Privacy Policy

Last updated: 19 August 2026

1. Who processes your data

The controller of personal data for the LUMEA Cosmetics shop is:

We process data in accordance with Regulation (EU) 2016/679 (GDPR) and Romanian Law no. 190/2018.

2. What data we collect

Data you give us

• When you order: first and last name, delivery address, billing address, email, phone; for companies, the name, VAT number and registration number.
• When you create an account: email, password (stored encrypted), order history.
• When you subscribe to the newsletter: your email address.
• When you write to us: the content of the message and the contact details in it.

Data collected automatically

• IP address, browser and device type, pages visited, date and time — from the server’s technical logs.
• Cookies and similar technologies, described in our Cookie Policy.

Data we do NOT hold

We do not collect or store your card details. The card number, expiry date and CVV are entered directly in the payment processor’s PCI DSS certified environment. We only receive confirmation of the transaction result and, where applicable, the last four digits of the card, to identify the payment.

We do not process special categories of data (health data). If you volunteer information about your skin or your health in a support message, we use it solely to reply to you and do not store it for any other purpose.

3. Purposes and legal bases

Purpose	Legal basis
Taking, processing and delivering your order; order-related communications	Performance of the contract (art. 6(1)(b) GDPR)
Issuing invoices, accounting records, archiving	Legal obligation (art. 6(1)(c) GDPR)
Handling returns, complaints and warranties	Contract and legal obligation
Creating and managing your customer account	Performance of the contract
Sending the newsletter	Consent (art. 6(1)(a) GDPR), withdrawable at any time
Fraud prevention, site security, technical logs	Legitimate interest (art. 6(1)(f) GDPR)
Defending our rights in the event of a dispute	Legitimate interest

Providing the order data is necessary to conclude the contract: without it we cannot process and deliver your order. Newsletter data is optional.

4. How long we keep it

• Financial and accounting documents (invoices, proof of payment): 10 years, as required by accounting law.
• Order and delivery data: for the duration of the contractual relationship and afterwards for the limitation period applicable to possible disputes.
• Your customer account: until you ask us to delete it, or after a long period of inactivity.
• Newsletter: until you unsubscribe.
• Support messages: a maximum of three years from the last exchange.
• Server technical logs: the period applied by the hosting provider, generally under 12 months.

5. Who we share it with

We do not sell your data. We share it only with those who help us deliver your order, or where the law requires us to:

• The courier company — name, delivery address, phone, cash-on-delivery amount, in order to deliver the parcel.
• The payment processor — the data needed to authorise the card payment; it receives the card details directly from you.
• The hosting provider — stores the site and the database.
• The email platform used for order notifications and the newsletter.
• Accounting — for financial records.
• Public authorities — at their request, under the conditions set by law.

All providers processing data on our behalf have signed data processing agreements under art. 28 GDPR.

6. Transfers outside the EEA

As a rule we process data in Romania and within the European Economic Area. If a provider processes data outside the EEA, the transfer takes place only on the basis of a European Commission adequacy decision or standard contractual clauses, with supplementary safeguards where needed.

7. Your rights

You have the right of access, rectification, erasure (“the right to be forgotten”), restriction of processing, data portability, objection to processing based on legitimate interest, and the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out beforehand.

You can exercise your rights by writing to us at contact@lumeastore.eu. We reply within one month of receiving your request; for complex requests the deadline may be extended by two months, in which case we will tell you.

You have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) — B-dul G-ral. Gheorghe Magheru 28–30, Bucharest, dataprotection.ro — and to bring the matter before the courts.

We use no automated decision-making producing legal effects on you, and we do not profile for marketing purposes.

8. Data security

The site runs over HTTPS. Passwords are stored encrypted. Access to order data is limited to the people who need it to do their job. We take regular database backups and keep the platform and the plugins we use up to date.

If a data breach occurs that may affect your rights, we notify the ANSPDCP within 72 hours and inform you without undue delay, under arts. 33–34 GDPR.

9. Minors

The shop is aimed at people over 16. We do not knowingly collect data from children below that age without the consent of the holder of parental responsibility. If you learn that a minor has given us data, write to us and we will delete it.

10. Cookies

We use cookies necessary for the cart and the session to work, and we keep your theme preference (light/dark) locally in your browser. The full details are in our Cookie Policy.

11. Changes

We may update this policy. The version in force is the one published here, and the date of the last update appears at the top of the page. If the changes are substantial, we will tell you by email or through a visible notice on the site.

12. Contact

For any question about your data: contact@lumeastore.eu · NEDERMANN LAB SRL, Bd. Eroilor nr. 42, floor 1, apt. 9, 400129 Cluj-Napoca, Cluj County, Romania.