Privacy policy

Last updated: 24 August 2026

This policy explains how LANCASTER SARL (“Lancaster”, “we”) collects, uses, stores and shares your personal data when you browse www.lancaster.com, create an account, place an order, contact our customer service team or interact with our services. It also describes our use of cookies and similar technologies.

Contents:

1. Personal data protection

1.1 Data controller

The data controller is LANCASTER SARL, a limited liability company with share capital of capital of €250,000, registered with the Paris Trade and Companies Register under number 387 651 565, with its registered office at 422 rue Saint-Honoré, 75008 Paris, France.

For any question or request concerning your personal data, you may contact us:

1.2 Data we process

Depending on how you use our services, we may process the following categories of data:

  • identity and contact details: title, surname, first name, postal address, email address and telephone number;
  • customer account: account login details, preferences, order history and information required for authentication;
  • orders and transactions: products ordered, amount, discounts, billing, delivery, returns, refunds, payment incidents and proof of transaction;
  • payment: payment status and technical payment references. Full bank card details are processed by payment providers and are not stored by Lancaster;
  • customer service and after-sales: content of exchanges, requests, complaints, returns, guarantees and, where necessary, photographs of products;
  • preferences and marketing: consents, unsubscribes, language, country, wishlist, interactions with communications and areas of interest inferred from your browsing where you have authorised this;
  • browsing and device: IP address, technical identifiers, device and browser type, pages and products viewed, searches, basket and order events, traffic source and privacy choices;
  • content submitted: reviews, responses to surveys or prize draws, and any information you choose to share with us.

Required fields are indicated in the forms. If you do not complete them, we may be unable to create your account, process your order or respond to your request.

1.3 Purposes and legal bases

Purpose Legal basis
Create and manage your account, your basket and your service-related preferences Performance of a contract or pre-contractual steps
Process orders, payments, deliveries, returns, refunds, guarantees and after-sales requests Performance of a contract and legal obligations
Issue and retain invoices, maintain accounts and respond to competent authorities Legal obligation
Respond to requests, provide customer service and retain proof of exchanges Performance of a contract or legitimate interest in providing and defending our services
Secure the website, prevent fraud, detect abuse and protect our rights Legitimate interest and, where applicable, legal obligation
Send information relating to your orders and your account Performance of a contract
Send newsletters, SMS messages and personalised offers Your consent where required; legitimate interest for similar products within the limits permitted by law, with the option to object at any time
Measure audience, attribute campaigns, personalise the experience and offer relevant advertising Your consent for the relevant non-essential cookies and processing
Manage reviews, wishlists, interactive content, surveys and prize draws Performance of the requested service, consent or legitimate interest depending on the feature
Improve our products, journeys and services using aggregated data or data that is strictly necessary Legitimate interest, subject to your rights and the rules applicable to cookies

1.4 Recipients and service providers

Your data is accessible only to authorised members of Lancaster and, to the extent necessary for their duties, to our service providers and partners. These include in particular:

  • Shopify, Shop and Shop Pay for hosting, customer account, basket, order, payment and security;
  • payment and fraud prevention providers, including Shopify Payments, Klarna and the payment methods offered at checkout;
  • logistics providers, including carriers and delivery, tracking and returns services such as Colissimo and Baback;
  • customer service and e-booking providers, including Gorgias and Socloz;
  • marketing and communications providers, including Klaviyo;
  • measurement and advertising providers, including Google, Meta, TikTok and Affilae, only in accordance with your consent choices where required;
  • website functionality providers, including LangShop, Wishlist Plus (Swym), Skeepers / Avis Vérifiés, JOIN Stories and NFCube / Instafeed;
  • our advisers, auditors, insurers and administrative or judicial authorities where required by law or where necessary to defend our rights.

Certain partners, including Shopify, Google, Meta, TikTok and payment providers, may act as independent data controllers for certain operations that they determine themselves. Their own policies set out these processing activities.

1.5 Transfers outside the European Economic Area

Some of our service providers are established or process data outside the European Economic Area. Where the country concerned is not covered by an adequacy decision, transfers are governed by appropriate safeguards, including the standard contractual clauses approved by the European Commission, supplemented where necessary by additional security measures. You may contact us for information about the applicable safeguards.

1.6 Retention periods

We keep data only for as long as necessary for the relevant purpose and then, where required by law or justified by the defence of our rights, in intermediate archiving with restricted access.

Data Indicative period
Customer account For the duration of account use, then for up to 3 years after the last activity, unless deletion is requested or a separate retention obligation applies
Orders, deliveries, invoices and accounting records For the duration of the business relationship, then 10 years for documents subject to accounting and evidential obligations
Customer service requests, returns, complaints and guarantees For the time required for processing, then archived for the applicable statutory limitation period, generally up to 5 years
Marketing and loyalty Until you withdraw your consent or object and, at the latest, 3 years after the last purchase or last active contact; the information needed to honour your objection may be kept for 3 years
Proof of consent and privacy choices For the time required to manage and demonstrate your choices, then for the applicable limitation period
Technical data, security and fraud prevention A period proportionate to the risk and security needs and then, in the event of an incident, for the time required to deal with it and defend our rights

The periods specific to cookies and similar technologies are set out in section 2.

1.7 Your rights

Under the conditions laid down by the applicable regulations, you have the following rights:

  • to access your data and obtain a copy of it;
  • to have inaccurate or incomplete data rectified;
  • to request the deletion of your data;
  • to request the restriction of processing;
  • to object to processing based on our legitimate interest, and at any time to direct marketing;
  • to receive the data you have provided to us in a structured format and request its transmission to another controller where the right to portability applies;
  • to withdraw your consent at any time, without affecting the lawfulness of processing carried out beforehand;
  • to define instructions concerning the handling of your data after your death.

You may exercise these rights using the contact details given in section 1.1. We may request additional information or proof of identity only where necessary to verify your identity. As a rule, we respond within one month, which may be extended under the conditions laid down by the applicable regulations.

You may also lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL).

1.8 Marketing communications

You may unsubscribe from marketing emails using the link included in each message. For marketing SMS messages, follow the unsubscribe instructions set out in the message. You may also contact us. Unsubscribing does not prevent the sending of communications necessary for processing your orders or for the security of your account.

1.9 Security

We implement technical and organisational measures designed to protect data against loss, unauthorised access, alteration or disclosure. As no system is entirely risk-free, we adapt these measures to the nature of the data and the risks identified.

1.10 Changes to the policy

We may amend this policy to reflect legal, technical or service developments. The update date shown at the top of the document indicates the applicable version. In the event of a significant change, we will inform you by appropriate means.

2. Cookies and similar technologies

This section explains how Lancaster uses cookies and similar technologies, including pixels, tags, identifiers and browser storage.

Shopify Customer Privacy is our consent management tool. You can accept, refuse or change your choices at any time by opening Cookie settings. Withdrawing your consent does not affect the lawfulness of processing already carried out.

2.1 Categories of technologies

Strictly necessary technologies

These technologies enable the website to function and provide the services you have expressly requested: security, navigation, language or country selection, customer account, basket, payment, fraud prevention, delivery and the retention of your privacy preferences. They cannot be disabled using our consent tool.

Personalisation

With your consent, these technologies remember your choices and interactions in order to personalise your experience, for example your wishlist or certain content displayed.

Analytics

With your consent, these technologies allow us to measure traffic, understand how the website is used and improve its performance. Services classified as strictly functional are limited to what is necessary to provide the requested functionality.

Advertising and marketing

With your consent, these technologies measure campaigns, attribute sales, personalise communications and enable us to show you more relevant advertising on other websites or services.

2.2 Services and retention periods

The periods below are the maximum retention periods on your device. Some technologies are limited to the session, may be deleted earlier by your browser, or are only created after you use a particular feature.

Service / provider Purpose and category Technologies Maximum duration Activation
Shopify, Shop and Shop Pay Hosting, security, account, basket, payment, preferences, analytics and Shopify services HTTP cookies, local storage, pixels and identifiers Session to 2 years depending on the technology Essential functions always active; personalisation, analytics and advertising according to your choices
Klarna and payment providers Secure payment, fraud prevention and display of payment options HTTP cookies and local storage Session to 400 days When the payment function or related information is displayed or used
LangShop Language, country and currency HTTP cookies and local storage Session to 1 year; some choices persist until deleted Functional
Google Maps Address entry assistance and validation at payment Scripts and technical requests Session, subject to Google's rules When using the payment journey
Wishlist Plus (Swym) Wishlist and visit personalisation HTTP cookies, local storage and identifiers Session to 1 year; some local data persists until deleted According to your personalisation choice and use of the wishlist
Skeepers / Avis Vérifiés Display, submission and functional measurement of product reviews; prevention of multiple votes Scripts, requests, local storage and technical browser characteristics Session to 13 months depending on the functionality Functional for displaying reviews; additional processing according to your choices
JOIN Stories Display of video content and measurement of its use HTTP cookies, local storage, scripts and pixels Session to 12 months Functional content; measurement according to your choices
NFCube / Instafeed Display of the Lancaster social feed Scripts, images and browser cache Session or cache duration Functional
Gorgias Support chat and retention of conversation history Cookies, local storage and conversation identifiers Session or until browser storage is deleted; retention of exchanges in accordance with this policy The Gorgias service is loaded only after clicking “Continue” in the prior notice
Klaviyo Forms, newsletter, personalisation, interaction measurement and marketing communications HTTP cookies, local storage, pixels and identifiers Session to 2 years depending on the technology Functional surfaces may be prepared before your choice; identification, personalisation and marketing depend on your choices
Google Analytics 4 Audience measurement and site performance Cookies _ga, _ga_*, pixels and identifiers Up to 2 years After consent to analytics
Google Ads and YouTube Campaign measurement, conversions and personalised advertising Cookies, local storage, pixels and advertising identifiers Session to 13 months depending on the technology After advertising consent
Meta (Facebook and Instagram) Conversion measurement, audiences and personalised advertising Pixel, cookies and local storage, including _fbp Up to 90 days for _fbp After advertising consent
TikTok Conversion measurement, audiences and personalised advertising Pixel, cookies and local storage, including _ttp and ttcsid* Up to 13 months After advertising consent
Affilae (NETILUM SARL) Attribution of clicks and sales to affiliate partners, measurement and fraud prevention Cookies _affilae*, AeFirst*, local storage, pixels and statistical fingerprinting 90 days on the device; tracking data retained for up to 25 months then anonymised by Affilae After advertising consent

Other technical providers may intervene only when you request a specific function, including Baback for returns, Socloz for e-reservations, Colissimo for delivery, the payment methods offered during checkout and Shopify security services. They use session technologies or technologies limited to providing the requested service.

2.3 Information on key partners

2.4 Manage or withdraw your consent

You can change your choices at any time via Cookie settings, also available in the footer. Refusing or withdrawing your consent prevents the relevant new non-essential loads; resources already loaded on the current page may remain in memory until it is refreshed. After making changes, we recommend refreshing the page.

You may also delete cookies and site data using your browser settings. This deletion does not replace the recording of your choice by our consent tool.

This list is reviewed whenever integrated apps, pixels or services are changed, and through periodic checks of journeys without consent, with consent and after withdrawal.