Privacy policy
Last updated: 4 October 2026
This policy explains what we do with your personal data when you visit robaluca.com, place an order, or sign up for our emails. We keep it short and specific, because a privacy policy you cannot read is not transparency.
1. Who is responsible
ROBA LUCA BV is the controller of your personal data.
Diksmuidsesteenweg 301, 8800 Roeselare, Belgium
Company and VAT number: BE 1036.431.043
Register of legal entities: RPR Ghent, Kortrijk division
Email: hello@robaluca.com
Phone: +32 451 09 32 00
We have not appointed a data protection officer; we are not required to. Write to the address above with any question about your data and we answer within 1 business day.
2. What we collect, why, and on what basis
| Data | Why | Legal basis |
|---|---|---|
| Name, email, delivery and billing address, phone number | To take, deliver and invoice your order, and to contact you about it | Performance of the contract |
| Order history, returns and refunds | To handle returns, the right of withdrawal and the legal guarantee | Contract and legal obligation |
| Payment data | To take payment. Your card details go straight to our payment provider; we never see or store them | Contract |
| Invoicing and accounting records | Belgian bookkeeping and VAT law requires us to keep them | Legal obligation |
| Email address for our newsletter and waitlist | To send you our emails and to tell you when we launch | Consent, which you can withdraw at any time |
| Email open and click behaviour | To see which emails are worth sending | Consent |
| Cookies and similar technology beyond what the shop needs to work | To measure how the site is used and, where you allow it, to measure advertising | Consent, through the cookie banner |
| Messages you send us, by email, form or social media | To answer you | Our legitimate interest in answering customers |
We do not sell your data, we do not profile you to make decisions with legal effect, and we do not use automated decision-making.
3. Who processes it for us
We use a small number of providers. Each of them acts on our instructions under a processing agreement, and each of them only gets what it needs.
- Shopify — our shop platform and hosting, including Shopify Payments for payments.
- Klaviyo — our email platform: the newsletter, the waitlist and order-related emails.
- Sendcloud and the carriers it books, including bpost and GLS — to ship your parcel and give you a tracking link.
- Google Workspace — our email and office software.
- Our accountant, for the invoices the law says we must keep.
- Google (Google Analytics) — to measure how the site is used. It only runs after you allow analytics cookies in the cookie banner.
- PostHog — to see how the site is used: which pages and pieces are viewed, what goes into the cart, and where the site does not work as it should. It records page views, clicks and scrolling, and can replay a visit as a recording, with everything you type into forms hidden. Your data is stored in the EU (Frankfurt). It only runs after you allow analytics cookies in the cookie banner.
One provider works differently: Meta (Meta Platforms Ireland). If you allow marketing cookies, the Meta Pixel tells Meta which pages you view and what you add to your cart and buy, so we can measure our ads on Instagram and Facebook. When you place an order, we also report that purchase to Meta directly from our shop, through Meta's Conversions API. To recognise you, Meta receives your email address and phone number in scrambled (hashed) form. Meta and we are jointly responsible for collecting and passing on this data; what Meta does with it afterwards falls under Meta's own privacy policy. Without your consent, none of this runs.
Shopify also uses some data from our shop for its own purposes. Together with data from other shops on Shopify, it uses it to protect, grow and improve shops on Shopify, for example with product recommendations and filters, and, if you allow marketing cookies, to show you ads based on your activity. For that part, Shopify is responsible itself: see Shopify's Consumer Privacy Policy, and use the Shopify privacy portal to exercise your rights towards Shopify.
Some of these providers are established outside the European Economic Area or use servers there. Where that is the case, the transfer rests on the European Commission's standard contractual clauses or an adequacy decision. You can ask us for a copy of the safeguards that apply.
We also share data when the law obliges us to, for example with the tax authorities.
4. Cookies
We use cookies and similar technology. Some are necessary for the shop to work at all: they keep your cart, your session and your security. Those are always on, because without them there is no shop.
Everything else only runs after you allow it in the cookie banner. That covers analytics and, where applicable, advertising measurement. You can change or withdraw your choice at any time through the Cookie settings link in our footer.
One cookie worth naming: __kla_id, set by Klaviyo. It links your visit to your email profile so that we can see which emails lead to a visit, and so an abandoned cart email reaches the right person. It is not necessary for the shop to work and is only set once you have given consent.
If you allow them, Google Analytics sets the cookies _ga and _ga_N2LWXD6HN6 (13 months), PostHog sets a cookie whose name starts with ph_ (1 year) and Meta sets _fbp (90 days).
Cookies set by the payment provider during checkout are necessary for the payment to complete and to prevent fraud.
5. How long we keep it
- Order and customer data: for the duration of the contract and afterwards as long as we may need it for the legal guarantee and for claims.
- Invoices and accounting records: 7 years, as Belgian law requires.
- Newsletter and waitlist data: until you unsubscribe, and we delete profiles that have been inactive for 3 years. Inactive means no order, no opened or clicked email, and no visit to the shop in that period.
- Cookie data: as set out in the cookie banner, and never longer than 13 months for analytics.
- Your messages to us: 2 years after the conversation ends.
6. Your rights
You have the right to access your data, to correct it, to have it erased, to restrict or object to its use, and to receive it in a portable form. Where we rely on your consent, you can withdraw it at any time, and that does not affect what we did before you withdrew it.
Email hello@robaluca.com and we act within one month. Unsubscribing from our emails is faster still: the link is at the bottom of every one.
If you think we handle your data wrongly, tell us first, we would rather fix it. You can also complain to the Belgian Data Protection Authority, Drukpersstraat 35, 1000 Brussels, gegevensbeschermingsautoriteit.be, or to the supervisory authority of the country where you live.
7. Security
Our shop runs over an encrypted connection, access to customer data is limited to the two of us, and our providers are chosen for what they do with data as much as for what they do for us. No system is perfect; if something goes wrong that puts your data at risk, we tell you and the authority, as the law requires.
8. Children
Our shop is not aimed at children and we do not knowingly collect data from anyone under 16.
9. Changes
If this policy changes, the new version appears here with a new date. For a material change that affects you, we tell you by email.