Privacy policy
PRIVACY POLICY
1. INTRODUCTION
1.1 Who we are
Welcome to LUMA Spritz Ltd's Privacy Policy.
At LUMA Spritz Ltd ("we", "us", "our") we are committed to protecting your personal data in compliance with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003.
This Privacy Policy explains what personal data we collect, why we collect it, the lawful bases on which we process it, who we share it with, how long we keep it, and the rights you have in relation to it.
It applies to:
- customers and prospective customers;
- individuals who join our launch reserve list or marketing mailing list;
- individuals who give us contact details at sampling events, tastings or pop-ups;
- individuals who contact us through our website forms or social media;
- named contacts at licensed venues, hotels and retailers we approach as prospective trade customers;
- suppliers and business contacts; and
- our employees and staff.
1.2 Your data controller
LUMA Spritz Ltd is the data controller responsible for your personal data.
| Company registration number | 17260079 |
| Registered office | 36 Owlstone Road, Newnham, Cambridge, CB3 9JH |
| hello@lumaspritz.co.uk | |
| ICO registration number |
We are not required to appoint a Data Protection Officer and have not appointed one. Any enquiries about your data should be sent to hello@lumaspritz.co.uk.
1.3 Your right to complain
You have the right to complain at any time to the Information Commissioner's Office, the UK supervisory authority for data protection (www.ico.org.uk, 0303 123 1113). We would appreciate the chance to deal with your concerns first, so please contact us in the first instance.
1.4 Cookies
Our use of cookies and similar technologies is described in our separate Cookie Policy.
2. THE PERSONAL DATA WE COLLECT
"Personal data" means information about an individual from which that person can be identified. It does not include anonymous data.
Not all of the following will be collected from every individual, but this is the full scope of what we collect:
Identity data — first name, last name, and where you provide it, date of birth.
Contact data — billing address, delivery address, email address, telephone number.
Age verification data — date of birth or confirmation of age, and the record of the outcome of any age check carried out by us or our courier.
Transaction data — details and records of orders placed, products purchased, returned, exchanged or cancelled, and payments made.
Billing data — the name attached to your payment method and your billing address. We do not collect or store full payment card numbers. Payment is processed by our payment provider; card details are handled by them and are not accessible to us.
Marketing and communications data — your preferences in receiving marketing from us, and your communication history with us.
Customer support data — the content of your enquiries, feedback and survey responses.
Technical data — IP address, browser type and version, time zone and location setting, operating system and platform, and other technology on the devices you use to reach us.
Usage data — information about how you use our website and services.
We also use aggregated data (for example Shopify analytics, email open rates and Instagram insights). Aggregated data may be derived from personal data but does not identify you and is not treated as personal data in law. If we combine aggregated data with personal data so that it can identify you, we treat the combined data as personal data.
We do not collect special category data — information about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, health, or genetic and biometric data. Date of birth collected for age verification is not special category data. We do not collect information about criminal convictions or offences.
2.1 Where we get it from
- Directly from you — when you place an order, join our list, contact us, or otherwise give us your details.
- Automatically — from your device when you use our website, including through cookies and similar technologies.
- From our service providers — where they collect or process personal data on our behalf, for example our courier's record of an age check on delivery.
3. HOW AND WHY WE USE YOUR PERSONAL DATA
We only use your personal data when the law allows us to. The lawful bases we rely on are consent, performance of a contract, compliance with a legal obligation, and legitimate interests.
| Activity | Data used | Lawful basis | Why |
|---|---|---|---|
| Registering an enquiry or reserve-list signup | Identity, Contact, Marketing | Consent | To tell you about our launch and products where you have asked us to |
| Verifying age before sale or delivery of alcohol | Identity, Age verification | Legal obligation | To comply with the Licensing Act 2003 and our premises licence conditions |
| Processing and fulfilling an order | Identity, Contact, Billing, Transaction | Contract | To take payment, deliver the product and provide customer support |
| Keeping records of sales, payments and refused deliveries | Identity, Contact, Transaction, Age verification | Legal obligation | To meet record-keeping duties under tax, alcohol wholesaling and licensing legislation |
| Marketing to existing customers | Identity, Contact, Marketing | Legitimate interests | To tell customers about similar products, subject to an opt-out in every message |
| Marketing to prospective trade contacts | Identity, Contact, Marketing | Legitimate interests | To grow the business by approaching licensed venues and retailers, subject to an opt-out |
| Managing relationships with venues and suppliers | Identity, Contact, Customer support | Legitimate interests | To operate and administer our commercial relationships |
| Improving our website and products | Technical, Usage, Customer support | Legitimate interests | To understand how our website is used and improve it |
| Detecting and preventing fraud | Identity, Contact, Transaction, Technical | Legitimate interests | To protect our business and our customers |
Where we rely on legitimate interests, we have assessed that our interest is not overridden by your rights and freedoms. You may object to that processing — see section 6.
3.1 Marketing
We will send you marketing emails where you have opted in, or where you have bought from us and we are marketing similar products (in which case we rely on the soft opt-in under the Privacy and Electronic Communications Regulations). Every marketing message contains an unsubscribe link.
Opting out of marketing does not stop us sending you service messages about an order you have placed.
3.2 Change of purpose
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another compatible reason. If we need to use it for an unrelated purpose we will notify you and explain the legal basis.
4. WHO WE SHARE YOUR DATA WITH
We share personal data with the following categories of recipient, all of whom act as our processors under a written contract unless stated otherwise:
- Shopify, which hosts our website and store — see section 5;
- our payment provider, which processes card payments;
- our courier, which delivers orders and carries out age verification;
- our email and marketing platform;
- our accountants and professional advisers;
- HMRC, licensing authorities and other regulators, where we are required to disclose;
- law enforcement, where required by law or valid legal process.
We may also share personal data with interested parties in the event of a sale, merger or transfer of our business or assets. If that happens, we will tell you, and the acquiring entity's privacy policy may govern further use of your data.
We do not sell your personal data.
5. OUR RELATIONSHIP WITH SHOPIFY
Our website and store are hosted by Shopify. Shopify collects and processes personal data about your access to and use of our website in order to provide the service to us, and information you submit will be transmitted to and shared with Shopify and with third parties that may be located outside the UK.
In addition, Shopify uses certain data about your interactions with our store, alongside other merchants, for its own purposes as a controller in order to protect, grow and improve its services. In those circumstances Shopify is responsible for that processing, including for responding to any requests you make about it. You can read the Shopify Consumer Privacy Policy at privacy.shopify.com for more detail on how Shopify uses your personal data and the rights available to you.
6. YOUR RIGHTS
Under data protection law you have the following rights in relation to your personal data. These rights are not absolute and may only apply in certain circumstances.
Right to be informed — about how we process your data. This policy provides that information.
Right of access — to receive a copy of the personal data we hold about you (a "data subject access request").
Right to rectification — to have inaccurate or incomplete data corrected.
Right to erasure — to ask us to delete personal data where there is no good reason for us to continue processing it. We may not always be able to comply, for example where we are required by law to keep sales or licensing records.
Right to object — to processing based on our legitimate interests, and at any time to direct marketing. Where you object to direct marketing we will always stop.
Right to restrict processing — to ask us to suspend processing in certain circumstances, for example while we verify the accuracy of data you have challenged.
Right to data portability — to receive personal data you provided to us, in a structured, commonly used and machine-readable format, and to have it transmitted to another controller. This applies to data processed by automated means on the basis of consent or contract.
Right to withdraw consent — where we rely on consent, you may withdraw it at any time. This does not affect the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, email hello@lumaspritz.co.uk.
6.1 How we handle your request
You will not have to pay a fee. We will respond within one month of receiving your request. If your request is complex, or you have made a number of requests, we may extend that period by up to two further months, and we will tell you within one month if we do.
We may ask you for information to confirm your identity before we act on a request. This is a security measure to ensure personal data is not disclosed to anyone who has no right to receive it.
We may refuse a request that is manifestly unfounded or excessive, and will explain why if we do.
You will not be discriminated against for exercising any of these rights.
7. HOW LONG WE KEEP YOUR DATA
We keep personal data only for as long as necessary for the purposes we collected it for.
| Data | Retention period |
|---|---|
| Order and transaction records | 6 years from the end of the financial year in which the order was placed, to meet HMRC requirements |
| Age verification records and records of refused or failed deliveries | [12 months], as part of our licensing due diligence |
| Marketing list data | Until you unsubscribe, or after [24] months of no engagement, whichever is sooner |
| Customer support correspondence | [24] months from the last contact |
| Website analytics and usage data | As set out in our Cookie Policy |
We may retain data for longer in the event of a complaint, or where we reasonably believe there is a prospect of litigation.
8. SECURITY
We take appropriate technical and organisational measures to protect your personal data. Access is limited to those who need it and who are bound by obligations of confidentiality. Where we engage subcontractors to process your data, we do so under written contracts requiring appropriate security.
No transmission of data over the internet is completely secure. While we strive to protect your personal data, we cannot guarantee the security of data you transmit to us, and any such transmission is at your own risk. If you believe your interaction with us is no longer secure, please contact us.
If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours, and will notify you directly where the risk is high.
9. INTERNATIONAL TRANSFERS
We may transfer, store and process your personal data outside the United Kingdom, including by our service providers.
Where we transfer personal data out of the UK, we do so only where the destination country has been found to provide an adequate level of protection, or where the transfer is covered by the UK International Data Transfer Agreement, the UK Addendum to the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism.
10. AGE LIMIT
You must be aged 18 or over to buy from us, to join our list, or to use our website. Our website is not intended for children and we do not knowingly collect data relating to children.
If you are the parent or guardian of a child who has given us their personal data, contact us at hello@lumaspritz.co.uk and we will delete it.
11. THIRD-PARTY LINKS
Our website may include links to third-party websites, plug-ins and applications. Clicking those links may allow third parties to collect or share data about you. We do not control these sites and are not responsible for their privacy practices. When you leave our website, we encourage you to read the privacy policy of every site you visit.
12. CHANGES TO THIS POLICY
We keep this Privacy Policy under review and will post any updates here with a revised date. Where changes are material, we will notify you.
This version is dated [DATE].
13. CONTACT
For any question about this policy, or to exercise any of your rights:
Email: hello@lumaspritz.co.uk Post: LUMA Spritz Ltd, 36 Owlstone Road, Newnham, Cambridge, CB3 9JH
For the purposes of applicable data protection law, LUMA Spritz Ltd is the data controller of your personal data.