Privacy policy

Lacquer Memorial / Angkor Artwork

Last Updated: January 10, 2026

1. Introduction

ANGKOR ARTWORK (Registration No. 50003135, TIN: E116-1500003506) takes the protection of your personal data seriously. This Privacy Policy describes what data we collect, how we use it, and what rights you have.

Data Controller:
ANGKOR ARTWORK
Siem Reap, Cambodia
Email: privacy@lacquermemorial.com

2. What Data We Collect

2.1 Data You Provide

When placing an order:

  • First and last name
  • Email address
  • Shipping address
  • Phone number (optional)
  • Payment information (processed by PayWay payment system; we do not store card details)

When personalizing a product:

  • Engraving text (names, dates, dedications)

When contacting customer support:

  • Content of your message
  • Files you send (photos, documents)

2.2 Data Collected Automatically

Technical data:

  • IP address
  • Browser type and device
  • Pages you visit on the site
  • Time and date of visit
  • Referral source (where you came from)

Cookies:
We use cookies for:

  • Shopping cart functionality
  • Remembering your preferences
  • Website traffic analysis
  • Improving user experience

3. Legal Bases for Data Processing (GDPR Article 6)

We process your personal data on the following legal bases:

3.1 Performance of Contract (Article 6(1)(b))

Purpose: Processing and fulfilling your order
Data: Name, email, shipping address, phone, engraving text, order data
Retention period: 2 years from order completion

3.2 Legitimate Interests (Article 6(1)(f))

Purpose: Service improvement, website usage analysis, fraud prevention, protection of our rights
Data: IP address, technical data, order history, correspondence
Retention period: 12-24 months
Balance of interests: Your rights are protected by the right to object (see section 5.6)

3.3 Consent (Article 6(1)(a))

Purpose: Marketing communications, analytical cookies, personalized advertising
Data: Email, interaction history
Retention period: Until withdrawal of consent or 2 years of inactivity
Withdrawal of consent: Click "Unsubscribe" in the email or write to privacy@lacquermemorial.com

3.4 Legal Obligations (Article 6(1)(c))

Purpose: Tax reporting, financial accounting, response to official requests
Data: Order data, payment data, tax information
Retention period: 7 years (Cambodia tax law requirement)

4. How We Use Your Data

4.1 Order Processing

  • Confirming and fulfilling your order
  • Processing payments
  • Shipping goods to the specified address
  • Communicating with you regarding your order
  • Sending design proof for approval (personalized products)

4.2 Service Improvement

  • Analyzing website usage
  • Improving functionality and design
  • Understanding customer needs
  • Developing new products
  • Fraud prevention

4.3 Marketing (with your consent only)

  • Newsletters about new products
  • Special offers
  • Company news

Important: You can unsubscribe from mailings at any time by clicking "Unsubscribe" in the email or contacting us at privacy@lacquermemorial.com.

4.4 Legal Obligations

  • Compliance with tax legislation
  • Response to official government requests
  • Protection of our rights and interests

5. Data Retention Period

5.1 Order Data

We store information about your orders for 2 years from order completion for:

  • Tax reporting
  • Warranty obligations
  • Simplifying repeat purchases

Exception: Minimum data for tax reporting (name, order amount, date) may be stored for up to 7 years in accordance with tax legislation requirements.

5.2 Marketing Data

If you have subscribed to our mailing list, we store your email until:

  • You unsubscribe from the mailing list, OR
  • 2 years pass without activity (orders or opening emails)

5.3 Technical Information

  • Website visit logs are stored for 12 months
  • Cookies are stored in your browser according to settings (typically up to 2 years)

6. Your Rights (GDPR Articles 15-22, 77)

6.1 Right of Access (Article 15)

You may request a copy of all your personal data we store, including:

  • What data we process
  • Purposes of processing
  • Categories of data recipients
  • Retention period
  • Source of data (if we did not obtain it from you)

6.2 Right to Rectification (Article 16)

You may request correction of inaccurate or incomplete data.

6.3 Right to Erasure / "Right to be Forgotten" (Article 17)

You may request deletion of your personal data. We will delete it within 30 days, except for data that must be retained by law (tax reporting).

How to delete data:
Send a request to: privacy@lacquermemorial.com with subject "Data Deletion Request"

What we will delete:

  • Completely: Email, shipping address, phone, correspondence, marketing data, technical logs
  • Anonymize: Order data for tax reporting (remove name/email, keep only amount and date)

6.4 Right to Restriction of Processing (Article 18)

You may request restriction of processing of your data in the following cases:

  • You contest the accuracy of the data
  • Processing is unlawful, but you do not want the data deleted
  • Data is no longer needed by us but is needed by you for legal purposes
  • You have objected to processing, and we are verifying the legitimacy

6.5 Right to Data Portability (Article 20)

You may request your data in a machine-readable format (CSV, JSON) for transfer to another service.

What is included:

  • Order history
  • Shipping addresses
  • Personalizations
  • Correspondence history

6.6 Right to Object (Article 21)

You may object to processing of your data in the following cases:

  • Marketing: You may opt out at any time (click "Unsubscribe" in the email)
  • Legitimate interests: You may object, and we will cease processing unless we demonstrate legitimate grounds
  • Profiling: You may object to automated processing (see section 6.7)

6.7 Right Not to be Subject to Automated Decision-Making (Article 22)

Important statement: We DO NOT useautomated decision-making (including profiling) that produces legal effects or similarly significantly affects you.

What we DO NOT do:

  • ❌ Automatic order rejection
  • ❌ Automatic price changes based on profile
  • ❌ Automatic credit scoring
  • ❌ Automatic creditworthiness determination

What we use (not covered by Article 22):

  • ✅ Basic web analytics (Google Analytics) for website improvement
  • ✅ Basic product recommendations (do not affect prices)
  • ✅ Automatic spam filtering in email

All decisions about your order are made by a human (our staff members).

6.8 Right to Lodge a Complaint with a Supervisory Authority (Article 77)

If you believe we have violated your data protection rights, you may lodge a complaint with a data protection supervisory authority:

For EU citizens:
You may contact the supervisory authority in your country:

  • List of EU authorities: https://edpb.europa.eu/about-edpb/board/members_en
  • For example, for France: CNIL (https://www.cnil.fr)
  • For Germany: BfDI (https://www.bfdi.bund.de)

For other jurisdictions:
Contact us directly, and we will do our best to resolve the issue.

Our contact: privacy@lacquermemorial.com

7. Transfer of Data to Third Parties

We DO NOT sell your personal data to third parties.

We transfer data only to the following partners for service provision:

7.1 Payment System

PayWay (ABA Bank) — payment processor (Data Processor)

  • They process your card data
  • We do not have access to full card details
  • PayWay complies with PCI DSS Level 1standard
  • Location: Cambodia
  • Legal basis: Performance of contract (Article 6(1)(b))

More about PayWay security:

  • PCI DSS certification: https://www.payway.com.kh/security
  • Privacy policy: https://www.payway.com.kh/privacy

7.2 Delivery Services

Courier services receive:

  • Your name
  • Shipping address
  • Phone number (for delivery contact)

Couriers used:

  • Local delivery (Cambodia): Cambodia Post, J&T Express
  • International delivery: DHL, FedEx, EMS

Legal basis: Performance of contract (Article 6(1)(b))

7.3 Shopify (e-commerce platform)

Shopify Inc. — website and hosting platform (Data Processor)

Shopify's role:

  • Website and database hosting
  • Shopping cart and order processing
  • Technical infrastructure
  • Data backup

Data location:

  • Servers: USA, Canada, Europe (Amazon AWS, Google Cloud)
  • Shopify has certifications: ISO 27001, SOC 2 Type II, PCI DSS Level 1

Legal basis: Performance of contract (Article 6(1)(b))

Data Processing Agreement (DPA):

  • Shopify acts as Data Processor pursuant to GDPR Article 28
  • Full text of DPA: https://www.shopify.com/legal/dpa
  • Shopify enters into an agreement with us including Standard Contractual Clauses (SCCs)

More about Shopify and GDPR:

  • GDPR FAQ: https://www.shopify.com/legal/gdpr
  • Privacy policy: https://www.shopify.com/legal/privacy
  • Security: https://www.shopify.com/security

7.4 Government Authorities

Only upon official request:

  • Cambodian tax authorities
  • Law enforcement agencies (with legal grounds)

Legal basis: Legal obligations (Article 6(1)(c))

8. International Data Transfers (GDPR Chapter V, Articles 44-50)

Our servers are located on the Shopify platform, which may store data in various jurisdictions (USA, Canada, EU).

8.1 Safeguards for International Transfers

For data transfers to the USA and other countries outside the EEA, we use:

  1. Standard Contractual Clauses (SCCs) — standard contractual terms approved by the European Commission

    • Shopify enters into SCCs with all EU clients
    • SCCs provide legally binding data protection guarantees
    • Text of SCCs: https://www.shopify.com/legal/dpa (Annex 2)

  2. EU-U.S. Data Privacy Framework (DPF) — if applicable

    • Shopify is certified under DPF: https://www.dataprivacyframework.gov/

  3. Technical and Organizational Measures (TOMs):

    • Encryption of data in transit (TLS 1.3)
    • Encryption of data at rest (AES-256)
    • Access control and authentication
    • Regular security audits

8.2 Your Rights Regarding International Transfers

You have the right to:

  • Obtain a copy of SCCs (request at privacy@lacquermemorial.com)
  • Object to the transfer (but this may make order fulfillment impossible)
  • Obtain information about data protection measures

9. Data Security

We implement technical and organizational measures to protect your data:

9.1 Technical Measures

  • SSL/TLS encryption of all connections to the website (https://)
  • Encryption of data at rest (AES-256)
  • Secure password storage (bcrypt hashing)
  • Regular security system updates
  • Protection against unauthorized access (firewalls, IDS)
  • Data backup (daily)

9.2 Organizational Measures

  • Data access only by authorized staff
  • Two-factor authentication (2FA) for admin accounts
  • Staff training on privacy principles and GDPR
  • Regular security and access policy audits
  • "Least privilege" policy
  • Non-disclosure agreements (NDAs) with all staff

9.3 Limitations

No method of data transmission over the internet is 100% secure. We make every effort but cannot guarantee absolute security.

9.4 Data Breach Notification

In case of a data breach that may affect your rights:

  • We will notify the supervisory authority within 72 hours
  • We will notify you by email within 72 hours if the risk is high
  • We will describe the nature of the breach and remediation measures

10. Cookies and Tracking Technologies

10.1 What are Cookies

Cookies are small files saved in your browser when visiting a website.

10.2 What Cookies We Use

Necessary cookies (cannot be disabled without loss of functionality):

  • User session
  • Shopping cart
  • Website security (CSRF protection)
  • Authentication

Legal basis: Legitimate interests (website functionality)

Functional cookies (with your consent):

  • Language memory
  • Display settings
  • User preferences

Legal basis: Consent (Article 6(1)(a))

Analytical cookies (with your consent):

  • Google Analytics — traffic analysis
  • Understanding user behavior
  • Website improvement

Legal basis: Consent (Article 6(1)(a))

We DO NOT use:

  • ❌ Advertising cookies (Google Ads, Facebook Pixel)
  • ❌ Cross-site tracking
  • ❌ Third-party cookies for selling your data

10.3 Cookie Management

On first visit to the site:
You will see a Cookie Consent Banner requesting cookie consent. You can:

  • Accept all cookies
  • Accept only necessary cookies
  • Customize preferences

At any time you can:

  • Withdraw consent through site settings (Footer → Cookie Settings)
  • Disable cookies in browser settings
  • Delete existing cookies
  • Set warnings when cookies are installed

Note: Disabling necessary cookies will make it impossible to use the shopping cart and place orders.

Cookie duration:

  • Session cookies: deleted when browser is closed
  • Persistent cookies: stored for up to 2 years (or until you delete them)

11. Minors

Our website is not intended for persons under 18 years of age. We do not knowingly collect data from minors without parental consent.

If we learn that we have collected data from a child under 16 years (GDPR) or 18 years (our policy):

  • We will immediately delete this data
  • We will contact parents/guardians (if possible)

If you believe we have received data from a child:
Contact us: privacy@lacquermemorial.com with subject "Underage Data"

12. Changes to Privacy Policy

We may update this Policy to reflect changes in our practices or legislation.

For substantial changes (e.g., new processing purposes, new data recipients):

  • Email notification (if we have your address)
  • Prominent website announcement (banner)
  • Update of "Last Updated" date at top of document
  • Request for renewed consent (if required by law)

For minor changes (corrections, clarifications):

  • Update of document on website
  • Date update

Continued use of the site after changes constitutes acceptance of the new Policy (unless law requires explicit consent).

Archive of previous versions:
You may request previous versions of the Policy: privacy@lacquermemorial.com

13. Privacy Contact Information

If you have questions about how we process your data or wish to exercise your rights, contact us:

Email for privacy requests:
privacy@lacquermemorial.com (priority)
or info@lacquermemorial.com

Email subjects:

  • "Data Access Request" — data access request
  • "Data Deletion Request" — data deletion request
  • "Data Correction Request" — data correction request
  • "Data Portability Request" — data portability request
  • "Withdraw Consent" — withdrawal of consent
  • "Privacy Question" — general privacy question
  • "GDPR Complaint" — GDPR violation complaint

Legal address:
ANGKOR ARTWORK
Registration No. 50003135
TIN: E116-1500003506
Siem Reap, Cambodia

Response time:

  • Standard requests: within 30 days
  • Complex requests: up to 60 days (with notification of extension)
  • Urgent requests (data breach): within 72 hours

Free of charge: All requests are processed free of charge, except for manifestly unfounded or excessive requests.

14. Applicable Law

This Privacy Policy is governed by the laws of the Kingdom of Cambodia.

For customers from the European Union:
We comply with the requirements of GDPR(Regulation (EU) 2016/679) in full, providing you with all rights described in section 6.

For customers from other jurisdictions:
We strive to comply with international data protection best practices, including:

  • CCPA (California Consumer Privacy Act) — for customers from California, USA
  • PIPEDA (Personal Information Protection and Electronic Documents Act) — for customers from Canada
  • Privacy Act 1988 — for customers from Australia

Dispute resolution:

  • Pre-litigation settlement: negotiations with us (privacy@lacquermemorial.com)
  • Mediation: through independent mediator (by agreement)
  • Litigation: courts of Cambodia or your jurisdiction (for EU customers)
  • EU law: EU customers may apply to courts in their country

15. Transparency and Accountability

15.1 Our Approach to Privacy

We respect your privacy and strive for transparency in data processing.

GDPR principles we follow:

  • Lawfulness, fairness, transparency — we clearly explain what we do with data
  • Purpose limitation — we use data only for stated purposes
  • Data minimization — we collect only necessary data
  • Accuracy — we strive to keep data up to date
  • Storage limitation — we delete data when no longer needed
  • Integrity and confidentiality — we protect data with technical and organizational measures
  • Accountability — we can demonstrate GDPR compliance

15.2 Compliance Documentation

We maintain the following documentation (available upon request by supervisory authorities):

  • Record of Processing Activities (Article 30)
  • Data Protection Impact Assessments (DPIA) — for high-risk processing
  • Data Processing Agreements (DPAs)
  • Data subject request log
  • Data breach log

15.3 Regular Audits

We conduct annual GDPR compliance audits, including:

  • Review of legal bases for processing
  • Review of data retention periods
  • Review of security measures
  • Review of processor agreements

16. Additional Information

16.1 Data for Personalized Products

Special attention: Engraving text (names, dates, dedications) is sensitive personal data.

We commit to:

  • Not disclosing engraving content to third parties (except engraving craftsmen)
  • Deleting engraving text from the system 2 years after order
  • Providing you full control through proof approval (design proof)

16.2 Email Communications

Transactional emails (do not require consent):

  • Order confirmation
  • Proof approval (design proof for approval)
  • Delivery status
  • Responses to your requests

Marketing emails (require consent):

  • News about new products
  • Special offers
  • Product feedback

Unsubscribe: All marketing emails contain an "Unsubscribe" link in the footer.

16.3 Data Processing for Fraud Prevention

We may use your data (IP address, order history, payment information) to:

  • Prevent fraudulent transactions
  • Protect against chargebacks
  • Identify suspicious activity

Legal basis: Legitimate interests (Article 6(1)(f)) — protection of company's financial interests and other customers

17. European Online Dispute Resolution Platform (ODR)

For EU customers:
The European Commission provides a platform for online dispute resolution:
https://ec.europa.eu/consumers/odr

You can use this platform to file complaints related to online purchases.

Our email for ODR:privacy@lacquermemorial.com or info@lacquermemorial.com

18. Conclusion

Your trust is our priority.

We are a small company creating handcrafted memorial products. We understand the sensitivity of the data you share with us (names of loved ones, memorial dates), and we treat it with utmost respect.

If you have any questions or concerns:
Do not hesitate to contact us: privacy@lacquermemorial.com

We are always ready to explain our practices, answer questions, and help you exercise your rights.

This Privacy Policy is effective from January 10, 2026 and applies to all data collected through lacquermemorial.com

Version: 2.0 (GDPR-Enhanced)
Last Updated: January 10, 2026
Next Scheduled Review: January 10, 2027