Last updated: 26 August 2026

This Privacy Policy explains how Lumea ("we", "us") collects, processes and protects personal data when you visit our website www.lumeasleep.com (the "Website") or make a purchase there. We process your data in accordance with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (GDPR) and applicable national data protection laws.

1. Controller

Controller within the meaning of the UK GDPR and GDPR:
Lumea (sole proprietorship)
Tesselschadestraat 25
8913 HA Leeuwarden
Netherlands
KvK number (Dutch trade register): 94684529
Email: info@lumeasleep.com

2. What data we collect

Order and contact data: When you place an order, subscribe to our newsletter or contact our customer service, we collect: your name, email address, delivery and billing address, phone number (optional) and payment information (processed exclusively by certified payment providers — we never store full payment details ourselves).

Automatically collected data: When you visit the Website, certain data is collected automatically: IP address, browser type and version, device type, time zone, pages visited and time spent, and the referring website. The legal basis is our legitimate interest in providing a secure and stable website (Art. 6(1)(f) GDPR / UK GDPR).

3. Purposes and legal bases of processing

We process your data for the following purposes:

- Order processing and delivery — Art. 6(1)(b) GDPR (performance of a contract)
- Communication about your order (e.g. order and shipping confirmations with tracking) — Art. 6(1)(b) GDPR
- Newsletter and marketing emails — only with your explicit consent (Art. 6(1)(a) GDPR); you can unsubscribe at any time via the link in every email
- Improving our website and shopping experience — Art. 6(1)(f) GDPR or Art. 6(1)(a) GDPR (for cookies requiring consent)
- Fraud prevention and security — Art. 6(1)(f) GDPR
- Compliance with legal obligations (e.g. tax and commercial retention duties) — Art. 6(1)(c) GDPR

4. Hosting and shop system (Shopify)

Our Website is operated via Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify processes order, contact and usage data on our behalf (Art. 28 GDPR). Data may also be transferred to Shopify Inc. in Canada and to service providers in the United States. Canada is covered by an adequacy decision; transfers to the US are safeguarded by standard contractual clauses and/or the EU-U.S. Data Privacy Framework and its UK Extension. More information: https://www.shopify.com/legal/privacy

5. Payment providers

We use external payment providers to process payments (e.g. Shopify Payments, PayPal, Klarna, credit card providers). Your payment details are transmitted directly and in encrypted form to the relevant provider and used solely to process your payment (Art. 6(1)(b) GDPR). The privacy policy of the respective payment provider applies in addition.

6. Delivery and logistics

To deliver your order, we share your name, delivery address and — where required for delivery — your email address or phone number with the appointed shipping and logistics company (Art. 6(1)(b) GDPR). A tracking service may be used to process the shipment data of your order.

7. Cookies and consent management

We use cookies and similar technologies. Strictly necessary cookies (e.g. for the basket and checkout) are set on the basis of our legitimate interest (Art. 6(1)(f) GDPR) and, for UK visitors, in accordance with the Privacy and Electronic Communications Regulations (PECR). All non-essential cookies (analytics, marketing, personalisation) are only set after your explicit consent via our cookie banner (Art. 6(1)(a) GDPR, PECR). You can withdraw or adjust your consent at any time with effect for the future via the cookie settings on our Website.

8. Web analytics and online marketing

Only with your consent, we use the following services:

Meta Pixel (Meta Platforms Ireland Ltd., Ireland): To measure and optimise our advertising on Facebook and Instagram and to build audiences (retargeting, audience matching). Data may be transferred to Meta Platforms Inc. in the US (safeguarded via the EU-U.S. Data Privacy Framework and its UK Extension). We are joint controllers with Meta with regard to the data collection within the meaning of Art. 26 GDPR. More information: https://www.facebook.com/privacy/policy

Google Analytics (Google Ireland Ltd., Ireland): To analyse how the Website is used. IP addresses are processed in truncated form. Data may be transferred to Google LLC in the US (EU-U.S. Data Privacy Framework and UK Extension). More information: https://policies.google.com/privacy

Email marketing platform (e.g. Klaviyo): To manage and send our newsletter, where you have signed up.

You can withdraw your consent for all of these services at any time via the cookie settings.

9. Customer service and email communication

If you contact us by email (info@lumeasleep.com) or via a contact form, we process the information you provide to handle your enquiry (Art. 6(1)(b) or (f) GDPR). The communication is deleted once it is no longer required for handling the enquiry and any statutory retention obligations.

10. Customer reviews and user-generated content

If you submit a product review, photo or video, we process the data you provide (e.g. name, email address, content of the review). With your consent, this content may be published on our Website, on social media or in marketing materials (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future.

11. Sharing of data

We do not sell your personal data. Data is shared only with the categories of service providers named in this policy (processors under Art. 28 GDPR) — payment providers, shipping partners, hosting, analytics and marketing services — and, where legally required, with public authorities. All service providers receive only the data they need to perform their service and are contractually bound to protect your data.

12. International data transfers

Where data is transferred to countries outside the UK and the EU/EEA (in particular the US and Canada), this is done only on the basis of appropriate safeguards: adequacy decisions, standard contractual clauses (SCCs), the UK International Data Transfer Agreement or Addendum, or certifications under the EU-U.S. Data Privacy Framework and its UK Extension. Transfers between the UK and the EU/EEA are covered by the respective adequacy decisions.

13. Retention

We store personal data only for as long as necessary for the purposes described. Order and invoice data is subject to statutory retention periods (generally 6–10 years) and is deleted once these expire. Newsletter data is stored until you unsubscribe.

14. Your rights

Under the UK GDPR and GDPR you have the following rights:

- Access to the data we process about you (Art. 15)
- Rectification of inaccurate data (Art. 16)
- Erasure of your data (Art. 17)
- Restriction of processing (Art. 18)
- Data portability (Art. 20)
- Withdrawal of any consent you have given, at any time with effect for the future (Art. 7(3))

Right to object (Art. 21): You have the right to object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f). You may object to processing for direct marketing purposes at any time, without giving reasons.

To exercise your rights, simply email: info@lumeasleep.com

Right to complain: You also have the right to lodge a complaint with a data protection supervisory authority. In the United Kingdom this is the Information Commissioner's Office (ICO, ico.org.uk); in the Netherlands, where we are established, it is the Autoriteit Persoonsgegevens. You may also complain to the authority in the member state of your habitual residence.

15. Data security

Our Website uses SSL/TLS encryption. We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. However, no method of transmission over the internet is 100% secure.

16. Children

Our Website is not directed at children under 16. We do not knowingly collect data from children. If you believe we hold data relating to a child, please contact us.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example when our services or the legal situation change. The version published on this page applies.

18. Contact

For questions about this Privacy Policy or the processing of your data:
Lumea
Tesselschadestraat 25, 8913 HA Leeuwarden, Netherlands
Email: info@lumeasleep.com