Last updated: August 2026
1. Controller
The controller responsible for data processing on this website is:
Uwe Malte Arndt, LUMABAG
Zum Sebaldsbrücker Bahnhof 1, 28309 Bremen, Germany
Phone: +49 421 5487335
E-mail: info@lumabag.de
2. Hosting
This website is hosted on servers operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. When the website is accessed, the server automatically processes so-called server log files: IP address, date and time of access, page accessed, browser type and operating system. This data is technically required to deliver the website and to ensure its stability and security (legal basis: Art. 6(1)(f) GDPR). The log files are automatically deleted after 30 days at the latest. A data processing agreement pursuant to Art. 28 GDPR is in place with Hetzner; processing takes place exclusively in Germany.
3. Cookies and local storage
This website uses strictly necessary cookies only: for the shopping cart and the ordering process (WooCommerce session), for delivering pages from the server cache, and for storing your cookie decision. These cookies are required for the operation of the shop and do not require consent pursuant to Section 25 (2) of the German TDDDG (legal basis of the associated data processing: Art. 6(1)(b) and (f) GDPR). We do not use any marketing, tracking or analytics cookies. The cookie notice is generated locally on this website; no data is transferred to third parties in the process.
4. Contacting us
If you contact us via the contact form or by e-mail, we process the data you provide (name, e-mail address, message) exclusively to handle your enquiry (legal basis: Art. 6(1)(b) GDPR, or Art. 6(1)(f) GDPR for general enquiries). The contact form transmits your details directly to our e-mail inbox; no third-party form services are used. We delete enquiries as soon as they are no longer required and no statutory retention obligations apply.
5. Customer account
You can create a customer account for your orders. In doing so, we process the data you provide (name, address, e-mail address) to provide the account (legal basis: Art. 6(1)(b) GDPR). The account can be deleted at any time — a short message to info@lumabag.de is sufficient. We retain data from completed orders in accordance with our obligations under German commercial and tax law.
6. Order processing
To process your order, we process the data provided during the ordering process: name, address, e-mail address, telephone number where applicable, and the order details (legal basis: Art. 6(1)(b) GDPR). We retain invoicing and accounting data for the statutory periods under German commercial and tax law (6 or 8 years). Transactional e-mails (order and dispatch confirmations) are sent via the mail server of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany.
7. Payment via PayPal
If you pay via PayPal (including “Pay Later” and direct debit via PayPal), your payment data is transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg (legal basis: Art. 6(1)(b) GDPR). For instalment payment offers, PayPal may carry out a credit check (Art. 6(1)(f) GDPR). For fraud prevention purposes, PayPal may also transfer data to group locations outside the EU (in particular the USA); this is done on the basis of the EU standard contractual clauses. PayPal’s privacy statement also applies: paypal.com/uk/legalhub/privacy-full
8. Shipping with DHL
To deliver your order, we pass on your name and delivery address to DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany (legal basis: Art. 6(1)(b) GDPR). We do not pass on your e-mail address or telephone number to DHL.
9. Web analytics and advertising
We do not use any web analytics services (e.g. Google Analytics) or advertising trackers on this website. To display our products in Google services (Google Shopping), we transmit product data — not visitor data — to Google.
10. Your rights
With regard to the personal data concerning you, you have the following rights vis-à-vis us: the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing (Art. 21 GDPR). You may withdraw any consent you have given at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority; the authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of the Free Hanseatic City of Bremen (Landesbeauftragte für Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen).
11. Storage period
We store personal data only for as long as is necessary for the purposes stated or as required by statutory retention obligations. After that, the data is deleted.
This privacy policy is an English translation provided for convenience; in case of doubt, the German version prevails.