Privacy policy
Last updated: 31 October 2026. This is a translation for your convenience; the German version is legally binding.
Privacy policy
Unless otherwise stated below, the provision of your personal data is neither required by law or contract nor necessary for concluding a contract. You are not obliged to provide the data. Not providing it has no consequences. This applies only insofar as no other information is given for the processing operations described below.
"Personal data" means any information relating to an identified or identifiable natural person.
Controller
The controller responsible for data processing is:
Dr. Falko Böttger-Hiller & Lars Ehrhardt Leuchtstoffe GbR, represented by Dr. Falko Böttger-Hiller and Lars Ehrhardt
Geschwister-Scholl-Str. 4, 04600 Altenburg, Germany
Phone: +49 151 55687366
Email: info@lumentics.de
Hosting and shop system (Shopify)
Our online shop runs on the platform of Shopify International Limited (Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; "Shopify"). As our processor, Shopify provides the shop system, hosting, checkout, customer accounts and the sending of system emails (e.g. order and shipping confirmations). All data arising from your visit and your order is processed in this context, in particular the usage, contact, order and payment data described below.
The processing is based on Art. 6(1)(b) GDPR insofar as it serves the performance of a contract or pre-contractual measures, and otherwise on Art. 6(1)(f) GDPR on the basis of our overriding legitimate interest in the secure, stable and efficient operation of our online shop. You have the right to object at any time, on grounds relating to your particular situation, to this processing based on Art. 6(1)(f) GDPR.
Shopify may also transfer data to Shopify Inc. (Canada) and to sub-processors in the USA. For Canada, an adequacy decision of the European Commission applies; transfers to the USA are based on the EU-US Data Privacy Framework or the EU standard contractual clauses. For certain purposes, such as fraud prevention, Shopify also processes data as an independent controller. Further information is available in Shopify's privacy policy at https://www.shopify.com/legal/privacy.
Server log files
You can visit our website without providing any personal information.
Each time you access our website, usage data is transmitted by your browser to us or to our web host / IT service provider (Shopify) and stored in log files (server log files). This data includes, for example, the name of the page accessed, date and time of access, IP address, amount of data transferred and the requesting provider.
The processing is based on Art. 6(1)(f) GDPR on the basis of our overriding legitimate interest in ensuring the trouble-free operation of our website and in improving our offer.
Contact
Contacting us by email
If you contact us by email, we collect your personal data (name, email address, message text) only to the extent you provide it. The processing serves to handle and answer your enquiry.
If the contact serves pre-contractual measures (e.g. advice on a purchase, preparing a quote) or relates to an existing contract between you and us, the processing is based on Art. 6(1)(b) GDPR. If you contact us for other reasons, the processing is based on Art. 6(1)(f) GDPR on the basis of our overriding legitimate interest in handling and answering your enquiry. In this case you have the right to object at any time, on grounds relating to your particular situation, to this processing.
We use your email address only to handle your enquiry. Your data is then deleted, subject to statutory retention periods, unless you have consented to further processing and use.
Contact form
When you use the contact form, we collect your personal data (name, email address, message text) only to the extent you provide it. The processing serves the purpose of contacting you. The legal bases and your right to object are the same as for contact by email (see above). Your data is deleted after your enquiry has been dealt with, subject to statutory retention periods, unless you have consented to further processing and use.
Withdrawal button
If you have concluded a contract through our online shop, we provide a withdrawal function (withdrawal button) with which you can submit your notice of withdrawal directly.
When you use it, we collect your personal data (name, email address, details identifying the contract or part of the contract you wish to withdraw from, and the date and time the notice was sent) only to the extent you provide it. The processing serves to give you the statutory option of withdrawing from your contract and to process your withdrawal properly.
If the contact relates to an existing contract between you and us, the processing is based on Art. 6(1)(b) GDPR; otherwise it is based on Art. 6(1)(c) GDPR to fulfil our legal obligation to provide a withdrawal function. The processing is also based on Art. 6(1)(f) GDPR on the basis of our overriding legitimate interest in offering a user-friendly way to withdraw. In this case you have the right to object at any time, on grounds relating to your particular situation.
We use your email address only to process your withdrawal. Your data is then deleted, subject to statutory retention periods, unless you have consented to further processing and use.
Customer account and orders
Customer account
When you open a customer account, we collect your personal data to the extent stated there. You sign in without a password using a confirmation code that we send to your email address. The processing serves to improve your shopping experience and simplify order processing. It is based on your consent under Art. 6(1)(a) GDPR. You can withdraw your consent at any time by notifying us, without affecting the lawfulness of processing carried out on the basis of the consent before its withdrawal. Your customer account will then be deleted.
Collection, processing and disclosure of personal data for orders
When you place an order, we collect and process your personal data only insofar as this is necessary to fulfil and process your order and to deal with your enquiries. Providing the data is necessary to conclude the contract; without it, no contract can be concluded. The processing is based on Art. 6(1)(b) GDPR and is necessary for the performance of a contract with you.
Your data is disclosed, for example, to shipping companies, payment service providers, service providers for order processing and IT service providers. In all cases we strictly observe the statutory requirements, and the scope of the data transferred is kept to a minimum.
Shipping with DHL
For delivery, we pass your name and delivery address to Deutsche Post AG / DHL Paket GmbH (Charles-de-Gaulle-Str. 20, 53113 Bonn, Germany; "DHL"). The processing is based on Art. 6(1)(b) GDPR.
We pass your email address to DHL only if you have expressly consented to the parcel notification in the cart, so that DHL can inform you of the delivery date. The processing is based on Art. 6(1)(a) GDPR. You can withdraw your consent at any time by notifying us or DHL, without affecting the lawfulness of processing carried out before the withdrawal.
Advertising
Newsletter
We use your email address to send you information and offers by newsletter if you have expressly agreed to this. The processing serves exclusively the purpose of advertising. For this we process your email address and any further data you voluntarily provide when subscribing.
The processing is based on your consent under Art. 6(1)(a) GDPR. You can withdraw your consent at any time without affecting the lawfulness of processing carried out before the withdrawal, by using the unsubscribe link in the newsletter or by notifying us. Your email address will then be removed from the mailing list. We may keep your email address on a blocklist to ensure that you do not receive any newsletters from us in future; this is based on Art. 6(1)(f) GDPR on the basis of our and your legitimate interest in preventing further use of your email address for our newsletter. You have the right to object to this processing at any time on grounds relating to your particular situation.
Shopify Email
We send our newsletter with Shopify Email, a service of Shopify International Limited (address above), acting as our processor. The data you provide when subscribing (email address and, if applicable, first and last name) is stored by Shopify. The processing serves the purpose of sending the newsletter and evaluating it statistically.
To evaluate newsletter campaigns, the newsletters contain a 1x1 pixel (tracking pixel) and/or tracking links. This lets us see whether you opened the newsletter and clicked any links. Data such as your IP address, browser type, device and the time of opening may be collected in this context. The data is used only for statistical evaluation to improve newsletter campaigns. The processing is based on Art. 6(1)(f) GDPR on the basis of our overriding legitimate interest in a targeted, effective and user-friendly newsletter system. You have the right to object at any time on grounds relating to your particular situation.
Inventory management
To process contracts, we use an inventory management system as our processor. Your personal data collected with your order is transmitted for this purpose to Billbee GmbH, Arolser Str. 10, 34477 Twistetal, Germany. The processing serves to perform the contract concluded with you and is based on Art. 6(1)(b) GDPR.
Payment service providers and credit checks
Shopify Payments
For credit card, Apple Pay, Google Pay, Klarna and other payment methods offered via Shopify Payments, we use the payment service Shopify Payments. Payments are processed by Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland; "Stripe"). If you choose one of these payment methods, the data required for payment processing (e.g. name, address, email address, payment details, invoice amount, IP address) is transmitted to Shopify and Stripe and, where applicable, to the provider of the payment method in order to perform the contract with you using the chosen payment method. This processing is based on Art. 6(1)(b) GDPR. Stripe also processes data for fraud prevention on the basis of Art. 6(1)(f) GDPR.
Providers of individual payment methods include:
- Apple Pay (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland)
- Google Pay (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland)
- Klarna (see below)
Further information is available in Stripe's privacy policy at https://stripe.com/privacy.
PayPal
We use the payment services PayPal Express and PayPal Checkout of PayPal (Europe) S.à r.l. et Cie, S.C.A. (22-24 Boulevard Royal, L-2449 Luxembourg; "PayPal"). To integrate PayPal Express, PayPal may collect, store and analyse data when the website is accessed (e.g. IP address, device type, operating system, browser type, location of your device), also using cookies that make it possible to recognise your browser. This is based on Art. 6(1)(f) GDPR on the basis of our overriding legitimate interest in offering a customer-oriented range of payment methods; you have the right to object at any time on grounds relating to your particular situation.
If you choose payment via PayPal, direct debit via PayPal or "Pay Later" via PayPal, the data required for payment processing is transmitted to PayPal in order to perform the contract with you using the chosen payment method (Art. 6(1)(b) GDPR).
For direct debit via PayPal and "Pay Later" via PayPal, PayPal reserves the right to carry out a credit check based on mathematical-statistical methods using credit agencies. For this purpose, PayPal transmits the personal data required for a credit check to a credit agency and uses the information received about the statistical probability of a payment default to make a balanced decision on establishing, performing or terminating the contractual relationship. The credit report may contain probability values (score values) calculated on the basis of scientifically recognised mathematical-statistical methods, which include address data among other things. Your legitimate interests are taken into account in accordance with the statutory provisions. The processing is based on Art. 6(1)(f) GDPR on the basis of our overriding legitimate interest in protection against payment default where PayPal makes an advance payment. You have the right to object to this processing at any time by notifying PayPal, on grounds relating to your particular situation. Providing the data is necessary to conclude the contract with the payment method you want; otherwise the contract cannot be concluded with that payment method.
Further information is available in PayPal's privacy statement at https://www.paypal.com/de/webapps/mpp/ua/privacy-full.
Klarna
Via Shopify Payments we offer payment methods of Klarna Bank AB (publ) (Sveavägen 46, 111 34 Stockholm, Sweden; "Klarna"). If you choose payment via Klarna, the data required for payment processing is transmitted to Klarna in order to perform the contract with you using the chosen payment method (Art. 6(1)(b) GDPR). Cookies may be stored that make it possible to recognise your browser; this is based on Art. 6(1)(f) GDPR on the basis of our overriding legitimate interest in offering a customer-oriented range of payment methods, and you have the right to object at any time on grounds relating to your particular situation.
For individual payment methods such as "Pay Later" (invoice) or "Financing" (instalments), Klarna reserves the right to carry out an identity and credit check using credit agencies. For this purpose, Klarna transmits the necessary personal data, such as first and last name, address, gender, email address, IP address and data related to the order, to a credit agency and uses the information received about the statistical probability of a payment default for a balanced decision on establishing, performing or terminating the contractual relationship. The processing is based on Art. 6(1)(f) GDPR on the basis of our overriding legitimate interest in protection against payment default where Klarna makes an advance payment. You have the right to object at any time by notifying Klarna, on grounds relating to your particular situation. Providing the data is necessary to conclude the contract with the payment method you want.
Further information, in particular on the credit agencies Klarna uses, and Klarna's privacy notice are available at https://www.klarna.com/international/privacy-policy/.
Prepayment and invoice for businesses
If you pay by prepayment (bank transfer) or – for businesses, public authorities and educational institutions by arrangement – on invoice, payment is made directly to us without involving a payment service provider. The processing is based on Art. 6(1)(b) GDPR.
Cookies and similar technologies
Our website uses cookies. Cookies are small text files stored in or by your browser on your device. When you visit a website, a cookie may be stored on your device; it contains a characteristic string that allows your browser to be uniquely identified when you visit the website again. Your browser's local storage works in a similar way and is used for some of the purposes described below.
You have full control over the use of cookies: in your browser settings you can choose to be notified before cookies are set, decide on each one individually, prevent cookies from being stored, and delete cookies already stored at any time. Please note that you may then not be able to use all functions of this website. Information on managing cookies is available from your browser provider (e.g. Chrome, Firefox, Safari, Microsoft Edge).
Technically necessary cookies
Unless otherwise stated in this privacy policy, we use only technically necessary cookies to make our offer more user-friendly, effective and secure – for example for the cart, checkout, sign-in to the customer account and storing your cookie choice. Some functions of our website cannot be offered without cookies. This is based on Section 25(2) TDDDG (German Telecommunications Digital Services Data Protection Act); the processing of your personal data is based on Art. 6(1)(f) GDPR on the basis of our overriding legitimate interest in ensuring the optimal functionality of the website and a user-friendly and effective design of our offer. You have the right to object at any time on grounds relating to your particular situation.
Consent management (Shopify cookie banner)
We use Shopify's cookie banner (Shopify International Limited, address above). It allows you to give consent to data processing on the website, in particular the setting of cookies, and to withdraw consent already given. The processing serves to obtain and document the required consents and thus to comply with legal obligations; your choice is stored in a cookie. It is based on Art. 6(1)(c) GDPR. You can change or withdraw your choice at any time using the "Cookie settings" link at the bottom of every page.
The banner distinguishes the categories "Necessary", "Personalisation", "Marketing" and "Analytics". Cookies and similar technologies in the categories Personalisation, Marketing and Analytics are used only with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). We currently do not use third-party advertising trackers (e.g. Google Ads or Meta); with your consent to "Marketing", Shopify may process data about your visit to measure and optimise marketing activities.
Analytics
Shopify statistics
If you have consented to the "Analytics" category in the cookie banner, Shopify collects usage data (e.g. pages viewed, time spent, referral source, device and browser) using cookies in order to provide us with aggregated statistics on the use of the online shop. This is based on your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future via "Cookie settings".
Matomo
We use the open-source analytics tool Matomo. Matomo is not operated by a third-party provider but on our own server (stats.provinzpreneur.de); no data is transmitted to InnoCraft Ltd., the maker of the software.
The processing serves to analyse this website and its visitors. We use Matomo in two stages:
Anonymous audience measurement without consent: For each page view, the address and title of the page, the referrer URL (the website from which you came) and – technically inherent in every request – your IP address and your browser's user agent are transmitted to our Matomo server. No cookies are set and no information is stored on or read from your device. The IP address is immediately shortened by two bytes (e.g. 192.168.xxx.xxx). To group page views of the same visit, Matomo creates a hash value from the shortened IP address and the user agent that changes daily; recognising you beyond that day is not possible. This processing is based on Art. 6(1)(f) GDPR on the basis of our overriding legitimate interest in knowing our visitor numbers and designing our website according to demand. You have the right to object at any time on grounds relating to your particular situation, e.g. by email to info@lumentics.de; tracking blockers in your browser are also respected.
Extended analysis with consent: If you have consented to the "Analytics" category in the cookie banner, the following information is also collected, among other things: information about your browser and device (device, screen size, language), products viewed, products added to the cart and completed orders (without name and address), number of visits, time of your first visit, date and time of the visit, time zone, location data. To recognise returning visits, a random identifier is stored in your browser's local storage. Pseudonymous usage profiles may be created from this data. This is based on your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future via "Cookie settings", without affecting the lawfulness of processing carried out before the withdrawal.
The data collected with Matomo is not used to identify visitors personally and is not merged with personal data about the bearer of the pseudonym. More information on privacy at Matomo: https://matomo.org/gdpr-analytics/.
Embedded videos (YouTube)
On some pages we embed videos from YouTube, a service of Google Ireland Limited (Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland; "YouTube"), in privacy-enhanced mode (youtube-nocookie.com). When the page loads, only a preview image that we provide ourselves via Shopify is shown; a connection to YouTube is established only when you start the video by clicking it. Your IP address, information about your browser and device and the page visited are then transmitted to YouTube, and YouTube may use cookies or similar technologies. A transfer to the USA is possible; it is based on the EU-US Data Privacy Framework.
The processing is based on the consent you give by clicking the video (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). More information is available in Google's privacy policy at https://policies.google.com/privacy.
Your rights and storage period
Storage period
After the contract has been fully processed, the data is stored first for the duration of the warranty period and then in accordance with statutory, in particular tax and commercial, retention periods, and deleted when these expire, unless you have consented to further processing and use.
Rights of the data subject
Where the statutory requirements are met, you have the following rights under Art. 15 to 20 GDPR: the right of access, rectification, erasure, restriction of processing and data portability. You also have the right under Art. 21(1) GDPR to object to processing based on Art. 6(1)(f) GDPR and to processing for direct marketing purposes.
Right to lodge a complaint with a supervisory authority
Under Art. 77 GDPR you have the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data is unlawful. You can lodge a complaint with, among others, the supervisory authority responsible for us:
Thüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheit
Postfach 90 04 55, 99107 Erfurt, Germany
or Häßlerstrasse 8, 99096 Erfurt, Germany
Phone: +49 361 573112900
Fax: +49 361 573112904
Email: poststelle@datenschutz.thueringen.de
Right to object
Where the processing of personal data described here is based on our legitimate interest under Art. 6(1)(f) GDPR, you have the right to object to this processing at any time with effect for the future, on grounds relating to your particular situation.
After an objection, the processing of the data concerned will cease unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.