Privacy policy

Last updated: October 14, 2026

Lucis Umbra operates this online store and website to provide you with our products and services (the "Services"). Our store is hosted on Shopify, which provides the e-commerce platform that enables us to offer the Services to you. This Privacy Policy explains how we collect, use, and share your personal information when you visit our website, make a purchase, or otherwise communicate with us.

1. Personal Information We Collect When you visit or shop at Lucis Umbra, we may collect the following categories of personal data depending on how you interact with our store:

  • Contact Details: Name, billing address, shipping address, phone number, and email address.

  • Payment & Transaction Data: Payment method details, transaction confirmations, and details about the products you view, add to your cart, purchase, or return.

  • Account & Communication Data: Account login details (if you create an account) and any information you provide when contacting us (e.g., via email or Instagram for custom orders).

  • Device & Usage Data: IP address, browser type, network connection, and information on how you interact with our website, collected automatically via cookies and similar technologies.

2. How We Use Your Personal Information We process your personal data in accordance with the EU General Data Protection Regulation (GDPR) for the following purposes:

  • Providing the Services (Contractual Necessity): To process your payments, fulfill and ship your orders, handle custom order requests, manage returns, and send order notifications.

  • Customer Support & Communication (Legitimate Interest): To respond to your inquiries and provide customer service.

  • Marketing & Analytics (Consent / Legitimate Interest): To send promotional emails (if you subscribe to our newsletter) and to analyze store traffic to improve our website and product offerings.

  • Security & Legal Compliance (Legal Obligation): To prevent fraud, secure our platform, and comply with Finnish tax, accounting, and consumer protection laws.

3. Sharing Your Personal Information & Relationship with Shopify We share your personal data only when necessary to run our store and fulfill your orders:

  • Shopify: Our store is hosted by Shopify, which processes your data to provide and secure the checkout and storefront. For certain enhanced platform and marketing features, Shopify acts as an independent data controller. You can read more about how Shopify handles your data and exercise your Shopify-specific privacy rights at https://privacy.shopify.com/en.

  • Service Providers: Third-party partners who process data on our behalf, such as payment processors (Shopify Payments, PayPal) and shipping carriers (Posti, Matkahuolto, and EU couriers).

  • Legal Obligations: Authorities or legal entities when required by applicable law.

4. International Data Transfers Because we use global service providers like Shopify, your personal information may be transferred and processed outside the European Economic Area (EEA), including in Canada and the United States. When data is transferred outside the EEA, we rely on recognized legal safeguards, such as the European Commission’s Adequacy Decisions and Standard Contractual Clauses (SCCs).

5. Data Retention & Security We retain your personal information only for as long as necessary to provide our Services, manage your orders, and comply with statutory retention periods under Finnish accounting and tax legislation. While we use industry-standard security measures to protect your data, no internet transmission is completely infallible.

6. Children's Data Our Services are not intended for children, and we do not knowingly collect personal data from minors without parental consent.

7. Your Rights Under GDPR If you reside in the European Economic Area (EEA), you have the following rights regarding your personal data:

  • Right of Access & Portability: To request a copy of the personal data we hold about you.

  • Right to Rectification: To ask us to correct inaccurate or incomplete information.

  • Right to Erasure ("Right to be Forgotten"): To request the deletion of your personal data, subject to statutory retention obligations (such as bookkeeping laws).

  • Right to Restrict or Object to Processing: To object to or ask us to limit how we process your data.

  • Right to Withdraw Consent: You may unsubscribe from marketing emails at any time using the "unsubscribe" link in our emails.

To exercise any of these rights, please contact us using the details below. We may need to verify your identity before processing your request. If you are unsatisfied with how we handle your data, you have the right to lodge a complaint with your local data protection authority (in Finland: Office of the Data Protection Ombudsman, tietosuoja.fi).

8. Changes to This Policy We may update this Privacy Policy from time to time to reflect operational or legal changes. The updated version will always be posted on this page with the revised date.

9. Contact & Data Controller For the purposes of applicable EU data protection law, the data controller of your personal information is: Lucis Umbra (Business ID: 3603729-4) Kiviportintie 15 A 5, 00950 Helsinki, Finland Email: info@lucisumbra.store