Privacy Policy
1. Who is responsible for your information
Dimensionalworks OÜ ("we", "us") is the controller of personal data processed for the Dimensionalworks portfolio website at dimensionalworks.com, including its automotive library, project pages and enquiry forms.
Registry code: 17608786
Contact address: Tartu maakond, Elva vald, Käärdi alevik, Rukki tn 5-16, 61007, Estonia
Privacy contact: info@dimensionalworks.com
This notice describes website visits and enquiries. Any future online checkout, customer account or digital-product delivery service will require an updated notice explaining its additional processing before that service is introduced.
2. Enquiries and project discussions
When you contact us, we receive the information you choose to send, such as your name, email address, subject, message and project references. We use it to respond, prepare a requested quotation and discuss or carry out your project. Please avoid sending sensitive personal data or information about other people that is unnecessary for your request.
For a request concerning your own potential or existing contract, the legal basis is GDPR Article 6(1)(b): steps at your request before entering a contract and performance of a contract. For general correspondence and communications with a company's representatives, we rely on Article 6(1)(f): our legitimate interest in answering enquiries and managing business relationships. Where a specific legal obligation requires records to be retained or disclosed, Article 6(1)(c) applies.
You are not legally required to submit an enquiry. We need a way to reply and enough information about your request to answer it; without that information we may be unable to help.
The website uses Contact Form 7 with an anti-spam honeypot. The contact form does not accept file uploads. Contact-form messages are delivered to our email inbox, hosted by Zone Media OÜ. We retain these messages in that mailbox and do not store a separate copy of submitted messages in the WordPress database.
3. Website delivery and security
Our hosting service processes the technical information needed to deliver website requests, such as an IP address, requested URL, request time and browser information. Our legitimate interest under Article 6(1)(f) is to keep the website available, diagnose faults and prevent misuse. We use Zone’s standard hosting configuration and have not added a separate CDN or security service.
Hosting provider and processing location: Zone Media OÜ, Estonia
Email provider and processing location: Zone Media OÜ (Zone Webmail), Estonia
4. Optional analytics
If you allow Analytics in Cookie Settings, Google Analytics, integrated through Google Site Kit, measures use of the website. Information can include pages visited, interactions, referral information, device/browser information and cookie identifiers. Requests to Google also involve technical connection information. The legal basis for our optional analytics processing is your consent under Article 6(1)(a).
Rejecting Analytics does not prevent you from browsing our portfolio or contacting us. The Cookie Policy describes the analytics cookies and their duration.
Enhanced Measurement is enabled for page views, scrolls, outbound link clicks, site searches, form interactions, video engagement and file downloads. These interactions are measured where the relevant content and supported functionality are present. Site Kit plugin conversion tracking is also enabled. Logged-in website users are excluded from Analytics.
Google Signals and user-provided data collection are disabled. The Analytics property is not linked to Google Ads.
Google Analytics account data sharing for technical support is enabled, allowing Google support representatives access when necessary to provide support. Sharing for Google products and services, modelling contributions and business insights, and recommendations for our business is disabled.
Google's information: https://policies.google.com/privacy
5. Optional Instagram content
The automotive site can display Instagram content through Smash Balloon. If you allow External media, your browser may contact Instagram/Meta servers to retrieve this content, disclosing connection information such as your IP address and browser details. A provider may associate a visit with an existing account where its systems and your account/browser settings permit this. The plugin may also retrieve and cache public feed content on our server.
We do not currently use Google reCAPTCHA on the website. Our use of optional Instagram content is based on consent under Article 6(1)(a).
Instagram’s European service provider is Meta Platforms Ireland Limited. Meta explains its processing and retention practices in its privacy policy: https://privacycenter.instagram.com/policy/
Ordinary links to third-party sites, including model marketplaces, take you to services with their own privacy notices. A link is distinct from embedded content loaded on this website.
6. Who receives information and international transfers
Information is accessible to authorised people handling your enquiry and to the hosting, email and optional-service providers described above, as required for their respective purposes. Authorities or professional advisers may receive information where required by law or necessary to establish, exercise or defend legal claims.
Google Analytics is provided to EEA customers by Google Ireland Limited. Google processes information internationally, including in the United States. Google states that it relies on the EU–US Data Privacy Framework for covered transfers to the United States and on standard contractual clauses for certain other transfers where applicable. Information about these safeguards and links to the relevant terms are available at https://business.safety.google/adsdatatransfers/ . You may also contact us for information about safeguards relevant to your data.
Instagram is provided by Meta Platforms Ireland Limited in the EEA. Meta may process information outside the European Economic Area, including in the United States. Where applicable, Meta describes using recognised transfer mechanisms such as adequacy decisions, including the EU–US Data Privacy Framework for participating entities and covered services, and Standard Contractual Clauses. The applicable mechanism depends on the recipient and processing concerned. Further information about Meta's international transfers and safeguards is available in its Privacy Policy: https://privacycenter.instagram.com/policy/ . You may also contact us for information about safeguards relevant to your data.
7. How long information is kept
Enquiries that do not lead to a project: we delete these messages from our email inbox within 12 months of our last correspondence.
Completed-project correspondence and project files: we retain these for at least three years after project completion. After that period, we review them annually and delete personal data and files no longer needed for the client relationship, agreed project support or the establishment, exercise or defence of legal claims. Retention beyond three years is assessed at each annual review rather than being indefinite by default. Records subject to a statutory retention requirement are kept for the applicable legal period.
Hosting logs: we use Zone’s default rotation without a separate log archive. Zone’s published default keeps the most recent four days of web access/error logs. This describes the standard hosting configuration, not every operational log Zone may keep for its own purposes.
Hosting and email backups: we use Zone’s standard daily backups, normally retained for 14 days, and no separate WordPress backup service. Deleted data may remain in these backups until the backup retention period ends. This description follows Zone’s documented standard configuration; a different hosting package or later configuration change may require an update.
Google Analytics is configured to retain event-level data for 2 months and user-level data for 14 months. New activity resets the retention period for the relevant user identifier, so this period may extend beyond the first visit. These settings do not apply to most standard aggregated reports. Analytics data retention is separate from cookie expiry.
The website's cookie-preference record lasts 180 days from your latest saved choice. Analytics cookie lifetime and Google's event-data retention are different settings; data retention is described above, and cookie lifetimes are addressed in the Cookie Policy. Records needed for a specific dispute may be retained for the relevant claim period, with access limited to that purpose.
8. Your choices and rights
You can accept, reject or change optional categories using Cookie Settings in the footer. Withdrawing consent is as easy as giving it and does not affect the lawfulness of processing before withdrawal. Withdrawal stops future optional loading on these pages; it does not automatically erase information already held by a provider.
Subject to the GDPR's conditions, you may request access to your personal data, correction, erasure, restriction of processing or data portability. You may object, on grounds relating to your situation, to processing based on legitimate interests. Any direct-marketing objection must be respected without such grounds.
Contact info@dimensionalworks.com to exercise a right. We may ask for proportionate information to verify your identity. We respond without undue delay and normally within one month. If a permitted extension of up to two further months is needed, we will explain the reason within the first month. Requests are normally free of charge.
You may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), https://www.aki.ee/en, or the competent supervisory authority where you habitually reside, work or believe an infringement occurred. You do not have to contact us first.
9. Automated decisions and updates
We do not make decisions based solely on automated processing that produce legal or similarly significant effects concerning you.
We update this notice when our services or processing change. New purposes or optional services will be explained and fresh consent requested where required.
Last updated: 27 September 2026