Privacy policy

Privacy Statement

Lune Lupo B.V. | Vismarkt 52a, 9711 KV Groningen, Netherlands | KvK 42085879 | VAT NL869643319B01

Version 1.0 — 21-08-2026

Lune Lupo attaches great importance to the protection of your personal data. In this privacy statement, we explain what data we collect when you visit our website or place an order with us, what we use it for, on what legal basis, with whom we share it, and what rights you have. We process your data in accordance with the General Data Protection Regulation (GDPR).

You are not obliged to provide us with personal data. However, without certain data, we cannot process an order or answer your question.

1. Who we are

Lune Lupo B.V. is the data controller for the processing of personal data as described in this privacy statement.

Statutory name: Lune Lupo B.V.

Registered address: Vismarkt 52a, 9711 KV Groningen, the Netherlands

Chamber of Commerce (KvK) number: 42085879

VAT number: NL869643319B01

Email address: hello@lunelupo.com

Website: https://lunelupo.com

2. What data we process, for what purpose, and on what legal basis

Which data we process depends on how you use our website and webshop. We describe this below per situation.

2.1 You visit our website

When you visit our website, certain technical data is automatically collected, partly through cookies and similar technologies.

What data: IP address, browser and device data, pages visited, click and browsing behaviour.

Purpose: Ensuring the website functions properly and securely, compiling anonymised statistics, and — only with your consent — displaying relevant advertisements.

Legal basis: Legitimate interest (functioning and securing of the website) and consent (analytical and marketing cookies). See our cookie policy for details and for the option to change your choice.

Shared with: Our hosting party and website platform, our analytics provider, and — only with your consent — advertising platforms.

2.2 You place an order (with or without an account)

To process your order, we need certain data from you. You can order with or without an account; the processing is the same in both cases.

What data: First and last name, delivery and billing address, email address, phone number, order data and order history, IP address. We do not process full payment details: payments are handled by our payment service provider. We only receive confirmation that your payment was successful, never your account or card number. If you choose to pay afterwards (buy now, pay later), the payment service provider may request additional data (such as your date of birth) for a creditworthiness assessment; that processing falls under the responsibility and privacy statement of that provider.

Purpose: Processing and delivering your order, sending order and shipping confirmations, handling payments, returns and warranty, and our administration.

Legal basis: Performance of the contract and compliance with legal (fiscal and administrative) obligations.

Shared with: Our webshop software/hosting party, the payment service provider, fulfilment and delivery partners (parcel carriers), and our bookkeeper/accountant.

2.3 You create an account

What data: Email address and password (encrypted, never readable by us), the data mentioned under 2.2, saved addresses, and your order history.

Purpose: Providing a customer environment in which you can view and manage your data and orders.

Legal basis: Performance of the contract.

Shared with: Our webshop software/hosting party.

2.4 You leave a filled shopping cart behind

If you place products in your shopping cart, have already entered your email address or are logged in, but do not complete your order, we may send you a reminder.

What data: Email address, contents of your shopping cart, IP address.

Purpose: Sending a maximum of a few reminders so you can easily complete your order.

Legal basis: Legitimate interest (facilitating a started ordering process). You can unsubscribe directly from each reminder.

Shared with: Our email marketing software.

2.5 You sign up for our newsletter or email marketing

What data: Email address, first name (optional), and — if you provide them yourself — additional preferences. In addition, measurement data about the opening and clicking of our emails.

Purpose: Sending newsletters, offers and product information, and making them more relevant based on your preferences and purchases.

Legal basis: Consent (opt-in). If you are a customer of ours, we may send you emails about our own, similar products on the basis of the statutory customer relationship provision; here too, you can unsubscribe at any time. You can unsubscribe via the link at the bottom of each email or by sending an email to hello@lunelupo.com.

Shared with: Our email marketing software.

2.6 You contact customer service

What data: Name, the contact details you use yourself (email address, phone number or social media account), and the content of your message.

Purpose: Answering your question or complaint and improving our services.

Legal basis: Performance of the contract and legitimate interest (good customer service).

Shared with: Our customer service software and, if necessary for handling your request, our fulfilment or delivery partner.

2.7 You post a review

What data: The (screen) name you wish to display with your review, your email address (not visible with the review), the content of your review, and the number of stars given. To ensure that reviews come from genuine buyers, we link review requests to actual orders.

Purpose: Displaying customer reviews with our products and following up on any complaints arising from a review.

Legal basis: Consent (posting the review) and legitimate interest (following up on complaints).

Shared with: Our review software and website party.

2.8 Advertising and social media

We advertise on platforms such as Meta (Facebook and Instagram), TikTok and Google.

What data: With your consent (via the cookie banner): data about your website visit and purchases via advertising pixels or server-side measurement solutions. In addition, with your consent, we may upload your (hashed) email address to advertising platforms for so-called custom audiences, so that we can show you relevant advertisements or exclude you from campaigns, and to reach similar audiences (lookalike audiences).

Purpose: Measuring the effectiveness of our campaigns and displaying relevant advertisements.

Legal basis: Consent. You can withdraw your consent at any time via the cookie settings on our website; for custom audiences, you can also opt out via hello@lunelupo.com.

Shared with: The relevant advertising platforms. For the processing within those platforms, we and the platform are in certain cases jointly responsible; please also consult the privacy statement of the relevant platform.

3. With whom we share your data

We never sell your personal data to third parties. We only share your data with parties that help us operate our webshop, and only insofar as necessary. With parties acting as processors on our behalf, we conclude a data processing agreement. This concerns the following categories:

- Webshop platform and hosting: Shopify
- Payment service providers: Shopify Payments / Mollie / Klarna
- Fulfilment and delivery partners: PostNL / DHL / DPD
- Email marketing and customer service software: Klaviyo
- Analytics and advertising platforms: Google, Meta, TikTok
- Our accountant and accounting software
- Subscription management software
- Government authorities, only where we are legally obliged to do so

4. Transfers outside the European Economic Area

Some of our service providers (such as our webshop platform, email marketing software and advertising platforms) are established in or process data in countries outside the European Economic Area, including the United States. In that case, we ensure appropriate safeguards as required by the GDPR: transfers take place on the basis of an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework, for organisations certified under it) or on the basis of the standard contractual clauses (SCCs) adopted by the European Commission, supplemented with additional measures where necessary. You can request a copy of these safeguards from us via the contact details at the bottom of this statement.

5. How long we retain your data

We do not retain your personal data longer than necessary for the purposes for which it was collected, unless a statutory retention obligation prescribes a longer period. We apply the following retention periods:

• Order and invoice data (administration): 7 years (fiscal retention obligation)
  - Customer account: until you delete the account, or until no later than 2 years after your last activity
  - Newsletter data: until you unsubscribe; after that, we only record that you have unsubscribed
  - Customer service correspondence: up to 1 year after your question or complaint has been handled
  - Shopping cart reminders: we retain data about an uncompleted order for a maximum of 3 months
  - Reviews: as long as the relevant product is offered, or until you request removal
  - Website visit data: in accordance with the periods in our cookie policy 
  - In the event of legal proceedings or a dispute: up to 6 months after this has been definitively concluded
  - Subscription data (frequency, deliveries, cancellations): for the duration of your subscription and up to 7 years thereafter as part of our administration

6. How we secure your data

We take appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access. These include at least: encrypted connections (TLS/SSL) across our entire website, encrypted storage of passwords, restricted access to personal data within our organisation on a need-to-know basis, two-factor authentication on our systems, and contractual agreements (data processing agreements) with our service providers. Should a data breach nevertheless occur that poses a risk to your rights and freedoms, we will report this to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and, where required, also to you.

7. Cookies

On our website, we use cookies and similar technologies. We always place functional cookies; we only place analytical and marketing cookies with your consent, which you give or refuse via the cookie banner on your first visit. You can change your choice at any time via the cookie settings on our website. You can find exactly which cookies we use, from which parties, and with what retention periods in our Cookie Policy.

8. Automated decision-making and profiling

We do not ourselves make decisions based solely on automated processing that have legal consequences for you or otherwise significantly affect you. If you choose to pay afterwards (buy now, pay later), our payment service provider may carry out an automated creditworthiness assessment; that provider is itself the data controller for this. For marketing purposes, we may use your purchases and preferences to make our communications more relevant (profiling with limited consequences); you can always object to this.

9. Minors

Our website and products are not aimed at children under the age of 16. We do not knowingly collect personal data from children under 16 without the consent of a parent or guardian. If you believe we have collected data from a minor without such consent, please contact us; we will then delete this data.

10. Your rights

Under the GDPR, you have the following rights with regard to your personal data:

- Right of access: you can request which personal data we process about you and receive a copy of it
- Right to rectification: you can have incorrect data corrected and incomplete data supplemented
- Right to erasure: you can ask us to delete your data, for example when it is no longer needed or when you withdraw your consent
- Right to restriction of processing
- Right to object: you can object to processing based on our legitimate interest. You can always object to the use of your data for direct marketing; we will then cease that processing immediately
- Right to withdraw your consent: if you have given us consent, you can withdraw it at any time. This does not affect the lawfulness of the processing prior to the withdrawal

You can submit your request via hello@lunelupo.com. To ensure that the request was made by you, we may ask you to confirm your identity — for example, by responding from the email address known to us or by confirming some details of your last order. We expressly ask you not to send a copy of your identity document.

We will respond to your request within one month. In the case of complex or numerous requests, we may extend this period by a maximum of two months; in that case, we will inform you within one month.

11. Filing a complaint

Do you have a complaint about the way we handle your personal data? We would be happy to resolve this together with you first via hello@lunelupo.com. In addition, you always have the right to file a complaint with the supervisory authority: the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), via www.autoriteitpersoonsgegevens.nl.

12. Contact and changes

Questions or comments about this privacy statement can be addressed to:

Company: Lune Lupo B.V.

Address: Vismarkt 52a, 9711 KV Groningen, the Netherlands

Email address: hello@lunelupo.com

We may amend this privacy statement from time to time, for example when we start using new services or providers. The current version is always available on our website; in the event of significant changes, we will inform you actively. This version was last updated on 21-08-2026.