Privacy Policy

Who we are

SixthLayer (“we”, “us”, “our”) is a UK 3D-printing business operated by a sole trader trading as SixthLayer. We are the “data controller” responsible for your personal data under the UK GDPR and the Data Protection Act 2018.

SixthLayer
64 Glebe Road, Annahilt, BT26 6NG
info@sixthlayer.co.uk

What we collect

Depending on how you use the site, we may collect:

• Your name, email address and delivery/billing address.
• The contents of your order and your order history.
• Messages you send us through the contact or custom-order forms.
• Any model files you upload for a custom order (e.g. STL, STEP, OBJ, 3MF).

Payments are processed by Stripe. We never see or store your full card details — Stripe handles card data on its own secure systems.

If you accept analytics cookies, we also collect usage data: the pages you visit, the products you view and search for, your approximate location (country/city level, from your IP address), your device type and the site or search engine you came from. This is never linked to your name, email address or order — but it does involve a random identifier stored in a cookie, so we don’t claim it is fully anonymous.

How and why we use it

We use your personal data to:

• Process, fulfil and deliver your orders and quotes.
• Respond to your enquiries and provide customer support.
• Meet our legal and tax obligations.
• Protect against fraud and keep the shop running securely.
• Understand which products people are looking for, so we know what to make next — only if you have accepted analytics cookies.
• Send you marketing — only if you have opted in.

Our legal bases

Under UK GDPR we rely on:

• Contract — to take and fulfil your order.
• Legal obligation — to keep tax and accounting records.
• Legitimate interests — to run and secure our business and prevent fraud.
• Consent — for marketing emails and for analytics cookies, either of which you can withdraw at any time.

Who we share it with

We only share your data with the services needed to run the shop:

• Stripe — payment processing.
• Royal Mail — delivery and tracking.
• Resend — sending order, enquiry and (if opted in) marketing emails.
• Render — website hosting.
• Cloudflare — spam and bot protection on our enquiry forms (Turnstile). It checks that a submission comes from a real person; it does not track you across sites or build an advertising profile.
• Google Analytics — anonymous traffic measurement, and only if you accept analytics cookies. We have switched off Google Signals and ad personalisation, so your data is not used to build an advertising profile.

These providers process data on our behalf under their own security and privacy terms. We never sell your personal data, and we only disclose it otherwise where the law requires it.

Some of these providers are based outside the UK, including in the United States. Where that is the case, transfers are covered by the UK extension to the EU–US Data Privacy Framework or by standard contractual clauses.

Cookies & storage

Essential storage. We use first-party browser storage to make the shop work — for example, remembering the items in your basket and keeping track of your checkout session. This is necessary for the site to function, so it does not require your consent.

Analytics cookies. With your consent we use Google Analytics 4 to understand how the shop is used and which products people look for. Nothing is loaded and no analytics cookie is set until you choose “Accept” on the cookie banner, and choosing “Reject” is equally easy and fully respected. We do not use advertising cookies at all.

• _ga — a randomly generated identifier used to count returning visitors. Expires after 2 years.
• _ga_* — keeps track of the current visit. Expires after 2 years.
• sixthlayer_analytics_consent — remembers your choice above. Stored in your browser’s local storage rather than a cookie, so recording your decision does not itself set one. Expires after 1 year.

Changing your mind. Use the Cookie settings link at the bottom of any page. Turning analytics off takes effect immediately — collection stops and the cookies are deleted. We also re-ask about once a year. See Google’s privacy policy for how they handle analytics data.

When you pay, Stripe sets its own cookies on its checkout pages under Stripe’s privacy policy.

How long we keep it

• Order and financial records: 6 years, to meet UK tax and accounting requirements.
• Custom-order model files you upload: kept only to fulfil your order and deleted within 90 days of completion. We do not reuse or share them.
• Enquiry messages: kept only as long as needed to deal with your query.
• Marketing contact details: until you unsubscribe.
• Analytics data (if you consented): up to 14 months, then automatically deleted by Google.

Your rights

Under UK data protection law you have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Ask us to erase your data, where we’re not required to keep it.
• Receive your data in a portable format.
• Object to, or ask us to restrict, certain processing.
• Withdraw consent to marketing at any time.

To exercise any of these, email info@sixthlayer.co.uk. If you’re unhappy with how we’ve handled your data, you can complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed.