{"id":3,"date":"2021-02-23T10:33:03","date_gmt":"2021-02-23T10:33:03","guid":{"rendered":"https:\/\/nicotinepouches.productize.dev\/?page_id=3"},"modified":"2026-09-15T18:57:40","modified_gmt":"2026-09-15T17:57:40","slug":"privacy-policy","status":"publish","type":"page","link":"https:\/\/thelumiclub.com\/uk\/privacy-policy\/","title":{"rendered":"Privacy Policy"},"content":{"rendered":"

LUMI \u2014 Privacy Policy<\/strong>
Last updated: 15 September 2026<\/p>\n

This notice explains how Kylm\u00e4korpi Sp. z o.o. (\u201cLUMI\u201d, \u201cwe\u201d, \u201cus\u201d) uses personal data when you use https:\/\/thelumiclub.com\/uk\/.<\/p>\n

We handle personal data in line with the UK GDPR and the Data Protection Act 2018.<\/p>\n

1. Who is responsible<\/h2>\n

Controller:<\/strong> Kylm\u00e4korpi Sp. z o.o.
ul. Ba\u0142tycka 6, 61-013 Pozna\u0144, Poland
KRS 0000974189 \u00b7 NIP 7831857847 \u00b7 Polish VAT PL7831857847 \u00b7 UK VAT GB 449 4108 82
Email: support@thelumiclub.com
Telephone: 0800 707 4448<\/p>\n

We are established in Poland and offer goods to customers in the United Kingdom. We have no UK establishment of our own. Metoni Logistics in Sheffield is a fulfilment processor, not our UK office.<\/p>\n

UK representative (UK GDPR Article 27):<\/strong> We are appointing a specialist UK representative. Until we publish their name and UK address here, write to support@thelumiclub.com for data-protection matters. The ICO is at https:\/\/ico.org.uk<\/a>.<\/p>\n

2. Data we collect<\/h2>\n

You give us:<\/strong> name, email, phone number, delivery and billing address, account login, order contents, subscription choices, messages you send to support, and date of birth or other details needed for age verification.<\/p>\n

PayU collects payment details<\/strong> on our behalf. We do not store your full card number.<\/p>\n

Yoti<\/strong> carries out the age check after you click Pay now. We receive a pass or fail result and a record that the check was done for that order. We do not use Yoti data for marketing. The decision is automated. If you think it is wrong, email support@thelumiclub.com and we will review it. If Yoti cannot confirm you are 18 or over, there is no sale and we refund you in full. Yoti is an independent controller for the check itself. Read Yoti\u2019s own privacy notice when the popup opens.<\/p>\n

The site collects automatically:<\/strong> IP address, device and browser type, pages viewed, referring site, and approximate location derived from IP. Some of this is collected through cookies and similar technologies. See the Cookie Policy<\/a>.<\/p>\n

Google Consent Mode:<\/strong> before you choose in the cookie banner, and if you reject cookies, our Google Analytics and Google Ads tags run in a cookieless mode. Google receives anonymous, aggregated signals (page, time, browser type, consent status, a random number and, if you came from a Google ad, the ad-click identifier \u2014 carried only in the page address while you browse, never stored on your device) so it can estimate overall traffic and advertising results without identifying you; no cookie or identifier is stored on your device. Details are in section 3 of the Cookie Policy<\/a>.<\/p>\n

Matching a purchase to a Google ad (enhanced conversions):<\/strong> if you have accepted Marketing cookies and you then complete an order, we pass Google the email address, phone number, first name and last name from that order in hashed<\/strong> form. Hashing (SHA-256) is a one-way conversion that we carry out on our own server before anything leaves it; the original text is never sent and cannot be recovered from the hash. The postcode and country of the billing address are passed as they are. Google uses the hashes only to check whether the person who bought is the same person who clicked one of our Google ads while signed in to a Google account, so that the sale can be counted against that ad. Google does not share these values with other advertisers. If you rejected Marketing cookies, or have not chosen yet, none of this is passed.<\/p>\n

Reviews:<\/strong> if you leave a product review, Klaviyo hosts the review content and any photo you upload.<\/p>\n

We do not want personal data about anyone under 18. If we learn we have it, we delete it.<\/p>\n

3. How we use data, and why<\/h2>\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Purpose<\/th>\nData<\/th>\nLawful basis<\/th>\n<\/tr>\n<\/thead>\n
Take and fulfil orders, run your account, send dispatch and tracking emails<\/td>\nIdentity, contact, order, delivery<\/td>\nContract<\/td>\n<\/tr>\n
Subscriptions, failed-payment retries, cancellation<\/td>\nAccount, payment token via PayU, order history<\/td>\nContract<\/td>\n<\/tr>\n
Age verification after Pay now<\/td>\nPass\/fail result and a record for that order<\/td>\nUntil 29 October 2026: legitimate interests and contract. From 29 October 2026: legal obligation not to sell nicotine products to under-18s, and contract<\/td>\n<\/tr>\n
Tax, accounting, VAT invoices<\/td>\nOrder and invoice data<\/td>\nLegal obligation<\/td>\n<\/tr>\n
Customer support and complaints<\/td>\nContact and message content<\/td>\nContract and legitimate interests<\/td>\n<\/tr>\n
Fraud prevention and site security<\/td>\nIP, account, order patterns, Cloudflare signals<\/td>\nLegitimate interests<\/td>\n<\/tr>\n
Analytics of how the shop is used, to improve it (Google Analytics 4, WooCommerce order attribution)<\/td>\nApproximate usage data, online identifiers<\/td>\nConsent (Statistics cookies). Before consent Google Analytics runs cookieless \u2014 see the row below<\/td>\n<\/tr>\n
Email about an item you bought (service messages)<\/td>\nEmail, order<\/td>\nContract<\/td>\n<\/tr>\n
Marketing emails and on-site Klaviyo personalisation<\/td>\nEmail, browsing and purchase history<\/td>\nConsent, or the PECR soft opt-in where it applies to similar products after a sale<\/td>\n<\/tr>\n
Advertising measurement (Meta Pixel, Google advertising tags)<\/td>\nOnline identifiers, events such as view, add-to-cart, purchase<\/td>\nConsent<\/td>\n<\/tr>\n
Aggregated, cookieless traffic and conversion estimates via Google Consent Mode before or without consent<\/td>\nPage, time, browser type, consent status, a random number and any Google ad-click identifier, carried only in the page address; nothing stored on your device<\/td>\nLegitimate interests \u2014 measuring the site and our advertising without identifying you<\/td>\n<\/tr>\n
Matching a completed purchase to a Google ad you clicked (enhanced conversions)<\/td>\nHashed email, phone number, first name and last name from the order; billing postcode and country<\/td>\nConsent (Marketing cookies)<\/td>\n<\/tr>\n
Reviews display<\/td>\nReview text, name you chose, photos<\/td>\nConsent \/ legitimate interests in publishing reviews you submitted<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

You do not have to create an account to browse. You do have to give us the details needed to complete a purchase and to pass Yoti.<\/p>\n

4. Who we share data with<\/h2>\n

We do not sell your personal data.<\/p>\n

We use processors and other controllers who only get what they need:<\/p>\n