Privacy policy

Who we are

Render Roll is a business-to-business product-rendering service operated by XO3D Ltd. XO3D Ltd is the controller for the personal information described here. It is registered in England and Wales, company number 11876020, with registered office at 1 Beauchamp Court, 10 Victors Way, Barnet, Hertfordshire EN5 5TZ. Contact privacy@renderroll.com for privacy requests.

Information we collect

• Business contact data: name, work email, company, phone, website, billing country or region, company registration or tax identifier and evidence that the order is for business use.
• Enquiry and order data: market, currency, package, quantities, product category, deadlines, scope approvals, terms version, payment status and order correspondence.
• Project material: CAD or 3D files, SKU spreadsheets, artwork, references, product information and delivery files.
• Payment metadata: Stripe customer, link, invoice, tax, payment and refund identifiers. Stripe receives card data directly; Render Roll does not receive full card details.
• Technical and security data: server requests, timestamps, IP address, form-abuse signals, file hashes, download access and webhook event records.
• Preferences and optional analytics: selected market and consent choice, plus Google Analytics data only after Allow analytics is selected.

Purposes and lawful bases

• Responding, validating files and preparing a quote: steps requested before a contract and our legitimate interest in operating a B2B enquiry service.
• Approving scope, taking payment, delivering work and supporting an order: performance of the contract.
• Invoices, tax, fraud prevention, sanctions checks and business records: legal obligations and legitimate interests in protecting the service and customers.
• Security logs, file hashes, private links and incident investigation: legitimate interests in preventing abuse, loss and unauthorised access.
• Optional analytics: consent. Analytics is not used for advertising and can be rejected without affecting the service.

Our specific legitimate interests are running and improving the service, preserving accurate commercial records, protecting systems and files, preventing fraud and resolving disputes. We consider the limited business-contact impact and provide the rights and controls below.

Required information

The required form fields are needed to prove a business enquiry, identify the customer, route the market and tax review and prepare a scope. If they are not supplied, we cannot validate or accept an order. Optional fields and quote-stage uploads may be omitted, although missing project material may prevent us confirming a scope.

How files are protected

Quote files are transferred over HTTPS, stored outside the public website, renamed, hash-recorded and made available through private time-limited download links. They are treated as untrusted until reviewed. Do not include passwords, payment-card details, special-category personal data or unnecessary personal information in project files.

Recipients and service providers

SiteGround hosts the site and private quote-file store. HubSpot holds business contacts, enquiries and order states. Microsoft carries operational email. Stripe hosts payment, invoice and tax-ID collection. Google provides analytics only after consent. Professional advisers, insurers, regulators, courts or law enforcement receive information only where reasonably necessary or legally required. We do not sell personal information.

International transfers

Some providers may process information outside the UK. Where UK restricted-transfer rules apply, we rely on an adequacy regulation or appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum, together with provider security and transfer assessments where required. Contact us for more information about the safeguard used for a relevant transfer.

Retention

• Quote-stage uploads and private download tokens: deleted after 30 days, including through automated expiry cleanup.
• Unsuccessful enquiry records: normally 24 months after the last meaningful contact, unless needed for a dispute, suppression request or legal obligation.
• Customer, contract, invoice, tax and payment records: normally seven years after the relevant financial year or longer where law or an active dispute requires it.
• Production source files and delivered images: the period in the confirmed scope or active customer relationship, then reviewed for deletion or agreed reuse.
• Security and webhook event records: normally 12 months, unless an incident or dispute requires longer.
• Google Analytics event and user data: two months. Analytics cookies set by this site expire within 60 days and are deleted when Reject analytics is selected where the browser permits.

Your rights

Subject to the law and available exemptions, you can ask for access, correction, deletion, restriction, objection or portability. You can withdraw analytics consent at any time through Cookie settings. To exercise a right, email privacy@renderroll.com. We may need to verify identity and authority. You may complain to the UK Information Commissioner's Office at ico.org.uk.

Automated decisions and marketing

We do not use personal information to make solely automated decisions with legal or similarly significant effects. Market routing and the price estimator are indicative only and do not accept or reject an order. The enquiry form does not opt you into marketing.

Security and policy changes

We use access controls, encrypted transfer, private storage, audit records and data minimisation. No system is completely secure, so we also maintain incident and recovery procedures. Material changes will be shown by the updated date and, where appropriate, brought to active customers' attention.