Privacy policy
This privacy policy explains how personal data is processed when you use lunara-wonderspray.com, place orders or contact Lunara. Personal data means information relating to an identified or identifiable person.
1. Controller and contact details
KAIZEN NOVA - FZCO
IFZA Properties, IFZA Business Park, Dubai Digital Park
Unit 88296 - 001, Dubai Silicon Oasis
Dubai, United Arab Emirates
Email: info@lunara-wonderspray.com
Telephone: +971 55 162 0091
Authorised representatives: Chris Stuart Douglas Duncan Oldfield (General Manager) and Shelby May Oldfield (Director), each individually. Contact us using the details above for privacy questions or to exercise your rights.
Representative in the European Union
Our representative under Article 27 GDPR is:
Horses Home INB OHG
Gildemeisterstraße 88
33689 Bielefeld, Germany
Email: info@horses-home.com
You may also contact our representative with questions about the processing of your personal data.
2. Legal bases
We process data necessary for an order, its fulfilment or pre-contractual steps requested by you under Article 6(1)(b) GDPR. Where an obligation under EU or Member State law requires processing, the basis is Article 6(1)(c) GDPR. Not every obligation under foreign law automatically qualifies under this provision.
We rely on Article 6(1)(f) GDPR to provide the shop securely, respond to general enquiries and establish or defend claims. Our interests are a functioning shop protected against misuse, reliable communication and safeguarding our rights. We take account of your interests and fundamental rights.
Where we ask for voluntary consent, the basis is Article 6(1)(a) GDPR. You may withdraw consent at any time with effect for the future. Visiting our website or reading this policy is not consent.
3. Shopify platform
We use Shopify as the technical platform for the website, basket, checkout and order management. For our business location, the contracting entity specified in Shopify's terms is Shopify International Limited, The Sidings, 4th Floor, Grand Canal Quay, Dublin D02 E7K8, Ireland.
When you visit, data processed may include your IP address, browser and device information, access time, requested pages and technical error data. This enables content delivery, stability and protection against attacks. The basis is Article 6(1)(f) GDPR and, where processing is necessary for a requested shop or contract function, Article 6(1)(b) GDPR.
The Shopify Data Processing Addendum applies to processing on our behalf. Depending on the features used, Shopify may also process data as a controller, for example through a direct relationship with you via Shop or Shop Pay. Information and contact options are available in Shopify's consumer privacy policy and privacy portal.
4. Orders, payments and delivery
When you order, we process your name, email, billing and delivery addresses, ordered items, quantities, order number, prices and payment and delivery status. A telephone number is processed where required for the selected process or supplied by you. Processing supports contract formation, payment allocation, delivery, customer service and returns or complaints under Article 6(1)(b) GDPR.
Your selected payment provider and its technical service providers receive the information necessary for payment. For delivery, we share necessary order and delivery information with the appointed warehouse and carrier. Providers receive only the data needed for their task. Available payment services are identified when you select them at checkout.
Returns are received by Horses Home, Pflugweg 70b, 32457 Porta Westfalica, Germany. Order and return information needed to identify and process the return is provided for this purpose.
5. Customer account
If you use a customer account, your login details and associated order information are processed to provide protected access to your account and orders under Article 6(1)(b) GDPR. Security logs also serve our legitimate interest in preventing unauthorised access under Article 6(1)(f) GDPR.
6. Contact, partner enquiries and creator applications
If you contact us by email or form, we process your information to answer your enquiry. The contact form collects your name, email, subject and message. Depending on the enquiry, the basis is Article 6(1)(b) GDPR or our legitimate interest in handling general enquiries under Article 6(1)(f) GDPR.
The partner form may also collect a company name and website. For creator applications, we process your name, email, supplied Instagram profile and information about your community, life with horses, content, motivation and previous brand partnerships. We use this to assess possible collaboration and contact you under Article 6(1)(b) GDPR. Where we view the publicly available profiles you identify, this supports assessment of the requested collaboration under Article 6(1)(f) GDPR; the source is the profile you specified.
Delivery details for product samples are requested separately after acceptance where needed. Applying does not itself add you to a marketing list. Confirming that you have read a privacy notice does not replace separate marketing consent.
Website forms are transmitted through Shopify. Provide only information necessary for your enquiry, and no payment credentials or unnecessary personal health information.
7. Care Finder and Luna
The Care Finder processes selected answers to display relevant information. Result parameters can appear in the page URL and therefore in browser history and technical access records. Do not enter personal data there. Providing the requested function is based on Article 6(1)(b) GDPR; technical security is based on Article 6(1)(f) GDPR.
Luna, the digital assistant on this website, operates using rules in your browser. The assistant does not send your input to an external AI service or store it as a permanent chat history. “Clear history” removes the visible messages. If you follow a contact or account link, processing there is separate, as described in the relevant sections of this policy. The assistant makes no decisions with legal effects concerning orders, refunds or you as an individual.
8. Cookies and similar technologies
Cookies and similar technologies may store or access information on your device. Where strictly necessary to transmit a communication or provide a function you explicitly request, Section 25(2) of the German TDDDG applies. This may include the basket, login and saving your privacy choices. Subsequent processing of personal data uses the legal bases identified in the relevant sections.
Non-essential analytics and advertising technologies require your prior consent where prescribed by Section 25(1) TDDDG and Article 6(1)(a) GDPR. Consent must be voluntary and as easy to withdraw as to give. Rejecting these technologies must not make a purchase conditional on marketing consent.
9. Marketing and newsletters
If you expressly subscribe to an offered newsletter, we process the contact details provided and evidence of consent to send the communications requested. The basis is Article 6(1)(a) GDPR. You may unsubscribe using the link in a message or our contact address. Necessary messages about an order, return or safety issue are separate.
10. Other recipients
Authorised staff, IT and communications providers, advisers and competent authorities may receive data to the extent necessary and where there is a legal basis for the purpose. Processors are bound by contract. Where a provider independently determines purposes and means, it processes data under its own responsibility as a controller.
11. Processing outside the European Economic Area
KAIZEN NOVA - FZCO is established in the United Arab Emirates. Authorised persons may process personal data there. The European Commission has not adopted an adequacy decision for the UAE. The applicability of the GDPR or a contract for buying goods does not replace any required safeguards for transfers to third countries.
Shopify uses international group companies and service providers. For transfers it covers, Appendix C of Shopify's Data Processing Addendum describes mechanisms including binding corporate rules, standard contractual clauses and applicable adequacy decisions. The mechanisms used and information about Shopify providers are linked there.
12. Retention periods
We keep data for as long as needed for its stated purpose. Once an enquiry or application is complete, associated data is deleted if there is no further reason to retain it. If a collaboration or order results, retention periods necessary for that contract apply.
Order and accounting records are kept for the applicable commercial and tax retention periods. Data may also be retained where necessary to establish, exercise or defend legal claims. Relevant criteria include contract duration, statutory periods, possible claims and ongoing proceedings. Data is then deleted or anonymised. Where retention alone is required, use is correspondingly restricted.
Records of consent and objections may be retained as long as necessary to honour and demonstrate your decision. Technical logs and browser storage follow the necessary security period or the durations stated in the cookie notice.
13. Your rights
Subject to the statutory requirements, you have the following rights:
- Access to information about processing of your data (Article 15 GDPR);
- Rectification of inaccurate data and completion of incomplete data (Article 16 GDPR);
- Erasure (Article 17 GDPR) and restriction of processing (Article 18 GDPR);
- Data portability where the requirements of Article 20 GDPR are met;
- Withdrawal of consent for the future, without affecting the lawfulness of earlier processing (Article 7(3) GDPR).
Right to object: You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. You may object at any time to processing for direct marketing, including related profiling. After such an objection, we will no longer process your data for direct marketing (Article 21 GDPR).
To exercise your rights, email info@lunara-wonderspray.com. If we have reasonable doubts about identity, we may request additional information necessary for verification. Do not send copies of identification documents without being asked. We generally respond within one month and will notify you of any legally permitted extension.
You may lodge a complaint with a data protection supervisory authority, particularly in the Member State of your habitual residence, place of work or the alleged infringement (Article 77 GDPR). The European Data Protection Board provides an overview. You do not have to contact us first.
14. Required information and changes
Information marked as required for an order or enquiry is needed to provide the requested service. Without it, we may be unable to fulfil an order or answer an enquiry. Voluntary information and marketing consent are not general conditions for a purchase.
We update this policy if our actual processes or legal obligations change. Where required by law, we will inform you about new purposes before further processing takes place.
