Privacy policy
Last updated: 1 September 2026
This policy explains what personal data Luma Lights collects when you visit our website, buy a lamp or visit one of our showrooms, why we collect it, and which rights you have. Luma Lights is the controller for the processing described here.
Who we are
Luma Lights, Lichtstraße 12, 10115 Berlin, Germany. You can reach our data protection contact at privacy@luma-lights.example or by post at the address above, marked “Data protection”.
Data we collect
- Order data: your name, delivery and billing address, email address, the lamps you ordered and the payment method you chose.
- Account data: if you create an account, your login email, a hashed password, your wishlist and saved comparisons.
- Contact data: the content of messages you send us through the contact form, by email or by phone.
- Technical data: the pages you request, the time of the request and a shortened IP address, kept in server logs.
Cookies and similar technologies
We only use cookies that are needed to run the shop, plus one optional cookie that remembers your display preferences. We do not use advertising or cross-site tracking cookies.
| Name | Purpose | Category | Set by | Duration | Legal basis |
|---|---|---|---|---|---|
| luma_session | Keeps you signed in and keeps the contents of your cart while you browse | Strictly necessary | Luma Lights | Until the browser is closed | § 25(2) TDDDG, Art. 6(1)(b) GDPR |
| luma_csrf | Protects forms such as checkout and contact against cross-site request forgery | Strictly necessary | Luma Lights | Until the browser is closed | § 25(2) TDDDG, Art. 6(1)(f) GDPR |
| luma_consent | Stores the choice you made in the cookie settings | Strictly necessary | Luma Lights | 12 months | § 25(2) TDDDG, Art. 6(1)(c) GDPR |
| luma_prefs | Remembers display preferences such as list or grid view and prices incl. VAT | Preferences | Luma Lights | 6 months | § 25(1) TDDDG, Art. 6(1)(a) GDPR |
Service providers we share data with
We share personal data only with providers who help us run the shop, and only as far as they need it. All of them process data on our instructions under a data processing agreement.
| Recipient | Service | Data shared | Location | Transfer safeguard | Retention by recipient |
|---|---|---|---|---|---|
| Parcel carrier | Delivery of orders | Name, delivery address, phone number if given | Germany | Not applicable (EU) | Until delivery plus 90 days |
| Payment provider | Card and wallet payments, fraud checks | Order amount, billing name, payment token | Ireland | Not applicable (EU) | As required by financial regulation |
| Hosting provider | Servers for the website and databases | All data stored by the shop | Germany | Not applicable (EU) | For the term of our contract |
| Email service | Order confirmations and, if you agreed, our newsletter | Email address, first name, order number | Netherlands | Not applicable (EU) | Until you unsubscribe or the contract ends |
How long we keep your data
We delete personal data when it is no longer needed for the purpose it was collected for, unless the law requires us to keep it longer.
Retention periods
Your rights
You have the right to access your data, to have it rectified or erased, to restrict or object to its processing, and to data portability. Where processing is based on your consent, you can withdraw it at any time with effect for the future. You also have the right to lodge a complaint with a supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information.
Changes to this policy
We update this policy when our services or the law change. The date at the top shows when it last changed.