Legal

Privacy Policy

Last updated: {{LAST_UPDATED}}

This policy explains what personal data LUNARIA collects when you visit our store or place an order, why we hold it, who we share it with, and the rights you have over it. We keep this plain, and we keep it honest. If anything here is unclear, please write to us and we will explain.

Who we are

LUNARIA is a trading name of a French micro-entreprise (sole trader) that sells lighting online to customers in the United Kingdom. We are the data controller responsible for the personal data described in this policy.

We are established in France, so our lead data protection authority is the French CNIL. Because we sell to customers in the United Kingdom, we handle UK residents' data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as well as French and EU data protection law where it applies to us.

Because we are established outside the United Kingdom and offer goods to consumers in the UK, we are required to appoint a UK representative under Article 27 of the UK GDPR, unless a narrow exemption applies. Our UK representative acts as a point of contact for UK data subjects and the ICO on matters relating to the processing described in this policy.

The personal data we collect

We only collect what we need to run the shop and look after your order. Depending on how you use the site, that may include:

• Order and account details: your name, delivery and billing address, email address and, if you give it, your phone number.
• Payment information: your card or payment details are entered directly with our payment providers at a secure checkout. We do not see or store your full card number; we receive only confirmation of payment and limited details such as the payment method and the last digits of the card.
• Order history and correspondence: what you have bought, delivery and returns records, and any messages you send us.
• Browsing and device data: information collected through cookies and similar technologies, such as your IP address, device and browser type, pages viewed and how you reached us. See our Cookie Policy for detail.
• Marketing preferences: whether you have chosen to receive our emails, and how you engage with them.

We do not knowingly collect data from children, and our store is intended for adults. We do not collect special category data (such as health or biometric data) in the ordinary course of running the shop.

How we use your data, and our lawful bases

Under UK GDPR we must have a lawful basis for using your personal data. Ours are set out below.

Where we rely on legitimate interests, we have considered your rights and interests and only proceed where ours do not override them. Where we rely on consent, you can withdraw it at any time (see marketing and cookies below).

Who we share your data with

We do not sell your personal data, and we never will. We share it only with the service providers that help us run the shop, and only so far as they need it. These providers act as our processors under contract, or as controllers in their own right for parts of the service.

• Shopify, which hosts our store, processes the checkout and stores order and customer data on our behalf.
• Payment providers (for example the card and wallet providers offered at checkout), which process your payment securely.
• Delivery carriers ({{CARRIER}}), which receive the delivery details needed to get your order to you and to provide tracking.
• Email, marketing and analytics tools, which help us send order updates, run our newsletter (if you have opted in) and understand how the store is used.

We may also disclose data where we are required to by law, by a regulator, or to establish, exercise or defend legal claims.

Where your data is held, and international transfers

As a French business serving UK customers, your data will be handled inside the United Kingdom, the European Economic Area (EEA) and, through some of our providers, in other countries including the United States.

Because we are established in France, your data is routinely processed in the EEA. This flow of data from the UK to the EEA relies on the UK Government's adequacy regulations for the EEA, and on appropriate safeguards where those apply, so your data stays protected to a standard equivalent to that required under UK GDPR.

Whenever personal data leaves the UK or the EEA, we make sure it stays protected by relying on appropriate safeguards recognised under UK GDPR, such as the UK International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses), transfers to countries the UK Government considers to offer adequate protection, or equivalent measures put in place by our providers. You can ask us for more detail about the safeguards that apply.

How long we keep it

We keep personal data only for as long as we need it, then delete it or anonymise it.

• Order, transaction and accounting records: kept for as long as tax and accounting law requires, which is generally several years after your order.
• Account and contact details: kept while you have an account or an ongoing relationship with us, then removed after a reasonable period of inactivity.
• Marketing data: kept until you unsubscribe or ask us to stop, and for a short period afterwards to honour your choice.
• Cookie and analytics data: kept for the periods set out in our Cookie Policy.

Your rights

Under UK GDPR you have the right to:

• be told how your data is used (this policy);
• ask for a copy of the data we hold about you;
• have inaccurate data corrected;
• ask us to delete your data, where there is no legal reason to keep it;
• ask us to restrict or object to certain uses, including profiling;
• ask us to transfer your data to you or another provider (portability);
• withdraw consent at any time, where we rely on consent.

To exercise any of these rights, email us at {{EMAIL}}. We may need to confirm your identity first. We will respond within one month, and we will not charge you unless a request is clearly unfounded or excessive.

Marketing and how to opt out

We only send marketing emails to people who have asked to receive them. Every email includes an unsubscribe link, and you can opt out at any time by using that link or by emailing us. Opting out of marketing does not stop the service messages we need to send about an order you have placed, such as confirmations and delivery updates.

Cookies

We use essential cookies to make the store work, and, with your consent, analytics and marketing cookies to understand and improve it. You can accept or decline non-essential cookies through the banner shown on your first visit, and change your choice at any time. Full detail is in our Cookie Policy.

How we keep your data secure

Payments are taken through a secure, encrypted checkout, and our store runs on Shopify's hosted, PCI-compliant platform. We limit who can access personal data and rely on our providers' technical and organisational measures to protect it. No online service can promise perfect security, but we take the safety of your data seriously and act quickly if anything goes wrong.

Complaints

If you have a concern about how we handle your data, please contact us first at {{EMAIL}} so we can put it right.

You also have the right to complain to a data protection authority. As our lead authority is in France, you may contact the CNIL (Commission Nationale de l'Informatique et des Libertés) at cnil.fr. If you are in the United Kingdom, you may instead contact the Information Commissioner's Office (ICO) at ico.org.uk.

Changes to this policy

We may update this policy from time to time to reflect changes in how we work or in the law. When we do, we will update the date at the top of this page, and significant changes will be made clear on the site.

Questions about your privacy? Write to us at {{EMAIL}} or {{LEGAL_NAME}}, {{ADDRESS}}.
Phone: {{PHONE}}