Home / Data protection
Data protection
How Shapeways.io meets its data protection obligations in the UK and Ghana.
On this page
- Introduction
- Legal Framework
- Scope of This Policy
- Data Protection Principles
- Responsibilities
- Collection and Use of Personal Information
- Data Access and Confidentiality
- Data Storage and Security
- Use of Company Devices and Technology
- Working With Third Parties and Clients
- International Data Transfers
- Data Retention and Disposal
- Personal Data Breaches and Security Incidents
- Individual Data Protection Rights
- Data Protection Training and Awareness
- Data Protection Impact Assessments
- Monitoring and Compliance
- Policy Breaches
- Policy Review and Updates
- Contact Information
Shapeways.io Ltd
Effective Date: 30 October 2026
Last Reviewed: 30 October 2026
Policy Owner: Shapeways.io Ltd
Review Frequency: Annually or when significant changes occur.
1. Introduction
Shapeways.io Ltd is committed to maintaining the highest reasonable standards of data protection, confidentiality and information security across all areas of its business.
We recognise that personal information is valuable and must be handled responsibly, securely and in accordance with applicable data protection legislation.
This Data Protection Policy establishes the principles, responsibilities and procedures that guide how Shapeways.io collects, accesses, uses, stores, shares, retains and disposes of personal information.
The policy applies to all Shapeways.io operations in the United Kingdom and Ghana.
We aim to ensure that personal information belonging to our customers, students, clients, employees, freelancers, contractors, business partners and other individuals is protected against unauthorised access, misuse, loss or disclosure.
2. Legal Framework
Shapeways.io is committed to complying with applicable data protection legislation, including:
UK General Data Protection Regulation (UK GDPR).
Data Protection Act 2018.
Ghana Data Protection Act 2012 (Act 843).
Applicable electronic communications and marketing legislation.
Other relevant privacy and information security requirements.
Where personal information is transferred between the United Kingdom and Ghana, we will take appropriate steps to ensure that the transfer complies with applicable international data transfer requirements.
3. Scope of This Policy
This policy applies to:
Directors and management.
Employees and temporary staff.
Freelancers and independent contractors.
Consultants and business partners.
Programme managers and trainers.
Volunteers and authorised representatives.
Third-party service providers who process personal information on our behalf.
It covers personal information handled through:
Company computers and laptops.
Mobile phones and tablets.
Email accounts.
Cloud storage platforms.
Website databases and contact forms.
Customer relationship management systems.
Online learning and training platforms.
Paper documents and printed records.
Communication platforms such as WhatsApp and Microsoft Teams.
Everyone working with or on behalf of Shapeways.io must follow this policy when handling personal information.
4. Data Protection Principles
Shapeways.io follows the key data protection principles established under UK GDPR and Ghana’s Data Protection Act.
4.1 Lawfulness, Fairness and Transparency
Personal information must be collected and processed lawfully, fairly and transparently.
Individuals should understand why their information is being collected and how it will be used.
4.2 Purpose Limitation
Personal information must only be collected for specific and legitimate business purposes.
It must not be used for unrelated purposes without an appropriate legal basis.
4.3 Data Minimisation
We only collect personal information that is necessary for the service, programme or business activity being delivered.
Staff and contractors must avoid collecting unnecessary personal information.
4.4 Accuracy
Personal information must be accurate and kept up to date where necessary.
Where incorrect information is identified, reasonable steps must be taken to correct it.
4.5 Storage Limitation
Personal information must not be kept indefinitely.
Information should only be retained for as long as necessary to fulfil its original purpose or meet legal and regulatory requirements.
4.6 Integrity and Confidentiality
Personal information must be protected against unauthorised access, accidental loss, damage, destruction or disclosure.
Appropriate technical and organisational security measures must be implemented.
4.7 Accountability
Shapeways.io is responsible for demonstrating compliance with applicable data protection requirements.
We will maintain appropriate policies, procedures, records and training to support this responsibility.
5. Responsibilities
Data protection is the responsibility of everyone working with or representing Shapeways.io.
5.1 Directors and Senior Management
Management is responsible for:
Ensuring that appropriate data protection policies are in place.
Providing adequate resources for information security.
Monitoring compliance with this policy.
Ensuring that staff and contractors understand their responsibilities.
Reviewing significant data protection risks.
Managing serious data breaches and security incidents.
Ensuring that appropriate agreements are in place with third parties.
5.2 Data Protection Supervisor / Responsible Person
Shapeways.io will designate an appropriate person to oversee its data protection arrangements.
Their responsibilities will include:
Monitoring compliance with this policy.
Supporting staff with data protection questions.
Maintaining records of data protection activities.
Coordinating responses to personal data requests.
Supporting the investigation of data breaches.
Arranging data protection awareness and training.
Advising management on data protection risks.
Where required, Shapeways.io will appoint a formally designated Data Protection Supervisor in Ghana and a Data Protection Officer in the UK if the legal criteria for such an appointment apply.
5.3 Employees, Freelancers and Contractors
Everyone working with personal information must:
Access information only where authorised.
Keep personal information confidential.
Use company-approved systems and platforms.
Protect passwords and login credentials.
Avoid sharing information with unauthorised individuals.
Follow company security procedures.
Report suspected data breaches immediately.
Complete any required data protection training.
Individuals must not use personal information obtained through their work for personal purposes or unrelated business activities.
6. Collection and Use of Personal Information
Shapeways.io may collect and process personal information relating to:
Customers and clients.
Students and programme applicants.
Employees and job applicants.
Freelancers and contractors.
Suppliers and business partners.
Website visitors and individuals making enquiries.
Information may include names, contact details, identification information, educational records, employment information, payment records, business documents and other relevant information.
Personal information must only be collected where there is a legitimate and lawful reason.
Before collecting information, the relevant team must consider:
Why is the information needed?
What information is genuinely required?
Who will have access to it?
How will it be stored?
How long will it be retained?
Will it need to be shared with another organisation?
Individuals must be provided with appropriate privacy information when their data is collected.
7. Data Access and Confidentiality
Access to personal information must be restricted to authorised individuals who require it to perform their duties.
Shapeways.io operates a need-to-know approach to information access.
Staff, freelancers and contractors must not:
Browse personal records without a legitimate work-related reason.
Share client or student information with friends, family or unauthorised colleagues.
Download personal information onto unauthorised devices.
Forward confidential information to personal email accounts.
Share login credentials.
Discuss confidential client or student matters in public places.
Take photographs or screenshots of personal records without authorisation.
Where access to a project or programme ends, access permissions should be reviewed and removed when no longer required.
Confidentiality obligations continue after an individual’s employment, contract or working relationship with Shapeways.io ends.
8. Data Storage and Security
Shapeways.io will take reasonable technical and organisational steps to protect personal information.
Depending on the system and type of information, these measures may include:
Password-protected accounts and devices.
Multi-factor authentication where available.
Restricted user permissions.
Secure cloud storage.
Appropriate encryption.
Antivirus and security software.
Regular software updates.
Secure backup arrangements.
Confidentiality agreements.
Physical security for paper records and office equipment.
Personal information must only be stored on approved systems.
Staff and contractors must not store confidential company, customer or student information on personal devices or external storage systems unless specifically authorised and appropriate security measures are in place.
Paper records containing personal information must be kept secure and disposed of using appropriate confidential waste procedures.
9. Use of Company Devices and Technology
Where Shapeways.io provides computers, laptops, mobile devices or other technology, these devices must be used responsibly.
Individuals must:
Keep devices password protected.
Lock devices when unattended.
Avoid installing unauthorised software.
Avoid connecting untrusted storage devices.
Keep operating systems and security software updated.
Report lost or stolen devices immediately.
Avoid accessing confidential information over unsecured public Wi-Fi unless appropriate protection is in place.
Where remote working is permitted, individuals must take reasonable steps to prevent other people from viewing or accessing confidential information.
10. Working With Third Parties and Clients
Shapeways.io may work with external organisations, clients, freelancers and service providers who require access to personal information.
Where Shapeways.io processes personal information on behalf of a client, we will:
Follow the client’s documented instructions.
Only access information necessary to deliver the agreed service.
Maintain confidentiality.
Apply appropriate security measures.
Avoid using client information for unrelated purposes.
Notify the client of relevant data breaches.
Return or securely delete information when the engagement ends, subject to legal retention requirements.
Where required, a written Data Processing Agreement will be established between Shapeways.io and the relevant client or service provider.
Third-party service providers must be assessed appropriately before being given access to personal information.
11. International Data Transfers
Shapeways.io operates between the United Kingdom and Ghana.
Personal information may be accessed by authorised staff and contractors in either country to support business operations and service delivery.
Where personal information is transferred internationally, we will:
Identify the countries involved.
Establish the appropriate legal basis for the transfer.
Use legally recognised transfer safeguards where required.
Limit access to authorised individuals.
Ensure appropriate confidentiality and security arrangements.
Review international data-sharing arrangements periodically.
International transfers must not take place without appropriate authorisation and safeguards.
12. Data Retention and Disposal
Shapeways.io will maintain appropriate retention arrangements for personal information.
Information should not be retained for longer than necessary.
Different categories of information may have different retention periods, including:
Student and training records.
Customer and client records.
Employment and recruitment records.
Financial and payment records.
Business contracts and project documents.
Website enquiries and marketing records.
Where information is no longer required, it must be securely deleted, destroyed or anonymised.
Employees and contractors must not independently delete important business or customer records without appropriate authorisation.
13. Personal Data Breaches and Security Incidents
A personal data breach occurs when personal information is accidentally or unlawfully lost, destroyed, altered, disclosed or accessed by an unauthorised person.
Examples include:
Sending an email containing personal information to the wrong recipient.
Losing a company laptop containing customer records.
Sharing student information with an unauthorised individual.
Unauthorised access to a company database.
A compromised email account.
Theft of paper documents containing personal information.
13.1 Reporting a Data Breach
Anyone who becomes aware of a suspected data breach must report it to management or the designated Data Protection Supervisor immediately.
Reports should include:
What happened.
When the incident occurred.
What information may have been affected.
Which individuals may be affected.
Whether the information may have been accessed by an unauthorised person.
Any action already taken.
Staff must not attempt to conceal or independently resolve a serious data breach without notifying management.
13.2 Managing a Data Breach
Management will:
Investigate the incident.
Identify the personal information affected.
Assess the potential risks to individuals.
Take steps to contain the incident.
Recover or secure affected information where possible.
Record the incident and actions taken.
Determine whether regulatory or individual notification is required.
Take steps to prevent similar incidents.
Where UK GDPR applies, reportable breaches must be notified to the ICO within 72 hours of becoming aware of them, where legally required.
For Ghanaian operations, notification requirements under Act 843 will be followed.
14. Individual Data Protection Rights
Individuals whose personal information is processed by Shapeways.io have rights under applicable data protection legislation.
These may include:
The right to access personal information.
The right to correct inaccurate information.
The right to request deletion of information.
The right to restrict certain processing activities.
The right to object to certain processing.
The right to data portability where applicable.
The right to withdraw consent where processing is based on consent.
Requests relating to personal information must be referred to the designated responsible person.
Shapeways.io will verify the identity of the requester where appropriate and respond within the applicable legal time limits.
15. Data Protection Training and Awareness
Shapeways.io recognises that staff awareness is essential to protecting personal information.
Employees, freelancers and contractors who handle personal information must receive appropriate guidance on:
Confidentiality.
Secure information handling.
Password security.
Recognising phishing and cyber threats.
Sharing information safely.
Reporting data breaches.
Understanding individual data protection rights.
Using company systems responsibly.
Additional training may be provided where an individual’s role involves handling significant amounts of personal information or sensitive records.
16. Data Protection Impact Assessments
Before introducing new systems, technologies or processes that may create significant risks to individuals’ privacy, Shapeways.io will consider whether a Data Protection Impact Assessment (DPIA) is required.
A DPIA may be necessary when introducing:
New customer or student management systems.
Large-scale processing of personal information.
Systems involving sensitive personal information.
New monitoring technologies.
Automated decision-making or profiling.
Significant changes to existing data processing activities.
Where required, the assessment will identify potential risks and the measures needed to reduce them.
17. Monitoring and Compliance
Shapeways.io will periodically review its data protection practices to ensure that this policy remains effective.
Reviews may include:
Checking who has access to personal information.
Reviewing storage and retention practices.
Assessing third-party service providers.
Reviewing data-sharing arrangements.
Checking staff training records.
Reviewing reported security incidents.
Identifying areas requiring improvement.
Any suspected breach of this policy may be investigated by management.
Where appropriate, disciplinary or contractual action may be taken in accordance with applicable employment and contractual arrangements.
18. Policy Breaches
Failure to comply with this policy may expose Shapeways.io and the individuals whose information we hold to significant risks.
Examples of unacceptable behaviour include:
Unauthorised disclosure of personal information.
Accessing records without permission.
Sharing passwords or login credentials.
Misusing customer or student information.
Removing confidential records without authorisation.
Failing to report a known data breach.
Using personal information for personal gain.
Any suspected violation must be reported to management.
Appropriate action will be taken depending on the seriousness of the incident and applicable law.
19. Policy Review and Updates
This policy will be reviewed at least annually or whenever significant changes occur to:
Data protection legislation.
Company operations.
Information systems and technology.
Business relationships.
Data processing activities.
Information security risks.
Any changes will be communicated to relevant staff, contractors and other individuals who need to understand their responsibilities.
20. Contact Information
For questions about this policy, data protection concerns or requests relating to personal information, please contact:
Shapeways.io Ltd
Website: https://shapeways.io
Email: info@shapeways.io
Address: 89 Bickersteth Road, London, SW17 9SH, United Kingdom.
UK Regulatory Authority:
Information Commissioner’s Office (ICO)
https://ico.org.uk/
Ghana Regulatory Authority:
Data Protection Commission
https://dataprotection.org.gh/
Policy Statement
Shapeways.io Ltd is committed to protecting personal information and maintaining responsible data handling practices across all its operations. Everyone working with or on behalf of the company is expected to respect confidentiality, follow this policy and take reasonable steps to protect the information entrusted to us.
Approved by: Shapeways.io Ltd Management
Effective date: 30 October 2026
Questions about this data protection policy?
Email us or message the team in the country you deal with. We reply as quickly as we can.