Privacy Policy

Effective from 22 September 2026 (first published 11 September 2026). This notice replaces the privacy policy of 1 January 2014.

1. Who we are

The controller of your personal data is CO2Art Technologies Limited, a company registered in Ireland under company number 658258, registered office Suite 2, Cathedral Buildings, Middle Street, Galway, H91 ERD1, Ireland, VAT number IE3647876IH. You can reach us at support@co2art.eu or by post at the address above.

This notice covers the online store at www.co2art.eu and its language versions on our own domains (for example de.co2art.eu, www.co2art.pl, www.co2art.fr), our customer accounts, our e-mails and our customer support. Our trade (B2B) store and our US store have their own notices.

2. What we collect and why

We only collect what we need to sell you our products, keep you informed and run the store. The legal bases under the GDPR are given in brackets.

Orders and delivery — your name, delivery and billing address, e-mail address, phone number, what you bought and how you paid. We need this to fulfil your order, deliver it, issue invoices and handle returns and warranty claims (performance of a contract; legal obligations such as tax and accounting law).
Your customer account — your e-mail address, name, addresses and order history. Sign-in is handled by Shopify with a one-time code sent to your e-mail, or with Google, Facebook or Shop if you choose so; we never see a password. If you sign in with Google or Facebook, we receive only your name and e-mail address from them (performance of a contract).
Customer support — the messages you send us by e-mail, chat or the contact form, and the details needed to answer them, such as your order number and photos of a product (performance of a contract; our legitimate interest in answering you well).
Newsletter and offers — your e-mail address and, where you tell us, the topics you are interested in. We send these only with your consent, which you can withdraw at any time with the link in every e-mail (consent).
Reviews — the name and review text you submit, together with your order, so that we can show verified reviews (consent; performance of a contract).
Purchase and review notifications on our website — to show visitors that the store is active, co2art.eu displays short notices about recent orders and recent product reviews, for example "Anna in Berlin, Germany bought a Pro-SE Regulator · 3 days ago". A purchase notice shows the buyer's first name, the town and country of the delivery address, the product and how long ago the order was placed; a review notice shows the reviewer's name as published with the review, the country, the rating and the product. We never show surnames, e-mail addresses, order numbers, prices, street addresses or review texts. A notice is generated automatically from orders and reviews of the last 14 days and removed automatically after that (our legitimate interest in presenting our store's activity). You can ask us at any time to leave your purchase or review out of these notices: write to support@co2art.eu with your order number or the e-mail address of your order and we remove it without delay, usually within the hour, and never show it again.
Website use — technical data such as your IP address, browser, the pages you visit and, if you accept them, analytics and advertising cookies (our legitimate interest in a working and secure website; consent for analytics and advertising cookies). We also count visits without cookies, as described in section 5 (our legitimate interest in knowing how many people visit the store).
Fraud prevention and security — the data around an order and a payment that Shopify and our payment providers use to detect fraud (legitimate interest; legal obligations).

3. Who we share it with

We share personal data only with providers that help us run the store, and only for those purposes. They act on our instructions, except where they are independent controllers (payment providers, carriers and the social sign-in providers you choose).

Shopify (Shopify International Limited, Ireland, and Shopify Inc., Canada) hosts the store, the checkout, the customer accounts and the order data, and provides Shopify Payments, Shop Pay, Apple Pay and Google Pay. Shopify's own privacy policy applies to the checkout and to payments.
Payment providers shown at checkout process your payment. We never receive your full card number.
Carriers such as FedEx and UPS receive your name, address, phone number and e-mail address to deliver your parcel and to send delivery notifications. For deliveries outside the European Union, customs authorities receive the data required by law.
Our own order and customer systems, operated by us, hold order, delivery, warranty and support records so that our team can serve you across the store, the warehouse and customer service.
Customer support tools — Re:amaze (chat and help desk). Part of our chat and e-mail support is answered by an AI assistant that we operate; to draft an answer it may process the content of your message with an AI service provider, Anthropic, under the EU Standard Contractual Clauses. A person from our team can always take over, and your message is never used to train those models.
E-mail — our newsletters and service e-mails are sent through Amazon Web Services (Amazon SES, Ireland region). Before we send a newsletter we may check that an e-mail address can receive mail through Bouncer, an e-mail verification service based in the European Union. Our sign-up forms, including the prize wheel, are our own.
Sign-in — Oxi Social Login (Oxi Apps) provides the sign-in window of our store: it receives the e-mail address you enter, sends you the one-time code and signs you in to your customer account, and it sets the sign-in cookies listed in section 5. If you choose to sign in with Google, Facebook, Apple or X (Twitter) instead, that provider confirms your name and e-mail address to it and acts as an independent controller under its own privacy policy.
Reviews — Stamped collects and displays product reviews and sends review requests on our behalf.
Order tracking — our "Track order" page looks up your order by its number and your e-mail address in our own order system and shows the carrier's tracking status.
Affiliate programme — GoAffPro records that you arrived through an affiliate's link so that the affiliate can be paid a commission; it does not receive your name or address.
Cloudflare (Cloudflare, Inc., United States) delivers and protects our website (content delivery and security), counts visits without cookies (Cloudflare Web Analytics) and checks that entries to our prize wheel come from a person (Cloudflare Turnstile). It processes technical data such as your IP address, your browser and the pages you request; Web Analytics stores nothing on your device and keeps no identifier (our legitimate interest in a secure, working website and in knowing how many people visit it).
Analytics and advertising — Shopify Analytics, Google Analytics, Google Ads and Meta (Facebook and Instagram) receive usage and conversion data as described in section 5, only after you accept those cookies.
Authorities and advisers where the law requires it, and a buyer of our business if it is sold.

Some of these providers are outside the European Economic Area, mainly in the United States and Canada. Where that is the case we rely on the European Commission's adequacy decisions (Canada; and the EU-US Data Privacy Framework for certified US providers) and on the EU Standard Contractual Clauses.

4. How long we keep it

Orders, invoices and the related correspondence: for as long as tax and accounting law requires, in general 6 years after the end of the year of the order, and for as long as a warranty claim can be made.
Your customer account: until you close it or after 3 years without an order or a sign-in.
Newsletter data: until you withdraw your consent; we then keep only the record that you unsubscribed.
Support conversations: 3 years after the last message, unless they belong to an order or a claim.
Analytics data: according to the retention settings of the tools in section 5, at most 14 months for Google Analytics. Cloudflare Web Analytics keeps only aggregated visit statistics, without any identifier.

5. Cookies and similar technologies

When you first visit the store, a banner lets you accept or decline cookies that are not necessary. Your choice is recorded by Shopify's consent tool and respected by the analytics and advertising tags on the site. You can change it at any time by clearing the cookies of this site in your browser; the banner then appears again.

Counting visits without cookies. To know how many people visit the store, every page uses Cloudflare Web Analytics. It sets no cookie, stores nothing on your device and does not identify you or follow you across other websites, so it does not depend on the banner: it records, in aggregate, the page, the site you came from, your country and your type of browser.

Type	Cookies	Purpose and lifetime
Necessary	_shopify_essential, cart, cart_currency, localization, _shop_app_essential	Your session, your cart, your currency and country, secure checkout; set by Shopify; from the session up to one year.
Preferences	co2art_local_store	Remembers whether you chose a language version of the store or asked to stay on the English one, so that we do not ask again; one year; set only when you answer the language bar.
Preferences	concept:newsletter-popup	Remembers that the newsletter window has been shown; one year.
Analytics (with your consent)	_shopify_y, _shopify_s, _shopify_analytics, _ga, _ga_*	Shopify Analytics and Google Analytics: which pages are visited and how the store is used, in aggregate; up to 13 months.
Advertising (with your consent)	_shopify_marketing, _fbp, _gcl_au	Meta and Google Ads: measuring whether an advertisement led to an order and showing relevant advertisements; up to 90 days.
Third-party (on their own domains)	_lantirn_session, framed, category_id, no_subject, require_attachment, tz_name (reamaze.com); ast, checkout_shop, oxi_referrer, osl_checkout_url, parenturl (oxiapps.com)	Re:amaze, our help desk: keeps the contact form working while you fill it in; session only, set when the contact form loads. Oxi Social Login, our sign-in window: keeps signing in working and returns you to the page you came from; 7 days.

6. Your rights

You have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format and to withdraw a consent at any time without affecting what was done before. You can see and change most of your data yourself in your customer account. For everything else write to support@co2art.eu; we answer within one month. This includes the purchase and review notices described in section 2: one e-mail with your order number or the e-mail address of your order, and your purchase or review is left out of them, usually within the hour.

If you think we have not handled your data correctly you can complain to the Irish Data Protection Commission (www.dataprotection.ie) or to the supervisory authority of the country where you live.

7. Children

Our products and our marketing are meant for adults. We do not knowingly collect personal data from anyone under 16.

8. Security

The store, the checkout and our own systems use encrypted connections, access controls and regular backups. No method of transmission or storage is completely secure, so please keep your sign-in e-mail account safe and tell us at once if you suspect misuse.

9. Changes

We will post any change to this notice on this page with a new effective date. For material changes we will also tell customers with an account by e-mail.

Spin to win!