point of contact for rights requests concerning marketplace data, and Cobuntu for account, transaction, subscription and payout data; each informs the other of a request it cannot fulfil alone; each is responsible for the security of the systems it operates; and each notifies the other of a personal data breach without undue delay. You may exercise your rights against either of us.
8.5. Artificial intelligence
Where you interact with an AI system on the Platform, this is indicated at the point of interaction, and content generated or manipulated by our AI systems is marked as such (Article 50, Regulation (EU) 2024/1689). Your content is not used to train AI models without your separate consent.
9. SECURITY
We apply technical and organisational measures appropriate to the risk, including: encryption in transit and at rest; hashing of passwords; role-based access control on a need-to-know basis; segregation of environments; logging and monitoring; regular backups; and supplier assessment.
No system is perfectly secure. If a breach is likely to result in a high risk to your rights, we will tell you without undue delay, and notify the supervisory authority within 72 hours where required.
Report a suspected vulnerability or compromise to security@dddimo.com.
10. MINORS
The Platform is for people aged 18 or over. We do not knowingly collect data from minors. On becoming aware that an account belongs to a minor, we suspend it, cancel pending transactions, refund amounts paid, revoke licences granted and delete the data.
We do not display profiling-based advertising to users identified or reasonably presumed to be minors.
If you believe a minor has given us data, write to privacy@dddimo.com.
11. CHANGES
We may update this Policy. Material changes are notified by email and published here with a new "Effective" date, at least 15 days before they take effect, except where the law requires immediate application. Previous versions are archived and available on request.
12. CONTACT
| Purpose | Address |
|---|---|
| Privacy and data rights | privacy@dddimo.com |
| Data protection officer | [TO COMPLETE] |
| Security | security@dddimo.com |
| Billing and plans | billing@dddimo.com |
| General support | support@dddimo.com |
| Postal | [TO COMPLETE] |
ANNEX A: EEA AND UNITED KINGDOM
A.1. This Policy is drafted to the GDPR standard, which applies in full to residents of the European Economic Area. For the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply, with equivalent rights.
A.2. Supervisory authorities. Portugal: CNPD (www.cnpd.pt). Other Member States: your national authority. United Kingdom: Information Commissioner's Office (ico.org.uk).
A.3. Representative. Where DDDIMO is required to designate a representative under Article 27 GDPR or the UK equivalent, the details are at [TO COMPLETE].
A.4. ePrivacy. Cookies and equivalent technologies require prior consent under Portuguese Law No. 41/2004 and equivalent national rules. See the Cookie Policy.
A.5. Subscription reminders. Where you hold a paid plan, we send you transactional messages about renewals, price changes and the expiry of a founding-price lock. These are not marketing and are sent on the basis of the contract and of the legal obligations in clause 17.4 and Annex A.9 of the Terms. They cannot be unsubscribed from while the subscription is active, but they stop when it ends.
ANNEX B: BRAZIL (LGPD)
B.1. Application. Law No. 13,709/2018 (LGPD) applies where data is processed in Brazil, where it is collected in Brazil, or where processing relates to offering goods or services to individuals in Brazil (Art. 3).
B.2. Controller and DPO. DDDIMO is the controlador. The encarregado (DPO) and contact details are at [TO COMPLETE].
B.3. Legal bases. LGPD Art. 7 bases correspond to those in section 3: performance of a contract (VI), compliance with a legal obligation (II), legitimate interests (IX), exercise of rights in proceedings (VI), and consent (I) for marketing and non-essential cookies.
B.4. Your rights (Art. 18). Confirmation of processing; access; correction; anonymisation, blocking or deletion of unnecessary or excessive data; portability; deletion of data processed on consent; information on sharing; information on the consequences of refusing consent; and revocation of consent. We reply within the periods set by the ANPD.
B.5. International transfers. Transfers out of Brazil are made under the ANPD Standard Contractual Clauses, mandatory since 23 August 2025 (Resolution CD/ANPD No. 19/2024).
B.6. Representative in Brazil. Required for foreign controllers offering services in Brazil. Details at [TO COMPLETE].
B.7. Minors. Law No. 15,211/2025, in force since 17 March 2026, applies. Self-declaration is not accepted as the sole method of age verification. Profiling-based advertising to minors is prohibited.
B.8. Complaints. Autoridade Nacional de Proteção de Dados (ANPD), www.gov.br/anpd.
ANNEX C: UNITED STATES
C.1. Scope. This Annex applies to residents of US states with comprehensive privacy laws, including California (CCPA/CPRA), and is supplemented by state-specific rights where they differ.
C.2. Categories collected. Identifiers; commercial information, including subscription and billing history; internet activity; geolocation inferred from IP; and, for Sellers, professional and financial account information. Sources, purposes and recipients are as described in sections 2, 3 and 5.
C.3. Sale and sharing. DDDIMO does not sell personal information and does not share it for cross-context behavioural advertising.
C.4. Your rights. Know, access, delete, correct, and port your personal information; opt out of sale or sharing; limit use of sensitive personal information; and not be discriminated against for exercising a right.
C.5. Universal opt-out signals. We honour recognised browser opt-out preference signals, including Global Privacy Control.
C.6. Automated decision-making. Where applicable, we provide the pre-use notice and opt-out required by the California ADMT regulations in force since 1 January 2026. See section 8.
C.7. Subscription records. Records evidencing your affirmative consent to a recurring charge, the acknowledgement sent to you and the renewal notices issued are retained to demonstrate compliance with the Restore Online Shoppers' Confidence Act and state automatic renewal laws. A deletion request does not extend to those records while that obligation subsists.
C.8. Exercising rights. privacy@dddimo.com. An authorised agent may act on your behalf with written authorisation and identity verification.
DDDIMO. From File to Life.
Version 1.1 · Document D02 · Last updated: October 2026