Original Design for Every Home

EUR

Original Design for Every Home

Privacy policy

Privacy Policy

This policy explains what personal data we collect when you visit eu.umbra.com or buy from us, why we use it, who we share it with and what your rights are. We wrote it to be easy to read. It follows the EU General Data Protection Regulation (GDPR).

1. Who is responsible for your data

The controller of your personal data is Umbra B.V., Monitorweg 1, 1322 BJ Almere, The Netherlands (KvK 34180896, VAT NL811198996B01). For any privacy question or request, email eu-info@umbra.com or call +31 (0)36 549 5422.

2. What we collect

  • Order and account details: name, delivery and billing address, email, phone number, order history, and your account login if you create one.
  • Payment details: handled by our payment providers. We do not see or store your full card number.
  • Messages: what you tell us when you email, chat or call us, or start a return or warranty claim (including photos you send).
  • Marketing preferences: whether you signed up for our emails and our rewards programme, and how you interact with our emails.
  • Device and usage data: IP address, browser, device, pages viewed, items added to cart and similar data, collected with cookies and similar technologies (see section 7).

We also receive some data from others, for example delivery status from carriers and fraud checks from payment providers.

3. Why we use it and our legal basis

  • To take, deliver and support your order, handle returns, refunds and warranty claims, and run your account. Legal basis: performance of our contract with you.
  • To keep records and meet legal duties, such as tax and accounting rules and consumer law. Legal basis: legal obligation.
  • To send you marketing emails and run our rewards programme. Legal basis: your consent. You can unsubscribe at any time using the link in every email or with our unsubscribe form.
  • To use analytics and advertising cookies, to measure our site and show you relevant ads. Legal basis: your consent through our cookie banner.
  • To keep our site secure, prevent fraud and improve our service. Legal basis: our legitimate interests, which we balance against your rights.

Do you have to give us your data? No law requires you to give us personal data. To place an order we need your name, delivery and billing address, email and payment details. This is necessary to enter into and carry out our contract with you. Without it we cannot process or deliver your order. Signing up for marketing emails, our rewards programme or an account is optional. If you do not sign up, the only consequence is that you do not receive those emails or benefits.

We do not make decisions about you based only on automated processing that have legal or similarly significant effects.

4. Who we share it with

We share data only with companies that help us run our shop, and only what they need. They act on our instructions under data processing agreements. They include:

  • Shopify (our online store platform and checkout)
  • Payment providers such as Shopify Payments, PayPal and Klarna
  • Carriers that deliver your orders and returns
  • Loop (our returns portal)
  • Klaviyo (email marketing)
  • Formstack (online forms we use to receive email unsubscribe requests and quality guarantee claims)
  • Gorgias (customer service and chat)
  • LoyaltyLion (Umbra Rewards)
  • Pandectes (cookie consent)
  • Bazaarvoice (product reviews)
  • Vimeo and YouTube (videos on our pages)
  • Analytics and advertising partners, only if you accept these cookies: Google, Microsoft (Bing and Clarity), Meta, Elevar, Triple Whale and Shogun
  • Other Umbra companies (Umbra Ltd. in Canada and Umbra LLC in the United States) that help run our website and customer service

We may also share data where the law requires it, or to protect our rights or the safety of others. We do not sell your personal data.

5. Transfers outside Europe

Some of these companies store or access data outside the European Economic Area, for example in Canada, the United Kingdom or the United States. When that happens we use a legal safeguard: an EU adequacy decision (for example for Canada and the United Kingdom, or the EU-US Data Privacy Framework for certified US companies), or the EU Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.

Formstack stores form entries with Amazon Web Services in the United States. According to Formstack, it complies with the EU-US Data Privacy Framework, which covers this transfer.

6. How long we keep it

  • Order and invoice records: 7 years, as Dutch tax law requires.
  • Your account: until you ask us to delete it.
  • Marketing data: until you unsubscribe or withdraw consent.
  • Customer service messages: as long as needed to deal with your request and any follow up, including the guarantee period for your order.
  • Cookies: for the period shown in our cookie banner.

After that we delete or anonymise the data.

7. Cookies

We use cookies and similar technologies. Strictly necessary cookies (for example to keep items in your cart and to run checkout) are always on. Analytics, personalisation and advertising cookies are only used if you accept them in our cookie banner. You can change your choice at any time by deleting our cookies in your browser, which shows the banner again, or by contacting us.

8. Your rights

You have the right to:

  • access your data and get a copy
  • correct inaccurate data
  • have your data deleted
  • restrict how we use it
  • receive your data in a portable format
  • object to our use of your data based on legitimate interests, and to direct marketing at any time
  • withdraw your consent at any time, without affecting what we did before

To use any of these rights, email eu-info@umbra.com. We reply within one month. We may ask you to confirm your identity first.

You can also complain to a data protection authority, either in the country where you live or work, or in The Netherlands: the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). We would appreciate the chance to help first.

9. Children

Our shop is not meant for children under 16, and we do not knowingly collect their data.

10. Security

We use technical and organisational measures to protect your data, such as encrypted connections and limited access. Payments are processed securely by our payment providers.

11. Changes

We may update this policy. The current version is always on this page.