Privacy Policy

1. Controller

The controller responsible for the processing of your personal data within the meaning of the General Data Protection Regulation (GDPR) is:

Luca Böckeler
LUBOÉ
Grüntenstraße 3
87452 Altusried
Germany
Email: info@luboe.co

2. General Information on Data Processing

LUBOÉ operates on the technical infrastructure of Shopify International Limited (hereinafter "Shopify"). This Privacy Policy explains what personal data is collected when using the shop, how it is used, and what rights customers have.

3. What Personal Data Is Collected?

Depending on how the shop is used, the following categories of data are processed:

• Contact details: name, billing and delivery address, phone number, email address
• Payment data: payment method, transaction details (the actual payment data, such as card numbers, is processed exclusively by the payment providers used, see section 6)
• Account information: username, password (stored encrypted), order history
• Communication data: content of inquiries to customer support (info@luboe.co, support@luboe.co)
• Device and usage data: IP address, browser type, operating system, referrer URL, pages visited, time spent on page
• Cookie and tracking data: see separate section 7

4. Legal Bases for Processing

The processing of personal data is based on:

• Art. 6(1)(b) GDPR: for the performance of a contract or to take steps prior to entering into a contract (e.g. order processing)
• Art. 6(1)(a) GDPR: based on consent given (e.g. newsletter, non-essential cookies)
• Art. 6(1)(f) GDPR: based on legitimate interest (e.g. fraud prevention, improving the shop)
• Art. 6(1)(c) GDPR: to comply with legal obligations (e.g. tax retention periods)

5. Disclosure to Shopify

The shop is operated on the Shopify platform. Shopify processes the data necessary for operating the shop as a processor (Art. 28 GDPR). For details, see Shopify's Privacy Policy: shopify.com/legal/privacy

6. Payment Providers

The following providers are used for payment processing; payment data is transmitted to them when the respective payment method is selected:

• Shopify Payments (operated via Stripe Payments Europe Ltd.) — shopify.com/legal/privacy
• PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A.) — paypal.com/privacy
• Klarna (Klarna Bank AB) — klarna.com/datenschutz

These providers process the data necessary for payment processing, in some cases as independent controllers. Their respective privacy policies apply in addition to this Privacy Policy. The legal basis is Art. 6(1)(b) GDPR.

7. Cookies and Tracking

The website uses cookies and comparable technologies. A distinction is made between:

• Technically necessary cookies: required for operating the shop (e.g. shopping cart function, login). Legal basis: Art. 6(1)(f) GDPR and § 25(2) TTDSG.
• Statistics and marketing cookies: only set with consent given via the cookie consent banner (Art. 6(1)(a) GDPR, § 25(1) TTDSG). Consent can be withdrawn or adjusted at any time via the cookie settings in the website footer.

Among others, the following tracking tools are used (active only with consent):

• Google Analytics (Google Ireland Limited) — policies.google.com/privacy
• Meta Pixel (Meta Platforms Ireland Limited) — facebook.com/privacy/policy

These providers may transfer data to third countries (in particular the USA). The Standard Contractual Clauses of the European Commission are used as an appropriate safeguard within the meaning of Art. 46 GDPR.

A detailed list of all cookies used, including their name, purpose, and retention period, can be found in the cookie banner.

8. Retention Period

Personal data is only stored for as long as necessary for the respective purpose:

• Order and invoice data: 10 years pursuant to § 147 AO / § 257 HGB (German tax and commercial law retention obligations)
• Account data: until the data subject deletes their customer account
• Communication data (support inquiries): 3 years after the inquiry is closed, unless a longer retention period is legally required
• Cookie and tracking data: as specified in the cookie banner, generally 30 days to 24 months depending on the tool

9. Rights of Data Subjects

Customers have the following rights:

• Access (Art. 15 GDPR) to the data processed
• Rectification (Art. 16 GDPR) of inaccurate data
• Erasure (Art. 17 GDPR), unless legal retention obligations prevent this
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR) to processing based on legitimate interest
• Withdrawal of consent given, at any time, with effect for the future

To exercise these rights: info@luboe.co

10. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is:

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 27, 91522 Ansbach
lda.bayern.de

11. Data Security

Technical and organizational security measures are used (including SSL/TLS encryption) to protect data against loss, misuse, and unauthorized access. However, complete protection against all risks cannot be guaranteed.

12. Children

This offer is not directed at persons under the age of 18. No data is knowingly collected from minors.

13. Changes to This Privacy Policy

This Privacy Policy may be updated to reflect changes in the law or in the services offered. The version published on this page at any given time applies.