Last updated: 21/07/2026
Lumicycle (“we”, “us”, “our”) is committed to protecting your privacy. This policy explains what personal data we collect through https://lumicycle.com, why we collect it, and what rights you have over it. It is written to comply with the UK GDPR and the Data Protection Act 2018.
Cookies are covered separately in our Cookie Policy.
We are the data controller for the personal data described in this policy.
Information you give us: your name, email address, postal address and phone number; order and delivery details; account login details if you register; any correspondence you send us; comments you leave on the site; and your marketing preferences.
Information collected automatically: your IP address, browser and device type, the pages you view, and how you reached our site. See our Cookie Policy for detail.
Payment information: we never see or store your card details. Payments are handled by Stripe and PayPal, who are PCI-DSS compliant. We receive only confirmation of payment and basic transaction details.
If you upload images to the site, please avoid images with embedded location data (EXIF GPS), as visitors can extract it. Pages may also include embedded content such as videos or maps from other websites, which behaves as though you had visited that site directly and may collect data about you.
We must have a lawful basis for everything we do with your data. Ours are:
Where we rely on consent you can withdraw it at any time, though this does not affect anything we did before you withdrew it.
We do not sell or rent your information, and we do not share it with third parties for their own marketing.
We share it with service providers who work on our behalf — hosting, email, delivery and payment providers — and only ever the minimum they need. They are contractually required to keep it secure and not use it for their own purposes. Our payment processors are Stripe and PayPal.
We may also disclose your data to professional advisers, or to authorities where we are legally required to. If our business is sold or reorganised, your data may transfer with it, and we will make sure your rights continue to be protected.
Some of our providers are based outside the UK. Where that is the case, we only transfer your data to countries the UK government has confirmed offer adequate protection, or under an International Data Transfer Agreement or equivalent safeguard.
We keep personal data only for as long as we need it. Order and transaction records are kept for seven years to meet HMRC requirements. Account details are kept while your account is open. Marketing records are kept until you unsubscribe, after which we keep a minimal record so we do not contact you again by mistake. Everything else is deleted or anonymised once it is no longer needed.
Our site uses SSL/TLS encryption, and details you give us are stored in encrypted form. We apply access controls and confidentiality obligations internally, and we have procedures for handling any suspected data breach, including notifying you and the ICO where we are required to.
If you have a password for part of our site, please keep it confidential and do not share it.
Under UK GDPR you have the right to:
There is no charge, and we will respond within one month. To exercise any of these, email info@lumicycle.com. We may ask you to confirm your identity first. Some data must be retained for legal or accounting reasons, and we will tell you if that applies.
You can unsubscribe from marketing at any time using the link in any email.
Please contact us first so we can put things right. You also have the right to complain to the Information Commissioner’s Office — 0303 123 1113, or https://ico.org.uk/make-a-complaint/.
We may look at your purchase history and preferences to send you more relevant information, and we use automated checks to help prevent fraud. We do not make decisions about you by automated means alone that have a legal or similarly significant effect. You can object to profiling for marketing at any time.
Our site is not aimed at children, and we do not knowingly collect data from anyone under 16. If you think we have, please contact us and we will delete it.
Our site links to websites run by other organisations. This policy covers only our site, so please read the privacy policies of any others you visit — we are not responsible for their practices.
We may update this policy from time to time. Changes will be posted here and the date above updated. Where changes are significant, we will tell you directly.