Privacy policy

Last updated: 5 August 2026

This Privacy Policy explains how Al Baraka Rotterdam B.V., trading under the name Fancy Light, collects, uses, stores and shares personal information when you visit fancylight.nl, place an order, contact us or otherwise use our website and related services.

Fancy Light uses Shopify to operate its website and online store.

For the purposes of applicable data protection laws, including the General Data Protection Regulation, Al Baraka Rotterdam B.V. is the data controller responsible for the personal information described in this Privacy Policy, except where another organisation acts as an independent controller for its own processing activities.

1. Who we are

Al Baraka Rotterdam B.V., trading as Fancy Light

Registered business address:
Hagemanstraat 41
2691 WN ’s-Gravenzande
The Netherlands

KvK number: 92937527
VAT number: NL865611211B01
Email: info@fancylight.nl
Telephone: +31 6 39475661

2. Personal information we collect

The personal information we collect depends on how you interact with our website and services.

Information you provide directly

We may collect:

your name;
billing and delivery addresses;
email address;
telephone number;
order and transaction details;
information you provide when contacting customer service;
return and refund information;
account information, where customer accounts are available;
marketing preferences;
reviews or other content you choose to submit, where these features are available.

Payment information

Payments are processed through Shopify and the payment provider selected at checkout.

Fancy Light does not ordinarily receive or store your complete payment-card details. We may receive limited information such as:

payment status;
payment method;
billing details;
transaction reference;
payment confirmation;
fraud or risk indicators.

Your payment provider may process your personal information as an independent data controller under its own privacy policy.

Information collected automatically

When you visit or use our website, we and our service providers may automatically collect:

IP address;
browser type and version;
device type;
operating system;
language and regional settings;
pages viewed;
links clicked;
products viewed;
shopping-cart activity;
approximate location based on IP address;
referring website;
date and time of visits;
cookie identifiers and similar technical information.

Non-essential information is collected through cookies and similar technologies only where permitted and, where required, after you have provided consent.

3. How we collect personal information

We may collect personal information:

directly from you when you place an order, complete a form, contact us or subscribe to marketing;
automatically through cookies, pixels and similar technologies;
from Shopify and other service providers that support our store;
from payment providers;
from shipping and fulfilment partners;
from advertising and analytics providers, where you have provided the required consent;
from fraud-prevention and security providers;
from social media or communication services when you interact with us through those services.

4. How we use personal information

Processing and fulfilling orders

We use personal information to:

process and confirm orders;
process payments;
deliver products;
provide order and delivery updates;
administer returns, cancellations and refunds;
communicate with you about an order;
provide invoices and transaction records.

The legal basis for this processing is the performance of our contract with you and taking steps at your request before entering into a contract.

Customer service

We use personal information to:

respond to questions and requests;
investigate complaints;
resolve delivery or product issues;
provide after-sales support;
administer warranty or legal-guarantee claims.

This processing is based on performing our contract with you and our legitimate interest in providing effective customer service and managing our business relationship.

Legal and administrative obligations

We may use personal information to:

maintain accounting, tax and transaction records;
comply with consumer-protection requirements;
respond to lawful requests from public authorities;
establish, exercise or defend legal claims;
comply with other applicable legal obligations.

The legal basis is compliance with a legal obligation or, where applicable, our legitimate interest in protecting our legal rights.

Security and fraud prevention

We may process personal information to:

protect our website and systems;
verify transactions;
prevent and investigate fraud;
detect suspicious or unlawful activity;
protect customers, Fancy Light and third parties;
enforce our terms and policies.

This processing is based on our legitimate interest in protecting our business, website, customers and transactions. Where a legal obligation applies, processing is also based on that obligation.

Website operation and improvement

We may use personal information to:

provide essential website functions;
remember shopping-cart contents and preferences;
understand how visitors use the website;
diagnose technical problems;
improve website performance and customer experience;
measure the effectiveness of our services.

Essential processing is based on performing our services and our legitimate interests. Analytics involving non-essential cookies is based on consent where consent is required.

Marketing and advertising

Where permitted, we may use personal information to:

send newsletters and promotional emails;
personalise marketing communications;
measure advertising performance;
show relevant advertising on other websites or platforms;
understand which advertisements contributed to visits or purchases.

Where required, we rely on your consent for electronic marketing and non-essential advertising technologies.

You can unsubscribe from promotional emails at any time using the unsubscribe link in the email or by contacting us.

Withdrawing from marketing does not prevent us from sending essential messages about orders, payments, deliveries, returns, security or customer-service requests.

5. Legal bases for processing

Depending on the activity, we process personal information on one or more of the following legal bases:

Performance of a contract

Processing is necessary to:

accept and fulfil an order;
process a payment;
arrange delivery;
administer a return or refund;
provide customer support connected with a purchase.

Legal obligation

Processing is necessary to comply with:

tax and accounting requirements;
consumer-protection obligations;
lawful government or regulatory requests;
other applicable legal duties.

Legitimate interests

Processing is necessary for legitimate business interests such as:

operating and securing our website;
preventing fraud;
improving our services;
responding to customers;
protecting our legal rights;
managing business records.

We rely on legitimate interests only where those interests are not overridden by your fundamental rights and freedoms.

Consent

We rely on consent where required for:

promotional email communications;
non-essential analytics cookies;
advertising cookies;
personalised advertising;
other optional processing activities.

You may withdraw consent at any time. Withdrawal does not affect processing carried out before consent was withdrawn.

6. Cookies and similar technologies

We use cookies and similar technologies to operate the website, remember preferences, analyse website activity and support advertising where permitted.

These technologies may include:

strictly necessary cookies;
functionality cookies;
analytics cookies;
advertising and personalisation cookies.

Strictly necessary cookies support essential functions such as:

website security;
shopping-cart operation;
checkout;
payment processing;
remembering privacy choices.

These cookies generally cannot be disabled through our cookie banner because the website cannot function properly without them.

Non-essential analytics, personalisation and advertising cookies are used only where permitted and, where required, after you have provided consent.

You can accept, reject or manage non-essential cookies through the cookie banner or cookie settings on our website. You can withdraw or change your choice later.

You may also configure your browser to block or delete cookies. Blocking essential cookies may prevent parts of the website from functioning correctly.

The Dutch Data Protection Authority states that visitors must receive advance information about cookies, including which cookies are used, who processes the information and what personal information is involved.

7. How we share personal information

We may share personal information only where necessary and for legitimate purposes.

Shopify

Our store is hosted by Shopify. Shopify processes personal information to provide and improve the ecommerce platform, checkout, hosting, security and related services.

Information submitted through our store may be transmitted to Shopify and its approved service providers.

For customers in the European Economic Area, Shopify states that personal information is initially processed by Shopify International Limited in Ireland.

Payment providers

We share information with the payment provider selected during checkout to:

process payments;
confirm transactions;
prevent fraud;
administer refunds;
comply with financial and legal obligations.

Payment providers may act as independent controllers under their own privacy policies.

Delivery and fulfilment providers

We may share names, delivery addresses, telephone numbers, email addresses and order information with postal, courier, warehouse or fulfilment providers to deliver and manage orders.

Professional and technical service providers

We may share information with providers supporting:

website hosting;
information technology;
customer service;
email delivery;
accounting;
analytics;
advertising;
fraud prevention;
cybersecurity;
data storage;
legal and professional advice.

These providers may process personal information only as necessary to provide their services and in accordance with their contractual and legal obligations.

Advertising and analytics partners

Where you have provided any required consent, information may be shared with analytics and advertising providers to:

measure website activity;
understand advertising performance;
personalise advertisements;
identify whether an advertisement resulted in a visit or purchase.

You can manage these activities using our cookie settings.

Legal and business purposes

We may disclose personal information:

where required by law;
in response to a valid legal or regulatory request;
to investigate suspected fraud or illegal activity;
to enforce our terms or policies;
to protect our rights or the rights of others;
in connection with a merger, acquisition, restructuring, financing or sale of all or part of the business.

8. Shopify’s role

Shopify provides the infrastructure used to operate our online store.

In some circumstances, Shopify processes personal information on our behalf. In other circumstances, Shopify may act as an independent controller for processing connected with its own services, platform security, enhanced features or legal obligations.

Shopify’s own privacy documentation explains how it processes personal information and how individuals can exercise rights relating to processing for which Shopify is responsible.

9. Third-party websites and services

Our website may contain links to websites, platforms or services operated by third parties.

When you follow an external link, the third party’s own terms and privacy policy apply. Fancy Light is not responsible for the privacy, content, security or practices of websites that we do not control.

The inclusion of a link does not necessarily mean that Fancy Light endorses the third party.

10. International transfers

Some service providers may process or store personal information outside the European Economic Area.

Where personal information is transferred outside the European Economic Area, we or the relevant service provider use an approved transfer mechanism where required, such as:

a European Commission adequacy decision;
Standard Contractual Clauses approved by the European Commission;
another legally recognised safeguard or exception.

Standard Contractual Clauses are a recognised mechanism for transfers to organisations outside the European Economic Area when the required conditions are met.

11. Data retention

We retain personal information only for as long as necessary for the purpose for which it was collected.

The applicable retention period depends on:

the nature of the information;
the reason it was collected;
whether an active customer relationship exists;
warranty and consumer-law requirements;
tax and accounting obligations;
fraud-prevention and security needs;
limitation periods for legal claims;
whether consent has been withdrawn;
whether deletion has been requested.

In general:

order, invoice and transaction information is retained for the period required by Dutch tax and accounting law;
customer-service communications are retained for as long as reasonably necessary to handle the request and manage possible legal claims;
account information is retained while the account remains active and afterwards where legally necessary;
marketing information is retained until you unsubscribe, withdraw consent or the information is no longer required;
cookie and analytics information is retained according to the periods shown in the relevant cookie or provider settings.

We may retain limited information after a deletion request where necessary to comply with legal obligations, prevent fraud, resolve disputes or establish, exercise or defend legal claims.

Under GDPR principles, personal information should be stored for the shortest period reasonably necessary, taking account of the purpose and any legal retention requirements.

12. Security

We use reasonable organisational and technical measures intended to protect personal information against:

loss;
misuse;
unauthorised access;
unauthorised disclosure;
alteration;
destruction.

However, no website, transmission method or storage system can be guaranteed to be completely secure.

Please do not send sensitive information, including complete payment-card details, through ordinary email, WhatsApp or an unsecured contact form.

You are responsible for keeping any account credentials confidential and for contacting us if you suspect unauthorised use of your account.

13. Your privacy rights

Subject to applicable conditions and exceptions, you may have the following rights:

Right of access

You may ask whether we process your personal information and request a copy of that information.

Right to rectification

You may ask us to correct inaccurate or incomplete personal information.

Right to erasure

You may ask us to delete personal information where there is no longer a lawful reason to retain it.

Right to restriction

You may ask us to temporarily restrict processing in certain circumstances.

Right to data portability

Where processing is based on consent or a contract and carried out by automated means, you may request certain information in a structured, commonly used and machine-readable format.

Right to object

You may object to processing based on our legitimate interests.

You may object to direct marketing at any time. When you object to direct marketing, we will stop using your information for that purpose.

Right to withdraw consent

Where processing is based on consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Rights relating to automated decisions

You may have rights concerning decisions based solely on automated processing that produce legal or similarly significant effects.

Fancy Light does not ordinarily make decisions producing legal or similarly significant effects solely through automated processing. Payment or fraud-prevention providers may use automated systems under their own policies.

Right to lodge a complaint

You have the right to lodge a complaint with a competent data protection authority.

In the Netherlands, the supervisory authority is:

Autoriteit Persoonsgegevens

You are welcome to contact us first so that we have an opportunity to resolve your concern, but you are not required to do so before contacting the supervisory authority.

14. Exercising your rights

To exercise a privacy right, contact us at:

Email: info@fancylight.nl
Telephone: +31 6 39475661

Please clearly describe your request.

We may request information needed to verify your identity before responding. We will use that information only to verify and administer the request.

You may authorise another person to submit a request on your behalf. We may ask for proof that the person is authorised to represent you.

We will respond within the period required by applicable law. In some cases, that period may be extended where a request is complex or multiple requests have been submitted. Where applicable, we will inform you of the extension and the reason for it.

We will not discriminate against you for exercising your privacy rights.

15. Marketing preferences

You can unsubscribe from promotional emails by:

clicking the unsubscribe link in a marketing email; or
contacting info@fancylight.nl.

Unsubscribing from promotional communications does not prevent us from sending necessary communications concerning:

orders;
payments;
deliveries;
returns;
refunds;
security;
customer-service requests;
changes to our contractual terms or policies where notice is required.

16. Children’s privacy

Our website and products are not directed at children.

We do not knowingly collect personal information from children for the purpose of selling lighting products.

If you are a parent or guardian and believe that a child has provided us with personal information, contact us at info@fancylight.nl. We will investigate and, where appropriate, delete the information.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

changes to our services;
changes to our technology or providers;
changes to our processing activities;
legal or regulatory requirements;
operational or security developments.

The revised version will be published on this website with an updated revision date.

Where required by law, we will provide additional notice of material changes.

18. Contact and data controller

For questions about this Privacy Policy, our privacy practices or the exercise of your rights, contact: