PRIVACY POLICY

Last updated: 29 September 2026

Funk-e Animations Support B.V. (“we”, “us”) operates the Atelier Lau store and website, including all related information, content, features, tools, products and services (together, the “Services”), to provide you with a curated shopping experience. The Services are hosted on Squarespace.

This Privacy Statement explains how we collect, use and share personal information when you visit or use the Services, make a purchase or other transaction, or contact us. If there is a conflict between our Terms of Service and this Privacy Statement, this Privacy Statement governs the processing of personal information.

1) Controller and contact

Controller: Atelier Lau, operated by Funk-e Animations Support B.V.
Address: Aert van Nesstraat 45, 3012 CA Rotterdam, the Netherlands
Email: concierge@atelierlau.co

We have not appointed a Data Protection Officer. For privacy questions or to exercise your rights, contact us using the details above.

2) Personal information we collect

Depending on how you interact with the Services, we collect and process:

  • Contact details (name, address, billing/shipping address, phone number, email address)

  • Account information (login details, preferences and settings)

  • Transaction information (items viewed, added to cart, added to wishlist, purchased, returned, exchanged, cancelled)

  • Payment and financial information (payment method and transaction details; payments are handled by payment providers)

  • Communications (customer support enquiries and other messages)

  • Device and technical information (device type, browser, network, IP address and similar identifiers)

  • Usage information (navigation and activity on the Services)

3) Sources of personal information

We collect personal information:

  • Directly from you (orders, account creation, forms, emails and customer support)

  • Automatically through cookies and similar technologies when you use the Services

  • From our service providers who operate parts of the Services on our behalf

  • From partners/third parties (such as advertising and social media partners) where you consent or where permitted by law

4) Purposes and legal bases (GDPR Art. 6)

We process personal information for the following purposes and on the following legal bases:

A. To provide the Services and fulfil contracts
Purpose: processing orders, payments, delivery, returns/exchanges, and essential service communications.
Legal basis: performance of a contract (Art. 6(1)(b)).

B. Customer support and relationship management
Purpose: handling enquiries, providing support, resolving issues.
Legal basis: performance of a contract (Art. 6(1)(b)) and/or legitimate interests (Art. 6(1)(f)).
Legitimate interest: maintaining service quality and customer satisfaction.

C. Security and fraud prevention
Purpose: securing the Services, preventing abuse and fraudulent transactions.
Legal basis: legitimate interests (Art. 6(1)(f)) and, where applicable, legal obligation (Art. 6(1)(c)).
Legitimate interest: protecting customers, the business and the platform.

D. Legal compliance and enforcement
Purpose: tax/accounting administration, responding to lawful requests, enforcing policies, managing disputes.
Legal basis: legal obligation (Art. 6(1)(c)) and/or legitimate interests (Art. 6(1)(f)).
Legitimate interest: asserting and defending legal claims and ensuring compliance.

E. Marketing communications (email marketing)
Purpose: sending newsletters and promotions.
Legal basis: consent (Art. 6(1)(a)) where required; and otherwise legitimate interests (Art. 6(1)(f)) only to the extent permitted under applicable e-privacy rules (you can always opt out).
Legitimate interest: promoting our products to existing customers in a proportionate manner. [NEW] As an existing customer, you may receive emails about similar products, as permitted under Dutch law. You can opt out at any time via the unsubscribe link in every email.

F. Analytics and improving the Services
Purpose: understanding usage, improving site performance, user experience, and reporting.
Legal basis: consent (Art. 6(1)(a)) where cookies/similar technologies are used for analytics.

G. Advertising and measurement (including retargeting)
Purpose: targeted advertising, measuring ad effectiveness, attribution and retargeting.
Legal basis: consent (Art. 6(1)(a)) where cookies/online identifiers are used.

5) Profiling and automated decision-making (GDPR Art. 13(2)(f))

After you give consent (where required), we may use analytics and marketing technologies that evaluate behaviour on our website to:

  • create audiences or segments (e.g., based on viewed products or purchase behaviour),

  • measure marketing performance,

  • improve the website and user experience.

This can constitute profiling. We do not make decisions that produce legal or similarly significant effects solely by automated means based on this profiling.

You can withdraw consent at any time via Cookie Settings (see the Cookie Statement below). Where processing is based on legitimate interests, you may object (see Section 9, “Your rights”).

6) Recipients: who we share personal information with

We may share personal information with the following recipients. [NEW] Service providers that process personal information on our behalf do so under a data processing agreement with us.

  • Squarespace (hosting, checkout, store operations)

  • Google Analytics (GA4) (analytics)

  • Meta (Facebook/Instagram) (advertising/measurement, after consent)

  • Pinterest (advertising/measurement, after consent)

  • Mailchimp (email marketing and customer engagement, after consent where required)

  • Payment providers, fraud prevention providers, shipping carriers, and other IT/service vendors necessary to operate the Services

  • Professional advisers (legal/accounting) where necessary

  • Authorities or third parties where required by law or in connection with legal claims or business transactions

7) International transfers (GDPR Art. 13(1)(f))

Some providers may process personal information outside the EEA/UK, including in the United States, depending on their corporate structure and technical setup. [REVISED] This includes providers such as Squarespace, Google, Meta, Pinterest and Mailchimp.

Where required, we rely on recognised transfer mechanisms, such as the EU–US Data Privacy Framework (for certified providers) or Standard Contractual Clauses (SCCs), and apply appropriate safeguards.

8) Retention (GDPR Art. 13(2)(a))

We retain personal information only as long as necessary for the purposes above, and then delete or anonymise it unless we must keep it longer by law.

Our retention periods are:

  • Order, invoice and tax administration data: 7 years (to meet Dutch administrative/tax record retention obligations). 

  • Customer support correspondence: 2 years after the matter is closed, unless we need it longer for a dispute or legal claim.

  • Account data: kept while your account remains active; if you request deletion, we delete or anonymise account data where possible and retain limited information only where necessary for legal compliance or dispute handling (e.g., order history subject to the 7-year period above).

  • Marketing subscription data: kept until you unsubscribe/withdraw consent; after that we keep a limited suppression record (email address and opt-out status) for 2 years to ensure we respect your choice.

  • Analytics and advertising data: kept according to the settings of the relevant tools and your consent status; we regularly review and minimise retention in these tools where possible.

9) Your rights

Under the GDPR, you have the right to request:

  • access, correction, deletion,

  • restriction, portability,

  • objection to processing based on legitimate interests (including profiling),

  • withdrawal of consent (where processing is based on consent).

You can exercise rights by emailing concierge@atelierlau.co. We may request verification of identity. [NEW] We will respond within one month of receiving your request. Where necessary, this period may be extended by two further months, in which case we will let you know.

10) Complaints (GDPR Art. 13(2)(d))

If you have a complaint, please contact us first. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or your local EEA authority.

11) Security

We implement appropriate technical and organisational measures to protect personal information. No system is perfectly secure.

12) Third-party links

The Services may contain links to third-party websites. We are not responsible for their privacy practices.

13) Children

The Services are not intended for children.  We do not knowingly collect personal information from children under 16 without the consent of a parent or legal guardian. If you believe we have done so, please contact us and we will delete it.

14) Changes

We may update this Privacy Statement from time to time. We will post the updated version with a revised “Last updated” date.

 

COOKIE STATEMENT

Last updated: 29 September 2026

We use cookies and similar technologies (including Local Storage, pixels and tags) to operate the Services, analyse performance, and—where you consent—support advertising and marketing.

Strictly necessary (always active): required for the website to function (e.g., cart, language/currency, security, returns functionality).

Analytics (consent required): after consent, we use tools such as Google Analytics (GA4) to understand how our website is used and to improve it.

Marketing (consent required): after consent, we may use Meta (Facebook/Instagram), Pinterest and Mailchimp to measure marketing performance, retarget and deliver personalised advertising/communications.

Manage your preferences: you can change your choices at any time using the Cookie Settings link at the bottom of our website.

You can also delete cookies via your browser settings; disabling strictly necessary cookies may affect site functionality.