Privacy policy
Valid as of 15 October 2026
This policy explains what personal data Frankenstein Research collects, why, who else handles it, how long we keep it, and what rights you have. It covers frankensteinresearch.com, our shop, our newsletter and email correspondence with us.
Who is responsible
The data controller is Frankenstein Research ApS, CVR 45471446, Fælledvejens Passage 2, 1., 2200 København N, Denmark. Email: [email protected], phone: +45 20 14 40 46.
What we collect, and why
When you buy something
Name, delivery and billing address, email address, phone number, what you ordered and the payment status. We use this to deliver your order, handle returns, repairs and guarantee claims, and to keep the accounts the law requires. Legal basis: the contract with you (GDPR Article 6(1)(b)) and our legal obligations under the Danish Bookkeeping Act (Article 6(1)(c)).
Card details are entered directly with our payment provider and never reach us. To prevent fraud, the payment provider checks each payment automatically and may block one that looks fraudulent. Legal basis: our legitimate interest in preventing fraud (Article 6(1)(f)). If a payment is blocked and you think it shouldn’t have been, write to us and a human will look at it.
WooCommerce also records which website or campaign led you to the shop (for example a search engine or a newsletter link), so we can see which channels work. Legal basis: our legitimate interest in understanding where customers come from (Article 6(1)(f)).
If you create an account
Name, email address, password (stored encrypted), addresses and order history, so you can see your orders and check out faster. Legal basis: the contract with you (Article 6(1)(b)). You can ask us to delete the account at any time.
When you sign up for the newsletter
Email address and, if you give it, your first name. We use it to send you a few emails a year about new lamps, launches and offers, and we see whether emails are opened and which links are clicked. Legal basis: your consent (Article 6(1)(a)). Every email has an unsubscribe link, and unsubscribing withdraws your consent.
If you are also a customer, your name, address and order history are synced to our newsletter service so we can avoid sending you irrelevant offers. This happens only if you have subscribed.
When you write to us
Whatever you write, plus your name and email address, whether you use the contact form or email. We use it to answer you. Legal basis: our legitimate interest in answering inquiries (Article 6(1)(f)), or the contract with you if the message concerns an order.
When you visit the website
Our web server and security systems process your IP address and browser information to deliver the site and protect it against attacks. Legal basis: our legitimate interest in running a secure website (Article 6(1)(f)).
If you accept statistics cookies, Google Analytics records how the site is used: pages visited, approximate location, device and browser. Legal basis: your consent (Article 6(1)(a)). You can change your choice at any time via the “Manage consent” button at the bottom of every page. Our cookie policy lists every cookie we use.
In our laboratories
Our laboratories are not under video surveillance. The scientists have been told it is a sign of trust.
Who else handles your data
We don’t sell your data, and we don’t share it for anyone else’s marketing. We use these providers, who process data on our behalf:
- WooPayments, powered by Stripe – card payments and fraud screening
- Intuit Mailchimp – newsletter, and customer and order data for subscribers
- Google Analytics – visitor statistics, only with your consent
- Google Workspace – our email
- Cloudflare – website delivery and protection
- Wordfence – website security
- Our web host – stores the website and its database
- The carrier delivering your parcel – receives your name, address, phone number and email address
- Our accountant and the Danish authorities – where the law requires it
Some of these providers (Stripe, Mailchimp, Google and Cloudflare) process data in the United States. Where they do, the transfer relies on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.
How long we keep it
- Orders and invoices: five years from the end of the financial year of the purchase, as required by the Danish Bookkeeping Act.
- Customer accounts: until you ask us to delete them. We may delete accounts that have been inactive for more than two years.
- Newsletter: until you unsubscribe.
- Emails and contact form messages: as long as needed to handle your matter, and no longer than two years after our last contact, unless they concern an order or a guarantee claim.
- Google Analytics: at most 14 months.
- Security logs: a few weeks.
Your rights
You have the right to:
- see the data we hold about you
- have incorrect data corrected
- have your data deleted, unless we are required to keep it
- have the processing restricted
- receive your data in a machine-readable format (data portability)
- object to processing based on our legitimate interests
- withdraw your consent at any time, without affecting processing that took place before
To use any of these rights, write to [email protected]. We answer within one month.
If you think we handle your data incorrectly, you can complain to Datatilsynet (the Danish Data Protection Agency), Carl Jacobsens Vej 35, 2500 Valby, Denmark, datatilsynet.dk. We would appreciate the chance to sort it out first.
Security
The website runs over an encrypted connection, access to customer data is limited to the people who need it, and our providers are bound by data processing agreements. No system is perfectly secure; if a breach affects your data, we will tell you and Datatilsynet as the law requires.
Children
Our shop is meant for adults. We don’t knowingly collect data about children. If you think a child has given us personal data, write to us and we will delete it.
Changes
If we change this policy, we update the date at the top. If the change matters to you, for example a new purpose or a new provider, we will say so on the website or by email.