Privacy Policy
This Privacy Policy sets out how The Lighterhouse collects, uses, stores and protects personal data, and explains the rights available to you under Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and the Dutch implementing act, the Uitvoeringswet AVG.
This notice is provided in accordance with Articles 13 and 14 GDPR.
1. Data controller
The Lighterhouse is a trade name of M.A.X. Meijster, a sole proprietorship (eenmanszaak) established in the Netherlands. M.A.X. Meijster is the data controller within the meaning of Article 4(7) GDPR.
M.A.X. Meijster, trading as The Lighterhouse
Oosteinde 248
2611 SW Delft, the Netherlands
Chamber of Commerce (KvK) number: 89207092
VAT identification number: NL004704588B57
Email: contact@thelighterhouse.com
The Lighterhouse is not required to appoint a Data Protection Officer under Article 37 GDPR, and has not done so. All data protection enquiries are handled by the controller directly at the address above.
2. Categories of personal data processed
The Lighterhouse processes the following categories of personal data.
Identity and contact data: name, email address, telephone number, and billing and delivery addresses.
Transaction data: order details, order history, correspondence relating to an order, and the record of payment. Payment card details are not processed by The Lighterhouse and are handled exclusively by the payment service provider identified in section 5.
Data provided when offering a lighter for sale: name, email address, country of residence, the information you provide about the item, and photographs submitted through the sell your lighter form or by email. Where a purchase is concluded, this extends to your address and the signed purchase statement (inkoopverklaring) recording the transaction.
Correspondence: the content of any communication you send to us.
Technical and usage data: IP address, browser and device type, operating system, and information about your use of the website, collected as described in section 4.
Marketing data: your email address, first name and your recorded consent or withdrawal of consent in respect of our newsletter.
3. Purposes and legal bases for processing
Processing is carried out on the following legal bases under Article 6(1) GDPR.
Performance of a contract, or steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR): to process and fulfil orders, arrange shipping and customs formalities, administer returns, assess and correspond about lighters offered to us for sale, and conclude and settle such purchases.
Compliance with a legal obligation (Article 6(1)(c) GDPR): to maintain accounting records and to meet obligations under Dutch tax and customs law, in particular the retention obligation in Article 52 of the Algemene wet inzake rijksbelastingen.
Consent (Article 6(1)(a) GDPR): to send our newsletter and related automated commercial communications, and to place non-essential cookies as described in section 4. Consent may be withdrawn at any time under Article 7(3) GDPR, by using the unsubscribe link contained in every message or by writing to the address in section 1. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Legitimate interests (Article 6(1)(f) GDPR): to maintain and improve the security and functioning of the website, to understand how it is used, and to prevent fraud. The legitimate interests pursued are the proper operation and security of our business. We have assessed that these interests are not overridden by your interests or fundamental rights, given the limited nature of the data concerned.
4. Cookies, analytics and consent
Strictly necessary cookies are placed without consent, as permitted by Article 11.7a of the Dutch Telecommunicatiewet. These cookies maintain your shopping basket and session and cannot be disabled without impairing the functioning of the website.
All other cookies and similar technologies are placed only after your prior, informed and freely given consent, obtained through the consent banner presented on your first visit. Consent may be reviewed or withdrawn at any time through the cookie settings available on the website.
Subject to that consent, the following analytics services are used.
Google Analytics, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Event data is retained for two months and user data for fourteen months, in accordance with the retention settings configured in our account.
Microsoft Clarity, operated by Microsoft Corporation. Clarity records interaction data, including scrolling, clicks and cursor movement, and may generate a session replay of your visit. The service is configured to mask text entered into form fields. Recordings are retained for thirty days.
Neither service is loaded unless analytics cookies have been accepted.
5. Recipients and processors
Personal data is disclosed only where necessary, and only to recipients acting as processors under a data processing agreement concluded pursuant to Article 28(3) GDPR.
Payment processing: Mollie B.V., Amsterdam, the Netherlands. Depending on the payment method selected, Mollie transmits the transaction to the relevant scheme or provider, including card networks, Apple Pay, PayPal or Klarna.
Shipping and fulfilment: Sendcloud B.V., Eindhoven, the Netherlands, and PostNL N.V., the Netherlands. These recipients receive the name, address and telephone number necessary for delivery and, for consignments crossing a customs border, the data required for the customs declaration. Where a return is carried by another carrier, the same applies to that carrier.
Hosting and email: Strato AG, Berlin, Germany.
Email marketing: Mailchimp, operated by Intuit Inc., United States.
Advertising measurement: Google Ireland Limited and Meta Platforms Ireland Limited, as described in our Cookie Policy. These recipients receive data only where marketing cookies have been accepted.
Analytics: as specified in section 4.
Professional advisers: our accountant, and the Dutch tax and customs authorities where disclosure is required by law.
Personal data is not sold, and is not disclosed to any third party for that party’s own marketing purposes.
6. Transfers to third countries
Mollie, Sendcloud, PostNL and Strato process personal data within the European Economic Area.
Processing by Mailchimp and Microsoft Clarity, and in certain circumstances by Google, involves transfer to the United States. Such transfers take place on the basis of the EU-US Data Privacy Framework adequacy decision adopted by the European Commission on 10 July 2023, and, where that decision does not apply, on the basis of the Standard Contractual Clauses adopted by the Commission under Article 46(2)(c) GDPR, together with any supplementary measures required.
7. Retention periods
Personal data is retained no longer than is necessary for the purposes for which it is processed, in accordance with Article 5(1)(e) GDPR.
Orders, invoices and purchase statements: seven years from the end of the relevant financial year, as required by Article 52 of the Algemene wet inzake rijksbelastingen.
Correspondence not resulting in a transaction, including valuations and offers made or declined, together with any photographs submitted: two years from the date of the last communication, after which it is erased.
Newsletter subscription data: until consent is withdrawn, or following two years of inactivity, whichever occurs first.
Analytics data: as stated in section 4.
8. Security measures
Appropriate technical and organisational measures are maintained in accordance with Article 32 GDPR. The website is served exclusively over TLS. Access to order and customer records is restricted to the controller. Payment credentials are held by the payment service provider and are not stored by The Lighterhouse. The number of systems in which personal data is held is deliberately kept to a minimum.
9. Your rights
Subject to the conditions set out in the GDPR, you have the following rights.
- The right of access to your personal data (Article 15).
- The right to rectification of inaccurate or incomplete data (Article 16).
- The right to erasure (Article 17).
- The right to restriction of processing (Article 18).
- The right to data portability (Article 20).
- The right to object to processing carried out on the basis of legitimate interests (Article 21).
- The right to withdraw consent at any time (Article 7(3)).
Requests should be addressed to contact@thelighterhouse.com. A response will be provided without undue delay and in any event within one month of receipt, in accordance with Article 12(3) GDPR. That period may be extended by two further months where necessary, in which case you will be informed within the first month. No fee is charged, save in the circumstances permitted by Article 12(5).
Where a request concerns data we are required to retain under the tax retention obligation referred to in section 7, erasure may not be possible until that period has expired. Processing will be restricted in the interim where Article 18 applies.
10. Right to lodge a complaint
Without prejudice to any other remedy, you have the right under Article 77 GDPR to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement.
The competent supervisory authority for The Lighterhouse is:
Autoriteit Persoonsgegevens
Postbus 93374, 2509 AJ Den Haag, the Netherlands
autoriteitpersoonsgegevens.nl
11. Automated decision-making
No decisions producing legal effects concerning you, or similarly significantly affecting you, are taken on the basis of automated processing, including profiling, within the meaning of Article 22 GDPR.
12. Children
The website is not directed at persons under the age of 18, and personal data is not knowingly collected from children. Where we become aware that such data has been provided, it will be erased.
13. Provision of data
The provision of identity, contact and delivery data is a contractual requirement and is necessary in order to conclude and perform a contract of sale. Where such data is not provided, an order cannot be processed. The provision of marketing data is entirely optional and carries no consequence if withheld.
14. Amendments
This Privacy Policy may be amended from time to time. The current version is published at this address and is identified by the date below. Where an amendment is material, subscribers will be notified directly.
Last updated: 16 September 2026