Privacy Policy
19/01/2024Last update: XX/05/2025
Privacy Policy
At 3Shape, we recognize the importance of privacy in both business and personal life and are committed to protecting your personal data. This Privacy Policy outlines how we manage and safeguard your personal information.
1. General information
About 3Shape
3Shape is a company with entities in many countries and operates globally. The privacy standards described in this Privacy Policy apply across the entire 3Shape group. However, since some jurisdictions require the designation of an entity responsible for data processing (e.g., “data controller” under the EU GDPR), this role is fulfilled by 3Shape A/S, company no. 25553489, Holmens Kanal 7, 4, 1060 Copenhagen K, Denmark.
Privacy Policy Scope
Before reading our comprehensive Privacy Policy, please check if its scope applies to you.
- Material scope of the Privacy Policy
This Privacy Policy provides information about how 3Shape processes personal data as a data controller (when 3Shape independently determines the purposes and means of processing personal data for its own purposes). It does not describe how 3Shape processes personal data as a data processor (when customers determine the purposes and means of processing, and 3Shape acts on their behalf). More information about 3Shape's role as a data processor can be found here.
- Personal scope of the Privacy Policy
The informational obligations fulfilled by 3Shape through this Privacy Policy arise primarily from data protection regulations. Accordingly, personal data refers to information about an identified or identifiable natural person, also known as the data subject. The data subjects to whom this Privacy Policy applies are primarily our direct customers (end-users of our products and services), their patients, employees of our resellers, suppliers, and business partners, participants in our events or training sessions, visitors to our websites and social media, etc.
Excluded from this Privacy Policy are job applicants, who are covered by a separate Recruitment Privacy Policy, and 3Shape employees, who are covered by an Internal Privacy Policy.
- Geographic Scope of the Privacy Policy
3Shape decided to present the Privacy Policy in this form due to GDPR regulations, which primarily apply within the European Union. However, 3Shape also considers privacy laws in other countries and strives to include all necessary information. Additional information specific to other regulations, such as CCPA and China’s privacy laws, may be found separately in our Privacy & Compliance Center. If you do not find the required information according to the laws of your country, please contact us at (dpo@3Shape.com), and we will provide you with the necessary information.
Data Protection Officer
You may contact our Data Protection Officer (DPO) at the following address: dpo@3Shape.com or via mail addressed to Data Protection Officer, 3Shape A/S, Holmens Kanal 7, 4, 1060 Copenhagen K, Denmark.
2. How 3Shape collects and uses your personal data
3Shape collects and uses personal data for various purposes. We ensure that all personal data is handled in compliance with applicable laws.
At times, we may ask you to provide information voluntarily to deliver our services (e.g., creating an account). Other times, you may provide personal information to communicate with us or maintain a service relationship (e.g., filling out contact forms or subscribing to a newsletter). In certain situations, we may combine the information you provide with existing data in our systems (e.g., when you request support).
Below, we describe the ways in which we collect personal data, indicate the purposes for which we do so, and provide the legal basis (contract, legal obligation, consent or legitimate interest).
Personal data provided by you
Creation of 3Shape Account
A 3Shape Account is required to use most of our platforms and services. To create an account, we collect and process your name, surname, email address, and company name. This processing is based on our contractual relationship, established when you accept our terms & conditions.
Registration of 3Shape products
After purchasing our scanner, you need to register it to be able to use it. For this purpose, we process your personal data from your 3Shape Account and the unique dongle/subscription number. This processing is based on our contractual relationship, established when you accept our terms & conditions (on your own behalf or on behalf of your company).
Contact forms
Sometimes, you fill out a form on our website to initiate contact from our side (e.g., Demo form, ROI calculator, Newsletter). The scope of personal data is visible in the form (usually your name, email address, location, company name/type of business), and we process this data to contact you in the most appropriate way. This processing is based on our legitimate interest (to respond to your request), or on the performance of a contract if the processing is necessary to take steps at your request prior to entering into a contract (e.g., sending you an offer).
Event registration and participation
You provide us with your personal data when you register for an event organized by us (e.g., dental events, trade fairs, online or on-site training sessions, contests, etc.). The scope of the data we collect depends on the specific event and is visible in the form you fill out for this purpose. The legal basis for processing your data here is a contractual relationship, as well as our legitimate interest (e.g., by contacting you after the event to send you presented materials or to ask about your satisfaction with the event).
3Shape Support
To receive support from us, you typically initiate contact and thus provide us with your data. The type of personal data provided by you will depend on the support case in question and also on the channel you use to request support (e.g., website form, email, phone, chatbot), but generally it is the name, surname, company name, e-mail, phone number, dongle/subscription/license/scanner serial number and address information in case of repair or replacement.
In some cases, and only subject to your approval, a 3Shape support agent may remotely access your local 3Shape system. No personal data is retrieved from your system or stored by 3Shape during or after such remote access, unless the investigation of a specific case requires it. In such instances, the support agent will cooperate with you to determine the specific case and the patient scans needed by 3Shape to resolve the issue. 3Shape does not access your patients' data without your consent and a clear necessity.
Please note that when requesting 3Shape support, you must not include patient information (e.g., screenshots or other materials containing patient data, which must be de-identified before being attached). If 3Shape receives patient information, the information will be anonymized or deleted, and you may be asked to re-submit your support ticket. The legal basis for processing your personal data for the purpose of providing support is a contractual relationship or legitimate interest.
Marketing communications
We may process your contact details to send marketing communications such as newsletters, event invitations, and product updates. This is based on your consent, which you can withdraw at any time. You can manage your preferences or unsubscribe from communications through your 3Shape account or via the unsubscribe link in emails you receive from 3Shape.
Business relationship
If your company or the company you work for has business relations with 3Shape (e.g., resellers, partners, suppliers, service providers), please be aware that 3Shape also processes your personal data/personal data of your employees. These data are obtained by 3Shape from your company (to contact a given employee) or directly from this employee. These are primarily basic identification data (such as name, surname, and company name) and contact information (such as address, email address, and phone number).
The legal basis for processing your personal data for this purpose is a contractual relationship or legitimate interest.
Participation in research
3Shape conducts various types of research, ranging from UX studies to clinical trials. Participation in these studies is entirely voluntary and requires the explicit consent of participants prior to their involvement. Detailed information about the purpose, scope, and procedures of each study, as well as the specific data being collected, is always provided to participants beforehand.
The personal data collected during these studies varies depending on the nature of the research. The legal basis for this processing is your consent. After the study is completed, on the basis of our legitimate interests, we may anonymize the personal data and continue to use the anonymized data, which will no longer constitute personal data.
Participation in surveys
To gather insights into your satisfaction with our products and services, 3Shape may invite you to participate in various surveys. Invitations are typically sent to groups of our customers who might find them relevant (e.g., those using a specific product or service). We process the personal data already present in our systems (e.g., name, surname, e-mail address, role) to distribute survey links based on our legitimate interest; however, participation in the survey is voluntary and requires your consent (obtained separately, usually by clicking the link provided and following further instructions, where you can also see what personal data will be processed in that particular survey).
Processing of image and voice
In connection with various 3Shape activities, your image and voice may be processed (e.g., if we record a video at an event and ask for your opinion, or if you are our partner and we film an interview with you). All such activities are conducted in compliance with applicable legal regulations. The legal basis for processing personal data is either a contract or consent, depending on the project.
Further information is always provided prior to the processing, in a consent form or along with the recording participation agreement.
3Shape sometimes uses so-called situational shots in its press materials and on social media (e.g., photos published on our official channels, atmosphere videos from events, etc.). The legal basis for processing data in this context is our legitimate interest, and we do not need to obtain consent because the focus is on the situation rather than on the individual.
Participation in online meetings, video calls, and phone conversations
Participation in online meetings, video calls, and phone conversations may involve the processing of basic personal data such as your name and surname, phone number, e-mail address used in the communication tool, as well as your image and voice. If calls or meetings are recorded, participants are informed in advance or consent is asked by the organizer or the caller. We may also transcribe the meeting audio into text for minute-taking or accessibility purposes.
Recordings and transcripts are used solely for purposes such as making them available later to absent participants, internal training, or as evidence of processes (e.g., for customer support).
Visiting 3Shape’s physical locations
If you visit 3Shape at our offices, we need to know who you are for security reasons. At the reception desk, we will ask for your name and surname, and the purpose of your visit (including the name of your host). If your visit involves access to restricted areas or information, you may be asked to sign a non-disclosure agreement (NDA). If we issue you an access card, we may track your movements within the building. Additionally, our offices are monitored with CCTV (recording images without sound). In all cases, we act in compliance with local laws.
Whistleblowing
If you make use of your rights under whistleblower laws, the scope of data processed will depend on the reporting channel you choose: Whistleblower. If you submit your report via email, we will process your contact details and any personal data you choose to include in your request. If you use the anonymous reporting platform, your personal data will be processed in accordance with the platform provider's privacy policy . The legal basis for processing your data is applicable law and our legitimate interest.
Personal data collected automatically
Visiting 3Shape websites, platforms and other digital content
When you visit our websites, we gather information about your device and how you use it. This data may include your IP address, device type, unique device identification numbers, browser type, approximate geographic location (e.g., country determined by your public IP address), as well as performance and other usage or technical details. We collect this information not merely out of curiosity, but to improve our products and services, ensuring they work as effectively as possible for you.
We also collect information about how you engage with our websites and platforms (e.g., which content you view most frequently, how long you stay on a website, and which links you click). This includes your interactions with our emails, content, or features such as opening a marketing email, clicking on embedded links, watching videos on our websites, or using our chat function. We analyze this data to evaluate the effectiveness of our user experience efforts and the reception of our marketing campaigns.
Some of this information may be gathered through cookies and similar tracking technologies (please refer to our Cookie Policy for details). By consenting to cookies, browsing while logged in to your 3Shape account, or providing data through website forms during your visit, we can associate some of your behavioral data with your registered user profile. If you choose not to accept cookies, your IP address will be anonymized for analytical and statistical purposes, allowing us to track general behavior patterns without identifying you personally.
The legal basis for processing your personal data is either our legitimate interest or your consent.
Using 3Shape products, mobile apps and services
When you use 3Shape products, mobile apps and services, we automatically collect certain data to improve functionality, support technical operations, and enhance your experience. This includes the information you provide when setting up or updating your 3Shape Account, such as your identification and contact details, as well as other technical information about your device, operating system, connection quality, etc. We may also collect data and analyze how you use our software, including usage and interaction patterns and operational statistics. However please remember that if you upload or import patient-related data, such as dental scans or health records, this data is encrypted and securely processed. Importantly, we do not have access to your patient data.
We take your privacy seriously and anonymize personal data whenever it is not necessary to achieve the intended purpose, in line with applicable legal requirements.
The legal basis for processing your personal data is either our legitimate interest or contract. For further details about how 3Shape handles your data and your responsibilities when using our software, please refer to the terms & conditions of product/service you are interested in (you can find all relevant information in your 3Shape Account).
Using anonymized scans and images
In order to develop our products and services, we may also collect automatically anonymized scans or images (e.g., smiles/mouths) from various sources. As a rule, when such data reaches 3Shape, it is no longer personal data for us, as it is anonymized before it reaches us in such a way that 3Shape is unable to identify the data subject. We mainly use this data for machine learning to ensure that the technologies we develop are useful and of the highest quality.
Personal data obtained from other sources
From third party sources
3Shape may collect business contact information about you from other sources, including our resellers, partners, event organizers, and sometimes from publicly accessible sources such as your company's website or professional network services (please note that we do not engage in data scraping etc.). The types of personal data we collect for this purpose may include: name, surname, business e-mail, phone number, company name, and job title. The way in which third parties collect your personal data is detailed in their privacy policies.
3Shape processes this data to contact you directly for various legitimate business reasons, but also to provide direct information about our products and services. The legal basis here is our legitimate interest, and in some cases, your direct consent given to a third party.
From your organization
3Shape may have your personal data because we received it from your organization (e.g., from your employer or from the DSO you are part of). We process this data for business contact purposes (e.g., if your employer created a 3Shape Account for you or designated you as a contact person on behalf of their organization). The basis for processing this data is legitimate interest.
3. With whom 3Shape may share your personal data
Depending on the circumstances, 3Shape may share or make your personal data accessible to third parties as follows:
- 3Shape affiliates: 3Shape has entities in various locations around the world – please check here – which means your personal data may be shared or made accessible to a specific location to fulfill a request you have submitted or for support, marketing, technical operations, local event registration, etc. Transferring data to local entities is always justified by business needs; not all our entities have unrestricted access to all personal data within the 3Shape Group.
- Service providers: We may disclose your personal data described above to third-party service providers or vendors contracted to provide services on our behalf (e.g. IT and hosting, data analytics & statistics, payment services, call recording, chatbot technologies, etc.). Please be informed that 3Shape has the legally required data protection agreements with all the entities it cooperates with, and these third-party service providers may use the personal data we provide to them only as instructed by 3Shape.
- 3Shape partners: 3Shape may share your data with our partners, such as resellers, DSOs, universities (for clinical research purposes), and providers offering complementary services. Such sharing occurs only when you consent (where legally required) or explicitly instruct us to interact with these partners (e.g., your reseller or DSO).
- Event organizer: When you participate in a webinar, event, or other activities organized by 3Shape where we collaborate with a third party (e.g., external speaker, co-organizer, etc.), we may disclose the information described above under 'Event registration and participation,' such as your contact information and interest in these offerings or services, to these approved third parties to communicate with you independently from 3Shape.
- Your organization: in certain situations, where your organization (e.g. your employer) is our customer, we may disclose some information to relevant people within your organization, but only in connection with the purpose for which we process your data. For example, if your employer registered you for our training or product onboarding and then inquires whether you completed the training, we have the right to provide them with such information.
- Cookie providers: With your consent, we may allow third-party cookie providers on our website to process your data for purposes such as advertising, analytics, or personalization. For more details or to manage your preferences, please see our Cookie Policy.
- Other disclosures: 3Shape may share your personal data if we reasonably believe it is necessary to: (a) comply with applicable laws or legal obligations; (b) respond to audits, investigations, or legal and regulatory proceedings; (c) protect our rights or property; (d) enforce our terms, policies, and agreements; or (e) safeguard the rights, property, or safety of our users, customers, or the public. In case of a corporate transition, such as a merger, acquisition, or asset sale, your personal data may be transferred. We will ensure the receiving party uses your personal data in line with this Privacy Policy. Additionally, we may ask for your consent before sharing your information with third parties not otherwise described here.
4. Transfers to third countries
3Shape operates globally, and 3Shape entities may transfer, store, or process your personal information in countries outside your jurisdiction to provide efficient services. When transferring your personal data internationally, 3Shape complies with applicable laws and regulations and implements appropriate safeguards to protect your privacy, fundamental rights, and freedoms. For example, when transferring personal data from the European Economic Area (EEA) to other countries such as the United States, we utilize suitable data transfer mechanisms like the Standard Contractual Clauses approved by the European Commission or other competent authorities. Additionally, 3Shape may rely on frameworks such as the EU-U.S. Data Privacy Framework and its UK Extension, following the adequacy decision by the European Commission, as a legal basis for transferring personal information from the EU and UK to the United States. We strive to retain personal information within its region of origin whenever possible, or ensure robust technical, organizational, and legal safeguards for international data transfers.
5. Profiling and automated decision-making
3Shape may create customer or user profiles by combining data from various sources, including personal information and non-personal data (such as information about how our products and services are used). Such profiling helps us to enhance the customer experience, better tailor marketing content (when we have your marketing consent), provide more effective technical support, and improve our products and services. Our profiling practices do not discriminate against any group of users or unfairly favor others. Moreover, we do not make any decisions about you based solely on automated processing or profiling. In accordance with Article 22 of the GDPR, any decision that could significantly affect you will involve human intervention to ensure fairness and compliance.
6. Personal data security measures
3Shape maintains comprehensive security measures and holds certifications in ISO 27001 and ISO 27701 to ensure that our internal processes align with recognized industry security standards. The specific security controls applied depend on the type and scope of data and processing activities, and are designed to consistently protect the confidentiality, integrity, and availability of personal information.
Please visit our Privacy & Compliance Center to learn more about how 3Shape products and services safeguard personal data and other information.
7. Retention of personal data
We retain your personal data for as long as there is a legitimate business purpose for its processing or as required to comply with applicable legal, tax, or accounting obligations.
The criteria used to determine the retention period include:
- The duration of our ongoing relationship with you
- The nature and sensitivity of the personal data
- Legal obligations and the necessity to retain data for dispute resolution or for the establishment, exercise, or defense of legal claims
Once the data is no longer required for these purposes, it will be deleted or anonymized. If immediate deletion is not feasible (e.g., due to technical limitations such as backup storage) the data will be securely stored, and access will be restricted until deletion becomes possible. Where feasible, we periodically review our data retention practices to ensure compliance. More information about specific retention periods can be provided upon request.
8. Use of Artificial Intelligence
3Shape uses artificial intelligence tools to streamline both our internal workflows and the functionality of our products. In everyday operations, we may employ AI-powered utilities (e.g., data cleaning assistants or spreadsheet organization tools) that process personal data under strict internal policies and security controls. For product development and advanced analytics (e.g., machine-learning models that improve image analysis or predictive insights), we train and evaluate AI exclusively on fully anonymized datasets that cannot be linked back to any individual. In all cases, we vet any third-party AI provider and put contractual safeguards in place to prevent them from using our data for their own purposes. Our AI practices follow industry standards for transparency, data minimization, and compliance with applicable data protection regulations.
9. Third-party links and content
Our websites may contain links to third-party websites or embedded content. We are not responsible for the privacy practices or content of such third parties. We encourage you to read their privacy and cookie policies before providing any personal data.
10. Social Media
You can find 3Shape on social media platforms such as Facebook, LinkedIn, Instagram, X, and YouTube. When you interact with our official pages, both 3Shape and the platform may collect information about your activity (e.g., views, reactions, comments, and messages). This data may be used by us for statistical analysis, to improve our content, and to engage with our community.
Please note that, in some cases, 3Shape and the platform may act as joint controllers of personal data in accordance with applicable data protection laws. For more information on how each platform processes your personal data, please refer to their respective privacy policies:
If you participate in discussions or share content on our social media pages, please be aware that this information may be visible to other users. 3Shape is not responsible for how third parties use or misuse data that you voluntarily make public on these platforms.
We may also use social media tools or technologies that collect aggregated or anonymized data to measure the effectiveness of our presence and advertising on these platforms. Where required by law, we obtain your consent before using such technologies.
To exercise your rights regarding data collected via social media, please contact the relevant platform directly.
11. Your rights regarding personal data
Depending on your location and how you interact with 3Shape, you may have certain rights under applicable data protection laws, including the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and other similar U.S. state privacy laws.
These rights may include the ability to:
- Obtain access to the personal data we process about you, including the categories of data collected, the purposes for processing, and any disclosures made
- Request correction of inaccurate or incomplete personal data
- Request the deletion of your personal data (the “right to be forgotten”)
- Object to or request restriction of our processing, where legally permitted
- Withdraw your consent at any time if processing is based on consent
- Request data portability in a structured, commonly used, and machine-readable format, where technically possible
- Object to the use of your data for direct marketing purposes
- Opt-out of the sale or sharing of your personal data for targeted advertising purposes (please remember that 3Shape does not sell any data)
- Limit the use and disclosure of sensitive personal information, where applicable
- Not be subject to discriminatory treatment for exercising your privacy rights
How to Exercise Your Rights?
To exercise the rights described in this Privacy Policy, please contact our Data Protection Officer (DPO) at 📧 dpo@3shape.com or by mail at 📬 3Shape, Holmens Kanal 7, 1060 Copenhagen K, Denmark.
Some rights can also be exercised directly by you. For example, you can withdraw your marketing consent at any time by adjusting your preferences in your 3Shape Account or by clicking the “unsubscribe” link included in our marketing communications.
We may need to verify your identity before processing your request. You may also authorize another person to submit a request on your behalf, provided that appropriate documentation is submitted (e.g., written authorization or power of attorney).
If you encounter any issues or have questions regarding your rights, please do not hesitate to reach out to us.
Right to lodge a complaint
If you believe that 3Shape has not handled your personal data in accordance with applicable laws, you have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet) or with your local data protection authority.
📍 Danish DPA: Carl Jacobsens Vej 35, 2500 Valby, Denmark
🌐 www.datatilsynet.dk
12. Changes to this Privacy Policy
3Shape may update or revise this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. Any changes will be posted on this page, and the date of the latest update will be indicated at the top of the policy. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data.
If we make material changes that significantly affect how we process personal data in connection with our products or services, you will be informed through the usual communication channels related to those products or services—such as in-product notifications. email updates, or messages on our platforms.
The latest applicable version is always available at www.3shape.com/privacypolicy.