Privacy Policy
Who We Are
This Privacy Policy applies to Lazarus Lab, an independent art brand based in Madrid, Spain, operating through the website www.lazaruslab.net. We sell original art prints, 3D sculptures, and design objects.
For any privacy-related enquiries, you can contact us at: info@lazaruslab.net
Data controller: Lazarus (trading as Lazarus Lab) · Calle Jaén 31, 28020 Madrid, Spain · info@lazaruslab.net
What Data We Collect
We collect personal data when you interact with our website. Below is a breakdown of what we collect and why.
| Data Category | Examples | Why We Collect It | Legal Basis (GDPR) |
|---|---|---|---|
| Identity & Contact | Name, email, phone number | To process and fulfil your order; to contact you about it | Contract performance (Art. 6.1.b) |
| Delivery Address | Postal address, city, country | To ship your order to the correct location | Contract performance (Art. 6.1.b) |
| Payment Data | Billing details | To process payment. Note: we do not store full card details — this is handled by our payment provider | Contract performance (Art. 6.1.b) |
| Account Data | Username, password, order history | If you create an account, to manage your profile and past orders | Contract performance (Art. 6.1.b) |
| Marketing & Newsletter | Email address, preferences | To send you news, new releases, and offers — only if you opt in | Consent (Art. 6.1.a) |
| Analytics Data | Pages visited, time on site, device type, location (approximate) | To understand how visitors use the site and improve it — only if you accept analytics cookies | Consent (Art. 6.1.a) |
| Technical Data | IP address, browser type, essential cookies | For site security, performance, and session management | Legitimate interest (Art. 6.1.f) |
Cookies
Our website uses cookies — small text files stored on your device — and similar technologies. Non-essential cookies are only used with your consent, which we ask for through the cookie banner on your first visit.
- Essential cookies — required for the site to function (shopping cart, checkout, login, remembering your cookie choice). These do not require consent.
- Analytics cookies — provided by Google Analytics, to help us understand how visitors use the site. They are set only if you accept them. If you reject or ignore the banner, Google Analytics does not run. Legal basis: your consent (Art. 6.1.a GDPR and Art. 22.2 LSSI).
- Embedded media — videos on our playlists page are served from YouTube’s privacy-enhanced domain (youtube-nocookie.com) and are only loaded once you accept the corresponding cookie category. Bandcamp and Spotify players may set their own cookies when you use them.
Accepting and rejecting are equally easy, and you can change or withdraw your choice at any time through the cookie settings link shown on every page. Withdrawing consent does not affect processing carried out before the withdrawal.
The full list of cookies we use, their purpose and their duration is in our Cookie Policy.
Third-Party Services
We share your data with third-party services only where necessary to operate our store. Most of them act as our processors and are bound by data processing agreements and GDPR-compliant terms; where a provider acts as an independent controller (for example, when you choose to pay with Klarna, Amazon Pay or Link), we say so below.
| Service | Purpose | Data Transferred |
|---|---|---|
| WooCommerce / WordPress | E-commerce platform | Order and customer data |
| Hosting — DreamHost (New Dream Network, LLC, USA) | Web hosting: the server and database the website and shop run on | All data processed through the website: order and customer data, account data, and technical data such as IP addresses and server logs |
| Payment Provider — Stripe Payments Europe, Limited (Ireland) | Payment processing: card, Apple Pay / Google Pay, Link, Klarna and Amazon Pay (all processed through Stripe) | Billing details, payment and order data, device and fraud-prevention data — card details are never stored by us |
| Shipping Carriers | Order delivery | Name, address, contact for delivery |
| Mailchimp | Newsletter & email marketing | Email address and name — only with your consent |
| Google Analytics | Website analytics | Pseudonymised usage and behaviour data — only with your consent |
| B2Brouter | Invoicing and tax reporting | Name, billing address, tax ID (if you provide one) and order details |
All payments are processed by Stripe Payments Europe, Limited (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). If you choose Link, Stripe’s saved-payment service, Stripe processes your Link account data as an independent controller under its own privacy policy (stripe.com/privacy). If you choose Klarna, the data needed for that payment is passed through Stripe to Klarna Bank AB (publ), Stockholm, Sweden. If you choose Amazon Pay, it is passed to Amazon Payments Europe S.C.A., Luxembourg. Klarna and Amazon Pay process that data as independent controllers under their own privacy notices, which may include identity or credit checks in Klarna’s case.
International Data Transfers
Some of our third-party providers process data outside the European Economic Area (EEA). Our website is hosted by DreamHost (New Dream Network, LLC) on servers in the United States. DreamHost is not certified under the EU-U.S. Data Privacy Framework, so these transfers are covered by the Standard Contractual Clauses (SCCs) approved by the European Commission, which are part of DreamHost’s Data Processing Addendum. Other providers (such as Mailchimp, Google Analytics and Stripe’s US affiliate, Stripe, LLC) may also process data outside the EEA. Where this occurs, we ensure appropriate safeguards are in place, such as the European Commission’s adequacy decision for companies certified under the EU-U.S. Data Privacy Framework, or Standard Contractual Clauses (SCCs).
How Long We Keep Your Data
- Order and transaction data — retained for 7 years to comply with Spanish tax law (Ley General Tributaria)
- Account data — retained while your account is active; deleted upon request
- Newsletter subscriptions — retained until you unsubscribe
- Analytics data — collected only with your consent; retained for up to 26 months (Google Analytics default)
Your Rights Under GDPR
As a resident of the EU or EEA, you have the following rights regarding your personal data:
Request a copy of all personal data we hold about you.
Ask us to correct any inaccurate or incomplete data.
Request deletion of your data, subject to legal retention requirements.
Receive your data in a structured, machine-readable format.
Object to processing based on legitimate interest or for direct marketing.
Ask us to limit how we process your data in certain circumstances.
Withdraw consent at any time for processing based on consent (e.g. newsletter, analytics cookies).
To exercise any of these rights, contact us at info@lazaruslab.net. We will respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with the Spanish Data Protection Authority (AEPD — Agencia Española de Protección de Datos).
Data Security
We take reasonable technical and organisational measures to protect your personal data from unauthorised access, loss, or disclosure. Our website uses HTTPS encryption for all data in transit. Payment information is handled by PCI-DSS compliant payment processors and is never stored on our servers.
Children’s Privacy
Our website is not directed at children under the age of 16. We do not knowingly collect personal data from minors. If you believe a child has provided us with their data, please contact us and we will delete it promptly.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. The date at the top of this page will always reflect the most recent version. For significant changes, we will notify customers by email where possible.
Contact
For any questions about this policy or your personal data, write to us at info@lazaruslab.net.