Privacy Policy

The controller is Lumo Group s. r. o., registered seat Vyšný Orlík 51, 090 11 Vyšný Orlík, Slovak Republic, Company ID (IČO): 57 720 975. Data-protection contact: contact@3lumo.com.

Identity & contact data: name, e-mail address, shipping and billing address, phone number (if provided).

Order data: products purchased, amounts, order history.

Payment data: payments are processed by Stripe; we do not store full card numbers (PAN) — we only handle identifiers and limited data returned by Stripe.

Account & sign-in data: managed by our identity provider (ZITADEL).

Technical data: essential cookies and basic server logs required to operate and secure the Site (see the Cookie Policy).

Performance of a contract (Art. 6(1)(b) GDPR): processing and delivering your order, account management, customer support.

Legal obligation (Art. 6(1)(c) GDPR): accounting and tax duties, issuing and retaining documents.

Legitimate interest (Art. 6(1)(f) GDPR): securing the Site, fraud and abuse prevention.

Consent (Art. 6(1)(a) GDPR): non-essential cookies and any marketing communications; you may withdraw consent at any time.

We share your data, only as necessary, with these categories of recipients: Stripe Payments Europe, Ltd. (payment processing); the ZITADEL identity provider (authentication); our e-mail/SMTP provider (transactional e-mails such as order confirmations); our hosting and storage provider (infrastructure and media storage); and the carrier delivering your parcel.

Each processor is engaged under a data-processing agreement per Art. 28 GDPR. We do not sell your data.

Where a provider processes data outside the European Economic Area, we ensure appropriate safeguards under GDPR (e.g. the European Commission's Standard Contractual Clauses).

Order data and accounting documents are kept for the period required by tax and accounting law. Account data is kept for the life of the account. Once the purpose ends, we delete or anonymise the data.

You have the right to access, rectification, erasure, restriction of processing, data portability, the right to object to processing based on legitimate interest, and the right to withdraw consent at any time.

Exercise your rights at contact@3lumo.com. You also have the right to lodge a complaint with the supervisory authority: Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava (https://dataprotection.gov.sk).

We apply appropriate technical and organisational measures to protect data, including encrypted transport (TLS) and access controls. No transmission over the internet is, however, completely secure.

If you write to one of our support e-mail addresses (support@3lumo.com for technical issues and requests, or contact@3lumo.com for general enquiries), the content of your message may be processed by an artificial-intelligence system (the Anthropic API) to classify your request and draft a suggested reply. This processor is engaged under an Art. 28 GDPR data-processing agreement.

No payment or card data is involved in this processing. Every reply is reviewed and approved by a human before it is sent — the AI never sends replies on its own.

We may update this policy; the current version with its effective date is always available on this page.