1. Who We Are
LUME LOAM ('we', 'us', 'our') is a global D2C artisanal home & living brand selling handmade brass, copper, bronze, and tin-lined metalware — each piece made by a named artisan, to order. Our Shopify store is operated by [LEGAL COMPANY NAME], incorporated in [COUNTRY OF INCORPORATION], registered address: [REGISTERED ADDRESS].
Our website: [www.lumeloam.com]. For all privacy matters:
- Email: [lumeloam@dekulture.com]
- Post: [REGISTERED ADDRESS]
- We respond to all privacy requests within 30 calendar days (or sooner as required by applicable law).
2. What Personal Data We Collect
2.1 Data You Provide Directly
| Data Type |
Why We Collect It |
| Full name |
Order processing, account creation, personalised gift notes |
| Delivery & billing address |
Order fulfilment, invoicing, customs declarations |
| Email address |
Order confirmation, dispatch & delivery updates, optional marketing |
| Phone number |
Courier delivery notifications (where provided by you) |
| Payment details |
Processed securely by our payment gateway — we do not store full card numbers |
| Order history & purchase records |
Customer service, repeat orders, care & repair programme records |
| Bespoke / personalisation instructions |
Hand-etching, engraving, monogram, custom inscription fulfilment |
| Customer service messages |
Resolving queries, returns, complaints |
| Product reviews & photos |
Displaying on our website with your permission |
| Newsletter sign-up preferences |
Email marketing (opt-in only; you can unsubscribe at any time) |
| Garden quiz / product finder inputs |
Personalised product recommendations |
2.2 Data Collected Automatically
When you visit our Site, we and our technology partners may automatically collect:
- IP address and approximate location (country / region)
- Browser type, device type, and operating system
- Pages visited, time on page, referring URL, clicks, and scrolls
- Session recordings and heatmap data (where you have given consent)
- Cookie identifiers and advertising pixel data (subject to your cookie consent choices — see Section 9)
2.3 Data from Third Parties
- Payment processors (e.g. Shopify Payments, Stripe, PayPal, Razorpay) share transaction status with us
- Courier and logistics partners share delivery status and proof-of-delivery data
- Social media platforms may share limited data if you use social login or interact with embedded content
- Review platforms may share your review content with us
3. How We Use Your Personal Data
| Purpose |
Legal Basis (EU / UK GDPR) |
| Processing and fulfilling your order — including made-to-order production |
Contractual necessity |
| Communicating order confirmation, production updates, dispatch, and delivery |
Contractual necessity |
| Sending bespoke / personalisation order details to our artisan makers |
Contractual necessity |
| Managing repairs, re-polishing, and re-tinning service requests |
Contractual necessity / Legitimate interests |
| Resolving returns, refunds, exchanges, and customer service queries |
Contractual necessity |
| Fraud prevention and security |
Legitimate interests / Legal obligation |
| Sending marketing emails, newsletters, and new-batch announcements — opt-in only |
Consent |
| Abandoned cart reminders — where you opted in or applicable law permits |
Consent / Legitimate interests |
| Personalising product recommendations |
Legitimate interests / Consent |
| Website analytics to improve our site and products |
Legitimate interests / Consent |
| Complying with tax, customs, accounting, and legal obligations |
Legal obligation |
| Operating loyalty, referral, or affiliate programme benefits |
Contractual necessity / Consent |
4. Who We Share Your Data With
We share your data only as necessary and never sell your personal information to third parties for their own marketing.
| Recipient Category |
Purpose |
| Shopify Inc. (platform provider) |
Store infrastructure, payments, checkout, data hosting |
| Payment gateway providers |
Secure payment processing (Shopify Payments, Stripe, PayPal, Klarna, Razorpay, others) |
| Courier & logistics partners |
Order shipment and delivery (e.g. DHL, FedEx, Aramex, India Post, local carriers) |
| Artisan makers & workshop partners |
Made-to-order production and personalisation fulfilment |
| Fulfilment / warehouse partners |
Order picking, packing, and dispatch |
| Email marketing platforms |
Newsletter and transactional email delivery (e.g. Klaviyo, Mailchimp) |
| SMS / WhatsApp marketing providers |
Transactional and marketing messages (where you have consented) |
| Analytics providers |
Google Analytics 4, Shopify Analytics — website performance measurement |
| Advertising platforms |
Meta Pixel, Google Ads, Pinterest Tag, TikTok Pixel (subject to cookie consent) |
| Review platforms |
Customer review collection and display |
| Accounting / tax tools |
Financial record-keeping and tax / GST compliance |
| Customs and border authorities |
Required for international shipments (recipient name, address, order value, contents) |
| Legal or regulatory authorities |
Where required by applicable law or valid legal process |
All third-party processors are contractually bound to use your data only for the stated purpose and to maintain appropriate security measures.
5. International Data Transfers
Because we operate globally and use international service providers, your data may be transferred to countries outside your home country — including India, the United States, and countries within the EU. Where we transfer personal data internationally, we rely on appropriate safeguards including Standard Contractual Clauses (SCCs), Shopify's data transfer mechanisms, and adequacy decisions where applicable. Contact [lumeloam@dekulture.com] for details of specific safeguards.
6. Data Retention
| Data Category |
Retention Period |
| Order records (name, address, items, payment confirmation) |
7 years from order date (legal / tax obligation) |
| Made-to-order and bespoke production records |
7 years (financial records) + as long as repair programme is active |
| Repair / re-polishing / re-tinning service records |
Duration of the repair programme relationship + 3 years |
| Customer account data |
Duration of account + 2 years after last activity |
| Marketing contact data |
Until you unsubscribe or request deletion |
| Customer service communications |
3 years from resolution |
| Analytics data |
As configured per platform (typically 14 months for Google Analytics 4) |
| Cookie / advertising identifiers |
Per Cookie Policy — typically 30 days to 13 months |
| Fraud prevention data |
Up to 5 years where legally required |
7. Your Privacy Rights
| Right |
What It Means |
| Access |
Request a copy of personal data we hold about you |
| Correction / Rectification |
Ask us to correct inaccurate or incomplete data |
| Deletion / Erasure |
Ask us to delete your data (subject to legal retention obligations) |
| Restriction |
Ask us to limit how we process your data in certain circumstances |
| Data Portability |
Receive your data in a structured, machine-readable format |
| Object |
Object to processing based on legitimate interests or for direct marketing |
| Withdraw Consent |
Withdraw any previously given consent at any time — does not affect prior processing |
| Opt Out of Sale/Sharing (US) |
Opt out of 'sale' or 'sharing' of personal information under CCPA/CPRA |
| Non-discrimination (US) |
We will not discriminate against you for exercising your privacy rights |
To exercise any right: email [lumeloam@dekulture.com] with your full name, the email used at checkout, and the right you wish to exercise. We respond within 30 days. We may ask you to verify your identity before fulfilling sensitive requests.
You may also complain to your local data protection authority — EU: your national DPA; UK: the ICO (ico.org.uk); India: the Data Protection Board of India (once operational); Australia: the OAIC (oaic.gov.au).
8. Data Security
We implement appropriate technical and organisational measures to protect your personal data, including:
- SSL/TLS encryption for all data in transit on our Site
- Shopify's PCI-DSS compliant payment infrastructure — we never store full payment card numbers
- Access controls limiting who within our organisation can access personal data
- Regular review of data-handling practices and third-party processor agreements
No digital system can be guaranteed 100% secure. If you suspect unauthorised access to your account, contact [lumeloam@dekulture.com] immediately.
9. Cookies & Tracking Technologies
We use cookies and similar technologies to operate our Site and personalise your experience. Full details are in our Cookie Policy (Policy 5 of this suite). In summary:
- Essential cookies — required for the Site to function (cart, checkout, security); no consent needed
- Functional cookies — remember your language, currency, and browsing preferences
- Analytics cookies — Google Analytics 4, Shopify Analytics (consent required in EU/UK)
- Marketing/advertising cookies — Meta Pixel, Google Ads, Pinterest Tag, TikTok Pixel (consent required)
- Personalisation cookies — product recommendations, gift-finder preferences
Manage your cookie preferences at any time via the 'Cookie Preferences' link in our footer. EU and UK visitors can reject non-essential cookies without affecting core site functionality.
10. Children's Privacy
Our Site is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected a child's data, contact [lumeloam@dekulture.com] immediately and we will delete it.
11. Marketing Communications
We send marketing emails, newsletters, and new small-batch announcements only to those who have opted in. You can withdraw consent at any time:
- Click 'Unsubscribe' in any marketing email
- Reply STOP to any SMS marketing message
- Email [lumeloam@dekulture.com] requesting removal
Unsubscribing from marketing does not affect transactional messages about your order.
12. Jurisdiction-Specific Addendums
12a. EU & UK (GDPR / UK GDPR)
Our legal bases for processing personal data are listed in Section 3. Where we rely on legitimate interests, we have balanced these against your rights. If you require information about our EU/UK representative (Art. 27 GDPR), contact [lumeloam@dekulture.com]. EU customers may access the Online Dispute Resolution platform at ec.europa.eu/odr.
12b. California (CCPA / CPRA)
California residents have rights to know, delete, opt out of sale/sharing, and non-discrimination. We do not 'sell' personal information in the traditional sense. We do share identifiers and browsing activity with advertising platforms (Meta, Google, Pinterest, TikTok) which may constitute 'sharing' under CCPA/CPRA. California residents may opt out via our Cookie Preferences. Submit requests with 'CCPA Request' in the subject to [lumeloam@dekulture.com].
12c. Australia (Privacy Act 1988)
We handle Australian customers' data in accordance with the Australian Privacy Principles (APPs). To access, correct, or complain about your information, contact [lumeloam@dekulture.com]. Unresolved complaints may be referred to the OAIC (oaic.gov.au).
12d. Canada (PIPEDA)
Canadian customers have rights under PIPEDA. We collect only information necessary for the purposes described, with your knowledge and consent. To access your data or withdraw consent, contact [lumeloam@dekulture.com].
12e. India (DPDP Act 2023)
As a Data Fiduciary under the Digital Personal Data Protection Act 2023, we process personal data for lawful purposes. Indian customers have the right to access, correct, and erase their personal data. Contact [lumeloam@dekulture.com] for any requests.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated by email or prominent notice on our Site. The 'Last Updated' date below reflects the current version. Continued use of the Site after changes constitutes acknowledgement.
