Privacy Policy

PRIVACY POLICY

jrlab3d.com

Last updated: 5 August 2026

1. Introduction

This Privacy Policy explains how АПРОКСИАН ЕООД (Aproxian Ltd.), trading as JRLab (“we”, “us”, “our”), collects, uses and protects your personal data when you visit or make a purchase from https://jrlab3d.com/.

We are committed to protecting your privacy and to complying with Regulation (EU) 2016/679 (GDPR), the Bulgarian Personal Data Protection Act (ЗЗЛД) and all other applicable data protection law.

2. Data Controller

АПРОКСИАН ЕООД (Aproxian Ltd.), trading as JRLab

ЕИК / Company number: 207431884
VAT number: BG207431884
Registered seat: ул. Перущица 17, ап. 12, р-н Западен, Пловдив 4002, Bulgaria
Correspondence address: 2 Seres Str., Plovdiv 4002, Bulgaria
Manager (МОЛ): Ivo Ivanov Radev
Email: office@jrlab3d.com
Telephone: +359 885 749 020

We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 GDPR. Data protection enquiries should be sent to office@jrlab3d.com.

3. Who This Website Is For

jrlab3d.com is open to both individual and business customers. The Website is intended for users aged 18 or over. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it.

4. Personal Data We Collect

a) Account and order information

Full name
Email address
Telephone number
Billing and delivery address
Company name, ЕИК and VAT number, where provided
Account username and password (stored in encrypted form)

b) Transaction information

Order details and order history
Invoices and payment status
Delivery and installation site details, where provided

Payment card details are processed directly by Stripe Payments Europe, Ltd. We do not store, receive or have access to your full card number.

c) Enquiry and custom design information

The content of messages you send us via the contact form, email, telephone or WhatsApp
Any designs, sketches, photographs, artwork or briefs you submit for a custom project, together with any personal data those materials happen to contain

d) Technical and usage data

IP address
Browser type, device type and operating system
Pages visited, time on page, referring source
On-site interactions, including clicks, scrolling and mouse movement
Session recordings and heatmaps (see clause 7)

This data is collected via WordPress, WooCommerce, Google Site Kit, Microsoft Clarity and Complianz.

5. Purposes of Processing

We process personal data in order to:

Process, manufacture and fulfil your orders
Quote for and manage custom projects
Create and administer user accounts
Communicate with you regarding orders, quotations, enquiries and support
Arrange delivery and, where applicable, installation
Meet our legal, accounting and tax obligations
Measure and improve website performance and user experience
Prevent fraud, abuse and unlawful activity
Establish, exercise or defend legal claims
Send marketing communications, where you have consented (see clause 8)

6. Legal Bases for Processing

Purpose	Legal basis
Processing and fulfilling orders; managing your account	Performance of a contract (Art. 6(1)(b))
Responding to enquiries and preparing quotations	Steps prior to entering a contract (Art. 6(1)(b))
Accounting, invoicing, tax and statutory record-keeping	Legal obligation (Art. 6(1)(c))
Site security, fraud prevention, defence of legal claims	Legitimate interests (Art. 6(1)(f))
Analytics, behavioural analytics and session recording	Consent (Art. 6(1)(a))
Marketing communications and advertising cookies	Consent (Art. 6(1)(a))

Where we rely on legitimate interests, we have assessed that our interest in operating a secure and functional business is not overridden by your rights and freedoms. You may object to this processing at any time (see clause 11).

7. Cookies, Analytics & Behavioural Tracking

We use cookies and similar technologies to ensure the Website functions correctly and to understand how visitors use it. Consent is managed through Complianz, which allows you to accept or reject non-essential cookies and to change your preferences at any time via the cookie settings link on the Website.

Strictly necessary cookies are used for core functionality such as the shopping cart, checkout, login sessions and security. These do not require consent.

Analytics and behavioural tools are loaded only after you give consent:

Google Site Kit / Google Analytics — aggregate traffic statistics, traffic sources, page performance
Microsoft Clarity — behavioural analytics including heatmaps and session recordings

About Microsoft Clarity. Clarity records how visitors interact with the Website, which may include mouse movement, clicks, scrolling and page navigation, and reconstructs these as session recordings and heatmaps. Clarity applies automatic masking to text entered into form fields, and we have configured it so that content typed into checkout and account forms is not captured. Recordings are used solely to diagnose usability problems and improve the Website. Microsoft may also use data collected through Clarity for its own purposes as set out in the Microsoft Privacy Statement, and may combine it with data from other Microsoft services. You can decline Clarity through our cookie banner at any time.

Marketing and advertising cookies. We do not currently operate advertising or remarketing cookies. Should we introduce them, they will be added to the Complianz cookie banner and will be loaded only with your prior consent, and this Policy will be updated before any such processing begins.

A full, current list of the cookies in use, their purpose and their duration is available in the cookie settings panel on the Website.

8. Marketing Communications

Where you have given consent, or where you are an existing customer and we are contacting you about similar products in accordance with applicable law, we may send you marketing emails about new designs, seasonal ranges and offers.

You may withdraw consent or opt out at any time using the unsubscribe link in any marketing email, or by emailing office@jrlab3d.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and does not stop transactional messages about orders you have placed.

9. Data Sharing & Recipients

We do not sell your personal data. We share it only where necessary, with:

Payment processing — Stripe Payments Europe, Ltd. (Ireland)
Hosting and infrastructure providers
Carriers and logistics partners, for delivery of your order
Analytics providers — Google Ireland Ltd., Microsoft Corporation
Accounting and invoicing partners, and our external accountants
Professional advisers, including lawyers and auditors, where necessary
Public authorities, where required by law or to establish or defend legal claims

All processors are engaged under written agreements meeting the requirements of Article 28 GDPR.

10. International Transfers

Some of our providers, including Microsoft and Google, may process data outside the European Economic Area, including in the United States. Where this occurs, transfers are made on the basis of the European Commission’s Standard Contractual Clauses, the EU–US Data Privacy Framework where the recipient is certified, or another lawful transfer mechanism under Chapter V GDPR.

You may request further information about the safeguards applied by contacting office@jrlab3d.com.

11. Data Retention

Data	Retention period
Order, invoice and accounting records	10 years from the end of the relevant financial year, as required by the Bulgarian Accountancy Act and tax legislation
Account data	Until you request deletion or the account becomes inactive, then deleted or anonymised
Enquiry and quotation correspondence	3 years from last contact, unless it forms part of a concluded order
Custom design files and specifications	For the duration of any warranty period and thereafter as needed to service repeat orders, unless you request deletion
Analytics and session recording data	In accordance with the provider’s default retention period; Clarity recordings are retained for a limited period and then deleted
Marketing consent records	For the duration of the consent plus 3 years, as evidence of consent

Data no longer required is deleted or irreversibly anonymised.

12. Your Rights

Under the GDPR you have the right to:

Access — obtain a copy of the personal data we hold about you
Rectification — have inaccurate or incomplete data corrected
Erasure — request deletion of your data, subject to our legal retention obligations
Restriction — limit how we process your data in certain circumstances
Objection — object to processing based on legitimate interests, and to direct marketing at any time
Portability — receive data you provided to us in a structured, commonly used, machine-readable format
Withdraw consent — at any time, where processing is based on consent
Not be subject to automated decision-making — we do not carry out automated decision-making or profiling that produces legal or similarly significant effects

To exercise any of these rights, contact office@jrlab3d.com. We will respond within one month, extendable by two further months for complex requests, and will notify you if an extension applies. We may ask you to verify your identity before acting on a request.

Please note that we cannot delete data we are legally required to retain, such as invoices and accounting records.

13. Right to Complain

If you believe we have processed your data unlawfully, you may lodge a complaint with:

Commission for Personal Data Protection (Комисия за защита на личните данни) 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria Telephone: +359 2 915 3518 Email: kzld@cpdp.bg Website: https://www.cpdp.bg

You may also complain to the supervisory authority in your country of residence or workplace.

14. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration and misuse, including TLS encryption in transit, access controls, hosting-level firewalling and malware scanning, and restriction of administrative access to authorised personnel.

Card payments are processed through PCI-DSS compliant infrastructure operated by Stripe.

No system is entirely secure. In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will notify you and the КЗЛД in accordance with Articles 33 and 34 GDPR.

15. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, our tools or applicable law. The current version will always be available at https://jrlab3d.com/. Where changes are material — including the introduction of new tracking or marketing technologies — we will make this clear on the Website and, where required, seek fresh consent.

16. Contact

АПРОКСИАН ЕООД (Aproxian Ltd.), trading as JRLab Email: office@jrlab3d.com Telephone: +359 885 749 020 Correspondence address: 2 Seres Str., Plovdiv 4002, Bulgaria