Privacy Policy

1. Who We Are

AgateLamps operates the website www.agatelamps.com. For the purposes of applicable data protection laws, AgateLamps is the “controller” of the personal data processed through this website unless otherwise stated.

You can contact us for any privacy-related question or request using the contact options described in Section 14.

2. Scope of This Policy

This Privacy Policy explains how we collect, use, disclose, secure, and retain personal data when you visit www.agatelamps.com, make a purchase, contact us, subscribe to communications, interact with our social features, or otherwise engage with our services. It also describes your rights and choices.

3. Personal Data We Collect

3.1 Data you provide directly

• Contact details (such as name, email address, phone number).
• Account details (username, password) if account functionality is offered.
• Order and delivery information (billing and shipping details, order contents, transaction totals; payment details are handled by our payment processors and are not stored in full by us).
• Communications and support requests (content of messages, feedback, and other information you choose to provide).
• Marketing preferences (newsletter subscriptions, consent choices).

3.2 Data collected automatically

• Device and usage data (IP address, device identifiers, browser type and settings, operating system, referring URLs, pages viewed, links clicked, session time, and interaction data).
• Cookies and similar technologies data (see Section 6).

3.3 Data from third parties

• Payment and fraud-prevention partners (confirmation of payment, limited card details such as last 4 digits and card type, fraud signals).
• Delivery and logistics providers (shipping status and tracking information).
• Analytics, advertising, and social media providers (aggregated or pseudonymous analytics; advertising identifiers where permitted).

4. Purposes and Legal Bases

We process personal data for the purposes listed below and under the following legal bases, where required by law (particularly in the EEA/UK):

• Providing our services and operating the website (contractual necessity; legitimate interests in operating an online service).
• Processing and fulfilling orders, returns, and customer service (contractual necessity; legal obligations for tax and accounting).
• Communicating with you, responding to inquiries, and providing support (contractual necessity; legitimate interests in customer care).
• Sending marketing communications and newsletters (consent where required; legitimate interests in promoting our services, with opt-out available at any time).
• Personalizing content and measuring performance (consent where required; legitimate interests in improving user experience and service quality).
• Analytics, research, and service improvement (consent where required; legitimate interests in understanding and improving our website and offerings).
• Security, fraud prevention, and abuse detection (legitimate interests; legal obligations where applicable).
• Compliance with legal obligations and enforcement of our terms (legal obligations; legitimate interests in protecting our rights).

Where we rely on consent, you may withdraw it at any time as described in Sections 6 and 9. Where we rely on legitimate interests, we balance our interests against your rights and expectations and implement safeguards.

5. Categories of Recipients

We disclose personal data, as necessary for the purposes above, to:

• Service providers acting on our behalf (e.g., hosting, website operation, customer support tools, analytics, payment processing, order fulfillment, email delivery, security, and fraud prevention). These providers are bound by contractual obligations to protect personal data.
• Business partners involved in transactions (e.g., payment networks, banks, delivery carriers).
• Advertising and analytics partners, only when you have permitted non-essential cookies or where permitted by law (see Section 6).
• Authorities, regulators, and legal advisors where required to comply with law or to protect our rights, users, or the public.
• Successors in the event of a merger, acquisition, or other corporate transaction, subject to appropriate confidentiality and data protection commitments.

6. Cookies and Similar Technologies

We use cookies, web beacons, pixels, and similar technologies to operate and secure the site, remember your preferences, understand usage, and tailor content. Cookies are small text files stored on your device.

6.1 Types of cookies we use

• Strictly necessary cookies: required for site operation, security, and to enable functions such as shopping cart, checkout, and account login.
• Preferences cookies: remember choices such as language and display settings.
• Analytics cookies: help us understand how visitors use the site to improve performance and content.
• Advertising cookies: enable us and our partners to deliver and measure ads, including cross-context behavioral advertising where allowed.

6.2 Your choices

• Consent: In regions where required (e.g., EEA/UK), we request your consent for non-essential cookies. You can accept or reject categories through the cookie banner or settings, and you can change your choices at any time using the same controls.
• Browser/device controls: Most browsers allow you to block, delete, or set preferences for cookies. Blocking some cookies may impact site functionality.
• Global Privacy Control (GPC): Where legally required, we treat a valid GPC signal as an opt-out of “sale”/“sharing” for advertising cookies.

Cookie lifetimes vary: session cookies expire when you close your browser; persistent cookies typically last between a few days and up to 24 months unless you delete them earlier.

7. International Data Transfers

We and our service providers may process your personal data in countries other than your own. If you are in the EEA or the UK and your data is transferred to countries without an adequacy decision, we implement appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and UK-approved equivalents), together with supplementary measures as needed. You can request more information about these safeguards as described in Section 14.

8. Data Retention

We retain personal data only as long as necessary for the purposes described in this policy, including to comply with legal, accounting, or reporting requirements, and to resolve disputes. Typical retention periods are:

• Account data: for the life of the account and up to 24 months after closure, unless longer retention is required by law or to resolve disputes.
• Order and transaction records: generally 6 to 10 years (depending on local tax and accounting laws).
• Customer support communications: up to 36 months after resolution.
• Marketing subscriptions: until you unsubscribe or your account becomes inactive for 24 months, plus a short period to record your opt-out.
• Security, fraud, and log data: typically 12 to 24 months, unless needed longer for investigations.
• Analytics data: typically 14 to 26 months in aggregated or pseudonymous form.

When data is no longer needed, we will delete or irreversibly anonymize it.

9. Your Rights

9.1 EEA/UK residents

You have the right to request access to your personal data, rectification, erasure, restriction of processing, and data portability, and to object to processing based on our legitimate interests. Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. You also have the right to lodge a complaint with your local supervisory authority.

9.2 California residents

Subject to the California Consumer Privacy Act (as amended), you may have the right to:

• Know the categories and specific pieces of personal information we collect, use, disclose, and “share.”
• Request deletion of personal information, subject to exceptions.
• Request correction of inaccurate personal information.
• Opt out of the “sale” or “sharing” of personal information for cross-context behavioral advertising.
• Limit the use and disclosure of sensitive personal information, if applicable.
• Be free from discrimination for exercising your rights.

We do not sell personal information for money. We may “share” identifiers and internet activity data with advertising partners for cross-context behavioral advertising only when you have permitted advertising cookies. You can opt out by rejecting advertising cookies, sending a valid Global Privacy Control signal, or contacting us as described in Section 14.

9.3 Other regions

Depending on your location, you may have similar rights under local law. We will honor valid requests as required by applicable regulations.

10. How to Exercise Your Rights

• Submit a request using the contact methods in Section 14 and clearly describe the right you wish to exercise.
• Verification: We may need to verify your identity and residency to process your request (e.g., by matching information you provide with our records). Authorized agents may submit requests where permitted by law when proof of authorization is provided.
• Response time: We aim to respond within one month (EEA/UK) or 45 days (California), with the possibility of extension as allowed by law. If we deny or partially fulfill a request, we will explain the reasons.
• Marketing opt-out: You can unsubscribe from marketing emails using the unsubscribe link in those emails. Service and transactional communications will still be sent as needed.

11. Data Security

We implement appropriate technical and organizational measures to protect personal data, including encryption in transit, access controls, secure development practices, regular monitoring, backup and recovery procedures, and vendor due diligence. No system is completely secure; if we detect a security incident that affects your data, we will take steps to mitigate it and notify you and/or authorities where required by law.

12. Children’s Privacy

Our website is not directed to children, and we do not knowingly collect personal data from anyone under 16 years of age. If we become aware that we have collected such data, we will delete it. If you believe a child has provided us with personal data, please contact us (Section 14).

13. Social Media, Analytics, and Advertising

We may use analytics to understand how our site is used and to improve it. We may also use advertising technologies to show relevant ads and measure their effectiveness. These activities typically rely on cookies or similar identifiers and may involve our partners acting as independent controllers. Where required, we seek your consent before enabling these technologies (see Section 6). You can withdraw consent or opt out at any time through cookie settings or by contacting us.

14. Contact and Data Protection Officer (DPO)

If you have questions about this Privacy Policy, our data practices, or wish to exercise your rights, please contact us using one of the following methods:

• Use the contact form available on our website and select a subject relating to privacy or data protection, or clearly state “Privacy Request” in your message.
• Send us a message using the general contact email address published in the website footer and address it to the “Data Protection Officer.”

Data Protection Officer: AgateLamps has appointed a Data Protection Officer. The DPO can be reached via the methods above by addressing your communication to the “Data Protection Officer.”

15. International Users

By using the website, you understand that your personal data may be processed in countries with privacy laws that may differ from those in your jurisdiction. We will protect your information as described in this policy and in accordance with applicable law, including by using appropriate transfer safeguards where required (see Section 7).

16. Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will take appropriate steps to inform you, such as posting a prominent notice on the website. The “Effective date” below indicates when this policy was last updated.

17. Additional Information

• Sensitive data: We do not seek to collect sensitive personal data. Please do not submit sensitive information unless it is necessary and you consent to our processing of it for the stated purpose.
• Automated decision-making: We do not use automated decision-making that produces legal or similarly significant effects without meaningful human involvement.
• Third-party links: Our site may include links or integrations to third-party sites or services. Their privacy practices are governed by their own policies.

Effective date: 16 December 2025