Privacy Policy

This Privacy Policy explains how EUcommerce, MB processes your personal data when you visit lumimicosmetics.com (the "Website"), place an order, contact us or subscribe to our newsletter. We process personal data in accordance with the EU General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Law on Legal Protection of Personal Data of the Republic of Lithuania and other applicable legislation.

Last updated: 17 September 2026

1. Data controller

The controller of your personal data is:

EUcommerce, MB
Company code: 306654141
VAT ID: LT100016611014
Address: Perkūnkiemio g. 19, LT-12120 Vilnius, Lithuania
Email: hello@lumimicosmetics.com
Phone: +370 699 09209

For any questions about this Policy or the processing of your personal data, please contact us by email at hello@lumimicosmetics.com.

2. What data we process, why and for how long

We only process personal data where we have a legal basis under Article 6 GDPR. The table below sets out the purposes, the categories of data, the legal basis and the retention period.

Purpose	Data	Legal basis	Retention
Orders and delivery – accepting, processing and delivering your order, invoicing, handling returns and warranty claims, communicating about the order	name, surname, email, phone number, delivery address or parcel locker, billing address, company details (if buying as a business), ordered products, order amount, payment method and status, order history, IP address	Performance of a contract (Art. 6(1)(b) GDPR); legal obligation – accounting and tax law (Art. 6(1)(c))	10 years from the end of the financial year in which the order was made (accounting requirements)
Customer account – if you register an account on the Website	name, email, password (encrypted), addresses, order history	Performance of a contract (Art. 6(1)(b))	Until you delete the account or after 3 years of inactivity
Customer support – answering inquiries sent by email, contact form, social media or phone	name, email, phone number, content of the inquiry, order number	Legitimate interest in responding to inquiries (Art. 6(1)(f)); steps prior to entering a contract (Art. 6(1)(b))	2 years after the inquiry is resolved
Direct marketing – newsletters, offers and product news by email; reminders about an unfinished order (abandoned cart)	email, name, country, language, purchase and browsing history, newsletter interaction data (opens, clicks)	Your consent (Art. 6(1)(a)); for existing customers – legitimate interest to offer similar products (Art. 6(1)(f), with the right to object at any time)	Until you withdraw consent or object, or 3 years after your last interaction with us
Product reviews – collecting and publishing reviews of products you have bought	name, email, country, rating, review text, order number	Your consent (Art. 6(1)(a)); legitimate interest in showing genuine reviews (Art. 6(1)(f))	Until the review is deleted at your request or the product is no longer sold
Website analytics and advertising – measuring how the Website is used and the effectiveness of advertising, showing personalised ads on Meta (Facebook, Instagram) and Google	cookie identifiers, IP address, device and browser data, pages viewed, products added to cart, purchases; for conversion measurement – hashed (pseudonymised) email, phone number, name and address	Your consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy Directive)	See the cookie table in section 7; analytics data up to 14 months (Google Analytics), advertising data up to 2 years
Website security and operation – ensuring the Website works, preventing fraud, abuse and attacks, keeping server logs	IP address, browser type, date and time of visit, requested pages, error messages	Legitimate interest in the security of the Website (Art. 6(1)(f))	Server logs – up to 12 months
Establishing, exercising or defending legal claims	data relating to the specific order or dispute	Legitimate interest (Art. 6(1)(f))	For the statutory limitation period (up to 10 years)

Providing the data marked as required when placing an order is necessary to conclude and perform the contract – without it we cannot accept or deliver your order. Providing data for marketing purposes is voluntary.

3. Where we get your data from

We mainly receive personal data directly from you – when you place an order, create an account, fill in a form, write to us or subscribe to the newsletter. We also receive data from your device (cookies and similar technologies, see section 7), from payment service providers (payment confirmation) and from delivery companies (parcel status).

4. Who we share your data with

We do not sell your personal data. We share it only with service providers (processors) who process data on our behalf and under our instructions, or with independent controllers where necessary to perform the contract:

Payment service providers: Montonio Finance UAB (bank links, card payments, MobilePay), Stripe Payments Europe Ltd (card payments, Apple Pay, Google Pay, Klarna, Bancontact, iDEAL and other local methods), PayU S.A. (Czech Republic), Klarna Bank AB. We never receive or store your full card number – payments are made in the provider's secure environment.
Delivery and logistics partners: NoParcels (shipping platform), Omniva, Unisend and LP Express (AB Lietuvos paštas), Packeta (Zásilkovna s.r.o.), DHL and other postal operators depending on the delivery country. They receive your name, phone number, email, delivery address or parcel locker.
Email marketing: UAB Omnisend (Lithuania) – sending newsletters, order and shipping notifications, abandoned cart reminders.
Analytics and advertising: Google Ireland Ltd (Google Analytics 4, Google Tag Manager, Google Ads), Meta Platforms Ireland Ltd (Meta Pixel and Conversions API for Facebook and Instagram advertising).
Hosting and IT: Hostinger (servers in the European Union), WordPress/WooCommerce infrastructure, IT maintenance providers.
Accounting, legal and other advisers – to the extent necessary to fulfil legal obligations.
Public authorities (tax authorities, courts, law enforcement, consumer protection) – where required by law.

5. Transfers outside the European Economic Area

We store data on servers within the EU. Some of our service providers (Google, Meta, Stripe) may transfer data to the United States or other third countries. In such cases we ensure an adequate level of protection: the provider is certified under the EU-US Data Privacy Framework (Commission adequacy decision) and/or we have concluded the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). You may request a copy of the safeguards by contacting us.

6. Automated decision-making and profiling

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. For marketing purposes we may segment customers (e.g. by purchase history, country or language) to send more relevant offers. You can object to this at any time.

7. Cookies and similar technologies

Cookies are small text files stored on your device. We use strictly necessary cookies without your consent; analytics and advertising cookies are used only with your consent, which you can give or withdraw at any time in the cookie settings of the Website or by changing your browser settings. Blocking necessary cookies may affect the operation of the cart and checkout.

Cookie	Provider	Purpose	Duration
Strictly necessary
woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_*	lumimicosmetics.com	Shopping cart and checkout session	Session / 2 days
wp-wpml_current_language, wcml_client_currency, wcml_client_currency_language	lumimicosmetics.com	Remembers your language and currency	1 day
__stripe_mid, __stripe_sid	Stripe	Payment security and fraud prevention	1 year / 30 minutes
montonio_tz	Montonio	Time zone for payment processing	Session
Functional
woodmart_recently_viewed_products	lumimicosmetics.com	Shows recently viewed products	Session
sbjs_*	lumimicosmetics.com (WooCommerce)	Records the source from which you came to the Website for order attribution	Session / 6 months
Analytics (with consent)
_ga, _ga_*	Google Analytics	Distinguishes visitors and sessions, Website usage statistics	2 years
omnisendSessionID, omnisendAnonymousID, page-views	Omnisend	Links Website activity to your newsletter profile (only if you are a subscriber)	Session / 1 year
Advertising (with consent)
_fbp, _fbc	Meta (Facebook, Instagram)	Measures ad effectiveness and shows personalised ads	3 months
pd_vid	lumimicosmetics.com	Random visitor ID, sent to Meta in hashed form (external_id) to match ad events	1 year
pd_capi_id	lumimicosmetics.com	Hashed (SHA-256) email, phone and name from checkout or from our email links – to match ad events with Meta	180 days
_gcl_au	Google Ads	Conversion measurement for Google advertising	3 months
pys_*	lumimicosmetics.com	Supports pixel events (traffic source, landing page)	Session / 1 year

Server-side conversion tracking. With your consent to advertising cookies, we also send purchase and cart events to Meta (Conversions API) and Google (Measurement Protocol) from our server. Contact data in such events (email, phone, name) is hashed before sending, and the same event is deduplicated so it is not counted twice.

Customer lists for advertising. Based on our legitimate interest, we share the email address, phone number, first and last name, city and country of our customers and newsletter subscribers with Meta Platforms Ireland Ltd in hashed form (irreversibly encoded with SHA-256), so that we can show relevant ads on Facebook and Instagram, exclude existing customers from certain ads and find similar audiences. Meta uses this data only to match it with its users and deletes data that does not match. People who have unsubscribed from our newsletter are not included in these lists. You can object at any time by writing to hello@lumimicosmetics.com – we will remove your data at the next update of the lists.

Social media content. The Website may display content from Instagram and Facebook. When such content loads, Meta may set its own cookies and receive your IP address. Meta's processing is governed by Meta's Privacy Policy.

You can manage cookies in your browser settings (Chrome, Firefox, Safari) and opt out of Google Analytics using the browser add-on.

8. Data security

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss or disclosure: the Website is served over an encrypted (HTTPS/TLS) connection, access to data is restricted to persons who need it for their work, passwords are stored encrypted, servers are protected by firewalls and monitored, and backups are made regularly. Payment data is processed only by licensed payment institutions.

9. Children

The Website and our products are intended for persons aged 16 and over. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Your rights

Under the GDPR you have the following rights:

Access – to find out whether we process your data and to receive a copy of it (Art. 15).
Rectification – to have inaccurate or incomplete data corrected (Art. 16).
Erasure ("right to be forgotten") – to have your data deleted where there is no longer a legal basis to keep it (Art. 17).
Restriction of processing – in the cases provided for in Art. 18.
Data portability – to receive the data you provided in a structured, commonly used, machine-readable format (Art. 20).
Objection – to object to processing based on legitimate interest, including direct marketing, at any time (Art. 21).
Withdrawal of consent – at any time, without affecting the lawfulness of processing carried out before withdrawal. You can unsubscribe from the newsletter using the link in every email.
Complaint – to lodge a complaint with a supervisory authority. In Lithuania this is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, LT-10312 Vilnius, ada@ada.lt, vdai.lrv.lt. You may also complain to the supervisory authority of your EU member state of residence.

To exercise your rights, write to hello@lumimicosmetics.com. We may ask you to confirm your identity. We will respond within one month; in complex cases this period may be extended by a further two months, in which case we will inform you. Exercising your rights is free of charge, unless requests are manifestly unfounded or excessive.

11. Changes to this Policy

We may update this Policy when our services or legal requirements change. The current version is always published on this page with the date of the last update. In the event of significant changes, we will inform registered customers and subscribers by email.