Privacy Policy

Data Protection

1) Information on the collection of personal data and contact details of the responsible party

1.1 We are pleased that you are visiting our website and thank you for your interest. Below, we inform you about how we handle your personal data when you use our website. Personal data is any data that can be used to identify you personally.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Luna B.V., Keizersgracht 520H, 1017 EK Amsterdam, The Netherlands.
The controller for the processing of personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.

1.3 For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or enquiries to the controller), this website uses SSL or TLS encryption. You can recognise an encrypted connection by the “https://” string and the padlock symbol in your browser’s address bar.

2) Collection of data when visiting our website

If you use our website for informational purposes only (i.e. if you do not register or otherwise provide information), we only collect data that your browser transmits to our server (so-called “server log files”). When you visit our website, we collect the following data that is technically necessary to display the website to you:

The website visited
Date and time of access
Amount of data sent in bytes
Source/referrer from which you came to the page
Browser used
Operating system used
IP address (where applicable: in anonymised form)

Processing is carried out in accordance with Article 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not passed on or used in any other way. However, we reserve the right to review server log files retrospectively if there are concrete indications of unlawful use.

“By using our website, you (the visitor) agree that third parties may process your IP address in order to determine your location for the purpose of currency conversion. You also agree that this currency is stored in a session cookie in your browser (a temporary cookie that is automatically removed when you close your browser). We do this so that the selected currency remains consistent while browsing our website, so that prices can be converted into your (the visitor’s) local currency.”

3) Cookies

In order to make visiting our website attractive and to enable the use of certain functions, we use cookies on various pages. Cookies are small text files that are stored on your end device. Some of the cookies we use are deleted after the browser session ends (so-called session cookies). Other cookies remain stored on your end device and enable us or our partner companies (third-party cookies) to recognise your browser on your next visit (persistent cookies). Persistent cookies are automatically deleted after a specified period.

In some cases, cookies are used to simplify the ordering process by saving settings (e.g. remembering the contents of a virtual shopping basket for a later visit). If personal data is also processed by individual cookies implemented by us, processing is carried out in accordance with Article 6(1)(b) GDPR for the performance of a contract, or in accordance with Article 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website and a customer-friendly, effective design of the website visit.

We may work with advertising partners who help us make our website more interesting for you. For this purpose, cookies from partner companies may also be stored on your hard drive when you visit our website (third-party cookies). If we work with the advertising partners mentioned above, you will be informed individually and separately about the use of such cookies and the scope of the information collected in each case in the following sections.

Use of Google services
We use services from Google (such as Google Analytics, Google Ads or other tools) to better understand user behaviour and improve our services. These services may set cookies and process personal data such as IP addresses and usage behaviour. For more information on how Google handles your data, please refer to Google’s privacy policy and terms, which can be found here: https://business.safety.google/privacy/

You can set your browser to inform you about the use of cookies and decide on a case-by-case basis whether to accept them, or you can exclude the acceptance of cookies for certain cases or in general. Each browser differs in how it manages cookie settings. This is described in each browser’s help menu. You can find this information at the following links:

Internet Explorer: https://support.microsoft.com/de-de/help/17442/windows-internet-explorer-delete-manage-cookies
Firefox: https://support.mozilla.org/de/kb/cookies-allow-und-reject
Chrome: https://support.google.com/chrome/answer/95647?hl=nl
Safari: https://support.apple.com/kb/ph21411?locale=nl
Opera: https://help.opera.com/en/latest/web-preferences/#cookies

If you do not accept cookies, the functionality of our website may be limited.

4) Contact

When you contact us (e.g. via a contact form or email), personal data is collected. Which data is collected in the case of a contact form can be seen on the relevant contact form. This data is stored and used exclusively for the purpose of responding to your enquiry or establishing contact and the associated technical administration. The legal basis for processing the data is our legitimate interest in responding to your enquiry in accordance with Article 6(1)(f) GDPR. If your enquiry is aimed at concluding a contract, the additional legal basis for processing is Article 6(1)(b) GDPR. Your data will be deleted after your enquiry has been conclusively processed, provided that this can be inferred from the circumstances.

5) Data processing when opening a customer account and for contract processing

In accordance with Article 6(1)(b) GDPR, personal data is also collected and processed if you provide it to us for the purpose of performing a contract or opening a customer account. Which data is collected can be seen from the relevant input forms. Deletion of your customer account is possible at any time and can be carried out by sending a message to the controller at the address stated above. We store and use the data you provide to process the contract. After the contract has been completed or your customer account has been deleted, your data will be blocked in accordance with tax and commercial retention periods and deleted once these retention periods have expired.

6) Use of single sign-on procedure

Facebook Connect
On our website, you can create a customer account or register using the “Facebook Connect” social plug-in of the Facebook social network operated by Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA (“Facebook”), using so-called single sign-on technology, provided you have a Facebook profile. You can recognise the “Facebook Connect” social plug-ins on our website by the blue button with the Facebook logo and the text “Log in with Facebook”, “Connect with Facebook” or “Sign in with Facebook”.

When you access a page on our website containing such a plug-in, your browser establishes a direct connection to Facebook’s servers. The content of the plug-in is transmitted by Facebook directly to your browser and integrated into the page. Through this integration, Facebook receives the information that your browser has accessed the respective page of our website, even if you do not have a Facebook profile or are not currently logged in to Facebook. This information (including your IP address) is transmitted directly from your browser to a Facebook server in the USA and stored there. This data processing is carried out in accordance with Article 6(1)(f) GDPR on the basis of Facebook’s legitimate interest in displaying personalised advertising based on browsing behaviour.

By using the “Facebook Connect” button on our website, you also have the option to log in or register on our website using your Facebook user data. Only if you give your express consent in accordance with Article 6(1)(a) GDPR prior to the registration process, based on a corresponding notice about the exchange of data with Facebook, will we receive from Facebook (depending on your Facebook privacy settings) the general and publicly accessible information stored in your profile. This information includes user ID, name, profile picture, age, and gender.

We note that following changes to Facebook’s data protection terms and terms of use, your profile pictures, your friends’ user IDs, and your friends list may also be transmitted if you have marked these as “public” in your Facebook privacy settings. The data transmitted by Facebook is stored and processed by us to create a user account with the necessary data, if you have given consent on Facebook (title, first name, last name, address details, country, email address, date of birth). Conversely, based on your consent, we may transmit data (e.g. information about your browsing or purchasing behaviour) to your Facebook profile.

Consent can be withdrawn at any time by sending a message to the controller named at the beginning of this notice.

Facebook Inc., based in the USA, is certified under the US–EU “Privacy Shield” framework, which ensures compliance with the level of data protection applicable in the EU.

For the purpose and scope of data collection and the further processing and use of the data by Facebook, as well as your rights in this regard and settings options to protect your privacy, please refer to Facebook’s data protection information: http://www.facebook.com/policy.php.

If you do not want Facebook to associate data collected via our website directly with your Facebook profile, you must log out of Facebook before visiting our website. You can also completely prevent the Facebook plug-ins from loading by using add-ons for your browser, e.g. “Adblock Plus” (https://adblockplus.org/de/).

7) Use of your data for direct advertising: subscription to our email newsletter

If you subscribe to our email newsletter, we will regularly send you information about our offers. The only mandatory information required to send the newsletter is your email address. Providing additional data is voluntary and will be used to address you personally. We use the so-called double opt-in procedure. This means that we will only send you an email newsletter if you have expressly confirmed that you consent to receiving newsletters. We will then send you a confirmation email asking you to click on a link to confirm that you wish to receive newsletters in the future.

By activating the confirmation link, you give us your consent to use your personal data in accordance with Article 6(1)(a) GDPR. When you subscribe to the newsletter, we store your IP address entered by your Internet Service Provider (ISP) as well as the date and time of registration in order to be able to trace any potential misuse of your email address at a later time. The data collected when subscribing to the newsletter is used exclusively for advertising via the newsletter. You can unsubscribe from the newsletter at any time via the designated link in the newsletter or by sending a message to the controller mentioned above. After you unsubscribe, your email address will be removed from our newsletter distribution list immediately.

8) Data processing for order processing

8.1 The personal data collected by us will be passed on to the transport company commissioned with delivery as part of contract processing, insofar as this is necessary for the delivery of goods. We will pass on your payment data to the commissioned credit institution as part of payment processing, insofar as this is necessary for payment processing. Where payment service providers are used, we will expressly inform you below. The legal basis for data transfer is Article 6(1)(b) GDPR.

8.2 In order to fulfil our contractual obligations to customers, we work with external shipping partners. We pass on your name and delivery address to a shipping partner selected by us solely for the purpose of delivering the goods in accordance with Article 6(1)(b) GDPR.

8.3 Use of payment service providers

Amazon Pay
If you select the “Amazon Pay” payment method, payment processing is carried out via the payment service provider Amazon Payments Europe S.C.A., 5 Rue Plaetis, L-2338 Luxembourg (“Amazon Payments”), to whom we transfer the information you provided during the ordering process along with information about your order in accordance with Article 6(1)(b) GDPR. Your data will only be passed on for the purpose of payment processing with Amazon Payments and only to the extent necessary. Further information on Amazon Payments’ data protection provisions can be found here: https://pay.amazon.com/de/help/201751600

PayPal
If you pay via PayPal, credit card via PayPal, direct debit via PayPal, or (if offered) “purchase on account” or “instalment payment” via PayPal, we transfer your payment data to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg (“PayPal”). The transfer is carried out in accordance with Article 6(1)(b) GDPR and only insofar as it is necessary for payment processing.

PayPal reserves the right to carry out a credit check for the payment methods credit card via PayPal, direct debit via PayPal, or (if offered) purchase on account or instalment payments via PayPal. For this purpose, your payment data may be transferred to credit agencies in accordance with Article 6(1)(f) GDPR on the basis of PayPal’s legitimate interest in determining your solvency. PayPal uses the result of the credit check in relation to the statistical probability of non-payment in order to decide whether to offer the respective payment method. The credit report may contain probability values (so-called score values). If score values are included, they are based on a scientifically recognised mathematical-statistical procedure. Among other things, address data is included in the calculation of score values. Further information on data protection, including the credit agencies used, can be found in PayPal’s privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

You may object to this processing of your data at any time by sending a message to PayPal. However, PayPal may still be entitled to process your personal data if this is necessary for contractual payment processing.

SOFORT
If you select the “SOFORT” payment method, payment processing is carried out via the payment service provider SOFORT GmbH, Theresienhöhe 12, 80339 Munich, Germany (“SOFORT”), to whom we transfer the information provided during the ordering process along with information about your order in accordance with Article 6(1)(b) GDPR. SOFORT GmbH is part of the Klarna Group (Klarna Bank AB (publ), Sveavägen 46, 11134 Stockholm, Sweden). Your data will only be passed on for the purpose of payment processing with SOFORT and only to the extent necessary. More information about SOFORT’s data protection provisions can be found here: https://www.klarna.com/sofort/datenschutz

Stripe
If you choose a payment method of the payment service provider Stripe, payment is processed via Stripe Payments Europe Ltd, Block 4, Harcourt Centre, Harcourt Road, Dublin 2, Ireland, to whom we transfer the information you provided during the ordering process together with information about your order (name, address, account number, sort code, where applicable credit card number, invoice amount, currency, and transaction number) in accordance with Article 6(1)(b) GDPR. Your data will only be passed on for the purpose of payment processing with Stripe Payments Europe Ltd and only to the extent necessary. Further information about Stripe’s data protection can be found at: https://stripe.com/de/terms.

In order to be able to offer you Klarna payment methods, we may transmit your personal data in the form of contact and order details to Klarna during the checkout process so that Klarna can assess whether you qualify for Klarna payment methods and tailor these payment methods to you. Your transmitted personal data will be processed in accordance with Klarna’s privacy policy.

9) Rights of the data subject

9.1 Applicable data protection law grants you comprehensive rights (right of access and intervention) towards the controller regarding the processing of your personal data. We inform you below:

Right of access pursuant to Article 15 GDPR
Right to rectification pursuant to Article 16 GDPR
Right to erasure pursuant to Article 17 GDPR
Right to restriction of processing pursuant to Article 18 GDPR
Right to be informed pursuant to Article 19 GDPR
Right to data portability pursuant to Article 20 GDPR
Right to withdraw consent pursuant to Article 7(3) GDPR
Right to lodge a complaint pursuant to Article 77 GDPR

9.2 Right to object
If we process your personal data on the basis of overriding legitimate interests, you have the right to object to this processing at any time with effect for the future on grounds relating to your particular situation. If you exercise your right to object, we will stop processing the data concerned. Further processing may remain reserved if we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or if processing serves the establishment, exercise, or defence of legal claims.

If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data for such marketing. If you object, we will stop processing the data concerned for direct marketing purposes.

10) Duration of storage of personal data

The duration of storage of personal data is based on the respective statutory retention period (e.g. commercial and tax retention periods). After the expiry of the period, the relevant data is routinely deleted, provided it is no longer required to fulfil or initiate a contract and/or we have no legitimate interest in further storage.