Privacy statement
Version 1.1, 28 October 2026
Introduction
This privacy statement explains how Lost n Found processes personal data when you visit this website, place an order, buy a ticket or send us a message.
Who is responsible
Lost n Found (LNF), e-mail lnf.curation@gmail.com. Our full company details are on our Legal page.
Which data we process, why, on what basis and for how long
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name and e-mail address | Processing your order, sending your order confirmation, tickets and receipt | Contract | 7 years, with the order (tax law) |
| Delivery address (clothing and artworks) | Shipping your order | Contract | Only until the parcel is handed to the delivery service |
| Order details: order number, items, sizes, quantities, prices | Processing your order, returns, guarantee claims, bookkeeping | Contract and legal obligation | 7 years (tax law) |
| Ticket details: order and ticket numbers, number of tickets | Sending your tickets and checking them at the entrance (door list) | Contract | Door list deleted after the event; order records 7 years (tax law) |
| Payment reference: payment method, status, refunds | Matching payments to orders, refunds, bookkeeping | Contract and legal obligation | 7 years (tax law) |
| Withdrawal notifications | Handling your withdrawal, recording the date and time of receipt | Legal obligation | 7 years (tax law) |
| Drawings you send us from the spray can, with the name and Instagram handle you add (both optional) | Looking at your drawing; showing it on our website or social media, crediting you if you add your name or handle | Consent | Until you ask us to delete it |
| Messages to us, including Join us applications | Answering your questions and complaints; for applications, considering working together | Legitimate interest | 2 years after the last message |
| Technical data, such as your IP address | Protecting the website against attacks and misuse | Legitimate interest | Processed by Cloudflare; we do not keep these data ourselves |
To order clothing or artworks, you give your name, e-mail address and delivery address; for event tickets, your name and e-mail address. Without them, we cannot deliver your order.
E-mails
We send e-mails only about your order: order confirmation, tickets and receipt, payment status, shipping confirmation, refunds and withdrawal confirmations. We do not send newsletters or marketing e-mails.
Who receives your data
We share personal data only with these service providers, and only as far as needed for their service. We do not sell personal data.
- Mollie B.V.: payment processing. You enter your payment details directly with Mollie, which processes them under its own privacy statement.
- Supabase: storage of order data, on servers in the European Union.
- Resend: sending order and ticket e-mails.
- Cloudflare: website hosting and security.
- Google (Gmail): our customer inbox, where your e-mails to us are kept.
- DHL: receives your name and delivery address to deliver your parcel.
Where a provider processes personal data outside the European Union, the transfer is covered by an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework) or by its standard contractual clauses. We may also share personal data with our accountant and, where the law requires it, with government authorities.
Security
Data is sent over an encrypted connection and stored in systems that are not publicly accessible. We do not store payment details. A data breach affecting your personal data is reported to the Dutch Data Protection Authority and, where required, to you.
Your rights
You have the right to access, correct or delete your personal data, to restrict or object to its processing, and to data portability. We cannot delete data that the law requires us to keep, such as our accounting records.
Send your request to lnf.curation@gmail.com from the e-mail address you used for your order, or state your order number, so we can verify your identity. We handle requests within one month, free of charge.
You may also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.
Other
We do not use automated decision-making or profiling.
Last updated: 28 October 2026. When this statement changes, we update it on this page.