Privacy policy

Last updated: 23 July 2026

This Privacy Policy explains how Luma & Home collects, uses, shares and protects personal information when you visit lumaandhome.co.uk, place an order, create an account, contact us, subscribe to marketing, submit a review or otherwise interact with our services.

It also explains your rights under applicable data-protection law, including the EU General Data Protection Regulation (“EU GDPR”), the UK General Data Protection Regulation (“UK GDPR”), the Swedish Data Protection Act, the UK Data Protection Act 2018 and applicable electronic-marketing and cookie rules.

1. Who we are

Luma & Home is the trading name of Matthias Moreillon, a sole trader registered in Sweden.

For the personal information described in this Privacy Policy, the data controller is:

Matthias Moreillon, trading as Luma & Home
Fredriksdalsgatan 4B
412 85 Gothenburg
Sweden
Email: support@lumaandhome.co.uk
Website: https://lumaandhome.co.uk/

You can contact us at the email or postal address above if you have a question about this policy or wish to exercise a privacy right.

2. Personal information we collect

Depending on how you interact with Luma & Home, we may collect the following categories of personal information.

Identity and contact information

This may include your name, billing address, delivery address, email address, telephone number and account details.

Order and transaction information

This may include products viewed, added to your basket or purchased; order numbers; purchase history; discounts; refunds; returns; delivery status; and related communications.

Payment information

Payments are processed through Shopify and the payment provider you select. Payment providers may collect card or wallet information needed to authorise your payment. Luma & Home does not receive or store your complete payment-card number. We may receive limited payment information such as payment status, payment method, transaction reference and fraud indicators.

Account information

If you create or use a customer account, we may process your login identifier, account preferences, saved addresses, order history and authentication or security information.

Communications and support information

This includes information you provide when you email us, use Shopify Inbox or a contact form, ask a question, report a problem, request a return or refund, or otherwise communicate with us.

Reviews and user-submitted content

If you provide a product or store review, we may process your name, email address, order details, rating, written review, photographs, videos and any other content you choose to submit. Reviews may be displayed publicly as explained when you submit them.

Marketing information

This includes your email-marketing subscription status, consent records, preferences, interactions with marketing messages and unsubscribe requests.

Device, usage and technical information

When you use the website, we and our service providers may collect IP address, general location derived from IP address, browser type, device type, operating system, cookie identifiers, pages viewed, referral source, search activity, basket activity, timestamps, diagnostic information and interactions with the website or advertisements.

Consent and privacy-preference information

We record the choices you make through the cookie banner, including the date, time and status of your consent or refusal.

We do not intentionally request special-category personal data, such as health, biometric, religious or political information. Please do not include such information in free-text forms or support messages unless it is strictly necessary.

3. How we collect personal information

We collect personal information:

directly from you when you browse, order, create an account, contact us, subscribe, submit a review or make a privacy choice;
automatically through Shopify, cookies, pixels, logs and similar technologies, subject to your consent where required;
from payment providers, fulfilment partners, suppliers, delivery carriers, fraud-prevention providers and order-tracking services;
from marketing, analytics, advertising and review platforms when you interact with those services; and
from publicly available sources or authorities where permitted by law.

4. How and why we use personal information

We use personal information only where we have a lawful basis.

Purpose	Typical personal information	Lawful basis
Operate the website, basket, checkout and customer account	Identity, contact, account, device, basket and order information	Performance of a contract; legitimate interests in operating our store
Accept payment and process orders	Identity, contact, order, transaction and limited payment information	Performance of a contract; legal obligation
Fulfil, deliver and track orders	Name, delivery address, contact details, order contents and tracking information	Performance of a contract
Handle questions, returns, refunds, complaints and after-sales support	Identity, contact, order and communication information	Performance of a contract; legal obligation; legitimate interests in customer service and dispute management
Prevent fraud, misuse and security incidents	Transaction, account, device, technical and fraud-risk information	Legitimate interests in protecting customers and our business; legal obligation where applicable
Keep financial, tax, accounting and legal records	Identity, order, transaction, refund and communication information	Legal obligation; establishment, exercise or defence of legal claims
Improve our website, products and customer experience	Usage, device, order and aggregated analytics information	Consent for non-essential analytics; legitimate interests where processing is strictly necessary and permitted without consent
Send newsletters and promotional messages	Contact details, marketing preferences and engagement information	Consent; you may withdraw consent at any time
Measure advertising and show relevant advertising	Cookie identifiers, device, usage and advertising interaction information	Consent where required
Invite, verify, publish and manage reviews	Identity, contact, order and review information	Legitimate interests in obtaining genuine customer feedback; consent or your request where required
Manage cookie consent and demonstrate compliance	Consent status, timestamp, page URL, encrypted consent identifier and limited technical information	Legal obligation; legitimate interests in demonstrating compliance
Enforce our terms and comply with law	Relevant identity, order, transaction, communication and technical information	Legal obligation; legitimate interests; legal claims

Where we rely on legitimate interests, we consider whether the processing is necessary and balance our interests against your rights and reasonable expectations. You may object to processing based on legitimate interests as described below.

5. Cookies, analytics and advertising

We use strictly necessary cookies to operate the website, basket, checkout, security and privacy controls. With your permission, we may also use functional, analytics and marketing cookies or similar technologies.

Pandectes GDPR Compliance manages the consent banner and records your choices. Google Tag Manager is used to manage approved tags. Google Analytics helps us understand website usage, and Google Ads helps us measure advertising and conversions. Meta advertising tools may also be used if enabled and only after the required marketing consent.

Non-essential cookies and marketing technologies should remain disabled until you provide the relevant consent. You can reject non-essential cookies or change your choices using the cookie control available on the website.

For information about individual cookies, providers, purposes and durations, please read our Cookie Policy.

6. Marketing communications

We send email marketing only where we have an appropriate lawful basis and, where required, your consent. Klaviyo supports our email-marketing and onsite subscription services.

You can unsubscribe at any time by:

using the unsubscribe link in a marketing email;
changing an available account or communication preference; or
emailing support@lumaandhome.co.uk.

Unsubscribing from marketing does not prevent us from sending service messages that are necessary for an order, account, return, refund, security matter or privacy request.

7. Reviews

We use Judge.me to support product and store reviews. Where enabled, Judge.me may receive customer and order information needed to send a review request, verify that a reviewer made a purchase, host submitted review content and allow the reviewer to manage that content.

A review may include your chosen display name, rating, written content and any media you submit. Information marked for public display may be visible to website visitors. Your email address is not intended to be displayed publicly by Luma & Home.

You can contact us to ask about a review or request assistance with your privacy rights. Judge.me also provides information about reviewer rights in its own privacy notice.

8. Who we share personal information with

We do not sell or rent your personal information. We share it only as needed for the purposes described in this policy.

Ecommerce, checkout and hosting

Our store is hosted by Shopify. Shopify processes personal information to provide storefront, customer-account, basket, checkout, payment, security and commerce services. Shopify may also process information as an independent controller for certain consumer services such as Shop or Shop Pay, as explained in Shopify's own consumer privacy policy.

Payment providers

Your selected payment provider receives information required to authorise, process, secure and refund payments. The provider's own privacy notice may also apply.

Suppliers, fulfilment partners and delivery carriers

We share the information needed to prepare, ship, deliver and support your order. This may include your name, delivery address, telephone number, email address, order contents and delivery instructions.

Some products may be fulfilled by partners outside the United Kingdom and European Economic Area. We limit the information shared to what is needed for fulfilment and delivery.

Order tracking

We use Track123 to provide order tracking and delivery updates. Track123 may process order number, tracking number, carrier, delivery status and contact information needed to provide tracking services.

Email marketing

We use Klaviyo to manage email subscriptions, marketing communications, preferences and engagement information.

Reviews

We use Judge.me to collect, verify, host and manage reviews and review invitations.

Consent management

We use Pandectes GDPR Compliance to display the cookie banner and record consent choices.

Analytics, advertising and product feeds

We use Google services, including Google Tag Manager, Google Analytics and Google Ads, subject to consent where required. Simprosys Google Shopping Feed supports product-feed and advertising operations. Meta advertising services may process information if the corresponding integration is enabled and you have provided the required consent.

Store operation and optimisation

Shopify Inbox supports customer chat. TinySEO supports technical search-engine optimisation and broken-link monitoring. These and other technical providers may process limited technical or communication information to provide their services.

Professional advisers, authorities and business transfers

We may disclose information to accountants, insurers, legal advisers, tax authorities, regulators, courts, law-enforcement bodies or other authorities where necessary and lawful. If the business is sold or reorganised, information may be disclosed to professional advisers and a prospective or actual buyer, subject to appropriate confidentiality and data-protection safeguards.

Each service provider is expected to use personal information only for agreed purposes, protect it appropriately and comply with applicable law. Some providers act as independent controllers for parts of their services and provide their own privacy notices.

9. International transfers

Luma & Home is established in Sweden and serves customers in the United Kingdom. Shopify and other service providers may process personal information in the United Kingdom, European Economic Area, Canada, United States and other countries. Fulfilment and delivery partners may also be located outside the UK and EEA.

Where a transfer is subject to the EU GDPR or UK GDPR, we rely on an appropriate transfer mechanism where required. This may include:

a decision recognising that the destination provides an adequate level of protection;
the European Commission's Standard Contractual Clauses;
the UK International Data Transfer Agreement or UK Addendum;
binding contractual and organisational safeguards; or
another lawful exception or transfer mechanism.

You may contact us for more information about the safeguards relevant to a particular transfer.

10. How long we retain personal information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including to:

fulfil and support orders;
maintain an account or subscription;
comply with accounting, tax, consumer-protection and other legal obligations;
prevent fraud and maintain security;
resolve complaints, returns, refunds and disputes; and
establish, exercise or defend legal claims.

When deciding the retention period, we consider the nature and sensitivity of the information, the amount collected, the risk of harm, the purpose of the processing, whether the purpose can be achieved another way, contractual requirements and applicable limitation or statutory retention periods.

In general:

order, payment-status, refund and accounting records are kept for the period required by applicable bookkeeping, tax and consumer-protection law;
customer-support and dispute records are kept while the matter remains relevant and for an appropriate period afterwards;
account information is retained while the account is active and for a reasonable period afterwards where needed for legal or security purposes;
marketing information is retained until you unsubscribe, withdraw consent or the information is no longer needed, after which limited suppression information may be kept to respect your opt-out; and
cookie and consent records are retained according to the periods described in the Cookie Policy and as needed to demonstrate compliance.

When information is no longer required, we delete or anonymise it, unless continued retention is required or permitted by law. Copies may remain for a limited period in secure backups before being overwritten.

11. How we protect personal information

We use reasonable technical and organisational measures intended to protect personal information against accidental or unlawful loss, misuse, alteration, unauthorised access or disclosure.

These measures include using established ecommerce and payment providers, limiting access to information, authentication and access controls, service provider agreements, security monitoring and keeping only the information we reasonably need.

No internet transmission or storage method can be guaranteed to be completely secure. If we become aware of a personal-data breach, we will assess it and notify affected people and relevant authorities where required by law.

12. Your data-protection rights

Depending on the law that applies to you, you may have the right to:

receive information about how we use your personal information;
request access to your personal information and obtain a copy;
correct inaccurate or incomplete information;
request erasure in certain circumstances;
request restriction of processing in certain circumstances;
object to processing based on legitimate interests;
object at any time to the use of your information for direct marketing;
receive information you provided in a structured, commonly used and machine-readable format and, where applicable, have it transferred to another controller;
withdraw consent at any time, without affecting processing already carried out lawfully before withdrawal; and
lodge a complaint with a data-protection authority.

These rights are subject to legal conditions and exceptions. For example, we may need to retain certain order or transaction records to comply with law or establish, exercise or defend legal claims.

To exercise a right, email support@lumaandhome.co.uk. Please describe your request clearly. We may ask for information reasonably necessary to verify your identity and protect your information from unauthorised disclosure.

We will respond without undue delay and normally within one month, subject to any lawful extension for a complex request.

13. Complaints

Please contact us first at support@lumaandhome.co.uk so that we can try to address your concern.

Because the controller is established in Sweden, you may lodge a complaint with the Swedish Authority for Privacy Protection:

Integritetsskyddsmyndigheten (IMY)
https://www.imy.se/

If the UK GDPR applies to the relevant processing, you may also have the right to complain to the UK Information Commissioner's Office:

Information Commissioner's Office (ICO)
https://ico.org.uk/make-a-complaint/

You may also be entitled to complain to the data-protection authority in the EEA country where you live, work or believe an infringement occurred.

14. Children

Our store is intended for a general adult audience. We do not knowingly collect personal information from children who cannot lawfully provide it. If you believe a child has provided personal information to us without appropriate authorisation, contact us so that we can investigate and take appropriate action.

15. Third-party websites and services

Our website may link to websites or services operated by other organisations. Their privacy practices are governed by their own notices. We are not responsible for third-party websites that we do not control, and we recommend reading their privacy information before providing personal information.

16. Changes to this Privacy Policy

We may update this Privacy Policy when our services, providers, technology or legal obligations change. We will publish the updated version on this page and change the “Last updated” date.

If a change materially affects how we use personal information, we will provide additional notice where required by law.