Privacy Policy | Lumasana

Version 26 October 2026. This privacy policy explains which personal data Lumasana processes when you visit our shop or place an order, why we do so, who we share data with, how long we keep it and what rights you have.

1. Who we are

Lumasana is the registered trading name of the sole proprietorship of I. Ismailey, Zoutstraat 41, 5612 HW Eindhoven, the Netherlands. We are the controller within the meaning of the General Data Protection Regulation (GDPR). If you have a question about privacy or want to exercise one of your rights, email support@lumasana.com or write to the address below.

Trading name: LumasanaAddress: Zoutstraat 41, 5612 HW Eindhoven, NetherlandsChamber of Commerce (KvK): 95801537VAT ID: NL005174233B27Email: support@lumasana.com

We have not appointed a data protection officer; we are not required to.

2. What data, for what purpose and on what legal basis

The legal bases refer to Article 6(1) GDPR: (a) consent, (b) performance of a contract, (c) legal obligation, (f) legitimate interest.

Purpose	Data	Legal basis	Retention period
Processing, paying for and delivering your order	name, delivery address, billing address, email address, phone number (if you provide it), items ordered, amount, payment status	(b) contract	7 years (Dutch tax law)
Statutory records (invoices, bookkeeping)	order and invoice data	(c) legal obligation	7 years
Customer service, returns and withdrawal	name, email address, order number, content of your message, photos you send	(b) contract and (f) legitimate interest: handling your request properly	2 years after completion
Contact form	name, email address, message	(f) legitimate interest: answering your question	1 year
Customer account, only if you create one	name, email address, encrypted password, addresses, order history	(b) contract	until you ask us to delete the account; order data itself 7 years
Product reviews, only if you write one	the name you provide, your review, email address (not public)	(a) consent	until you ask us to remove it
Security and technical operation of the shop	IP address, date and time, page requested, browser type (server log files)	(f) legitimate interest: a secure, working shop	as briefly as possible, then deleted automatically
Website statistics with Google Analytics 4	usage data and online identifiers via cookies	(a) consent via the cookie banner	14 months
Origin of orders (WooCommerce Order Attribution)	source or campaign, referring website, landing page, device type	(a) consent via the cookie banner	during your visit; with an order, as part of that order for 7 years
Your cookie choice	yes or no	(c) legal obligation: being able to demonstrate consent	180 days

We do not send newsletters or other marketing emails. If we start doing so in the future, it will only be with your consent. We do not process special categories of personal data, and we never sell your data.

3. Payments

Online payments are handled by Mollie B.V. in Amsterdam, a payment institution supervised by De Nederlandsche Bank. Mollie processes your bank or card details to carry out the payment and for its own legal obligations; Mollie’s privacy statement applies to this. We only receive the payment status and a payment reference. We do not store card details.

4. Who we share data with

EPROLO, our fulfilment partner. We pass your name, delivery address, phone number (if you provide it) and the items ordered to EPROLO. EPROLO packs your order and ships it from its warehouses, including outside the European Union. See section 5.
Carriers. The company delivering your parcel receives your name and address and, where needed, your email address or phone number for tracking.
Mollie B.V. for payments, see section 3.
Our hosting provider. The shop, the database and our email (mail.lumasana.com) run on a server of a hosting provider in a data centre in the Netherlands.
Google Ireland Limited for Google Analytics 4, only if you consent. Google Signals and advertising features are switched off.
Our accountant and the Dutch Tax Administration, where needed for our records or required by law.

Parties that process data on our behalf may only use it for the purposes stated here. The shop software (WordPress, WooCommerce and WPML) runs on our own server; the makers of that software do not receive customer data.

ven if you do not consent or have not yet answered the cookie banner, our shop loads Google Analytics in what is called advanced consent mode. Google Analytics then sets no cookies and reads nothing from your browser. Your browser does, however, send a limited, cookieless signal to Google for each page, for example that a page was viewed, without a persistent visitor ID and without advertising features. Google technically receives your IP address in doing so; Google Analytics 4 does not store IP addresses. We use these signals only for aggregate figures on how the shop is used, based on our legitimate interest (f). You can object to this, see section 8.

5. Transfers outside the European Economic Area

EPROLO is based outside the European Economic Area (EEA), including in China, and works with warehouses in several countries. Your data is therefore transferred to a country for which the European Commission has not decided that the level of protection is adequate. This transfer is necessary to perform the contract with you: without your name and address your order cannot be shipped (Article 49(1)(b) GDPR). In addition, we are putting the European Commission’s standard contractual clauses in place with EPROLO (Article 46 GDPR); this agreement is currently being confirmed.

Google may process data in the United States. Google LLC is certified under the EU-US Data Privacy Framework; the standard contractual clauses also apply. This only applies if you consent to Google Analytics.

6. Retention periods

We do not keep data longer than necessary. We keep orders and invoices for 7 years because Dutch tax law requires it. We keep a customer account until you ask us to delete it. Statistics in Google Analytics are deleted after 14 months. We keep your cookie choice for 180 days. The other periods are listed in the table in section 2.

7. Cookies

We use cookies that the shop needs to work and, only with your consent, cookies for statistics and order attribution. Which cookies these are and how long they last is set out in our cookie policy. You can change your choice at any time via Cookie settings.

8. Your rights

You have the following rights:

Access: you may find out what data we hold about you.
Rectification: if your data is incorrect, we will correct it.
Erasure: you may ask us to delete your data, unless we are legally required to keep it.
Restriction: you may ask us to restrict processing temporarily.
Portability: you may receive the data you gave us in a common file format.
Withdrawing consent: if you have given consent, you can withdraw it at any time. This applies from that moment; anything done before remains lawful.

Right to object (Article 21 GDPR). Where we process your data on the basis of our legitimate interest, you may object at any time on grounds relating to your particular situation. We will then stop that processing unless we have compelling legitimate grounds that override your interests. You can always object to the use of your data for direct marketing; we will then stop immediately.

Send your request to support@lumasana.com. We will respond within one month. We may ask you to prove your identity so that we do not give data to the wrong person.

If you disagree with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). If you live in another EU country, you can also contact the supervisory authority in your own country.

9. No automated decisions

We do not take decisions about you based solely on automated processing that produce legal effects for you or similarly significantly affect you. We do not profile customers.

10. Security

Our shop uses a secure connection (HTTPS). Passwords are stored encrypted, only authorised persons have access to customer data and we keep the software up to date. Card details never reach us.

11. Changes

We update this privacy policy when the way we work changes. The date at the top shows which version applies. Please also read our terms and conditions and our returns and withdrawal page.