Privacy notice

Each part of the business has its own notice. One business and one controller, but a shop, a creative studio and a page about the company collect very different things, and a single notice covering all of them would be too vague to be any use. This one does not try.

If you have an account, an order or a quote, the 3D Essentials notice is the one that governs it, wherever you first arrived. One account covers all three.

The controller is Freddie Sparrow Limited, which trades as 3D Essentials. The company was incorporated on 22 September 2026 and became the controller on that date; its registered name, number, place of registration and registered office are in the footer of every page here. Before that date the controller was Freddie Sparrow personally, and anything collected then was collected by him. Freddie Sparrow Official, the YouTube channel, is his own and not the company's. Where a video is made as the company's business the company is the controller of the personal information gathered in making it; the channel itself — its subscribers, comments and analytics — is his, is outside this notice, and Google's terms cover it as they would for anybody's channel.

There is no data protection officer. One is not required for a business of this size and nature, and appointing one who did nothing would be worse than not having one. Ask anything about this through the contact page and it reaches a person.

If you use the contact form

Your name, your email address, and whatever you write in the message. Nothing else is asked for and nothing is inferred. It is sent to our admin desk — the one place the business answers everything from, whichever name you arrived under — and it is held there under the retention periods published in the 3D Essentials privacy notice.

The lawful basis is legitimate interests (UK GDPR Article 6(1)(f)) — you asked the business a question, and a business that could not keep your message long enough to answer it would be no use to you. The balancing test is short: you chose to write, the information is what you chose to put in the box, and it is used only to reply.

Sending a message creates a pending customer record against your email address on the business's system, so that your message has an owner from the first moment. That record grants nothing and cannot be signed into. It exists so that if you later open an account with the same address, what you have already sent is already yours — no linking step, and no chance of your message being attached to the wrong person.

There is a hidden field in the form that a person never sees and never fills in. If it arrives filled in, the message is treated as automated.

Three more checks run on what you send, all of them automatic. A spam filter reads the words for the marks of a sales pitch — search-engine offers, link selling and the like. If enough of them are there, your message is still saved, but it is filed on the desk as Spam and no acknowledgement is sent to the address in the form, because a pitch usually carries somebody else's address. Nothing is deleted. A risk score may be worked out from how the message arrived — how many came from the same place in a short time, whether the same words have been sent before, whether the address is a throwaway one — and kept beside it as the names of the rules that fired. It changes nothing about what happens to your message. An IP reputation check, when it is switched on, sends the address your message came from to a reputation service — proxycheck.io or ipapi.is — to ask whether it belongs to a VPN, a proxy or a data centre. It runs after your message is saved, so it cannot stop it arriving, and what is kept is the answer beside a scrambled (hashed) form of the address, not the address itself.

None of these has a legal or similarly significant effect on you. If you think a message of yours has been filed as Spam, ask — by email or by writing again — and a person will review it. If you are a person who has somehow tripped the hidden field, writing again will reach somebody.

The anti-bot check

The form runs Cloudflare Turnstile, which works out whether you are a person from how the browser behaves. It may store a short-lived token in your browser while it does so. It does not track you across sites, does not build a profile and is not used for advertising. Without it the form would be filled in by machines all day. See the cookie notice.

If you only read a page

Cloudflare serves this site and keeps short-lived request logs — IP address, time, page, browser — to deliver pages, spot attacks and keep the site up. That is a legitimate interest too. Nothing in those logs is used to build a profile of you, and they are not joined to anything you send.

There is no analytics on this site. No page-view counter, no heatmap, no advertising pixel, no third-party embed, no social button, no font loaded from somebody else's server. The only request your browser makes to another company is the anti-bot check, and only on the page with the form.

• Cloudflare — serves the site and runs the anti-bot check. A processor for the request logs.
• An IP reputation service — proxycheck.io or ipapi.is, and only when that check is switched on. It is sent the IP address a message came from and nothing else, and answers whether it is a VPN, a proxy or a data centre. A processor.
• Our own admin desk and the systems behind it — where a message from the form lands and is answered from. Not a third party: same business, same people, same controller. It is reached through 3dessentials.co.uk because that is where the software lives, not because the trading name is the one you are dealing with.
• The email provider used to reply to you, named in the 3D Essentials privacy notice.

Nothing here is sold, and nothing is shared for advertising. Information is disclosed otherwise only where the law requires it, or to establish or defend a legal claim.

Some of these providers operate outside the UK. Where information leaves the UK it does so under the transfer arrangements recognised by UK law — adequacy where it exists, and the International Data Transfer Addendum where it does not. The 3D Essentials notice names each provider and where it sits.

A message sent through this form is kept on the same schedule as any other enquiry to the business — the periods published in the 3D Essentials privacy notice, and enforced by a job that runs every night rather than by somebody remembering. An enquiry that turns into an order is kept for as long as the order is, because it is then part of the record of a contract.

Cloudflare's request logs are short-lived and are not under the business's control. Nothing else about your visit to this site is stored anywhere.

All of these are free, and the answer comes within one month.

• A copy of what is held about you, and confirmation of whether anything is.
• A correction, if something is wrong or incomplete.
• Deletion, where there is no continuing reason to hold it. A record the business must keep by law — an order, an invoice — cannot be deleted on request, and the answer will say so and say which law.
• Restriction, to have it held but not used while something is being sorted out.
• An objection to the business relying on legitimate interests. Say what it is about your situation, and the balance gets struck again with that in it.
• Portability, where it applies — information you gave, in a machine-readable file.

Ask through the form and say which one you want. You may be asked to confirm you control the email address in question, which is not obstruction — it is the step that stops somebody else asking for your information.

Nothing on this site makes an automated decision with a legal or similarly significant effect, and none of it is directed at children.

Raise it through the form first — it is usually quicker and it is the only route that can actually fix the thing. If that does not resolve it you can complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or 0303 123 1113. Complaining to them does not require asking here first, and does not affect any other right you have.

The version on the page is the one that applies to your visit. This site does not keep a version history, because nothing here is a document anybody accepts or is bound to over time. The documents that do work that way — the terms of sale, the 3D Essentials privacy notice, the account terms — live on 3dessentials.co.uk, where every version is frozen, fingerprinted and kept, so a customer who agreed to one set of words can still read exactly those words back.