Datenschutzerklärung

1. Who we are

This Privacy Policy explains how [Lux Health Ltd.], a corporation established in Ontario, Canada ("Lux Health", "we", "us", "our"), collects, uses, and discloses personal information when you visit theluxhealth.com (the "Site"), purchase from us, or otherwise communicate with us (together, the "Services"). We are the controller of your personal information for the purposes of the EU and UK General Data Protection Regulation and the organization responsible for it under Canada's PIPEDA and Quebec's Law 25.

Our contact details, and the details of the person responsible for privacy at Lux Health, are in Section 17.

2. Scope and acceptance

By using the Services you acknowledge that you have read this Privacy Policy. Where the law requires your consent for a particular use of your information (for example, marketing messages or non-essential cookies), we ask for it separately and you may withdraw it at any time.

3. Personal information we collect

Information you provide to us

  • Contact and order details: name, billing and shipping address, email address, phone number, and the products you order.
  • Payment confirmation: we do not receive or store your full card number. Our payment processor sends us the card type, last four digits, authorization result, and billing address.
  • Account details if you create an account: your email address and login credentials.
  • Customer support communications: anything you include in messages to us, including photographs you send with a return or damage claim.
  • Reviews and other content you choose to submit.

Information collected automatically

  • Usage and device data: IP address, browser and device type, operating system, referring site, pages viewed, products viewed or added to cart, and timestamps, collected through cookies, pixels, and similar technologies (see Section 5).

Information from third parties

  • Shopify, which hosts our store and processes checkout on our behalf.
  • Payment processors, which collect your payment details directly and send us a fraud-risk assessment for each order.
  • Shipping carriers, which send us tracking and delivery events for your parcel.
  • Advertising and analytics partners, which may tell us that you interacted with one of our advertisements or emails.

4. How we use your information and why we are allowed to

  • To fulfil your order: process payment, ship the parcel, send order and shipping notifications, handle returns, and provide support. Legal basis: performance of our contract with you.
  • To prevent fraud and handle payment disputes: screen orders for fraud, verify identity and address, and keep records needed to respond to chargebacks (see Section 7). Legal basis: our legitimate interest in protecting our business and preventing fraud; compliance with card-network rules.
  • To meet legal obligations: tax, accounting, customs, product-safety, and consumer-protection requirements. Legal basis: legal obligation.
  • To send marketing: emails and, where you have opted in, text messages about our products and offers. Legal basis: your consent, which you can withdraw at any time using the unsubscribe link or by replying STOP.
  • To run and improve the Site: analytics, testing, and personalization. Legal basis: consent for non-essential cookies in the EU/UK and where otherwise required; our legitimate interests elsewhere.
  • To enforce our terms and protect our rights: including responding to lawful requests from authorities. Legal basis: legitimate interests; legal obligation.

5. Cookies and similar technologies

We use strictly necessary cookies to run the Site (cart, checkout, security). We use analytics and advertising cookies only where permitted. If you are in the European Economic Area, the United Kingdom, or another jurisdiction that requires prior consent, non-essential cookies are not set until you accept them in our cookie banner, and you can change your choice at any time via the "Cookie preferences" link in the Site footer. Details of the cookies Shopify sets on our behalf are at https://www.shopify.com/legal/cookies. Blocking cookies through your browser may prevent parts of the Site from working.

6. Who we share your information with

We share personal information only as needed to run the Services:

  • Service providers acting on our instructions: Shopify (store hosting and checkout), payment processors, shipping carriers and postal services, email and SMS platforms, customer-support tools, and analytics providers.
  • Customs and tax authorities, where required to clear your parcel or comply with law.
  • Advertising partners, where you have consented, to measure our advertising and show you relevant advertisements on other platforms.
  • Our affiliated companies, for administration and operations within our corporate group.
  • Professional advisers, courts, regulators, and law enforcement where we are legally required to or to protect our rights.
  • A buyer or successor if our business or assets are sold or reorganized.

We do not sell your personal information for money, and we do not use or disclose sensitive personal information to infer characteristics about you.

7. Fraud prevention, payment disputes, and record retention

When you place an order we record your IP address, device identifiers, billing and shipping address, email address, the time of the order, your acceptance of our policies at checkout, and the carrier's delivery events for your parcel. We keep these records for seven years from the date of the order. We use them to detect fraudulent orders and, if you or your bank dispute a charge, to provide our payment processor and the card network with evidence that the order was placed by you, delivered to you, and governed by the policies you accepted. This is a legitimate interest, and we will not delete these records while a dispute is open or possible.

8. How long we keep your information

  • Order, payment, and delivery records: seven years, to satisfy tax and accounting law and to respond to payment disputes.
  • Customer-support communications: three years after the last contact.
  • Marketing consents and email/SMS activity: until you withdraw consent, then a suppression record so we do not contact you again.
  • Account data: until you delete your account or after three years of inactivity.
  • Usage and analytics data: up to 26 months, or as set by the analytics provider.

9. International transfers

We are located in Canada and your information is stored and processed in Canada and, through our service providers, in the United States and other countries. The European Commission and the UK have recognized Canada's PIPEDA as providing adequate protection for commercial transfers. For transfers from the EU or UK to countries without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (or the UK equivalent) or on providers certified under the EU-US or UK-US Data Privacy Framework.

10. Your rights

Depending on where you live, you may have the right to:

  • access the personal information we hold about you and receive a copy;
  • correct inaccurate or incomplete information;
  • delete your information, subject to our retention obligations in Sections 7 and 8;
  • restrict or object to certain processing, including for direct marketing;
  • receive your information in a portable format;
  • withdraw consent where processing is based on consent; and
  • not be discriminated against for exercising these rights.

To exercise any right, email support@theluxhealth.com with the subject "Privacy request." We will verify your identity (usually by confirming the email address on your order) and respond within the time required by your local law: 30 days in Canada, one month in the EU/UK, and 45 days in US states with privacy laws. An authorized agent may act for you with written proof of authorization.

Residents of the EEA, UK, and Switzerland also have the right to lodge a complaint with your national data-protection authority.

Residents of Canada: the person responsible for privacy compliance is named in Section 17. Quebec residents may also file a complaint with the Commission d'accès à l'information.

Residents of California and other US states with privacy laws: we do not sell personal information or share it for cross-context behavioural advertising except through consented cookies, which you can opt out of via the cookie preferences link or the "Do Not Sell or Share" link in the footer. We honour Global Privacy Control signals. You may appeal a decision on your request by replying to our response.

11. Marketing communications

We send marketing emails only to people who have subscribed at checkout or on the Site, and marketing text messages only to people who have separately opted in by entering their mobile number and agreeing to receive texts. Every marketing email includes an unsubscribe link, and you can stop texts by replying STOP. Message and data rates may apply. Unsubscribing does not stop transactional messages about your orders.

12. Children

The Services are not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has provided us information, contact us and we will delete it.

13. Security

We use Shopify's PCI DSS compliant checkout, TLS encryption on the Site, access controls on our systems, and staff access limited to what is necessary. No system is completely secure, so please do not send full card numbers or other sensitive details by email.

14. Reviews and public content

Anything you post in a public area of the Site, such as a product review, is visible to anyone and may be used by us in accordance with our Terms of Service. Do not include personal information you do not want public.

15. Third-party sites

The Site may link to third-party sites and platforms. Their privacy practices are their own, and this policy does not apply to them.

16. Changes to this policy

We will post any revised policy on the Site with a new "Last updated" date and, where a change materially affects how we use your information, notify you by email or a notice on the Site before it takes effect.