This notice explains how Kylmäkorpi Sp. z o.o. (“LUMI”, “we”, “us”) uses personal data when you use https://thelumiclub.com/uk/.

We handle personal data in line with the UK GDPR and the Data Protection Act 2018.

1. Who is responsible

Controller: Kylmäkorpi Sp. z o.o.
ul. Bałtycka 6, 61-013 Poznań, Poland
KRS 0000974189 · NIP 7831857847 · Polish VAT PL7831857847 · UK VAT GB 449 4108 82
Email: support@thelumiclub.com
Telephone: 0800 707 4448

We are established in Poland and offer goods to customers in the United Kingdom. We have no UK establishment of our own. Metoni Logistics in Sheffield is a fulfilment processor, not our UK office.

UK representative (UK GDPR Article 27): We are appointing a specialist UK representative. Until we publish their name and UK address here, write to support@thelumiclub.com for data-protection matters. The ICO is at https://ico.org.uk.

2. Data we collect

You give us: name, email, phone number, delivery and billing address, account login, order contents, subscription choices, messages you send to support, and date of birth or other details needed for age verification.

PayU collects payment details on our behalf. We do not store your full card number.

Yoti carries out the age check after you click Pay now. We receive a pass or fail result and a record that the check was done for that order. We do not use Yoti data for marketing. The decision is automated. If you think it is wrong, email support@thelumiclub.com and we will review it. If Yoti cannot confirm you are 18 or over, there is no sale and we refund you in full. Yoti is an independent controller for the check itself. Read Yoti’s own privacy notice when the popup opens.

The site collects automatically: IP address, device and browser type, pages viewed, referring site, and approximate location derived from IP. Some of this is collected through cookies and similar technologies. See the Cookie Policy.

Google Consent Mode: before you choose in the cookie banner, and if you reject cookies, our Google Analytics and Google Ads tags run in a cookieless mode. Google receives anonymous, aggregated signals (page, time, browser type, consent status, a random number and, if you came from a Google ad, the ad-click identifier — carried only in the page address while you browse, never stored on your device) so it can estimate overall traffic and advertising results without identifying you; no cookie or identifier is stored on your device. Details are in section 3 of the Cookie Policy.

Matching a purchase to a Google ad (enhanced conversions): if you have accepted Marketing cookies and you then complete an order, we pass Google the email address, phone number, first name and last name from that order in hashed form. Hashing (SHA-256) is a one-way conversion that we carry out on our own server before anything leaves it; the original text is never sent and cannot be recovered from the hash. The postcode and country of the billing address are passed as they are. Google uses the hashes only to check whether the person who bought is the same person who clicked one of our Google ads while signed in to a Google account, so that the sale can be counted against that ad. Google does not share these values with other advertisers. If you rejected Marketing cookies, or have not chosen yet, none of this is passed.

Reviews: if you leave a product review, Klaviyo hosts the review content and any photo you upload.

We do not want personal data about anyone under 18. If we learn we have it, we delete it.

3. How we use data, and why

Purpose	Data	Lawful basis
Take and fulfil orders, run your account, send dispatch and tracking emails	Identity, contact, order, delivery	Contract
Subscriptions, failed-payment retries, cancellation	Account, payment token via PayU, order history	Contract
Age verification after Pay now	Pass/fail result and a record for that order	Until 29 October 2026: legitimate interests and contract. From 29 October 2026: legal obligation not to sell nicotine products to under-18s, and contract
Tax, accounting, VAT invoices	Order and invoice data	Legal obligation
Customer support and complaints	Contact and message content	Contract and legitimate interests
Fraud prevention and site security	IP, account, order patterns, Cloudflare signals	Legitimate interests
Analytics of how the shop is used, to improve it (Google Analytics 4, WooCommerce order attribution)	Approximate usage data, online identifiers	Consent (Statistics cookies). Before consent Google Analytics runs cookieless — see the row below
Email about an item you bought (service messages)	Email, order	Contract
Marketing emails and on-site Klaviyo personalisation	Email, browsing and purchase history	Consent, or the PECR soft opt-in where it applies to similar products after a sale
Advertising measurement (Meta Pixel, Google advertising tags)	Online identifiers, events such as view, add-to-cart, purchase	Consent
Aggregated, cookieless traffic and conversion estimates via Google Consent Mode before or without consent	Page, time, browser type, consent status, a random number and any Google ad-click identifier, carried only in the page address; nothing stored on your device	Legitimate interests — measuring the site and our advertising without identifying you
Matching a completed purchase to a Google ad you clicked (enhanced conversions)	Hashed email, phone number, first name and last name from the order; billing postcode and country	Consent (Marketing cookies)
Reviews display	Review text, name you chose, photos	Consent / legitimate interests in publishing reviews you submitted

You do not have to create an account to browse. You do have to give us the details needed to complete a purchase and to pass Yoti.

4. Who we share data with

We do not sell your personal data.

We use processors and other controllers who only get what they need:

• Kinsta — website hosting
• WooCommerce / WordPress — shop, cart, account, subscriptions
• PayU S.A. — card payments, and Apple Pay / Google Pay on one-off baskets
• Yoti — age verification after Pay now (pass/fail for that order)
• Royal Mail — delivery and tracking
• Klaviyo (account WBe6xa) — hosts and delivers product reviews (the read-only review feed is shown before any cookie choice; it stores nothing on your device), on-site messages and tracking after consent, and marketing email if you are subscribed
• Google (Google Ireland Limited) — Tag Manager (GTM-THVFPZ2R), Analytics (G-TSLL2G2W1B) and advertising tags. Cookieless, aggregated signals before consent (Google Consent Mode); full measurement, remarketing and hashed purchase matching (enhanced conversions, section 2) only where you have consented
• Meta — Pixel 858050253360302, where you have consented
• Ahrefs — site analytics, where you have consented
• Cloudflare — CDN, bot protection and Turnstile
• Usercentrics A/S (Cookiebot) — runs the cookie banner and keeps the log of your consent choices
• Metoni Logistics Limited, Unit 2, Redwall Close, Dinnington, Sheffield S25 3QA — UK warehousing, picking, dispatch and returns
• Mintsoft / Access UK Ltd — warehouse and order management used at the Sheffield warehouse. Receives name, delivery address and order contents so the parcel can be picked, packed and despatched. Not used for marketing
• Professional advisers, HMRC and other authorities where the law requires it

Some of these organisations are outside the UK. Poland has an adequacy decision from the UK. Where a provider is in the United States or another third country, we rely on the UK International Data Transfer Agreement, the UK Addendum to the EU SCCs, and/or the UK-US data bridge where the provider is certified.

5. How long we keep data

• Orders, invoices and tax records: 6 years after the end of the tax year
• Account: for as long as the account is open, then as long as we still need it for tax or a dispute
• Age-verification result: as long as we need it to show we checked age on that sale, and in any event no longer than 6 years
• Support emails: up to 3 years after the last message
• Marketing email: until you unsubscribe, then a suppression record so we do not email you again
• Cookies: see the Cookie Policy

6. Your rights

You can ask us for a copy of your data, a correction, deletion, restriction, or to object to legitimate-interests processing. You can ask for data you gave us in a portable format. You can withdraw consent at any time, without affecting processing already done.

Email support@thelumiclub.com. We may need to check who you are before we act.

You can complain to the Information Commissioner’s Office: https://ico.org.uk or 0303 123 1113.

7. Marketing

We only send marketing email if you have opted in, or if you are an existing customer and the message is about similar products and you were given a clear chance to refuse when your details were collected (PECR soft opt-in). Every marketing email has an unsubscribe link.

8. Cookies

Our Cookie Policy explains the cookies and similar technologies this site uses, which ones need consent, and how to change your mind.

9. Changes

We will update this notice when our processing changes. The date at the top is the latest version.