Privacy policy

Email: art.lumo.shop@gmail.com

When you access the website, the web server processes technically necessary connection data, in particular IP address, date and time, requested address, amount of data transferred, referrer, browser and operating system details. This is necessary to deliver the website securely and reliably. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is secure operation and troubleshooting.

Hosting provider: IPAX GmbH, Donaustraße 106, 3400 Klosterneuburg, Österreich. Server logs are deleted after 14 days, unless they are exceptionally required for longer to investigate a specific security incident.

Lumo does not use analytics or advertising cookies. To provide the shop flow you request, we store in your browser: the basket in Local Storage – for each item a small preview image of your artwork, the selected style, a technical identifier of the artwork and, if you write one, your note –, a redeemed voucher code, the technical identifiers of your most recent completed payments (so the basket is only emptied once after an order), the reduced-size preview of your current artwork in Session Storage, and, in IndexedDB, the image files required for later printing for each artwork: the full-resolution artwork and your original photo. The legal basis for any related personal data is Article 6(1)(b) GDPR. Storage and access on your device are permitted without consent under section 165(3) of the Austrian Telecommunications Act 2021 because they are strictly necessary to provide the shop service you expressly requested.

The basket stays in your browser until you empty it or delete site data. The Session Storage preview ends with the browser session. Image files in IndexedDB are kept only as long as they are needed: while you are working on the artwork or while at least one basket item refers to it. If you remove an artwork that is not in the basket, or the last basket item with an artwork, we delete the related files; leftovers from an abandoned session are removed the next time you visit the website. Your browser may also delete this data itself, for example when storage runs low or you have not visited the website for a while. The image files and notes are only transmitted to us when you submit an order. They are not accessed for advertising or tracking.

When you select an AI style, your photo is transmitted to our server over an encrypted connection, reduced in size in memory and passed to our AI service provider, which creates the preview. We do not store the photo ourselves in this step. The legal basis is Article 6(1)(b) GDPR.

Our AI service provider is OpenAI (OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland), acting as our processor. Processing also takes place at OpenAI in the USA, based on EU Standard Contractual Clauses in our data processing agreement with OpenAI. According to OpenAI, images submitted via the API are not used for training and are generally retained in abuse-monitoring logs for up to 30 days unless longer retention is legally required.

Further information: OpenAI API data controls.

If you select “Original”, the photo remains on your device until you place an order (section 5).

To prevent abuse and disproportionate costs, we limit the number of previews and order attempts per IP address. For this purpose, we keep the IP address and the time of the request in the server's memory for up to 24 hours; it is not stored permanently and is gone whenever the server restarts. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is protection against automated mass requests.

When you tap “Checkout”, we transmit the order lines, your notes, the approved print artwork and, where applicable, the original photo to our server. After payment, Stripe provides us with your name, email address, phone number where given, delivery address and payment status. This data is required to form and perform the contract, manufacture and deliver the product, and handle complaints (Article 6(1)(b) GDPR). We send the order confirmation — order number, line items, amounts and delivery address — to the email address you provided; we are obliged to do so under section 7(3) FAGG (Article 6(1)(c) GDPR). It is sent via our email provider (see below); we do not attach the print artwork itself. Records required by tax and commercial law are also processed under Article 6(1)(c) GDPR.

If you cancel or do not complete payment, we delete the transmitted order including the print artwork and photo once the payment session expires – usually after one hour.

Payments are processed by Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). You enter your payment details directly on a Stripe payment page; card details never reach us. Stripe processes some data as an independent controller, for example for fraud prevention and to meet legal obligations, and may transfer it to recipients in the USA. According to Stripe, these transfers rely, depending on the recipient, on the EU-US Data Privacy Framework or EU Standard Contractual Clauses. Stripe privacy policy.

The print artwork and original photo will be deleted no later than 30 days after delivery unless needed for an ongoing complaint. Invoices, accounting records and business correspondence subject to retention duties are generally kept for seven years from the end of the relevant calendar year under section 132 of the Austrian Federal Fiscal Code (BAO) and section 212 of the Austrian Commercial Code (UGB), and longer where required for pending proceedings.

If you email us, we process the sender address, message content and any other information you provide to answer your enquiry. The legal basis is Article 6(1)(b) GDPR for pre-contractual or contractual matters, and otherwise Article 6(1)(f) GDPR based on our legitimate interest in answering enquiries.

Email provider: Google Inc. We generally delete enquiries once they are fully resolved; content subject to statutory retention or needed for legal claims remains stored for the applicable period.

We only use service providers where necessary for operations, communication, payment, production or delivery. These include hosting and email providers, the payment service provider Stripe (see section 5), the production and shipping partner AS “Printful Latvia”, Raiņa bulvāris 25, Riga, LV-1050, Latvia, tax advisers and public authorities. Providers only receive the data required for their task. We provide Printful in particular with the print artwork, product and shipping information where required for production and delivery.

We use OpenAI for the AI preview; the provider, processing in the USA and safeguards are described in section 4.

Printful may use its own facilities and subprocessors outside the European Economic Area for production and delivery. International transfers only take place on a valid basis, in particular an adequacy decision or EU Standard Contractual Clauses. The same applies to the providers identified in sections 4 and 5.

Further information: Printful data processing terms.

Subject to the statutory conditions, you have the following rights in particular:

• access to your processed data (Article 15 GDPR),
• rectification of inaccurate data (Article 16 GDPR),
• erasure or restriction of processing (Articles 17 and 18 GDPR),
• data portability (Article 20 GDPR), and
• objection to processing based on legitimate interests (Article 21 GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority, in particular the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, Austria, dsb@dsb.gv.at. You may withdraw any consent at any time with future effect. None of the processing described in this policy relies on consent.

The photo and browser storage are only required if you choose to use the preview or basket features. Fields marked as mandatory at checkout are required for an order; without them we cannot perform the contract. We do not carry out automated decision-making, including profiling, within the meaning of Article 22 GDPR.