Effective: 29 August 2026
Riga Group L.L.C., trading as Pigmentia, is the controller of personal data described here. Our registered details and contact methods are in the Legal Notice.
1. Data we collect
- Orders: name, email, phone, billing and delivery details, chosen products, totals, tax, payment status, Stripe transaction identifiers, fulfilment, support, and refund history.
- Payments: card details are entered in Stripe's embedded interface and are not stored in our application. Stripe returns limited payment and fraud-prevention information.
- Enquiries: name, email, enquiry type, order number, company, message, and technical anti-abuse data.
- Personalised orders: files, images, text, instructions, and communications you choose to provide.
- Newsletter: email, source, consent time, and subscription status.
- Device and service data: IP-derived security signals, request logs, browser/device information, error events, consent choices, and cart/wishlist data stored on your device.
- Storefront page views: Vercel, our host, collects privacy-focused aggregate web analytics such as route, referrer, approximate country, and device or browser information. This uses no third-party analytics cookies and is separate from consent-managed Google Analytics and advertising tools.
- Optional measurement: online identifiers and browsing or shopping events are collected only for categories you accept in Cookie Settings.
2. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Take payment, fulfil, deliver, support, cancel, or refund an order | Contract and steps requested before contract |
| Accounting, tax, product safety, sanctions, and lawful requests | Legal obligation |
| Prevent abuse and fraud; secure and diagnose the service; operate denied-by-default consent controls | Legitimate interests in a safe and effective store, balanced against your rights |
| Answer general, personalised-art, and trade enquiries | Requested pre-contract steps or legitimate interests in responding |
| Send newsletters and use optional analytics or advertising technologies | Consent, withdrawable at any time |
| Establish, exercise, or defend legal claims | Legitimate interests and applicable legal provisions |
Where information is required for checkout or delivery, not providing it may prevent us from completing the order. Newsletter and optional tracking choices are voluntary.
3. Recipients and service providers
We disclose only what is reasonably needed to: Stripe for payment, authentication, and fraud services; Vercel for website hosting, delivery, and privacy-focused aggregate web analytics; contracted database and media-storage providers; Klaviyo for newsletters and consented onsite shopping events; production and fulfilment partners; carriers and customs authorities; professional advisers; and authorities where law requires it.
Vercel Web Analytics does not use third-party analytics cookies. It records aggregate page-view information (for example route, referrer, approximate country, and device or browser details) to operate and understand the storefront. It is not controlled by Cookie Settings, which continue to govern Google Analytics and advertising technologies. Google Analytics uses advanced Consent Mode v2: storage defaults to denied, limited cookieless consent and measurement pings may be sent before a choice, and analytics cookies and full measurement require Analytics consent. Meta Pixel loads only after marketing consent. Pinterest Tag is not currently configured. Klaviyo is not currently configured. We do not sell personal data.
4. International transfers
Some providers may process data outside Kosovo, the EEA, the United Kingdom, or your country. Where required, we use an adequacy decision, standard contractual clauses, a provider's approved data-transfer framework, or another lawful safeguard, with supplementary measures where appropriate. You may contact us for information about the relevant safeguard.
5. Retention
- Order, payment, invoice, and refund records: for the statutory accounting/tax period and while claims may reasonably arise.
- Customer-service and enquiry records: normally up to 24 months after resolution, longer if linked to an order, dispute, or legal duty.
- Personalised source files: only as long as needed to review, produce, resolve issues, and meet applicable claim periods; production copies should then be deleted or anonymised.
- Newsletter data: until you unsubscribe; a minimal suppression record may be retained to honour the request.
- Security and abuse-prevention records: normally up to 12 months unless an incident requires longer.
- Cookie consent choice: normally 12 months before renewal; cart and wishlist remain on your device until cleared.
6. Your rights
Depending on applicable law, you may request access, correction, deletion, restriction, objection, or portability; withdraw consent without affecting earlier lawful processing; and complain to the competent data-protection authority. Rights can be limited where a legal duty, another person's rights, or a valid exemption applies.
Send a request to info@pigmentia.co. We may ask for proportionate information to verify identity. You can withdraw tracker consent using “Cookie settings” in the footer and stop newsletter messages on the unsubscribe page.
7. Automated decisions, children, and security
Stripe and other fraud providers may evaluate transaction risk. We do not make solely automated decisions that produce legal or similarly significant effects, except where necessary to prevent fraudulent payment and allowed by law; contact us if a legitimate order is declined.
The store is not directed to children. A person who cannot legally enter the purchase contract should order only with a parent or guardian. We use access controls, encryption in transit, restricted administration, signed payment webhooks, and other proportionate safeguards, but no online system is risk-free.
8. Changes and contact
Material changes will be reflected by a new effective date and, where required, a prominent notice or renewed consent. Privacy questions and rights requests: info@pigmentia.co.