Cookie Policy
Last updated: 15 September 2026
This site uses cookies and similar technologies (pixels, local storage, tags and scripts). This policy should be read with the Privacy Policy.
1. What the law requires
Under the Privacy and Electronic Communications Regulations we must tell you what we store or access on your device and, for many technologies, get consent first.
- Strictly necessary cookies do not need consent.
- First-party analytics used only to improve this site, and cookies that remember how the site looks for you, do not need prior consent if we give you a simple, free way to object.
- Advertising, profiling, cross-site tracking and most marketing pixels still need a clear opt-in. Rejecting them must be as easy as accepting them.
2. What this site actually uses
We inspected the live UK shop in September 2026. The following load on https://thelumiclub.com/uk/. The full, automatically scanned list is in section 7.
Strictly necessary
| Tool | Whose | What it does |
|---|---|---|
| WooCommerce session and cart cookies | Us | Remembers your basket, checkout and logged-in account |
| WordPress account cookies | Us | Keeps you signed in |
Cloudflare __cf_bm and related security cookies |
Cloudflare | Distinguishes people from bots |
| Cloudflare Turnstile | Cloudflare | Stops automated form abuse |
CookieConsent cookie (Cookiebot by Usercentrics) |
Usercentrics A/S, as our processor | Remembers your banner choice for 12 months. Each choice is logged with a consent ID, a timestamp and an anonymised IP address so we can show that consent was given or refused |
| Yoti age-verification scripts | Yoti | Opens after Pay now so we can complete an 18+ sale |
Analytics
| Tool | Whose | What it does | Consent |
|---|---|---|---|
| Google Tag Manager GTM-THVFPZ2R | Loads the Google tags below and, after consent, the marketing tags | Loads on every page and sets no cookie itself. The Google tags inside it run cookieless until you choose (section 3). Meta, Ahrefs and Klaviyo tags wait for Accept | |
| Google Analytics 4 G-TSLL2G2W1B | Measures visits, product views and purchases. Ads personalisation is on for this shop, so this is not treated as stats-only | Prior consent required for cookies. Before consent it runs in cookieless mode (section 3) | |
| Ahrefs Analytics | Ahrefs | Site performance and traffic | Prior consent required |
| WooCommerce order attribution / Sourcebuster | Us | Records how an order reached the shop | Statistics consent. Off, and its cookies removed, if you reject |
Marketing and advertising
| Tool | Whose | What it does | Consent |
|---|---|---|---|
| Meta Pixel 858050253360302 | Meta | PageView, ViewContent, AddToCart, InitiateCheckout, Purchase | Prior consent required |
| Google advertising / DoubleClick tags loaded via GTM | Ad measurement and remarketing | Prior consent required for cookies and remarketing. Before consent, conversion signals are sent cookieless (section 3). After Accept, a completed order is also matched to the ad using hashed order details — see the Privacy Policy, section 2 | |
| Klaviyo on-site tracking and forms (company WBe6xa) | Klaviyo | Identify browser, full reviews widget, on-site messages, marketing | Consent for tracking and marketing forms. Publishing a review you submit is separate |
Klaviyo also sends marketing email if you subscribe. That is not a cookie issue; it is covered in the Privacy Policy.
Content loaded without cookies
| Tool | Whose | What it does |
|---|---|---|
| Product reviews (read-only feed) | Klaviyo | Shows published reviews on product pages before you have made a choice. A plain content request, like an image: nothing is stored or read on your device. Klaviyo sees your IP address to deliver it, as any content server does |
3. Google Consent Mode
Before you make a choice in the cookie banner, and if you reject cookies, our Google Analytics and Google Ads tags run in a restricted, cookieless mode. No cookies are set or read and no identifier is stored on your device. Google receives anonymous, aggregated signals — the page you viewed, the time, your browser type, your consent status and a random number that is never stored on your device: it is carried only in the page address while you move around the site and is gone when you leave — so that it can estimate overall traffic and advertising results without identifying you. If you arrived from a Google ad, the ad-click identifier in that link is carried the same way, so a purchase you make after accepting cookies can still be counted against the ad. Your IP address is processed by Google to deliver the request and is not stored with these signals.
If you accept Statistics or Marketing cookies, the same tags switch to the normal mode described in section 2. Our contracting entity is Google Ireland Limited. For Google Analytics, Google acts as our processor under the Google Ads Data Processing Terms, and as a controller under the Google Measurement Controller-Controller Data Protection Terms where advertising features are used; for Google Ads measurement it acts as an independent controller under the Google Ads Controller-Controller Data Protection Terms. You can change your choice at any time via Cookie settings in the footer or in section 7.
4. How to choose
When we show the cookie banner, use Accept or Reject. Nothing is pre-ticked. Rejecting non-essential cookies does not block the shop, the basket or checkout.
You can change your mind later through Cookie settings in the footer, or through the declaration in section 7, which also shows your current consent ID and date.
Browser settings are not a substitute for that choice. They will not reliably switch off the Meta pixel or Klaviyo tracking on this site.
5. How this site is set up
Our consent banner is Cookiebot by Usercentrics, a Google-certified consent management platform. It blocks non-essential tags until you choose.
- Necessary cookies (basket, account, security, the Yoti check needed to complete an 18+ sale) work without a click.
- The Meta Pixel, Ahrefs and Klaviyo on-site tracking stay off until you press Accept. Google Analytics 4 and Google advertising tags load, but run without cookies or identifiers until you accept (section 3).
- Reject is as easy as Accept. Rejecting does not block the shop, the basket or Pay now.
- Google Analytics on this shop has ads personalisation on, so it is not treated as a stats-only cookie. It needs prior consent.
- Targeting and analytics toggles do not default to on.
- If you withdraw consent, the cookies set by these tools are removed from your browser on the spot.
Yoti runs after Pay now because it is needed to complete an age-restricted sale you have asked for. It is not used for advertising.
6. How long cookies last
Session cookies expire when you close the browser. WooCommerce cart cookies usually last days, not years. The CookieConsent cookie lasts 12 months. Google, Meta and Klaviyo set their own durations, listed per cookie in section 7; their own notices apply as well as this one.
7. Cookie declaration
The list below is generated by Cookiebot from a monthly scan of this site. It shows every cookie and tracker found, grouped by purpose, with the provider and how long each one lasts. It also shows your current consent ID and date, and lets you change or withdraw your choice.