Privacy policy
Last updated: 15 August 2026
This Privacy Policy explains how Lumé Lumé ("we", "us", "our") collects, uses, shares and protects your personal data when you visit, browse or make a purchase through our website at bylumelume.com.
1. Who We Are (Data Controller)
Artura Commerce, a sole proprietorship (eenmanszaak) registered in the Netherlands and trading as Lumé Lumé, is the data controller responsible for processing your personal data.
- Business name: Artura Commerce (trading as Lumé Lumé)
- Chamber of Commerce (KvK): 91047714
- Address: J.G. Waltherhof 75, 1323 BC Almere, The Netherlands
- Email: contact@bylumelume.com
We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 GDPR.
2. What Personal Data We Collect
Depending on how you use our website, we may collect the following personal data:
- Identity & contact details: name, billing/shipping address, email, phone number.
- Order & payment details: products purchased, order history, transaction data, payment status. We do not store full card details; payments are handled directly by our payment providers.
- Account details (if you create an account): login information and preferences.
- Customer support data: messages, emails, or other communications with us.
- Technical & usage data: IP address, browser type, device information, cookie identifiers, pages viewed, and interactions with our site.
- Marketing preferences: newsletter sign-ups, opt-ins/opt-outs, and campaign engagement.
Providing your identity, contact and payment details is necessary to enter into a purchase contract with us. Without this data we cannot process or deliver your order. All other data is optional and depends on your choices.
3. How We Collect Your Data
- Directly from you when you place an order, contact us, or subscribe to marketing.
- Automatically through cookies and similar tracking technologies when you browse our website.
- From third parties involved in processing your order (e.g., Shopify, payment providers, shipping partners, analytics and advertising tools).
4. Why We Use Your Data (Purposes & Legal Bases)
We process personal data only when we have a lawful basis under the GDPR. Our purposes and their legal bases are:
| Purpose | Legal basis |
|---|---|
| Processing and delivering your order | Performance of a contract (Art. 6(1)(b)) |
| Handling payments and preventing fraud | Contract and legitimate interest (Art. 6(1)(b) and (f)) |
| Providing customer support | Contract and legitimate interest (Art. 6(1)(b) and (f)) |
| Complying with tax and accounting obligations | Legal obligation (Art. 6(1)(c)) |
| Improving our website and services | Legitimate interest (Art. 6(1)(f)) |
| Sending marketing communications | Consent (Art. 6(1)(a)) |
| Showing and measuring advertising on Meta platforms | Consent (Art. 6(1)(a)) |
Where we rely on legitimate interest, our interest is in operating, securing and improving our store. We balance this against your rights and freedoms, and you may object to this processing at any time (see Section 8).
Where we rely on consent, you may withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
We do not use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.
5. Who We Share Your Data With
We only share personal data when necessary to operate our store, including with:
- Shopify (our e-commerce platform, which hosts our store and processes order data on our behalf).
- Payment providers such as Shopify Payments, PayPal and Klarna, to process transactions.
- Shipping and fulfilment partners, to deliver your order.
- Meta Platforms, Inc. (Facebook and Instagram): where you consent to marketing cookies, we share website activity and order data with Meta, including hashed versions of contact details such as your email address, phone number and name, using Meta's Conversions API and Advanced Matching. Hashing means these details are converted into an irreversible code before being sent. This allows us to measure the performance of our advertising and show relevant ads. You can review or disconnect this activity from your Facebook or Instagram account at any time through Meta's Off-Facebook Activity settings.
- Other analytics and advertising providers, where you consent to marketing cookies.
- Email and SMS service providers, if you subscribe to marketing.
- Professional advisors (accountants, legal advisors) where required.
Where these parties process data on our behalf, we ensure appropriate data processing arrangements are in place, as required by Article 28 GDPR.
We never sell your personal data.
6. International Data Transfers
Because we sell worldwide and use global service providers, your data may be transferred outside the European Economic Area, including to the United States (for example, when shared with Meta Platforms, Inc. or Shopify).
Where this happens, we ensure appropriate safeguards are in place as required by Chapter V of the GDPR. These may include the European Commission's Standard Contractual Clauses, an adequacy decision (such as the EU–US Data Privacy Framework), or equivalent legal protections. You may request more information about these safeguards by contacting us.
7. Data Retention
We keep your personal data only as long as necessary for the purposes described above:
- Order and invoice data: 7 years, as required by Dutch tax law (Article 52 of the Algemene wet inzake rijksbelastingen).
- Customer service communications: up to 2 years after your request is resolved.
- Account data: until you delete your account or request erasure.
- Marketing data: until you unsubscribe or withdraw consent.
- Website analytics and advertising data: in line with your cookie choices and the retention settings of the relevant provider, typically no longer than 26 months.
After these periods, data is deleted or anonymised.
8. Your Rights Under the GDPR
If you are in the EU/EEA, you have the following rights:
- Access – to obtain a copy of the personal data we hold about you.
- Rectification – to have inaccurate or incomplete data corrected.
- Erasure – to have your data deleted, where applicable.
- Restriction – to limit how we process your data in certain cases.
- Data portability – to receive your data in a structured, machine-readable format.
- Objection – to object to processing based on legitimate interest, and to object to direct marketing at any time.
- Withdrawal of consent – at any time, for processing based on consent.
To exercise any of these rights, email us at contact@bylumelume.com. We will respond within one month of receiving your request. If your request is complex, we may extend this by up to two further months and will let you know if that applies. We may ask you to verify your identity before acting on your request. Exercising your rights is free of charge.
9. Cookies & Tracking Technologies
We use cookies and similar technologies to operate our website, understand how it is used, and, with your consent, for marketing and advertising, including advertising on Meta platforms.
- Essential cookies are always active, because the website cannot function without them.
- Analytics and marketing cookies are only placed after you give consent.
You can manage or change your preferences at any time through our cookie banner or your browser settings. Withdrawing consent will stop future data collection through these cookies.
10. Security
We take appropriate technical and organisational measures to protect your data against loss, misuse, unauthorised access, disclosure or alteration. These include encrypted connections (SSL/TLS), limiting access to personal data to those who need it, and taking security into account when selecting the service providers we work with. However, no online system can be guaranteed to be completely secure.
11. Children's Privacy
Our website is not intended for children under 16 years old. We do not knowingly collect personal data from children. If you believe a child has provided data to us, please contact us at contact@bylumelume.com so we can delete it.
12. Complaints
If you believe we are not handling your data correctly, please contact us first at contact@bylumelume.com so we can try to resolve it.
You also have the right to lodge a complaint with a data protection authority. In the Netherlands, this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). If you live in another EU/EEA country, you may complain to your local supervisory authority.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or in legal requirements. The latest version will always be available on our website, with the date of the most recent update shown at the top. We encourage you to review this page periodically.
Company details
Artura Commerce — a sole proprietorship (eenmanszaak) trading as Lumé Lumé Chamber of Commerce (KvK): 91047714 Address: J.G. Waltherhof 75, 1323 BC Almere, The Netherlands Email: contact@bylumelume.com
