EU Privacy Policy (GDPR)

1. Who We Are

Lumenaxy ("we", "us", "our") is the data controller responsible for your personal data. For any privacy-related enquiries, contact us at: privacy@lumenaxy.com

2. What Data We Collect

We collect and process the following personal data:

• Identity & contact data: name, email address, phone number, delivery and billing address
• Order data: purchase history and transaction details (payments are processed securely by our payment provider — we do not store card data)
• Account data: login credentials if you create an account
• Technical data: IP address, browser type, device information, and cookies
• Marketing data: your preferences for receiving marketing communications

3. Why We Process Your Data & Legal Basis

• To process and fulfil your orders — legal basis: performance of a contract (Art. 6(1)(b) GDPR)
• To manage your customer account — legal basis: performance of a contract (Art. 6(1)(b) GDPR)
• To send marketing emails/SMS, where you have opted in — legal basis: consent (Art. 6(1)(a) GDPR)
• To comply with legal obligations (e.g. tax and accounting records) — legal basis: legal obligation (Art. 6(1)(c) GDPR)
• To prevent fraud and improve our services — legal basis: legitimate interest (Art. 6(1)(f) GDPR)

4. Who We Share Your Data With

We may share your personal data with:

• Shipping carriers — to deliver your orders
• Payment processors — to handle transactions securely
• Email & marketing platforms — only where you have given consent
• Legal & regulatory authorities — where required by applicable law

We never sell your personal data to third parties.

5. International Data Transfers

Some of our service providers may be located outside the European Economic Area (EEA). Where we transfer data internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission.

6. How Long We Keep Your Data

We retain your personal data only for as long as necessary for the purposes described above, or as required by law. Order records are generally kept for 7 years to meet accounting and tax obligations. Marketing consent data is kept until you withdraw your consent.

7. Your Rights Under GDPR

If you are located in the EU/EEA, you have the following rights:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure — request deletion of your data ("right to be forgotten"), subject to legal exceptions
• Right to restriction of processing — ask us to pause processing your data in certain circumstances
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests or for direct marketing purposes
• Right to withdraw consent — withdraw consent at any time where processing is based on consent (this does not affect the lawfulness of processing before withdrawal)

To exercise any of these rights, email us at privacy@lumenaxy.com. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority (e.g. CNIL in France, ICO in the UK, AEPD in Spain).

8. Cookies

We use cookies and similar tracking technologies. You can manage your preferences via our cookie banner or our Cookie Policy page.

9. Changes to This Policy

We may update this policy from time to time. The current version will always be available on this page with the date of the last update.

Last updated: July 2026