Privacy policy

1. Introduction

This privacy policy explains how Lumiris collects, uses, shares and protects your personal data when you visit lumiris.co.uk, place an order, create an account, subscribe to our newsletter or contact our customer service team. We handle your information in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003.

This policy is published in full and can be read at any time, without creating an account and without logging in.

2. Who is the data controller

The data controller is AKYT LTD, trading as Lumiris, a company registered in England and Wales under company number 17022802, with its registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.

Data protection contact: Arthur Yamga Tientcheu - contact@lumiris.co.uk. He is the person to contact about this policy and about your rights. The controller responsible for your personal data remains AKYT LTD.

For any question about this policy or about how we use your data, email contact@lumiris.co.uk or write to us at the address above.

3. The information we collect

We collect only the data we need to run the shop properly.

3.1 Information you give us

Identity and contact details: name, billing address, delivery address, email address and, if you provide one, a telephone number.
Order information: the items you buy, order value, delivery preferences and order history.
Payment information: your card or wallet payment is processed by our payment providers. We receive confirmation of payment and a truncated card reference, never your full card number or security code.
Account information: if you create an account, your login details and saved addresses.
Correspondence: the content of emails, contact form messages and any photographs you send us in support of a return or a claim.
Reviews and submissions: any review, rating or photograph you choose to publish.
Marketing preferences: whether you have subscribed to our newsletter and how you interact with our emails.

3.2 Information we collect automatically

Device and connection data: IP address, browser type, operating system, language and time zone.
Usage data: the pages you view, the products you look at, the links you click, the search terms you use and how long you stay on the site.
Cookie identifiers and similar technologies, as described in section 6.

3.3 Information from third parties

We may receive data from our e-commerce platform, from payment providers (for example fraud-screening results), from carriers (delivery status) and from analytics or advertising partners where you have consented to their cookies.

We do not knowingly collect special category data. Please do not send us health, biometric or similar sensitive information.

4. Why we use your data, and our lawful basis

Purpose	Data used	Lawful basis
Processing and delivering your order, taking payment, issuing invoices, handling returns and refunds	Identity, contact, order, payment data	Performance of our contract with you
Providing customer service and answering your questions	Contact data, correspondence, order data	Performance of a contract, or our legitimate interest in helping visitors who have not yet ordered
Preventing fraud and securing the site	Device, connection, payment and order data	Legitimate interest in protecting our business and our customers
Improving our shop, our range and our content through analytics	Usage and cookie data	Consent, where analytics cookies are used
Sending marketing emails about new collections and offers	Contact data, marketing preferences	Consent, or the soft opt-in for existing customers, withdrawable at any time
Publishing customer reviews	First name, review content, photographs	Consent
Meeting legal obligations, including accounting, tax and consumer law record-keeping	Order, payment and correspondence data	Compliance with a legal obligation
Establishing, exercising or defending legal claims	All relevant data	Legitimate interest in protecting our legal position

We do not carry out automated decision-making that produces legal or similarly significant effects for you, beyond the routine automated fraud screening applied at checkout, which you can ask us to review manually.

5. Marketing

We send marketing emails only where you have subscribed, or where you have bought from us and have not objected. You can unsubscribe at any time using the link at the bottom of every message, or by emailing us. Unsubscribing from marketing does not stop the service emails we must send about an order you have placed. We do not sell or rent your details to third parties for their own marketing.

6. Cookies and similar technologies

Cookies are small files placed on your device. We use:

Strictly necessary cookies, which run the basket, the checkout, your login session and site security. These do not require consent, and disabling them prevents the shop from working.
Analytics cookies, which tell us how the site is used so that we can improve it. These are set only with your consent.
Personalisation and advertising cookies, which help us show relevant content and measure campaigns. These are set only with your consent.

You give or refuse consent through the cookie banner shown on your first visit, and you can change or withdraw your choices at any time through the cookie settings on the site. You can also block or delete cookies in your browser settings.

7. Who we share your data with

We never sell your personal data. We share it only with the organisations listed below, each of which is bound by contract to protect it and to use it solely on our instructions, except where they act as controllers in their own right for payment and fraud purposes.

Recipient	Role	Data shared
Shopify Inc. (Canada)	E-commerce platform, hosting and order management	Account, order, contact and usage data
Shopify Payments	Card payment processing and fraud screening	Payment, billing and order data
PayPal	Payment processing where you choose PayPal	Payment, billing and order data
Royal Mail, Evri and DPD	Delivery and returns carriage	Name, delivery address, email address and, where relevant, telephone number
Google Analytics	Website analytics, with your consent	Usage, device and cookie data
Email and review platforms	Order notifications, newsletters and review collection	Name, email address, order reference
Professional advisers and public authorities	Accounting, legal advice, legal obligations	Only what is necessary or legally required

Apple Pay, Google Pay and Shop Pay transactions are processed through the payment providers named above, using the wallet on your device.

8. International transfers

Some of our providers are based outside the United Kingdom, including Shopify Inc. in Canada and providers in the United States and the European Economic Area. Where personal data leaves the UK, we rely on an appropriate safeguard recognised under the UK GDPR:

a UK adequacy regulation covering the country concerned, which is the case for Canada and the EEA for the transfers we make; or
the International Data Transfer Agreement, or the UK Addendum to the European Commission standard contractual clauses, supported by a transfer risk assessment and by additional technical and organisational measures where necessary.

You may ask us for details of the safeguards applying to a particular transfer by emailing contact@lumiris.co.uk.

9. How long we keep your data

Order and transaction records: six years from the end of the accounting period, to meet HMRC and company law requirements.
Customer accounts: for as long as the account remains active, and for two years after your last interaction, after which we delete or anonymise it.
Customer service correspondence: up to three years after the enquiry is closed.
Guarantee and returns records: for the duration of the two-year guarantee, plus the applicable limitation period.
Marketing data: until you unsubscribe, and for a short period afterwards to record your objection.
Analytics and cookie data: in line with the retention periods set out in our cookie settings, typically no more than 24 months.

When a retention period ends, we securely delete the data or anonymise it so that it can no longer identify you.

10. How we protect your data

Our site uses TLS encryption, and payment pages are operated by PCI DSS compliant providers. Access to customer data is limited to the people who need it to do their job and is protected by strong authentication. No transmission over the internet can be guaranteed to be completely secure, but we take appropriate technical and organisational measures to protect your information. Where the law requires it, we notify you and the Information Commissioner's Office of a personal data breach.

11. Your rights under the UK GDPR

Under the UK GDPR you have the right to:

Access the personal data we hold about you and receive a copy of it.
Rectification of inaccurate or incomplete data.
Erasure of your data where we no longer have a valid reason to keep it.
Restriction of processing in certain circumstances.
Data portability, receiving the data you gave us in a structured, commonly used, machine-readable format.
Object to processing based on our legitimate interests, and to object to direct marketing at any time.
Withdraw consent at any time, without affecting processing carried out before you withdrew it.

How to exercise your rights

Email contact@lumiris.co.uk with the subject line Data request, or write to us at our registered office. A request is easier to handle in writing, but you can call us on +44 7470 409015 with any question about the process.
Tell us which right you wish to exercise and, where relevant, which data or which order it concerns.
We may ask you to confirm your identity before we act, to make sure we do not disclose data to the wrong person.
We reply within one month of receiving a valid request. If a request is complex or if you have made several, we may extend that period by two further months and will tell you why within the first month.
Exercising your rights is free of charge. We may charge a reasonable fee, or refuse, only where a request is manifestly unfounded or excessive, and we will explain our reasons.

12. Children

Our shop is intended for adults and orders may only be placed by people aged 18 or over. We do not knowingly collect data from children under 13. If you believe a child has given us personal data, contact us and we will delete it.

13. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at contact@lumiris.co.uk so that we can put things right. We acknowledge complaints within 24 hours and aim to resolve them within five working days.

You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, or online at ico.org.uk. Complaining to the ICO does not affect any other legal remedy available to you.

14. Changes to this policy

We review this policy regularly and publish any update on this page with a new effective date. Where a change materially affects you, we will tell you by email.

15. Contact

AKYT LTD, trading as Lumiris, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. Registered in England and Wales, company number 17022802. Email: contact@lumiris.co.uk. Telephone: +44 7470 409015. Customer service: Monday to Friday, 9am to 6pm, excluding bank holidays, replying within 8 to 24 hours by email.