Scope and data controller
This Privacy Policy applies when you visit the Lambert online store, create an account, place an order, communicate with customer care, subscribe to marketing or otherwise interact with our online services.
The entity identified as the store operator in the Imprint is the controller responsible for personal information processed through the store, except where another party acts as an independent controller.
Personal information we collect
Personal information is information that identifies you or can reasonably be linked to you. Depending on how you use the store, we may collect:
We do not intentionally request sensitive personal information unless it is necessary for a specific lawful purpose.
How we collect information
We collect information directly from you when you order, register, subscribe, complete a form or contact us. We also collect certain technical data automatically through cookies, server logs and similar technologies.
We may receive information from service providers involved in payment, delivery, fraud prevention, analytics, advertising or customer support, and from publicly available sources where legally permitted.
How we use personal information
We may process personal information to:
- operate the website and provide requested features;
- process payments, fulfil orders, arrange delivery and manage returns;
- create and administer customer accounts;
- respond to enquiries and provide customer support;
- send transactional messages about orders and policy changes;
- detect fraud, misuse, security threats and prohibited activity;
- analyse performance and improve products, services and website usability;
- personalise content and advertising where permitted;
- administer promotions, surveys or reviews; and
- comply with tax, accounting, consumer-protection and other legal duties.
Legal bases for processing
Where the GDPR, UK GDPR or similar law applies, we rely on one or more of the following legal bases:
- Contract: processing needed to accept, fulfil and support your order or another agreement with you.
- Legal obligation: processing needed to comply with tax, accounting, product-safety or other laws.
- Legitimate interests: operating and improving the store, preventing fraud, securing systems and understanding business performance, provided your rights do not override those interests.
- Consent: where you have actively agreed, including for certain cookies or marketing. You may withdraw consent at any time without affecting earlier lawful processing.
Cookies and similar technologies
Cookies are small files or identifiers stored on or accessed from your browser or device. Similar technologies include pixels, tags, local storage and software development kits.
We use technologies that are necessary for checkout, account security and core site functions. With your consent where required, we may also use functional, analytics and advertising technologies to remember preferences, understand site use, measure campaigns and personalise content.
You can manage non-essential choices through the cookie settings displayed on the website and through your browser. Blocking necessary cookies may prevent parts of the store from working correctly.
Marketing and personalised advertising
We may send marketing communications when you have consented or where another lawful basis permits. You can unsubscribe using the link in a marketing message or by contacting us. Service messages concerning an order, security issue or account are not marketing and may still be sent.
Where permitted and subject to your cookie choices, we and advertising partners may use online identifiers and activity data to measure campaigns or show more relevant advertising. You can change your consent choices at any time.
When we share personal information
We do not sell personal information in the ordinary meaning of selling data for money. We may disclose only what is reasonably necessary to:
- e-commerce, hosting and technology providers;
- payment processors and fraud-prevention services;
- warehouses, carriers and delivery partners;
- customer-support, analytics, marketing and communication providers;
- professional advisers, auditors and insurers;
- public authorities when disclosure is legally required; and
- a buyer or successor in connection with a merger, reorganisation or sale, subject to appropriate safeguards.
Some providers act on our instructions as processors; others may act as independent controllers under their own privacy policies.
International data transfers
Some service providers or systems may process information outside your country. Where personal information is transferred from the European Economic Area, United Kingdom or another jurisdiction with transfer restrictions, we use an approved transfer mechanism where required, such as an adequacy decision, standard contractual clauses or another lawful safeguard.
You may contact us for further information about safeguards relevant to your data, subject to confidentiality and legal restrictions.
How long we keep information
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including order fulfilment, customer support, dispute handling, fraud prevention and legal, tax or accounting requirements.
Retention periods vary according to the type of information, our relationship with you, legal limitation periods and mandatory record-keeping rules. When information is no longer required, we delete or anonymise it unless continued retention is legally permitted or required.
Security
We use reasonable organisational, technical and physical safeguards designed to protect personal information against unauthorised access, alteration, loss, misuse or disclosure. These may include access controls, encryption in transit, service-provider reviews and internal procedures.
No internet transmission or storage system can be guaranteed completely secure. You are responsible for keeping account credentials confidential and should contact us promptly if you suspect unauthorised activity.
Your privacy rights
Depending on your location and applicable law, you may have the right to:
- request access to and a copy of your personal information;
- correct inaccurate or incomplete information;
- request deletion or restriction of processing;
- object to processing based on legitimate interests or to direct marketing;
- receive certain information in a portable format;
- withdraw consent at any time;
- request information about certain disclosures or transfers; and
- complain to the competent data-protection authority.
To protect your information, we may ask for reasonable verification before completing a request. Rights can be subject to legal exceptions. We will respond within the timeframe required by applicable law and will explain if we cannot fulfil all or part of a request.
Children’s privacy
The online store is intended for adults and is not directed to children. We do not knowingly collect personal information from children below the minimum age permitted in their jurisdiction.
If you believe a child has provided personal information without appropriate authorisation, please contact us so that we can review and, where required, delete it.
Third-party websites and services
The store may link to websites, tools or services controlled by third parties. Their privacy practices are governed by their own policies, and we are not responsible for their independent processing or content.
Please review the relevant privacy information before providing personal data to a third-party service.
Changes to this policy
We may update this Privacy Policy to reflect changes in technology, business practices, services or legal requirements. The current version will be published on this page.
If a change materially affects how we use personal information, we will provide additional notice or request consent where required by law.
Contact and complaints
For privacy questions or to exercise a privacy right, use our Contact page and clearly identify your request. Formal company and postal details are available in the Imprint.
You also have the right to contact the data-protection authority responsible for your place of residence, work or the location of an alleged infringement, where applicable.