Privacy statement

01Who is responsible

The controller is UIC International B.V., trading as ExpoLightbox, at St. Servatiusstraat 13, 5482 HC Schijndel, Netherlands. The company is registered with the Dutch Chamber of Commerce; its registration and VAT numbers are on the legal notice page.

We have not appointed a Data Protection Officer. We are not required to: we do not process special categories of data, and we do not monitor anyone on a large scale.

02What we collect and why

Price list request

Your email address only. Legal basis: your request (art. 6(1)(b) GDPR, steps prior to a contract). Used to send the price list once and to reply if you write back.

Quote request

Name, company, email, and optionally phone, exhibition, build-up date and your message. Legal basis: your request (art. 6(1)(b)). Used to prepare and send your quotation.

Online order

Company, name, email, phone, billing and delivery address, VAT number and your configuration. Card and bank details are entered at Stripe and never reach us. Legal basis: performance of the contract (art. 6(1)(b)) and our tax obligations (art. 6(1)(c)).

Artwork files

The print files you upload after paying, which can contain logos, names and images. Stored privately and opened only by us to check and produce your order. Legal basis: performance of the contract (art. 6(1)(b)).

Visit statistics

Pages viewed, referrer, country, device type and the steps you take in the configurator and checkout, counted by Vercel Web Analytics and Ahrefs Web Analytics. Neither sets a cookie or stores an identifier on your device; visits are counted from a daily-rotating hash, not a profile. Legal basis: legitimate interest in knowing which pages help buyers (art. 6(1)(f)).

Server logs

IP address, page requested, timestamp, user agent. Held by our hosting provider for security and abuse prevention. Legal basis: legitimate interest (art. 6(1)(f)).

03What we do not do

• No cookies for statistics or marketing. The two analytics services above are cookieless, which is why you were not asked to consent to any.
• No advertising or tracking pixels, no remarketing lists, no social plugins.
• No profiling and no automated decision-making with legal effect.
• No newsletter unless you ask for one separately. Requesting the price list does not subscribe you to anything.
• We never sell, rent or trade personal data.

04Who else sees it

Brevo (Sendinblue SAS, France)

Sends the price list and the quote notifications. Processes your email address and the contents of your request. EU-based, acting as our processor.

Vercel Inc.

Hosts the site and holds the server logs. Data is served from EU regions; where any transfer to the United States occurs it is covered by Standard Contractual Clauses.

Stripe Payments Europe Ltd. (Ireland)

Processes your payment and issues the invoice. You enter card or bank details at Stripe, not on this site.

Vercel Inc. (Blob storage, Web Analytics)

Stores your uploaded artwork files privately, and counts visits without cookies.

Ahrefs Pte. Ltd. (Web Analytics)

Counts visits and referrers without cookies or personal identifiers.

Google Workspace

Our mailbox. Once you email us, or we email you, the message sits in that mailbox.

05How long we keep it

• Price list requests: 24 months from the request, then deleted.
• Quote requests that do not become orders: 24 months, so we can pick up a conversation that resumes a season later.
• Quote requests that become orders: seven years, because Dutch tax law requires us to keep the underlying records that long.
• Server logs: as retained by our hosting provider, typically 30 days.

06Your rights

You may ask us for a copy of your data, to correct it, to delete it, to restrict or object to its processing, or to receive it in a portable format. Where processing rests on consent you may withdraw that consent at any time, and the withdrawal does not affect what was lawful before it.

Email info@expolightbox.com. We answer within one month. There is no charge unless a request is manifestly unfounded or excessive.

If you think we have handled your data badly, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or to the supervisory authority in your own country. We would rather you told us first.

07Security and changes

The site is served over HTTPS only. Form submissions travel over TLS. Access to the mailbox and to the email platform is limited to the people who answer enquiries.

If this statement changes materially we will change the date at the top and, where the change affects data we already hold, tell the people it affects.

08Contact

Questions about this statement, or a request to exercise any right below: info@expolightbox.com.