Privacy policy

LUXA Store Privacy Policy

Last updated: 5 September 2026

1. Controller

The controller of your personal data is LUXA sp. z o.o., with its registered office at ul. Hetmańska 40a/23, 35-045 Rzeszów, Poland, entered in the Register of Entrepreneurs of the Polish National Court Register, tax identification number (NIP): 8133781271, statistical number (REGON): 380307103 (hereinafter: the “Controller”, “LUXA” or the “Store”).

You may contact the Controller about privacy matters and the exercise of your rights:

by e-mail: support@luxa.cc;
by post: LUXA sp. z o.o., ul. Hetmańska 40a/23, 35-045 Rzeszów, Poland.

2. Scope of this policy and sources of data

This policy explains how we process personal data when you use luxa.cc, place and receive orders, create an account, contact customer service, use the chat, subscribe to the newsletter, or use cookies and similar technologies.

We obtain data primarily from you. We may also receive payment or delivery information from payment service providers, banks, carriers and postal operators, and technical data from your device, browser, server logs and tools used in accordance with your consent choices.

Depending on how you use the Store, we may process in particular:

identification and contact details, such as your first name, surname, address, e-mail address and telephone number;
account, order, delivery, return, complaint and settlement information;
the content of correspondence and chats, and data necessary to handle your request;
information about newsletter consent, its confirmation, the source and date of subscription, and any subsequent withdrawal of consent or objection;
technical data, such as an IP address, session and device identifiers, event date and time, security logs, and information stored in cookies.

Please do not provide special categories of personal data through forms or chat, such as health data, political opinions, religious beliefs or biometric data, unless this is necessary and has been expressly agreed.

3. Purposes, legal bases and retention periods

Entering into and performing a contract, processing an order and maintaining an account: Article 6(1)(b) GDPR. Providing the data marked as required in the form is necessary to enter into or perform the contract. We retain the data for the duration of the contract and then for the period required for settlement and until the relevant limitation periods have expired.
Handling payments, delivery, returns, exchanges and complaints: Article 6(1)(b) GDPR and, where required by law, Article 6(1)(c) GDPR. We retain the data for the duration of the matter and then for the applicable settlement period or limitation period.
Compliance with tax, accounting and other legal obligations: Article 6(1)(c) GDPR. We retain the data for the period required by applicable law, in particular tax and accounting law.
Handling enquiries and communicating with customers: Article 6(1)(b) GDPR where the contact concerns a contract or steps taken before entering into a contract, or Article 6(1)(f) GDPR — our legitimate interest in answering enquiries and providing customer service. We retain the data until the matter is closed and then for the period necessary to defend against claims.
Ensuring Store security, preventing abuse and maintaining technical logs: Article 6(1)(f) GDPR — our legitimate interest in protecting the Store, customers and infrastructure. We retain the data only for as long as necessary to detect and investigate incidents and protect legal claims.
Establishing, pursuing or defending legal claims: Article 6(1)(f) GDPR. We retain the data until the applicable limitation periods have expired or the proceedings have been finally concluded.
Newsletter and direct marketing by e-mail: Article 6(1)(a) GDPR and Article 398 of the Polish Electronic Communications Law. We process the data until you withdraw your consent or object. We may retain a record of the consent and its withdrawal, as well as a suppression-list entry, for the period necessary to demonstrate compliance and ensure that no further message is sent, pursuant to Article 6(1)(c) or (f) GDPR.
Analytics, personalisation and marketing using optional cookies or similar technologies: Article 6(1)(a) GDPR in conjunction with Article 399 of the Polish Electronic Communications Law. We process the data until consent is withdrawn or until the lifetime of the relevant technology stated in the consent-management tool expires, whichever occurs first.

4. Newsletter and anti-spam rules

The newsletter contains information about LUXA products, new releases, promotions and brand activities. Subscription is voluntary and is not a condition of purchase.

Double opt-in: after you provide your e-mail address, we send a message containing a confirmation link. The newsletter starts only after you confirm the subscription. We keep evidence of consent, including its wording, date, source and confirmation information.
No purchased lists: we do not buy, rent or use address lists obtained without the required legal basis.
Migration of existing contacts: we transfer to a new mailing system only contacts for which we hold sufficient and demonstrable evidence of valid consent. Contacts without such evidence are not used for newsletter distribution.
Easy unsubscribe: every marketing message contains a free unsubscribe link. You may also withdraw consent by writing to support@luxa.cc. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Separation of transactional messages: order, payment, delivery, return and complaint notifications are sent to perform a contract or comply with a legal obligation and do not depend on newsletter consent. We do not add marketing to such messages unless we have an appropriate legal basis.

5. Chat and customer service contact

Use of the chat is voluntary. We process the data provided in your message and technical data required to operate and secure the conversation, in particular the conversation identifier, date and time of contact, IP address and basic technical information.

Chat data are used to answer your enquiry, assist with product selection and handle an order, return, exchange or complaint. The legal basis is Article 6(1)(b) GDPR where the conversation concerns a contract, or Article 6(1)(f) GDPR — our legitimate interest in handling enquiries, ensuring security and defending against claims.

Chat messages may be forwarded to our customer service team through the communication service we use, including Telegram. We limit the information transferred to what is necessary to handle the conversation. Telegram may process data as a separate controller under its own privacy policy. Please do not provide sensitive data or information that is not necessary to handle the matter through the chat.

Providing an e-mail address in the chat does not subscribe you to the newsletter. We may use the address to reply or continue handling your request, while marketing requires a separate legal basis.

6. Recipients of data

We do not sell personal data or disclose it to other entities for their own marketing purposes. To the extent necessary for the purposes described above, data may be received by:

providers of hosting, Store maintenance, e-mail, newsletter systems, backup, security and other IT services;
payment service providers, banks, courier companies, postal operators and entities handling returns;
providers of customer service, chat, analytics and advertising tools — for optional tools, only in accordance with your consent;
accountants, legal advisers, auditors, insurers and entities assisting with the pursuit or defence of claims;
public authorities and other entities entitled to receive data under applicable law.

Entities processing data on our behalf receive it under a contract and only in accordance with our documented instructions. Some recipients, such as payment service providers, banks, carriers or communication-service operators, may act as separate controllers and apply their own privacy policies.

7. Transfers outside the European Economic Area

Some technology providers may process data outside the European Economic Area. Where such a transfer takes place, we rely on a mechanism provided for in Chapter V GDPR, in particular a European Commission adequacy decision or Standard Contractual Clauses together with supplementary measures where required. You may contact us to obtain information about the safeguards used or a copy of them.

8. Cookies and similar technologies

The Store uses cookies and similar technologies. Strictly necessary cookies are used where required to transmit a communication or provide a service expressly requested by the user, in accordance with Article 399(3) of the Polish Electronic Communications Law. Other cookies — in particular analytics, non-essential functional and marketing cookies — are used only after consent has been obtained.

Strictly necessary: session, basket, login, security and essential Store functions.
Functional: remembering selected settings and improving convenience.
Analytics: measuring how the Store is used and improving its operation.
Marketing: measuring campaigns, limiting advertising frequency and adapting communications.

On your first visit, you can accept or reject optional categories. You may withdraw consent at any time using the consent-management tool available in the Store or your browser settings. Withdrawing consent should be as easy as giving it. Blocking strictly necessary cookies may prevent some functions from working.

9. Your rights

Subject to the conditions set out in the GDPR, you have:

the right of access and to receive a copy of your data (Article 15 GDPR);
the right to rectification (Article 16 GDPR);
the right to erasure (Article 17 GDPR);
the right to restriction of processing (Article 18 GDPR);
the right to data portability (Article 20 GDPR);
the right to object to processing based on Article 6(1)(e) or (f) GDPR (Article 21 GDPR);
the right to object to direct marketing at any time — after an objection, the data will no longer be used for this purpose;
the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

You may send a request to support@luxa.cc. Before acting on a request, we may ask for information necessary to verify your identity. We will respond without undue delay, generally within one month, subject to the exceptions provided for in the GDPR.

You also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office, ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland, uodo.gov.pl, or with the supervisory authority in the country of your habitual residence, place of work or place of the alleged infringement.

10. Voluntary and mandatory provision of data

Providing data for the newsletter, optional forms and chat is voluntary, although without the information needed to respond we may not be able to handle your request. Providing data marked as required when placing an order is necessary to enter into and perform the contract or comply with a legal obligation. Without it, we may be unable to process your order.

11. Automated decision-making and profiling

The Controller does not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR. With your consent, data concerning your use of the Store may be used for basic content personalisation, campaign measurement or audience grouping, but this does not produce the effects described above.

12. Data security

We use technical and organisational measures appropriate to the risk, including access controls, encryption in transit, backups, updates, data minimisation and security-event monitoring. Access to data is granted only to persons and entities that need it to perform their tasks.

13. Links to other websites

The Store may contain links to websites and services operated by other entities. Once you enter such a service, its operator determines how personal data are processed. We encourage you to read the relevant privacy policy.

14. Changes to this policy

We may update this policy if the law, the operation of the Store or the services we use change. The new version will be published on this page together with its update date. If a change requires new consent, we will ask for it before commencing the relevant processing.