Privacy policy

Privacy Policy

Effective from 31 October 2026.

1. Data controller

The controller of your personal data is Romuald Lubiński LUMANO, ul. Josepha Conrada 13, 01-922 Warsaw, Poland, NIP: 1182316903, REGON: 543131960. For any data-related matters, write to lumano.pl@gmail.com.

2. What data we process and why

  • Fulfilling your order – name, delivery address, e-mail, phone number (if provided), order details. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
  • Accounting and tax – order and invoice data. Legal basis: legal obligation (Art. 6(1)(c) GDPR). Kept for the period required by tax law (usually 5 years from the end of the tax year).
  • Complaints, returns, exchanges and enquiries – data you provide in your message. Legal basis: legitimate interest in handling requests and defending against claims (Art. 6(1)(f) GDPR).
  • Abandoned checkout reminders – the e-mail address entered at checkout if you don’t complete your order. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). You can unsubscribe with one click in the message.
  • Newsletter – your e-mail address, if you sign up. Legal basis: consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
  • Analytics and marketing – website usage data collected through cookies and pixels (e.g. Pinterest, Meta). Legal basis: consent given in the cookie banner (Art. 6(1)(a) GDPR).

Providing data is voluntary, but we cannot ship an order without the data needed to fulfil it.

3. Who we share data with

We share data only with providers that help us run the store:

  • Shopify International Ltd. (Ireland) – store platform,
  • InPost sp. z o.o. and other carriers – delivery,
  • payment providers (Shopify Payments / Stripe, PayPal, Klarna, BLIK, Apple Pay, Google Pay) – payment processing,
  • analytics and advertising providers (e.g. Pinterest, Meta) – only with your consent given in the cookie banner,
  • our accounting office – bookkeeping.

Some of these providers may process data outside the European Economic Area, e.g. in the USA. Such transfers are based on a European Commission adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses.

4. How long we keep data

We keep data for as long as needed to perform the contract, and then until claims become time-barred and for the period required by tax law. Data processed on the basis of consent is kept until consent is withdrawn.

5. Your rights

You have the right to access, rectify and erase your data, to restrict processing, to data portability, to object to processing based on legitimate interest, and to withdraw consent at any time (without affecting the lawfulness of earlier processing). To exercise these rights, write to lumano.pl@gmail.com.

You also have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or with the authority in your country of residence.

6. Cookies

The website uses cookies necessary for the store to work (cart, checkout, security) and – with your consent – analytics and marketing cookies. You can change your choice at any time in the privacy settings in the website footer or in your browser settings.

7. Automated decisions

We do not make decisions about you based solely on automated processing that produce legal effects.