Privacy policy

Effective date: 18/07/2026

1. Who We Are

The controller of your personal data is:

•      Trading name: Lumatra (brand operated on the website www.lumatra.pl)

•      Registered trade name: Vylor Ventures LLC

•      Registered address: United States of America

•      Contact e-mail: lumatra.pl@gmail.com

2. What Data We Collect

•      Identity and contact data: name, delivery and billing address, e-mail address, phone number

•      Order data: products purchased, order value, payment status

•      Payment data: processed directly by our payment provider; we do not store full card details

•      Technical data: IP address, browser type, device data, cookies and similar technologies

•      Communications: messages you send us via the Contact form or e-mail

3. Purposes and Legal Basis

•      Processing and fulfilling your order, including delivery and returns — performance of a contract (Art. 6(1)(b) GDPR)

•      Handling complaints and warranty claims — performance of a contract and compliance with a legal obligation (Art. 6(1)(b) and (c) GDPR)

•      Issuing invoices and accounting records — compliance with a legal obligation (Art. 6(1)(c) GDPR)

•      Responding to enquiries sent via the Contact form — legitimate interest in operating customer support (Art. 6(1)(f) GDPR)

•      Marketing communications (e.g., newsletter) — consent (Art. 6(1)(a) GDPR), where you have opted in; you may withdraw consent at any time

•      Analytics and advertising cookies — consent, collected via the cookie banner, in accordance with the Polish Telecommunications Law

4. Who We Share Data With

We share personal data, to the extent necessary, with: our e-commerce platform provider (Shopify); payment processors; courier and logistics companies; IT and hosting providers; and, where legally required, tax and public authorities. Each processor acts under a data-processing agreement and only on our documented instructions.

5. International Data Transfers

Because our business is established in the United Arab Emirates and we use service providers located outside the European Economic Area (including in the UAE and, via Shopify's infrastructure, potentially other countries), your data may be transferred outside the EEA. Where this happens, we rely on the European Commission's Standard Contractual Clauses or another legally recognised transfer mechanism. You may request a copy of the relevant safeguard by contacting us.

6. Retention

We retain order and invoicing data for the period required by applicable tax and accounting law (generally 5 years from the end of the relevant tax year). Marketing consent data is retained until you withdraw consent. Contact-form enquiries are retained for as long as necessary to resolve the matter, and no longer than 180 days.

7. Your Rights

Subject to the conditions set out in the GDPR, you have the right to: access your data; rectify inaccurate data; request erasure; request restriction of processing; object to processing based on legitimate interest or for direct marketing; request data portability; and withdraw consent at any time without affecting the lawfulness of processing before withdrawal. You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (Urząd Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warsaw, www.uodo.gov.pl.

8. Cookies

The Store uses cookies and similar technologies that are necessary for its operation, as well as optional analytics and advertising cookies, which are only set with your consent given via the cookie banner. You can manage or withdraw your consent at any time through your browser settings or the cookie preference tool on the Store.

9. Changes to This Notice

We may update this Privacy Notice from time to time, for example to reflect changes in the law or in our processing activities. The current version is always be updated here.