Privacy policy
Privacy Policy
LUCA operates this store and website, including all related information, content, features, tools, products and Services, to provide you, the customer, with a personalised shopping experience (the "Services"). LUCA is powered by Shopify, which enables us to provide the Services to you. This Privacy Policy describes how we collect, use, and disclose your personal information when you visit or use the Services, make a purchase, or otherwise communicate with us.
For the purposes of the General Data Protection Regulation (GDPR), LUCA is the data controller for your personal information.
Please read this Privacy Policy carefully. By using the Services, you indicate that you have read and understood this Privacy Policy.
Personal information we collect
We may collect or process the following categories of personal information, depending on how you interact with the Services:
- Contact details, including your name, address, billing address, shipping address, phone number, and email address.
- Financial information, including payment card details, transaction data, and payment confirmations. Please note: payment card details are processed directly by Shopify Payments or another payment provider and are not stored by us.
- Account information, including your username, preferences, and settings.
- Transaction data, including items you view, purchase, return, or exchange, and your previous orders.
- Communications with us, such as the content of your messages when you contact us.
- Device and usage data, including your IP address, browser type, and how you use the Services, including via cookies (see below).
Sources of personal information
We collect personal information:
- Directly from you, for example when you place an order or contact us.
- Automatically via the Services, for example through cookies and similar technologies when you visit our online store.
- From our service providers, such as Shopify and payment providers, who enable certain technology on our behalf.
How we use your personal information, and on what legal basis
In accordance with the GDPR, we only process your personal information where a legal basis exists:
| Purpose | Legal basis |
|---|---|
| Processing your order, handling payments, arranging shipping, providing customer support | Performance of our contract with you |
| Age verification for orders containing alcoholic beverages | Legal obligation (Dutch Alcohol Act) |
| Fraud and abuse prevention, securing our Services | Our legitimate interest in a secure online store |
| Sending marketing emails (e.g. newsletter, offers) | Your consent, or our legitimate interest in direct marketing to existing customers, depending on the situation — you can unsubscribe at any time |
| Complying with legal obligations (e.g. tax record-keeping requirements) | Legal obligation |
| Analysing and improving our Services | Our legitimate interest in improving our service |
Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal.
Cookies
Our online store uses cookies and similar technologies, including functional cookies (necessary for the cart and checkout process to work) and, where applicable, analytics and marketing cookies. For non-essential cookies, we ask for your prior consent via a cookie banner, where legally required. You can adjust your preferences at any time via the cookie settings on our site.
How we share personal information
We may share your personal information with:
- Shopify and our service providers, who perform services on our behalf (e.g. payment processing, shipping, customer support, hosting).
- Business partners, to the extent you have given your consent or this is necessary to fulfil your order.
- Third parties where legally required, for example in response to a valid request from a competent authority.
We do not sell your personal information to third parties.
Relationship with Shopify
Our Services are hosted by Shopify, which processes personal information about your use of the Services in order to provide them to you. For more information on how Shopify processes your data, and your rights in relation to it, you can consult Shopify's customer privacy policy: www.shopify.com/legal/privacy/consumers.
Third-party websites and links
Our Services may contain links to third-party websites. We are not responsible for the privacy practices of such third parties. Please review their privacy policy before sharing your personal information with them.
Children's data
Our Services are not intended for children under the age of 16. We do not knowingly collect personal information from children. If you believe we may have unintentionally collected a child's data, please contact us using the details below so we can remove it.
Security and retention period
We take appropriate technical and organisational measures to protect your personal information. However, no security measure is completely foolproof.
We do not retain your personal information longer than necessary for the purposes for which it was collected, unless a longer retention period is legally required (for example, the 7-year tax record-keeping obligation for administrative records in the Netherlands).
Your rights
As a data subject under the GDPR, you have the following rights regarding your personal information:
- Right of access — you can request which personal information we hold about you.
- Right to rectification — you can have inaccurate data corrected.
- Right to erasure ("right to be forgotten") — you can request the deletion of your data in certain cases.
- Right to restriction of processing — you can ask us to temporarily limit the processing of your data.
- Right to data portability — you can receive a copy of your data in a structured format.
- Right to object — you can object to processing based on our legitimate interest, including direct marketing.
- Right to withdraw consent — where we rely on your consent, you can withdraw it at any time.
These rights are not absolute and may be subject to legal limitations in certain cases. We may need to verify your identity before processing your request. We will respond within the statutory timeframe (generally one month).
You can exercise these rights by contacting us using the contact details below.
Complaints
Do you have a complaint about how we process your personal information? Please contact us first using the details below — we're happy to resolve it together with you.
You also always have the right to lodge a complaint with the supervisory authority of the EU country where you live. For the Netherlands, this is:
Autoriteit Persoonsgegevens
www.autoriteitpersoonsgegevens.nl
Do you live in another EU country? Then you can also lodge your complaint with the supervisory authority of your own country of residence.
International transfers
Your personal information may be transferred, stored, and processed outside the Netherlands, for example by Shopify. When we transfer data outside the European Economic Area, we rely on recognised transfer mechanisms, such as the European Commission's standard contractual clauses, unless the receiving country offers an adequate level of protection.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time, for example due to changes in our practices or for legal reasons. We will post the revised version on this page and update the "Last updated" date.
Chat with our virtual assistant
On our online store you can chat with Giulia, our virtual assistant. Giulia uses artificial intelligence (AI) and is powered by Shopify. Shopify processes the content of your chat messages and the data you enter in the chat (such as your name and email address) to generate answers and to improve the quality of the assistant over time. Our team can read your conversation and take over. Please do not share payment details or other sensitive information in the chat.
Contact
For questions about this Privacy Policy, or to exercise your rights, you can contact us at: