Privacy Policy

1. Data controller

Lumière Science Ltd is the data controller responsible for your personal data. We are registered in England and Wales (Company No. 14820391) with our registered office at 21 Marylebone Lane, London, W1U 2DR, United Kingdom.

If you have any questions about this policy, you can contact us at care@lumierebeauty.co.

2. Information we collect

We collect and process the following categories of personal data:

• Identity and contact data: name, business email, company name and phone number.
• Transaction data: details of products purchased and order references. Payment card details are processed solely by Stripe and are never stored on our servers.
• Technical data: IP address, browser type and usage data collected via essential and (with consent) analytics cookies.
• Communications data: the content of enquiries and messages you send us.

3. How we use your data

We use your personal data on the following lawful bases:

• To perform our contract with you: processing orders, shipping your products and providing support.
• For our legitimate interests: improving our products, securing our services and responding to enquiries.
• To comply with legal obligations: tax, accounting and regulatory requirements.
• With your consent: sending marketing communications and using non-essential cookies.

4. Payment processing

All payments are processed securely by Stripe Payments Europe, Ltd. We do not collect or store your full payment card details. Stripe's processing of your data is governed by their own privacy policy.

5. Data sharing

We share data only with trusted processors who help us operate our business, including our payment processor (Stripe), hosting and infrastructure providers, and email service providers. All processors are bound by appropriate data-protection agreements.

We do not sell your personal data to third parties.

6. International transfers

Where personal data is transferred outside the UK, we ensure an adequate level of protection through appropriate safeguards such as the UK International Data Transfer Agreement or adequacy regulations.

7. Data retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting and reporting requirements. Transaction records are typically retained for at least six years to meet UK tax obligations.

8. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request erasure of your data in certain circumstances.
• Object to or restrict our processing.
• Data portability.
• Withdraw consent at any time.
• Lodge a complaint with the Information Commissioner's Office (ICO).

9. Cookies

We use cookies as described in our Cookie Policy. You can manage your preferences via the cookie banner displayed on your first visit.

10. Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be available on this page with the date of the most recent revision.