Privacy policy

This policy explains what personal data Blacksand Lab collects through blacksandlab.com, by email, on social media and at our studio, why we use it, who we share it with, how long we keep it and how you can use your rights. We collect only what we need. We do not sell your data, we do not use advertising trackers and this website sets no cookies (see our Cookie policy).

1. Who is responsible for your data

The controller of your personal data is Bryant Creative Industries, S.L.U. (Sociedad Unipersonal), trading as Blacksand Lab ("Blacksand", "we").

• Address: Carrer de Fray Francisco Cabezas 13, Bajo C, 46019 València, Spain

• NIF: B26574954 · Registro Mercantil de Valencia, Hoja V-231290

• Privacy contact: info@blacksandlab.com (subject "Privacy") · +34 614 412 917

We have not appointed a Data Protection Officer. The law does not require one for a small company like ours, because we do not monitor people on a large scale and do not process sensitive data as our main activity. Write to the privacy contact above about anything in this policy.

2. Requests and quotes

When you send a request through a form on this site, our website provider (Framer) delivers it to our mailbox. We use what you send only to answer you and prepare your quote or proposal.

2.1 Sand Store quote requests

• Data: name, email, phone (optional), location or country, your message, the pieces you selected and the reference code of your request.

• Why: to prepare and send you a written quote and follow it up.

• Legal basis: steps you ask us to take before a contract.

• How long: 24 months after our last contact if no order follows. If you order, as set out in section 3.1.

2.2 Bespoke requests

• Data: name, email, company, your project description, any files or links you add, the designers you shortlisted and the reference code of your request.

• Why: to understand your brief, talk to you about it, work with the designers on it and prepare a design proposal.

• Legal basis: steps you ask us to take before a contract; for business contacts, also our legitimate interest in managing the professional relationship.

• How long: 24 months after our last contact if no project follows (files you attach are kept with your request). If the project goes ahead, as set out in section 3.1.

Sharing your brief with designers. To assess and work on your brief, we share it with the designers you shortlisted, or with another designer you agree to. They are independent members of the Blacksand Collective who work for us as subcontractors under a confidentiality agreement, and they may use your information only for your project. They receive only what they need to assess and work on your brief: usually your project description, files and references and, if they join a conversation with you, your name and company. Some designers are based outside the European Economic Area (EEA); section 8 explains how that transfer is protected.

Files you attach. Files you add to the Bespoke form are uploaded to our private file storage (Supabase, in the EU) as soon as you add them, before you press send. They are not public: we receive a private link to them that expires after 30 days. Please only add files you are happy to share with us.

2.3 Production requests

• Data: your contact details (name, email, company and phone if you give it), your 3D files (for example STL or OBJ), drawings, specifications and messages.

• Why: to check that your files can be printed, prepare a quote and, if you order, produce your pieces.

• Legal basis: steps you ask us to take before a contract; performing our contract with you.

• How long: request details: 24 months after our last contact if no order follows. Your files: 24 months after your last order, so that you can re-order, and then we delete them. Tell us if you want them deleted sooner and we will delete them, except any copy we need to deal with a claim or a safety issue or to meet a legal obligation (section 38 of our Service terms).

We use your files only to produce your order. We share them only with our production partners, under confidentiality, and never publish them without your consent. See our Service terms.

2.4 Trade pricing and trade requests

The trade question on our site ("Are you a trade professional?") only takes you to the right page. It asks for no personal data.

• Data: name, company or studio, email, phone (optional), country, your notes, the pieces you selected, what you want us to include (spec sheets, lead times, samples, volume pricing) and the reference code of your request. We may also check public information about your business (for example its website or VAT number) to confirm that you are a trade professional.

• Why: to confirm your trade status, send you trade prices and documents and manage our business relationship.

• Legal basis: steps you ask us to take before a contract; our legitimate interest in managing professional relationships and in offering trade prices only to professionals.

• How long: 24 months after our last contact if no order follows. For trade customers, the business relationship and 6 years after it (Commercial Code).

2.5 Sample pack requests

• Data: name, email, phone, delivery address and, for businesses, company name and VAT number.

• Why: to send you the sample pack you order, invoice it and deliver it.

• Legal basis: performing our contract with you; our legal obligations (invoices and tax).

• How long: as for orders (section 3.1).

3. Orders, payments and after-sales

3.1 Orders, invoices, deliveries and payments

• Data: name, email, phone, billing and delivery address, company name and VAT number (businesses), the pieces or services you ordered and their options, prices, payments, delivery details and, outside the EU, customs information. If you pay by bank transfer, we see the payer's name and the bank details shown on the transfer. If you pay by card, our payment provider handles your card details and we never see them.

• Why: to make and perform the contract, produce and deliver your order, take payment, issue invoices, keep our accounts and handle the legal guarantee.

• Legal basis: performing our contract with you; our legal obligations (accounting, tax, customs, consumer law and product safety law).

• How long: invoices and accounting records: 6 years from the end of the financial year (Commercial Code, art. 30), longer if tax law requires. Order and guarantee records: until the 3-year legal guarantee and the 5-year period to bring a claim have passed (up to 8 years after delivery); this record is also how we can reach you about a safety notice or recall. Product traceability records (model, serial or batch number, production records and technical documentation) are kept for 10 years, but they identify the piece, not you.

Card payments. If you pay by card, including through our online checkout once it is available, Stripe processes the payment. Stripe also acts as an independent controller for fraud prevention and legal compliance (for example anti-money laundering checks), under its own privacy policy. Stripe screens payments automatically to prevent fraud and may decline a payment. If that happens, contact us and we will find another way for you to pay.

Delivery. We share your name, delivery address, phone and email with the shipping platform, carrier or freight forwarder that delivers your order and, for deliveries outside the EU, the customs information needed with customs agents and authorities.

3.2 Withdrawals, guarantee claims and safety reports

Anyone can send us a safety report, not only customers.

• Data: name, contact details, order details, what happened, photos or videos you send, our correspondence and, for withdrawals, your statement and the date and time we received it. A safety report may include information about an injury.

• Why: to receive and acknowledge withdrawals, deal with guarantee claims, investigate safety reports, take corrective action and, where the law requires, inform the authorities.

• Legal basis: our legal obligations under consumer law and EU product safety law; our legitimate interest in defending claims. We use any information about an injury only for these purposes (Article 9(2)(i) and (f) GDPR: public health in product safety, and legal claims).

• How long: withdrawals, guarantee claims and safety reports are kept with the order record (section 3.1). Personal data in our register of product safety complaints is kept for no longer than 5 years from when it is entered, unless we need it longer to deal with a claim.

Resellers. Shops and other resellers that sell our pieces keep their own records of who bought from them, as controllers of that data under their own privacy policies. We receive a buyer's details from a reseller only if they are needed for a safety notice or a recall.

3.3 Complaints

• Data: name, contact details, order details, your complaint, our reply and its reference number, and the details on an official complaint form (hoja de reclamaciones) if you use one.

• Why: to answer your complaint within 15 days and keep a record of it.

• Legal basis: our legal obligations under consumer law; our legitimate interest in defending claims.

• How long: until the complaint is closed, then blocked for as long as a claim could be brought (generally 5 years).

4. Emails, business contacts and social media

4.1 Email correspondence

• Data: your email address, name, the content of your messages and any attachments.

• Why: to answer you and keep track of our conversations.

• Legal basis: depending on what you write about: steps you ask us to take before a contract, performing a contract, or our legitimate interest in answering messages.

• How long: emails about an order, a project or a business relationship are kept with those records (business correspondence: 6 years, Commercial Code). Other emails: 12 months after our last contact.

4.2 Business contacts and introductions

We introduce Blacksand to architects, interior designers, studios, retailers and other professionals who may need our pieces or services.

• Data: name, role, company, professional email and phone, website or social media profile, and notes of our contacts. We take these details from public professional sources (such as a studio's website or Instagram profile), from events or from introductions.

• Why: to introduce our pieces and services to professionals and keep in touch with business contacts.

• Legal basis: our legitimate interest in developing business relationships, using professional contact details only for that purpose.

• How long: 24 months after our last contact if no business relationship follows. If you ask us not to contact you again, we keep only your email address on a do-not-contact list, so that we can respect your request.

We do not add business contacts to newsletters or promotional mailings without their consent, as Spanish law on electronic commercial communications (LSSI, art. 21) requires. Our introductions are individual messages: each one says who we are and links to this policy, and you can ask us to stop at any time with a simple reply. We then stop.

4.3 Social media

We have pages on Instagram and LinkedIn. This site links to them but does not embed them.

• Data: your public profile, your interactions with our pages and the messages you send us there.

• Why: to communicate with people who follow or contact us and to see how our pages perform.

• Legal basis: our legitimate interest in communicating through social media.

• How long: messages are kept like emails (section 4.1). The platforms keep their data under their own policies.

For page statistics, Meta (Instagram) and LinkedIn are joint controllers with us, under their own terms (Meta, LinkedIn). They are responsible for answering requests about the data they hold. Each platform also processes your data under its own privacy policy.

4.4 Newsletter

We do not send a newsletter at the moment. If we start one, we will only send it to you with your consent, given in a separate, unticked box and confirmed by email, and every email will include a link to unsubscribe. If you are a customer, we may instead email you about pieces similar to ones you bought; you can opt out when we collect your email and in every message.

5. Our website

5.1 Visitor statistics without cookies

We measure how our website is used with our own simple visitor counter. For each page view, and for clicks on the links and buttons we have tagged, it records:

• the page, the time and the type of event (a page view or a tagged click);

• the type of device (phone, tablet or computer, worked out from the screen size) and your browser's language;

• on the first page of a visit only: the website that sent you (its domain), any campaign tags in the link and whether you came from an AI assistant;

• for tagged clicks: which designer or product was clicked, or the website domain or email address the link points to;

• for our request forms: only that a form was started or sent, never what you typed.

It does not use cookies, does not store anything on your device and gives you no identifier. It does not record your IP address, your full browser details or your location, so we cannot recognise you or follow you across visits or websites. Supabase stores the records for us in the EU (Ireland). Supabase's servers see your IP address to receive each record, as any web server does, and keep it in their logs for 7 days; it never reaches our statistics. We keep the individual records for 25 months, then only anonymous daily totals. We never combine them with your requests, orders or emails, and we use them only to understand and improve the site.

Our website provider, Framer, also gives us aggregated statistics without cookies. Framer converts your IP address and browser information into a code that changes every day, so it cannot recognise you on later days.

• Legal basis: our legitimate interest in knowing which pages, pieces and designers interest our visitors, so we can improve the site. This measurement follows the conditions the Spanish data protection authority (AEPD) sets for audience measurement without consent.

• Your choice: because these records contain nothing that identifies you, we cannot find or delete your own visits. If you prefer not to be counted, a content blocker or your browser's tracking protection will stop the counter.

5.2 Running the website

• Data: your IP address, the date and time, the page or file requested, your browser and the referring page (standard server logs).

• Why: to deliver the website to your browser, keep it secure and fix problems.

• Legal basis: our legitimate interest in running a secure, working website.

• How long: for the limited period set by each provider (for example, 7 days for Supabase's logs).

To show you the site, your browser connects to Framer, which hosts the site and its images and files; to Google Fonts, which delivers the typeface; and to jsDelivr, a public network that delivers the animation library used by the Sand Store map. Each of them receives your IP address, as any web server does. None of them sets cookies on this site.

5.3 Data stored only on your device

Some features save information in your own browser (local storage) so they keep working as you move around the site: your shortlist of designers (Bespoke), the pieces you select (Sand Store and trade pricing) and the reference code of a request you have sent. This information stays on your device and only reaches us when you send a request. See our Cookie policy.

6. Designers of the Blacksand Collective

This section is for the designers who work with us and for people who apply to join the Collective.

• Data: name, contact details, address, portfolio, biography, photos, your portrait, social media links, the designs you license to us, our agreement and the bank and tax details we need to pay you.

• Why: to assess applications, manage our agreement, credit you as the designer of your pieces, present you and your work on our website, social media, catalogues and press materials, and pay you.

• Legal basis: performing our agreement with you (or, when you apply, steps you ask us to take before it); our legal obligations (accounting and tax); your consent for your portrait made with AI tools.

• How long: for the duration of our agreement and 6 years after it ends, or longer if tax law requires. Applications that do not lead to an agreement: 12 months after our decision.

Your portrait. With your consent, we create a portrait of you from your own photos using AI tools. We use it only to present you as a member of the Collective. You can withdraw your consent at any time; we then stop using the portrait from that moment, although we cannot recall material already printed or published by others.

Your public profile. Your name, portrait, biography and the pieces you designed are shown on our website and may appear on our social media, in catalogues and in press materials. When our agreement ends, we remove your profile within a reasonable time, but your name may stay as the credit on pieces already sold and in our records.

7. Who we share your data with

We share only what each recipient needs. Our service providers act on our instructions, under contracts that oblige them to protect your data.

• Framer B.V. (Amsterdam, Netherlands) · What they do: Hosts this website, delivers your form requests to our mailbox and provides cookie-free statistics · Where: EU company; servers on Amazon Web Services, including in the United States

• Fastmail Pty Ltd · What they do: Our email (info@blacksandlab.com), including the requests you send through our forms · Where: Australia (company); servers in the United States

• Supabase Pte. Ltd. · What they do: Database for our visitor statistics and for the withdrawal statements sent through our online form, and private storage for the files you attach to a Bespoke request · Where: Database and file storage in the EU (Ireland); company in Singapore

• Google (Google Fonts) · What they do: Delivers the typeface used on this site · Where: Global network, including the United States

• jsDelivr · What they do: Delivers the animation library used by the Sand Store map · Where: Global network

• Stripe (Stripe Payments Europe, Limited, Ireland) · What they do: Card payments, including our online checkout once available. Also an independent controller for fraud prevention and legal compliance · Where: EU and United States

• Our bank · What they do: Receives your bank transfers · Where: EU

• Designers of the Blacksand Collective · What they do: Assess and work on Bespoke briefs as our subcontractors, under confidentiality · Where: Spain, other EU countries and outside the EEA

• Our production partners · What they do: Produce the pieces. They receive only files and technical details, not your contact details · Where: Inside or outside the EU

• Shipping platforms, carriers and freight forwarders · What they do: Deliver your order. Carriers act as independent controllers for the delivery · Where: Spain and the destination country

• Providers of AI image tools · What they do: Help us create and edit images, including designer portraits made from the designers' own photos with their consent · Where: May be outside the EEA, including the United States

• Our IT and software providers · What they do: Store our files and records (for example cloud storage, office and accounting software) · Where: EU and other countries (see section 8)

• Our accountant, lawyers and insurers · What they do: Accounting, tax, legal advice and claims · Where: Spain

• Meta and LinkedIn · What they do: Joint controllers for the statistics of our social media pages · Where: EU (Ireland) and other countries

• Public authorities, consumer bodies and courts · What they do: Tax, customs, consumer and product safety authorities, arbitration bodies and courts, when the law requires it or you take a matter to them · Where: Spain and the destination country

We do not sell your data or share it for anyone else's marketing.

8. Transfers outside the European Economic Area

Some recipients are based, or process data, outside the EEA. We only use them with the safeguards EU law requires:

• United States (Framer's servers, Fastmail, Stripe, Google, AI image tools): the European Commission's adequacy decision for the EU-US Data Privacy Framework, where the provider is certified under it, and otherwise the European Commission's Standard Contractual Clauses in the provider's data processing terms.

• Australia (Fastmail) and Singapore (Supabase; our database and file storage are in Ireland): the Standard Contractual Clauses in their data processing agreements.

• Designers outside the EEA: where a designer works from a country without an adequacy decision, we rely on the Standard Contractual Clauses where they are part of our agreement with that designer. Otherwise, the transfer takes place only because it is necessary for the steps you asked us to take before a contract (Article 49(1)(b) GDPR). Either way, the designer receives only what is needed for your brief.

• Deliveries outside the EU: your delivery and customs data go to the carrier and the authorities of the destination country because this is necessary to deliver the order you asked for (Article 49(1)(b) GDPR).

• Fonts and scripts: when your browser downloads files from Google Fonts or jsDelivr, the request may be answered by a server outside the EEA. These services receive only the technical data any web server receives.

You can ask us for a copy of the safeguards at the privacy contact in section 1.

9. How long we keep your data

We keep data only as long as we need it for the purpose we collected it for. After that, we keep it only as long as the law requires or allows, to deal with possible claims. During that second period the data is blocked: we keep it securely and use it only if a claim, an authority or the law requires it. The main periods are:

• requests and quotes with no order: 24 months after our last contact; other emails: 12 months;

• invoices and accounting records: 6 years from the end of the financial year (Commercial Code, art. 30), longer if tax law requires;

• order and guarantee records, including withdrawals, guarantee claims and safety reports: up to 8 years after delivery;

• personal data in our register of product safety complaints: no longer than 5 years from when it is entered, unless needed longer for a claim;

• Production files: 24 months after your last order, then deleted (sooner if you ask);

• product traceability records (model, serial or batch number and technical documentation, which identify the piece, not you): 10 years;

• trade customers and business correspondence: the business relationship and 6 years after it;

• business contacts with no relationship: 24 months after our last contact;

• designers: the agreement and 6 years after it ends (longer if tax law requires); applications that do not lead to an agreement: 12 months;

• visitor statistics: individual records for 25 months, then only anonymous daily totals; providers' server logs: a few days (7 days for Supabase);

• requests about your data protection rights: 3 years.

10. Required data and automated decisions

To answer a request we need your name and email address. To make a contract and deliver, we also need your billing and delivery details and, for businesses, your company and VAT details. Everything else is optional. If you do not give us the data we need, we cannot answer your request or complete your order.

We do not make decisions about you by automated means and we do not build profiles of you. The only automated check is Stripe's fraud screening of card payments (section 3.1).

11. Your rights

You can, at any time and free of charge:

• access your data and get a copy;

• correct it if it is wrong or incomplete;

• ask us to delete it;

• ask us to restrict how we use it;

• object to our use of it based on our legitimate interest, and object to any marketing at any time;

• receive the data you gave us in a structured, machine-readable format (portability);

• withdraw your consent where we rely on it, without affecting what we did before.

To use your rights, email info@blacksandlab.com or write to the address in section 1. We reply within one month. For complex requests this can be extended by two more months, and we will tell you why. We only ask for proof of identity if we have reasonable doubts about who is asking.

If you are not happy with our answer, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (C/ Jorge Juan 6, 28001 Madrid, www.aepd.es), or to the data protection authority of the EU country where you live.

12. Children

You must be 14 or over to send us a request or contact us, and 18 or over to place an order. We do not knowingly collect data from children under 14. If we learn that we have, we delete it.

13. Security

We protect your data with measures appropriate to the risk. The site is served only over encrypted connections (HTTPS). Card payments are handled entirely by Stripe, which is certified to the PCI DSS standard. Your selections stay on your own device until you send a request. Access to our accounts with our providers is protected and limited to the people who need it. If a personal data breach puts your rights at risk, we notify the Spanish data protection authority within 72 hours and, where the risk is high, we tell you directly.

14. Changes to this policy

If we change how we use personal data, we update this page and its date and keep the previous versions. If a change matters to you, for example a new purpose, we tell you before it applies.