Privacy policy

1. What we collect

• Order data: name, delivery address, email address, phone number if provided, and the contents of the order.
• Billing data: invoice details if provided, and the transaction identifier from the payment provider.
• Personalisation content, if you ordered an inscription — most often a name. It is part of the order and goes onto the product.
• Correspondence: the content of messages sent to us and our replies.
• Technical data recorded by the infrastructure serving the shop: IP address, date and time of the request, the page requested, and browser and device information.
• Error reports: when the shop fails to work properly, we record a description of the error, the page address without its parameters, and the browser and device type. A report contains no IP address and no order data.
• Questions to the configurator assistant, if you use it: the questions and answers, the lamp options chosen on the page, and a hash of the IP address that changes every day, used to limit the number of questions. We do not link them to an order.

We do not collect card details. They are given directly to the payment provider on its own page and never reach the shop.

2. Purposes and legal bases

• Fulfilling the order, contacting you about it, and handling a withdrawal and the settlements that follow — art. 6(1)(b) GDPR, performance of a contract.
• Issuing and retaining sales documents and meeting obligations under consumer law, including handling complaints — art. 6(1)(c) GDPR, legal obligation.
• Retaining order and complaint records to establish, pursue or defend against claims — art. 6(1)(f) GDPR; our legitimate interest is protecting our own rights and being able to pursue and defend against claims.
• Keeping the shop secure and working — art. 6(1)(f) GDPR; our legitimate interest is keeping it operational and resistant to abuse.
• Answering your questions through the configurator assistant, and judging whether it helps — art. 6(1)(f) GDPR; our legitimate interest is helping customers choose a product and improving that help.

Providing the data is voluntary but necessary to place an order: without a delivery address and an email address the contract cannot be concluded or performed.

3. How long we keep it

• Accounting and tax documents — for the period required by tax and accounting law; currently five years from the end of the year in which the tax obligation arose.
• Data relating to fulfilling an order — for as long as needed to perform the contract, and then for the period in which claims relating to it may arise or be pursued.
• Personalisation content — as part of the order, for the same period as its other data.
• Correspondence — until it is no longer needed to handle the matter, and no longer than the period in which claims may be pursued.
• Technical data in infrastructure logs — for as long as is needed to keep the shop secure and to diagnose faults, within the retention periods applied by the infrastructure provider, after which it is deleted or aggregated.
• Error reports — for up to 90 days, after which they are deleted automatically.
• Conversations with the configurator assistant — for up to 90 days, after which they are deleted automatically.

4. Who we share data with

Data may be passed to the providers whose services we use to run the shop. Depending on the nature of the service, they process it on our behalf as processors, or as separate controllers in their own right.

• Stripe — handling payments and refunds. For taking a payment on our instruction it acts as a processor; for its own purposes, in particular fraud prevention and its own legal obligations, as a separate controller.
• Vercel — application hosting, serving the shop, and visit and page-speed statistics.
• Supabase — database and file storage.
• Resend — sending order confirmations.
• Sentry (Functional Software, Inc.) — collecting reports of errors in the shop; the data is stored in the European Union (Germany).
• Anthropic (Anthropic, PBC) — preparing the configurator assistant’s answers (the Claude model). It receives the question, the earlier questions and answers of the same conversation and a description of the chosen lamp; it does not receive the IP address. The data is not used to train models.
• OVH — running the shop’s mailbox.
• A postal operator or courier — delivering the parcel; for the delivery itself acting under its own obligations.
• An accountancy office — keeping the books, under its own professional obligations.

Some providers belong to groups established outside the European Economic Area. Where that is the case, transfers rely on the mechanisms in Chapter V of the GDPR, in particular standard contractual clauses or an adequacy decision.

You can obtain information about the safeguards used, or a copy of them, by writing to kontakt@arturlab.pl.

The shop’s primary database is hosted in a European Union region (Ireland). Some providers may nevertheless process data outside the EEA, on the basis described above.

5. Data stored on your device

The shop stores the contents of your basket in your browser’s local storage under the key “lamp-shop.cart”. That is the identifiers of the options you chose and the quantity — and, if you configured a lamp with an inscription, the text of that inscription as you typed it. No amounts and no delivery details are held there.

We store this solely to make the basket work. Storing it is necessary to provide a service you explicitly requested, and therefore requires no separate consent under art. 399(3) of the Polish Electronic Communications Act. You can remove it at any time by clearing the site’s data in your browser.

Besides the basket, your browser remembers the last configuration of the lamp you were looking at (keys beginning with “lamp-config:”), the fact that the ready-made lamp hint has already been shown, and which photograph the home page gallery was left on — the last only until the tab is closed. They exist solely so that the shop is as you left it, and for the same reason need no separate consent.

We count visits and measure page loading speed with Vercel Web Analytics and Speed Insights. They use no cookies and store nothing on your device; visits are recognised by a hash of the request that expires after 24 hours and cannot tell who you are. Page addresses reach them without their parameters, and an order number in an address is replaced. We use no cookies for marketing or profiling, and we pass no traffic data on for advertising purposes.

The payment page belongs to the payment provider and is served from its own domain. Whatever your browser stores there is covered by that provider’s privacy notice.

6. Your rights

Depending on the basis and the scope of processing, you have the following rights:

• access to your data and a copy of it,
• rectification of inaccurate or incomplete data,
• erasure, to the extent it does not conflict with an obligation to retain it,
• restriction of processing,
• portability of data processed on the basis of a contract,
• objection to processing based on a legitimate interest.

To exercise these rights, write to kontakt@arturlab.pl. You also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office.

7. Automated decisions

We take no decisions about you based solely on automated processing, including profiling, that would produce legal effects or similarly significantly affect you.