Privacy Policy

1. Controller

Marcel Kartolo, sole proprietor trading as “Lelumáré”, Speditionsstraße 15a, 40221 Düsseldorf, Germany. Privacy contact: shop@lelumare.com.

2. Hosting and security

We operate the shop with Pawhost in Germany. Requests involve processing IP addresses, timestamps, requested pages and browser information. Technical logs support troubleshooting and prevention of abuse (Article 6(1)(f) GDPR). Ordinary operational logs of our shop services are automatically cleared after 14 days; hourly rotation and cleanup may delay deletion by up to about two hours during normal operation, while high volume may cause earlier deletion. Separate security logs contain IP addresses, timestamps, shortened browser identifiers, path categories, response status and technical volume data. They contain no form entries, messages, cookies or confidential URL parameters. These raw records are normally deleted after about seven days and, because of daily rotation and cleanup, after about eight days at the latest; sooner under high traffic. Daily statistics without personal data may be kept longer. Retention depends on the time needed to investigate an error or security incident; longer preservation requires a specific incident or legal claim. Hosting and maintenance providers may access data as necessary, acting as processors under Article 28 GDPR where required.

To recover from technical failures or data loss, we back up shop data to separate systems with restricted access. This includes encrypted offsite backups with Proton Drive (Proton AG, Switzerland), which may contain order, account, return and accounting data. Switzerland has an adequacy decision under Article 45 GDPR. The legal basis is our legitimate interest in data security and recoverability (Article 6(1)(f) GDPR). Backups are not used for normal shop operations. Retention depends on the necessary recovery period and statutory retention duties for the accounting records they contain. Deletions may take effect in backups later; intervening deletions and applicable retention periods must be applied again when restoring data.

3. Fonts

Fonts are served from our own server without connecting to Google.

4. Necessary storage and analytics choice

The cart cookie _lelumare_cart lasts up to 30 days. NEXT_LOCALE stores your language choice for the browser session. Temporary checkout state in your browser session lets you resume a payment. These functions support your requested shopping or language setting (§ 25(2) no. 2 TDDDG; Article 6(1)(b) or (f) GDPR).

We store your analytics acceptance or rejection with its date and notice version in local browser storage for 180 days (lelumare_analytics_consent). This is necessary to respect your choice (§ 25(2) no. 2 TDDDG; Article 6(1)(c) GDPR). We do not load the analytics tracker without consent. You can change your choice at any time through “Analytics settings” in the footer.

5. Optional Umami analytics

Only with your consent, we use self-hosted Umami on our server in Germany to improve the shop and evaluate campaigns. We collect page views, sanitized referrers, campaign source, medium and name, browser, operating system, language, screen size, device type and approximate location derived from the IP address. Events include product views, variant selection, cart actions, checkout steps, purchase value and currency.

Umami processes IP addresses to associate visits and derive location without storing the IP address itself. Technical session identifiers can link visits and events, so this is more than anonymous totals. We do not send customer names, email addresses, order numbers, payment identifiers or form entries to Umami. Confidential URL parameters are removed. We do not link analytics to customer accounts or share it with advertising networks. Analytics runs through our own domain without tracking cookies. After consent, session storage prevents duplicate purchase events; its order identifier is not sent to Umami.

The legal bases are Article 6(1)(a) GDPR and § 25(1) TDDDG. Withdrawing consent through the footer stops further collection without affecting the lawfulness of earlier processing. We also respect Do Not Track. Analytics events are deleted after 13 months. Technical session data is then deleted once no newer events remain associated with the session. Contact us to request deletion; identifying your technical session may not be possible without further information.

6. Payments

We use Stripe Payments Europe, Ltd., Ireland. Stripe loads only at the payment step. It processes payment, contact, transaction and technical device data to process payments and prevent fraud, and may set cookies such as __stripe_mid and __stripe_sid. Storage necessary for the requested payment relies on § 25(2) no. 2 TDDDG; data processing relies on Article 6(1)(b) and, where necessary for fraud prevention, (f) GDPR.

Depending on your payment choice, necessary data also goes to the relevant provider. These providers partly act as independent controllers: Stripe and Link, Klarna, PayPal, Amazon Pay and Satispay. Their notices explain their retention periods and any credit checks.

Stripe may process data outside the European Economic Area, particularly in the USA. Its Data Transfers Addendum describes transfer mechanisms, including adequacy decisions and standard contractual clauses. You can inspect these safeguards there or ask our privacy contact for further information.

7. Shopping, shipping and contact

We process contact and address information, selected items, payment status and correspondence for carts, orders, delivery and enquiries (Article 6(1)(b) GDPR). We cannot fulfil the purchase without the necessary order and address details. The selected carrier (DHL, Hermes, DPD, GLS or UPS and its destination-country delivery partners) receives necessary recipient and shipment details. Accounting providers, tax advisers and competent authorities may receive necessary records for accounting and statutory obligations (Article 6(1)(c) GDPR).

Invoices and accounting vouchers are generally retained for eight years, business correspondence subject to retention duties for six years, and certain tax records for ten years. The start and any extensions depend on the applicable statutory period. Other contract and case data is retained while needed for fulfilment or enforcement or defence of possible claims (Article 6(1)(b), (c) and (f) GDPR). Expiry of a cart cookie does not automatically delete server data; outstanding payments or cases are relevant to its continued necessity.

Contact and transactional emails, including return and newsletter confirmation messages, are sent and handled through Proton AG, Switzerland. Proton processes recipient and sender addresses and message contents. Switzerland has an EU adequacy decision under Article 45 GDPR. The legal basis follows the purpose: contract fulfilment, handling your enquiry or newsletter consent.

Contact details in unused carts are removed after 30 days without activity unless linked orders, payments or retention holds prevent this. Unneeded guest profiles without an account or linked orders or carts are cleared after 90 days. Additional telephone numbers and gift messages in completed orders are removed after 90 days without changes unless case handling or retention duties require them. Required original documents and correspondence remain within their respective retention periods. Ongoing proceedings and statutory extensions may require longer storage for the specific purpose.

8. Geoapify address suggestions

As you type a delivery or billing address in the checkout, or an address in your customer account’s address book, our server sends the typed address fragments and the selected country to Geoapify Address Autocomplete (KEPTAGO LTD, Cyprus). We use the EU endpoint api-eu.geoapify.com. Your browser contacts only our server. We do not forward your IP address, browser cookies or our own user identifiers to Geoapify. Geoapify receives the technical connection from our server. Our legitimate interest is helping you enter an accurate address (Article 6(1)(f) GDPR). You can always enter the address manually. The fragments are themselves address data; server mediation does not automatically anonymize them. Geoapify states that it logs technical API requests, including request content, server IP and time, for access control and troubleshooting; successful requests are generally retained there for no more than 24 hours. Geoapify lists hosting and network providers such as Hetzner, Cloudflare and Bunny as further recipients. Selecting the EU endpoint alone does not guarantee that all subprocessors process data exclusively within the EEA. Further information: Geoapify privacy policy.

9. Withdrawals, returns and defects

We process your name, email, contract reference, any specified items, optional delivery date and declaration to handle the case (Article 6(1)(b) and (c) GDPR). Optional defect photos are stored on our server in Germany without sending them to external image recognition or virus scanning services. Case information is also sent by email through Proton for confirmation and processing. Carriers receive necessary recipient and shipment data for returns where required.

Private attachments are deleted six months after case closure. Cases remain open while attachments are needed for an unresolved dispute. Closed case records and related correspondence are generally kept for six years from the end of the year of closure or latest correspondence. Payment and refund records have the separate retention periods described in section 7. Documented retention holds protect necessary evidence beyond these periods.

10. Newsletter

“The Inner Light Journal” uses double opt-in: we send a confirmation email after sign-up, and only your confirmation click activates the subscription. The legal basis is Article 6(1)(a) GDPR. We store your email, sign-up and confirmation times and IP addresses, source and notice version as consent evidence, separately from order data. Unconfirmed sign-ups are deleted after seven days. Email is sent through Proton.

You can unsubscribe through our contact address and withdraw consent at any time without affecting the lawfulness of previous processing. After unsubscription, consent and unsubscribe records remain protected to demonstrate consent, respect unsubscription and defend legal claims (Article 6(1)(c) and (f) GDPR). Retention depends on remaining evidence obligations and limitation periods for possible claims; unsubscription does not automatically erase these records.

11. Customer account

A customer account is optional; buying as a guest remains fully possible without one. If you create an account, we process your email address, password (only as a cryptographic hash), name, the addresses saved in the account and, optionally, telephone number and company. The purpose is providing the account with its order overview and address book at your request (Article 6(1)(b) GDPR); securing the sign-in, in particular limiting sign-in attempts, relies on Article 6(1)(f) GDPR. We check a new password for easily guessed patterns only in your browser and on our server and show you an estimate of its strength; it is not sent to any third party for that.

If you create the account while placing an order, we take your name and that order’s delivery address into the account as its first address; the checkout says so at that point. If you are signed in while ordering, we save the delivery address entered there in the account only when the corresponding option is selected. It is preselected while the address book is still empty and can be deselected. You can change or delete saved addresses in the account at any time.

After registration we send a confirmation email; only your click unlocks the account. This prevents an account from being created on someone else’s email address. Signing in sets a technically necessary cookie (_lelumare_customer) holding your session token, which expires after a day at most and renews while you are active (§ 25(2) no. 2 TDDDG). We reset a password only through a one-time link sent to your confirmed address; that link is valid for 15 minutes.

You may set up two-factor sign-in in the account and switch it off again at any time; it is optional. Signing in then also asks for a code from an authenticator app. For this we store a secret key for that app (encrypted) and recovery codes (only as cryptographic hashes). Your browser draws the QR code for the setup itself; we send the key and the codes to no third party, and we receive no data from your authenticator app. Between entering the password and the code, a technically necessary cookie (_lelumare_customer_2fa) holds the sign-in that has begun for five minutes at most. If you asked at registration to set up two-factor sign-in, a cookie (_lelumare_2fa_setup) remembers that wish until your first sign-in, for 30 days at most (§ 25(2) no. 2 TDDDG). When two-factor sign-in is switched on, switched off or reset, we tell you by email at your account address, so that you notice a change you did not make. Once switched off, the key and the codes are no longer used; they are deleted with the account at the latest. If you have neither the app nor a recovery code at hand, we reset two-factor sign-in at your request after verifying your identity. The legal basis is Article 6(1)(b) GDPR; limiting code attempts relies on Article 6(1)(f) GDPR.

The account shows the orders assigned to it together with their progress (for example being prepared, shipped or delivered). Orders you placed as a guest before registering do not appear there automatically. If you later order as a guest using your account address, the shop assigns that order to the account.

You can delete the account yourself at any time. We then remove the sign-in, profile details, saved addresses and the data of a two-factor sign-in. Orders, invoices and accounting vouchers remain subject to the statutory periods named in section 7; a documented retention hold can temporarily prevent deletion, and we tell you when that is the case. An account is not newsletter consent, and a newsletter sign-up does not create an account; the two exist independently (section 10).

12. AI shop assistant

The AI assistant in the shop is optional and only acts once you send it a message. It answers questions about products, shipping, returns and the content of this website. It has no access to customer accounts, orders, carts or payment data, even when you are signed in. Please do not enter personal data or order information in the chat.

We process your messages, the selected language, the previous messages of the same conversation and a random session identifier. Your browser keeps the identifier only in the memory of the open page; no cookie is set for it. The conversation ends after 30 minutes without activity. We automatically replace email addresses, telephone numbers and order numbers before transmission and storage; this does not reliably detect names, addresses or other details. The assistant application uses your IP address briefly in memory to limit requests and does not send it to the AI providers. Separately, the shop security logs described in section 2 apply.

To generate answers, we send the conversation’s messages to OpenAI Ireland Ltd., Ireland, and, only during a technical disruption, alternatively to Mistral AI SAS, France. Processing by the providers is governed by the applicable data processing agreements (Article 28 GDPR). OpenAI does not use API content for model training by default. We enable the Mistral fallback only after confirming training exclusion and reviewing the applicable privacy agreements. Providers may normally retain inputs and outputs for up to 30 days, particularly for abuse monitoring; legal obligations and security incidents may require longer retention. Disabling storage of OpenAI responses does not remove these security logs. OpenAI may process data outside the European Economic Area, particularly in the USA, on the basis of standard contractual clauses (Article 46(2)(c) GDPR).

On our server in Germany we store the redacted question and answer, the language, technical details of the answer (provider, model, response time, size, estimated cost, shop sources used) and your optional rating with an optional comment. This data is not linked to customer accounts or orders and is deleted after 90 days. We review it to identify incorrect or missing answers and to improve the assistant.

The legal basis for answering is Article 6(1)(b) GDPR where your question prepares a purchase, and otherwise Article 6(1)(f) GDPR (legitimate interest in answering shop questions). Abuse prevention and quality review rely on Article 6(1)(f) GDPR. No automated decision within the meaning of Article 22 GDPR takes place. The assistant’s answers are non-binding; the product pages, checkout and legal texts prevail.

13. Your rights

Subject to statutory conditions, you have rights to access, rectification, erasure, restriction and portability (Articles 15 to 20 GDPR). You can object to processing based on legitimate interests on grounds relating to your situation, and to direct marketing at any time (Article 21 GDPR). You may withdraw consent at any time for future processing. Contact: shop@lelumare.com.

You can complain to a supervisory authority, particularly where you live, work or believe an infringement occurred. Our competent authority is the North Rhine-Westphalia Commissioner for Data Protection and Freedom of Information (LDI NRW).

Last updated: 16 October 2026