Privacy Policy

Data controller

Lacap BV, trading as Lacom, is a wholesale company in silver and gemstones, with its registered office in Breda, the Netherlands, registered with the Dutch Chamber of Commerce under number 24260723. Lacom is the data controller for the personal data processed via lacomgems.com and processes it in accordance with the GDPR. Privacy questions: info@lacomgems.com.

What data do we collect?

When you register and use a business account we process: company name, registration number (such as KVK), VAT number, contact person's name, email address, phone number, billing and delivery address(es), and optionally a website or social media link. We also process order data and order history, payment references of bank transfers (we do not ourselves process credit card or account details beyond what is visible on received payments), correspondence with us, and limited technical data such as IP addresses in server log files for security purposes.

Purposes and legal bases

We process your data for: assessing your registration and managing your account, processing and shipping orders, invoicing and related communication (performance of the agreement); complying with tax and administrative obligations (legal obligation); securing the webshop, fraud prevention and anonymised visitor statistics (legitimate interest); and sending our newsletter and ad measurement via Google (both only with your consent, see Newsletter and Cookies below).

Visitor analytics

To understand how the webshop is used, we run self-hosted, cookieless analytics on our own servers within the EU. No cookies are placed, no personal profiles are built and no data is shared with third parties; the statistics are anonymised and cannot be traced back to individual visitors.

Newsletter

If you sign up for our newsletter we process your email address solely on the basis of your consent. To make sure the signup came from you, we first send a confirmation email; you only receive the newsletter after clicking the confirmation link (double opt-in). We use Mailchimp (Intuit Inc.) for this, which also processes data outside the EEA on the basis of appropriate safeguards. Every newsletter contains an unsubscribe link, so you can withdraw your consent at any time without giving a reason. We keep your email address until you unsubscribe, after which we remove it from our mailing list within 12 months.

Sharing with third parties

We only share your data with service providers that need it to make our services possible: hosting and database providers, an email service provider for transactional email (such as order confirmations), shipping services for delivering your order, and (only with your consent) Mailchimp for sending the newsletter and Google for ad measurement. Data processing agreements or equivalent arrangements are in place with these parties. We also provide data to government authorities where legally required. We never sell your data to third parties. Our systems run on servers within the EU; insofar as a service provider processes data outside the EEA, this is done on the basis of appropriate safeguards such as the EU-US Data Privacy Framework or standard contractual clauses.

Retention periods

We retain account data for as long as you have an active account; after termination it is deleted or anonymised within 12 months, unless a longer statutory period applies. Order and invoice data is retained for 7 years in accordance with Dutch tax retention requirements. Correspondence is retained for a maximum of 2 years after handling. Your email address on our newsletter list is kept until you unsubscribe. Server log files are automatically deleted after a short period.

Security

We take appropriate technical and organisational measures to protect your data, including encrypted connections (TLS), encrypted password storage, access restrictions and hosting in data centres within the EU.

Your rights

You have the right to access, rectify, delete and port your personal data, the right to restrict and object to processing, and the right to withdraw consent at any time. Contact us at info@lacomgems.com; we will respond within one month. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or the supervisory authority in your own country.

Cookies

Functional cookies (session, cart, preferences) are always active: the webshop cannot work without them. We do not ask consent for these, nor are we required to. Our visitor analytics (see above) do not use cookies at all.

We also use Google Ads and Google Consent Mode v2 to measure which ads lead to a registration. Cookies for this (such as _gcl_au) are only placed, and data is only shared with Google, after you explicitly consent via the cookie banner. If you decline, nothing is placed and nothing is sent; only anonymised measurement remains via Consent Mode v2. You can revoke your choice at any time by clearing site data for lacomgems.com in your browser.

Changes

We may update this privacy policy, for example when our services or legislation change. The current version is always available on this page; in the event of significant changes we will inform account holders by email.