Privacy Policy

Privacy Policy of luniumsystems.de

This policy helps you understand what data we collect, why we collect it, and what rights you have in this regard.

Last updated: November 8, 2026

Provider and Data Controller

Lunium GmbH
Ludwigstr. 8
80539 Munich
Germany
Represented by Managing Director Kerem Acikgöz
Commercial Register: Munich District Court, HRB 312044
VAT ID: DE462409483

Provider's email address: support@luniumsystems.de

Types of Data Collected

The personal data processed by this website either on its own or by third parties includes: trackers, usage data, email, payment data, first name, last name, data related to the point of sale, device information, clicks, purchase history, browser history, session statistics, referrer URL, country, product interaction, number of users, delivery address, and telephone number.

Full details on each type of personal data processed are provided in the relevant sections of this privacy policy or, in some cases, in explanatory texts displayed before the data is collected.

Personal data may be voluntarily provided by the user or, in the case of usage data, automatically collected when this website is used.

Unless otherwise stated, providing all data requested by this website is mandatory. If the user refuses to provide the data, this website may not be able to provide its services to the user. In cases where this website expressly states that the provision of personal data is voluntary, users may choose not to provide this data without any consequences for the availability or functionality of the service.

Users who are unsure about which personal data is mandatory can contact the provider.

Any use of cookies—or other tracking tools—by this website or third-party service providers used by this website is intended to provide the service requested by the user and for all other purposes described in this document and in the Cookie Policy.

Users are responsible for all third-party personal data that is obtained, published, or disclosed through this website.

Type and Location of Data Processing

Processing Methods

The provider processes users' personal data in a proper manner and takes appropriate security measures to prevent unauthorized access to, transmission, alteration, or destruction of data.

Data processing is carried out using computers or IT-based systems according to organizational procedures and practices specifically designed for the stated purposes. In addition to the data controller, other persons may also operate this website internally (human resources, sales, marketing, legal department, system administrators) or externally—and in that case, where necessary, appointed by the data controller as a data processor (such as technical service providers, delivery companies, hosting providers, IT companies, or communication agencies)—and thus have access to the data. An up-to-date list of these parties can be requested from the provider at any time.

Location

Data is processed at the provider's place of business and at all other locations where the parties involved in data processing are located.

Depending on the user's location, data transfers may involve the transfer of the user's data to a country other than their own. To learn more about the location where the transmitted data is processed, users can consult the section providing detailed information on the processing of personal data.

Retention Period

Unless otherwise specified in this document, personal data will be processed and stored for as long as is necessary to fulfill the purpose for which it was collected, and may be retained longer if required by a legal obligation or based on the user's consent.

Purposes of Processing

Personal data about the user is collected so that the provider can provide the service and, furthermore, comply with its legal obligations, respond to enforcement claims, protect its rights and interests (or those of the user or third parties), and uncover malicious or fraudulent activities. In addition, data is collected for the following purposes: payment processing, platform services and hosting, analytics, contacting the user, optimization and distribution of traffic, tag management, interaction with external social networks and platforms, as well as shipping and delivery.

Detailed Information on the Processing of Personal Data

Analytics

With the services listed in this section, the provider can monitor and analyze traffic and track user behavior.

Shopify Analytics

Shopify Analytics is an analytics service provided by Shopify Inc.

Personal data processed: browser history, purchase history, device information, clicks, country, usage data, product interaction, session statistics, trackers, referrer URL.

Service provided by: Shopify Inc. (Canada)—Privacy Policy

Google Analytics 4

Google Analytics 4 is a web analytics service provided by Google Ireland Limited ("Google"). Google uses the collected data to track and analyze how this website is used, create reports on user activity, and use this information together with other Google services. Google may use the collected data to contextualize and personalize ads in its own advertising network. In Google Analytics 4, IP addresses are used at the time of collection and then deleted before the data is stored in a data center or on a server. Users can learn more by reviewing Google's official documentation.

To understand how Google uses data, consult Google's Partner Policies and Business Data Page.

Personal data processed: number of users, usage data, session statistics, trackers.

Service provided by: Google Ireland Limited (Ireland)—Privacy Policy—Opt-out

Interaction with External Social Networks and Platforms

This type of service enables interaction with social networks or other external platforms directly through this website. Interaction and the information collected through this website are always subject to the privacy settings the user has selected for the respective social network. This type of service may continue to collect web traffic data for the pages on which the service is installed, even if users do not use it. It is recommended to opt out of the respective services to ensure that the processed data is not linked back to the user's profile through this website.

PayPal Button and Widgets

The PayPal button and widgets are services for interacting with PayPal's PayPal network.

Personal data processed: usage data, trackers.

Service provided by: PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg)—Privacy Policy

Contacting the User

Contact Form

By filling out the contact form with their data, users authorize this website to use this information to respond to inquiries about information, offers, or other matters stated in the form's header.

Personal data processed: email, usage data.

Optimization and Distribution of Traffic

With this type of service, this website can distribute its content via servers located in various countries and optimize its performance. Which personal data is processed depends on the characteristics and implementation of the services, whose function is to filter communication taking place through this website and the user's browser. Given the widespread use of this system, it is difficult to determine the locations where content containing users' personal data is delivered.

Cloudflare

Cloudflare is a service provided by Cloudflare Inc. for optimizing and distributing traffic. Due to the way Cloudflare's features are integrated, the service filters all traffic taking place through this website—that is, communication taking place through this website and the user's browser—while also enabling the collection of analytics data contained in this website.

Personal data processed: trackers; various types of data as described in the service's privacy policy.

Service provided by: Cloudflare, Inc. (United States)—Privacy Policy

Platform Services and Hosting

These services are intended to host and operate the application's main components for this website so that this website can be offered from a single platform. Such platforms provide the provider with a range of tools—for example, analytics and commenting features, user and database management, e-commerce, and payment processing—that involve the processing of personal data. Some of these services use geographically distributed servers, making it difficult to determine where the personal data is stored.

Shopify

Shopify is a platform provided by Shopify Inc. that allows the provider to create, host, and operate an e-commerce website. This service can place trackers on the user's device. The most up-to-date and comprehensive information can be found in the service's official documentation.

Personal data processed: device information, usage data, trackers.

Service provided by: Shopify Inc. (Canada)—Privacy Policy

Tag Management

This type of service helps the provider centrally manage the tags or scripts required for this website. This means that user data flows through these services and may be stored.

Google Tag Manager

Google Tag Manager is a service provided by Google Ireland Limited for managing tags. To understand how Google uses data, consult Google's Partner Policies and Business Data Page.

Personal data processed: usage data, trackers.

Service provided by: Google Ireland Limited (Ireland)—Privacy Policy

Payment Processing

Unless otherwise stated, this website processes all payments by credit card, bank transfer, or otherwise through third-party payment service providers. Generally, and unless otherwise stated, users are asked to provide their payment and personal data directly to these payment service providers. This website is not involved in collecting and processing such information, but only receives a notification from the respective payment service provider as to whether the payment was successfully completed.

American Express

American Express is a payment service provided by American Express Company that allows users to make online payments.

Personal data processed: email, usage data, trackers, payment data.

Service provided by: American Express Company (United States)—Privacy Policy

Apple Pay

Apple Pay is a payment service provided by Apple Inc. that allows users to make payments with their mobile phones.

Personal data processed: usage data, trackers, payment data.

Service provided by: Apple Inc. (United States)—Privacy Policy

Google Pay

Google Pay is a payment service provided by Google Ireland Limited that allows users to make online payments with their Google credentials.

Personal data processed: email, last name, usage data, trackers, first name, payment data.

Service provided by: Google Ireland Limited (Ireland)—Privacy Policy

Mastercard

Mastercard is a payment service provided by Mastercard Inc. that allows users to make online payments.

Personal data processed: email, usage data, trackers, payment data.

Service provided by: Mastercard Inc. (United States)—Privacy Policy

PayPal

PayPal is a payment service that allows users to make online payments. For users in Europe, the service is provided by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.

Personal data processed: email, usage data, trackers, payment data.

Service provided by: PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg)—Privacy Policy

Shop Pay

Shop Pay is a payment management and product checkout service provided by Shopify Inc. that allows users to make online payments on this website.

Personal data processed: data related to the point of sale, usage data, trackers, payment data.

Service provided by: Shopify Inc. (Canada)—Privacy Policy

Visa

Visa is a payment service provided by Visa Inc. that allows users to make online payments.

Personal data processed: email, usage data, trackers, payment data.

Service provided by: Visa Inc. (United States)—Privacy Policy

Shipping and Delivery

To deliver the ordered goods, we pass on your name, delivery address, and—where necessary for delivery—your email address and telephone number to the respective shipping company. Depending on the size and weight of the shipment, these are:

• DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany
• United Parcel Service Deutschland S.à r.l. & Co. OHG, Görlitzer Straße 1, 41460 Neuss, Germany
• trans-o-flex Express GmbH & Co. KGaA, Hertzstraße 10, 69469 Weinheim, Germany

We also use the Sendcloud service (Sendcloud B.V., Stadionplein 10, 5616 RE Eindhoven, Netherlands) to create shipping labels and track shipments.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract). The disclosure of your email address or telephone number to announce delivery is based on our legitimate interest in ensuring smooth delivery (Art. 6(1)(f) GDPR). The data is used exclusively to process the delivery.

Personal data processed: first name, last name, delivery address, email, telephone number.

Cookie Policy

This website uses trackers. Further information is provided in the Cookie Policy.

Further Information for Users in the European Union

This section applies to all users in the European Union pursuant to the General Data Protection Regulation ("GDPR") and replaces any other potentially differing or conflicting information in the privacy policy for these users. Further details on the categories of processed data, the purposes of processing, the categories of recipients of personal data, if any, and other information about personal data can be found in the "Detailed Information on the Processing of Personal Data" section of this document.

Legal Bases for Processing

The provider may only process users' personal data if one of the following applies:

• The users have given their consent for one or more specific purposes;
• the collection of data is necessary for the performance of a contract with the user and/or for pre-contractual measures related to it;
• the processing is necessary to comply with a legal obligation to which the provider is subject;
• the processing is related to a task carried out in the public interest or in the exercise of official authority conferred on the provider;
• the processing is necessary to protect the legitimate interests of the provider or a third party.

In any case, the provider is happy to provide information about the specific legal basis on which the processing is based, in particular whether the provision of personal data is a legal or contractual obligation or a requirement for entering into a contract.

Further information on the retention period

Unless otherwise specified in this document, personal data will be processed and stored for as long as is required for the purpose for which it was collected, and may be retained for longer if necessary to comply with a legal obligation or based on the user's consent.

Therefore:

• Personal data collected for the purpose of fulfilling a contract concluded between the provider and the user will be stored until this contract has been fully performed.
• Personal data collected to protect the legitimate interests of the provider will be retained for as long as is necessary to fulfill these purposes. Users can obtain more information about the provider's legitimate interests in the relevant sections of this document or by contacting the provider.

In addition, the provider is permitted to store personal data for a longer period if the user has consented to such processing, provided that the consent has not been withdrawn. The provider may also be required to retain personal data for a longer period if this is necessary to comply with a legal obligation or an order from an authority.

Once the retention period has expired, personal data will be deleted. Therefore, the right of access, the right to erasure, the right to rectification, and the right to data portability cannot be exercised after the retention period has expired.

The users' rights under the General Data Protection Regulation (GDPR)

Users can exercise certain rights in relation to their data processed by the provider. To the extent permitted by law, users have the right, in particular, to do the following:

• Withdraw their consent at any time. If the user has previously consented to the processing of personal data, they can withdraw their consent at any time.
• Object to the processing of their data. The user has the right to object to the processing of their data if the processing is based on a legal basis other than consent.
• Obtain information about their data. The user has the right to know whether their data is being processed by the provider, to obtain information about individual aspects of the processing, and to receive a copy of the data.
• Review and request rectification. The user has the right to check the accuracy of their data and request that it be updated or corrected.
• Request a restriction on the processing of their data. Users have the right to restrict the processing of their data. In this case, the provider will process the data for no purpose other than storage.
• Request the erasure or other removal of the personal data. Users have the right to request that the provider delete their data.
• Receive their data and have it transferred to another controller. The user has the right to receive their data in a structured, commonly used, and machine-readable format and, where technically possible, to have it transmitted without hindrance to another controller.
• File a complaint. Users have the right to file a complaint with the competent supervisory authority.

Users also have the right to be informed about the legal basis for the transfer of data abroad or to an international organisation subject to international law or established by two or more countries, such as the UN, as well as about the security measures taken by the provider to protect their data.

Details on the right to object to processing

If personal data is processed in the public interest, in the exercise of official authority conferred on the provider, or to protect the legitimate interests of the provider, the user may object to such processing by stating a ground relating to their particular situation.

Users are informed that they can object to the processing of personal data for direct marketing at any time free of charge and without giving any reason. If the user objects to the processing for direct marketing purposes, the personal data will no longer be processed for these purposes. Users can find out whether the provider processes personal data for direct marketing purposes in the relevant sections of this document.

How the rights can be exercised

All requests to exercise users' rights can be directed to the provider using the contact details provided in this document. These requests can be made free of charge and will be answered by the provider as soon as possible, and no later than within one month, and the users will be provided with the legally required information. The provider will communicate any rectification or erasure of personal data, or restriction of processing, to all recipients to whom personal data has been disclosed, if any, unless this proves impossible or involves disproportionate effort. The provider will inform the user about these recipients if the user requests this.

Further information for users in Switzerland

This section applies to users in Switzerland and replaces all other potentially different or conflicting information in the privacy policy for these users.

Further details on the categories of data processed, the purposes of processing, the categories of recipients of personal data, if any, the retention period, and other information about personal data can be found in the section "Detailed information on the processing of personal data" in this document.

The users' rights under the Swiss Federal Act on Data Protection

Users can exercise certain rights in relation to their data within the framework of the legal provisions, including the following:

• the right of access to personal data;
• the right to object to the processing of their personal data (which also enables users to request the restriction of processing, the erasure or destruction of personal data, and the prohibition of the disclosure of certain personal data to third parties);
• the right to receive their personal data and have it transmitted to another controller for processing (data portability);
• the right to request the correction of inaccurate personal data.

How to exercise these rights

All requests to exercise users' rights can be directed to the provider using the contact details provided in this document. Such requests are free of charge and will be answered by the provider as quickly as possible, and the users will receive the legally required information.

Further information on the collection and processing of data

Legal measures

The user's personal data may be processed by the provider for the purposes of enforcing legal claims or in connection with legal proceedings arising from the improper use of this website or the associated services. The user acknowledges that they are aware that the provider may be required by authorities to disclose personal data.

Further information about the user's personal data

In addition to the information listed in this privacy policy, this website can provide the user with further context-specific information upon request relating to specific services or to the collection and processing of personal data.

System logs and maintenance

This website and third-party services may collect files for operational and maintenance purposes that record interactions taking place on this website (system logs), or use other personal data (e.g. IP address) for this purpose.

Information not included in this privacy policy

Further information about the collection or processing of personal data can be requested from the provider at any time using the contact details listed.

Changes to this privacy policy

The provider reserves the right to make changes to this privacy policy at any time, and users will be informed of such changes on this page and, if applicable, through this website and/or – where technically and legally possible – by sending a notification to the users' contact details on file. Users are therefore advised to visit this page regularly and, in particular, to check the date of the last change indicated at the top of the page.

Where changes affect data use based on user consent, the provider will, where necessary, obtain new consent.

Definitions and legal notices

Personal data (or data)

Any information by which, or by which in combination with other information, a natural person is or can be identified.

Usage data

Information that this website (or third-party services used by this website) automatically collects, e.g.: the IP addresses or domain names of the computers of users who use this website, the URI addresses (Uniform Resource Identifier), the time of the request, the method used to send the request to the server, the size of the received response file, the status code indicating the status of the server response (successful result, error, etc.), the country of origin, the features of the browser and operating system used by the user, the various time indications per visit (e.g. how much time was spent on each page of the application), and information about the path followed within an application, in particular the order of the visited pages, as well as other information about the device's operating system and/or the user's IT environment.

User

The person using this website, who, unless otherwise specified, corresponds to the data subject.

Data subject

The natural person to whom the personal data relates.

Data processor (or processor)

A natural or legal person, authority, institution, or other entity that processes personal data on behalf of the controller, as described in this privacy policy.

Controller (or provider)

The natural or legal person, authority, institution, or other entity that alone or jointly with others decides the purposes and means of processing personal data, including the security measures regarding the operation and use of this website. Unless otherwise specified, the controller is the natural or legal person through which this website is offered.

This website (or this application)

The hardware or software tool with which the user's personal data is collected and processed.

Service

The service offered by this website, as described in the relevant Terms and Conditions and on this website.

European Union (or EU)

Unless otherwise specified, all references in this document to the European Union refer to all current member states of the European Union and the European Economic Area (EEA).

Cookie

Cookies are trackers consisting of a small data set stored in the user's browser.

Tracker

The term tracker refers to any technology – e.g. cookies, unique identifiers, web beacons, embedded scripts, e-tags, or fingerprinting – through which users can be tracked, e.g. by enabling access to or storage of information on the user's device.

Legal notice

This statement was drafted on the basis of provisions from various legislations. This statement refers exclusively to this website, unless otherwise specified in this document.

Contact

Lunium GmbH
Ludwigstr. 8
80539 Munich
Germany
Email: support@luniumsystems.de