Privacy Policy
Privacy policy
1. Who We Are
LUME LOAM (“we”, “us”, “our”) is a global D2C artisanal home and living brand selling handmade brass, copper, bronze and tin-lined metalware, each piece made by a named artisan, to order. Our Shopify store is operated by Dekulture Works Pvt. Ltd., incorporated in India, registered address E-222, UDB Harmony Apartments, Ajmer Road, Mahapura, Jaipur 302026, Rajasthan, India.
Our website is lumeloam.shop (the “Site”). For all privacy matters:
| lumeloam@dekulture.com | |
| Post | E-222, UDB Harmony Apartments, Ajmer Road, Mahapura, Jaipur 302026, Rajasthan, India |
| Response time | We respond to all privacy requests within 30 calendar days, or sooner as required by applicable law |
2. What Personal Data We Collect
2.1 Data You Provide Directly
| Data Type | Why We Collect It |
|---|---|
| Full name | Order processing, account creation, personalised gift notes |
| Delivery & billing address | Order fulfilment, invoicing, customs declarations |
| Email address | Order confirmation, dispatch and delivery updates, optional marketing |
| Phone number | Courier delivery notifications, where provided by you |
| Payment details | Processed securely by our payment gateway. We do not store full card numbers |
| Order history & purchase records | Customer service, repeat orders, care and repair programme records |
| Bespoke / personalisation instructions | Hand-etching, engraving, monogram and custom inscription fulfilment |
| Customer service messages | Resolving queries, returns and complaints |
| Product reviews & photos | Displaying on our website with your permission |
| Newsletter sign-up preferences | Email marketing, opt-in only. You can unsubscribe at any time |
| Product finder inputs | Personalised product recommendations |
2.2 Data Collected Automatically
When you visit our Site, we and our technology partners may automatically collect:
- IP address and approximate location, at country or region level
- Browser type, device type and operating system
- Pages visited, time on page, referring URL, clicks and scrolls
- Session recordings and heatmap data, where you have given consent
- Cookie identifiers and advertising pixel data, subject to your cookie consent choices (see Section 9)
2.3 Data from Third Parties
- Payment processors (for example Shopify Payments, Stripe, PayPal, Razorpay) share transaction status with us
- Courier and logistics partners share delivery status and proof-of-delivery data
- Social media platforms may share limited data if you use social login or interact with embedded content
- Review platforms may share your review content with us
3. How We Use Your Personal Data
| Purpose | Legal Basis (EU / UK GDPR) |
|---|---|
| Processing and fulfilling your order, including made-to-order production | Contractual necessity |
| Communicating order confirmation, production updates, dispatch and delivery | Contractual necessity |
| Sending bespoke and personalisation order details to our artisan makers | Contractual necessity |
| Managing repairs, re-polishing and re-tinning service requests | Contractual necessity / legitimate interests |
| Resolving returns, refunds, exchanges and customer service queries | Contractual necessity |
| Fraud prevention and security | Legitimate interests / legal obligation |
| Sending marketing emails, newsletters and new-batch announcements, opt-in only | Consent |
| Abandoned cart reminders, where you opted in or applicable law permits | Consent / legitimate interests |
| Personalising product recommendations | Legitimate interests / consent |
| Website analytics to improve our site and products | Legitimate interests / consent |
| Complying with tax, customs, accounting and legal obligations | Legal obligation |
| Operating loyalty, referral or affiliate programme benefits | Contractual necessity / consent |
4. Who We Share Your Data With
We share your data only as necessary and never sell your personal information to third parties for their own marketing.
| Recipient Category | Purpose |
|---|---|
| Shopify Inc. (platform provider) | Store infrastructure, payments, checkout, data hosting |
| Payment gateway providers | Secure payment processing (Shopify Payments, Stripe, PayPal, Klarna, Razorpay and others) |
| Courier & logistics partners | Order shipment and delivery (for example DHL, FedEx, Aramex, India Post, local carriers) |
| Artisan makers & workshop partners | Made-to-order production and personalisation fulfilment |
| Fulfilment / warehouse partners | Order picking, packing and dispatch |
| Email marketing platforms | Newsletter and transactional email delivery (for example Klaviyo, Mailchimp) |
| SMS / WhatsApp marketing providers | Transactional and marketing messages, where you have consented |
| Analytics providers | Google Analytics 4, Shopify Analytics, for website performance measurement |
| Advertising platforms | Meta Pixel, Google Ads, Pinterest Tag, TikTok Pixel, subject to cookie consent |
| Review platforms | Customer review collection and display |
| Accounting / tax tools | Financial record-keeping and tax or GST compliance |
| Customs and border authorities | Required for international shipments (recipient name, address, order value, contents) |
| Legal or regulatory authorities | Where required by applicable law or valid legal process |
All third-party processors are contractually bound to use your data only for the stated purpose and to maintain appropriate security measures.
5. International Data Transfers
Because we operate globally and use international service providers, your data may be transferred to countries outside your home country, including India, the United States and countries within the EU. Where we transfer personal data internationally, we rely on appropriate safeguards including Standard Contractual Clauses (SCCs), Shopify’s data transfer mechanisms and adequacy decisions where applicable. Contact lumeloam@dekulture.com for details of specific safeguards.
6. Data Retention
| Data Category | Retention Period |
|---|---|
| Order records (name, address, items, payment confirmation) | 7 years from order date (legal and tax obligation) |
| Made-to-order and bespoke production records | 7 years (financial records) plus as long as the repair programme is active |
| Repair, re-polishing and re-tinning service records | Duration of the repair programme relationship plus 3 years |
| Customer account data | Duration of account plus 2 years after last activity |
| Marketing contact data | Until you unsubscribe or request deletion |
| Customer service communications | 3 years from resolution |
| Analytics data | As configured per platform, typically 14 months for Google Analytics 4 |
| Cookie and advertising identifiers | Per our Cookie Policy, typically 30 days to 13 months |
| Fraud prevention data | Up to 5 years where legally required |
7. Your Privacy Rights
| Right | What It Means |
|---|---|
| Access | Request a copy of personal data we hold about you |
| Correction / rectification | Ask us to correct inaccurate or incomplete data |
| Deletion / erasure | Ask us to delete your data, subject to legal retention obligations |
| Restriction | Ask us to limit how we process your data in certain circumstances |
| Data portability | Receive your data in a structured, machine-readable format |
| Object | Object to processing based on legitimate interests or for direct marketing |
| Withdraw consent | Withdraw any previously given consent at any time. This does not affect prior processing |
| Opt out of sale or sharing (US) | Opt out of “sale” or “sharing” of personal information under CCPA/CPRA |
| Non-discrimination (US) | We will not discriminate against you for exercising your privacy rights |
To exercise any right, email lumeloam@dekulture.com with your full name, the email used at checkout and the right you wish to exercise. We respond within 30 days. We may ask you to verify your identity before fulfilling sensitive requests.
You may also complain to your local data protection authority. EU: your national DPA. UK: the ICO (ico.org.uk). India: the Data Protection Board of India (once operational). Australia: the OAIC (oaic.gov.au).
8. Data Security
We implement appropriate technical and organisational measures to protect your personal data, including:
- SSL/TLS encryption for all data in transit on our Site
- Shopify’s PCI-DSS compliant payment infrastructure. We never store full payment card numbers
- Access controls limiting who within our organisation can access personal data
- Regular review of data-handling practices and third-party processor agreements
No digital system can be guaranteed 100% secure. If you suspect unauthorised access to your account, contact lumeloam@dekulture.com immediately.
9. Cookies & Tracking Technologies
We use cookies and similar technologies to operate our Site and personalise your experience. Full details are in our Cookie Policy. In summary:
- Essential cookies required for the Site to function (cart, checkout, security). No consent needed
- Functional cookies that remember your language, currency and browsing preferences
- Analytics cookies such as Google Analytics 4 and Shopify Analytics. Consent required in the EU and UK
- Marketing and advertising cookies such as Meta Pixel, Google Ads, Pinterest Tag and TikTok Pixel. Consent required
- Personalisation cookies for product recommendations and gift-finder preferences
Manage your cookie preferences at any time via the “Cookie Preferences” link in our footer. EU and UK visitors can reject non-essential cookies without affecting core site functionality.
10. Children’s Privacy
Our Site is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected a child’s data, contact lumeloam@dekulture.com immediately and we will delete it.
11. Marketing Communications
We send marketing emails, newsletters and new small-batch announcements only to those who have opted in. You can withdraw consent at any time:
- Click “Unsubscribe” in any marketing email
- Reply STOP to any SMS marketing message
- Email lumeloam@dekulture.com requesting removal
Unsubscribing from marketing does not affect transactional messages about your order.
12. Jurisdiction-Specific Addendums
12a. EU & UK (GDPR / UK GDPR)
Our legal bases for processing personal data are listed in Section 3. Where we rely on legitimate interests, we have balanced these against your rights. If you require information about our EU/UK representative (Art. 27 GDPR), contact lumeloam@dekulture.com. EU customers may access the Online Dispute Resolution platform at ec.europa.eu/odr.
12b. California (CCPA / CPRA)
California residents have rights to know, delete, opt out of sale or sharing, and non-discrimination. We do not “sell” personal information in the traditional sense. We do share identifiers and browsing activity with advertising platforms (Meta, Google, Pinterest, TikTok) which may constitute “sharing” under CCPA/CPRA. California residents may opt out via our Cookie Preferences. Submit requests with “CCPA Request” in the subject to lumeloam@dekulture.com.
12c. Australia (Privacy Act 1988)
We handle Australian customers’ data in accordance with the Australian Privacy Principles (APPs). To access, correct or complain about your information, contact lumeloam@dekulture.com. Unresolved complaints may be referred to the OAIC (oaic.gov.au).
12d. Canada (PIPEDA)
Canadian customers have rights under PIPEDA. We collect only information necessary for the purposes described, with your knowledge and consent. To access your data or withdraw consent, contact lumeloam@dekulture.com.
12e. India (DPDP Act 2023)
As a Data Fiduciary under the Digital Personal Data Protection Act 2023, we process personal data for lawful purposes. Indian customers have the right to access, correct and erase their personal data. Contact lumeloam@dekulture.com for any requests.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated by email or prominent notice on our Site. The “Last Updated” date below reflects the current version. Continued use of the Site after changes constitutes acknowledgement.