Legal

GDPR Compliance

Last updated: 4 September 2026

LumiereX is based in Amsterdam, the Netherlands, and is committed to complying with the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) in everything we do — as a data controller for our Website visitors, and as a data processor for the fulfillment clients we serve.

1. Our role under the GDPR

As a website operator: we act as data controller for the contact and analytics data described in our Privacy Policy.
As a fulfillment partner: once you become a client, we act as data processor for any personal data contained in the orders we pick, pack, and ship on your behalf (e.g. your customers' names and delivery addresses). This processing is governed by a separate Data Processing Agreement (DPA) signed as part of your services agreement — ask us for a copy at hello@lumierex.nl.

2. Data controller details

Entity: LumiereX (registered as a sole proprietorship / eenmanszaak with the Dutch Chamber of Commerce)
Address: Baweanstraat 18-2, 1095 XZ Amsterdam, Netherlands
KVK number: 93981929
Contact: hello@lumierex.nl

3. Your rights as a data subject

Under Articles 15–22 of the GDPR, you have the right to:

Right of access — obtain a copy of the personal data we hold about you;
Right to rectification — correct inaccurate or incomplete data;
Right to erasure — request deletion of your data, subject to legal retention requirements;
Right to restrict processing — limit how we use your data in certain circumstances;
Right to data portability — receive your data in a structured, machine-readable format;
Right to object — object to processing based on legitimate interest, including for direct marketing;
Right to withdraw consent — at any time, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, email hello@lumierex.nl with your request. We will verify your identity where necessary and respond within one month, as required by the GDPR.

4. Supervisory authority

If you believe we have not handled your personal data in accordance with the GDPR, you have the right to lodge a complaint with the Dutch supervisory authority:

Autoriteit Persoonsgegevens
autoriteitpersoonsgegevens.nl

5. International data transfers

Some of our processors (e.g. Google, for Analytics and Tag Manager) may process data outside the EU/EEA. Where this occurs, it is covered by the EU-approved Standard Contractual Clauses or an equivalent adequacy mechanism.

6. Data protection by design

We limit the personal data we collect to what is necessary for each purpose, restrict internal access to submitted data, and only work with processors (hosting, analytics) that offer GDPR-appropriate safeguards.

7. Related documents

See also our Privacy Policy and Terms of Service.