Privacy Policy and Cookie Notice
Last updated: 11 October 2026
Part 1: Privacy Policy
Thanks for visiting Lumengin. We’re a small company in Shrewsbury, England, making handmade leather bags and keyrings. This policy explains, in plain English, what personal information we collect when you visit lumengin.com or buy from us, why we need it, who we share it with, how long we keep it and what your rights are. We’ve tried to keep it short and clear. If anything doesn’t make sense, just email us at sales@lumengin.co.uk.
Key points (the 30-second version)
- Who we are: Lumengin Ltd, a small company in Shrewsbury. We’re responsible for your information (the “data controller”). Contact: sales@lumengin.co.uk.
- What we collect: the details we need to take and deliver your order: your name, email, delivery and billing address, phone number (if you give it), what you bought, any messages you send us, and your account details if you choose to create an account (you can also just check out as a guest). We also collect some basic technical information when you use our website, and we use cookies.
- Why: mainly to process and deliver your order, answer your questions, keep the accounting and tax records the law requires, and keep our website working and secure.
- Payments: card payments are handled by Stripe. We never see or store your full card details.
- Sharing: we only share what’s needed with the companies that help us run the shop, such as Royal Mail and other couriers, our payment providers, our website and email host (zFast) and our accountants. We never sell your data.
- Marketing: we don’t send marketing emails at the moment. If we ever do, we’ll only send them if you’ve agreed, and you can unsubscribe at any time.
- Cookies: we only use strictly necessary cookies, to make the basket, checkout and payments work. We don’t use analytics or marketing cookies (see Part 2: Cookie Notice).
- Your rights: you can ask for a copy of your information, ask us to correct or delete it, and more. You can also complain to the Information Commissioner’s Office (ICO).
1. Who we are
lumengin.com is run by Lumengin Ltd, a company registered in England and Wales.
- Company number: 15889078
- Registered office: 21 Hunter Street, Shrewsbury, Shropshire, SY3 8QN
- Email: sales@lumengin.co.uk
Lumengin Ltd is the data controller of the personal information described in this policy. This means we decide how and why your information is used, and we’re responsible for looking after it under UK data protection law (the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (“PECR”)).
Lumengin Ltd is registered with the Information Commissioner’s Office (ICO) as a data controller, registration number ZC270481.
We’re a very small business, so we don’t have (and aren’t required to have) a Data Protection Officer. Our founder and director, Glynn Gore, is responsible for data protection. You can contact him at sales@lumengin.co.uk.
When this policy says “we”, “us” or “our”, it means Lumengin Ltd. “You” means anyone who visits our website, buys from us or gets in touch with us.
2. What information we collect
Information you give us
- Contact details: your name and email address, and your phone number if you choose to give it (for example, so a courier can contact you about a delivery).
- Delivery and billing addresses.
- Order details: what you’ve bought, the price, delivery choice, order dates, and any returns, refunds or problems with an order.
- Payment information: limited details of your payment, such as the payment method, the amount and whether it went through. Your full card details go straight to Stripe and we never see or store them.
- Account details (optional): you can check out as a guest, or create an account if you’d like. If you create one, we hold your name, email address and password (stored securely in hashed form, so no one – including us – can see it), your order history and any delivery and billing addresses you save. If you check out as a guest, we only keep the details needed for that order.
- Messages to us: anything you send us by email, through a contact form, on social media or by phone, such as questions, custom order requests or feedback.
Information we collect automatically
- Basic technical and website data: like most websites, our site and web host automatically record some technical information when you visit, such as your IP address, browser and device type, the pages you visit and the date and time. This is used to keep the site running, secure and free of spam and fraud.
- Analytics and order attribution: we don’t use a visitor-analytics tool such as Google Analytics, and WooCommerce’s “order attribution” feature (which records where orders come from) is switched off. We don’t track where you came from or how many pages you view. We just use WooCommerce’s ordinary sales reports.
- Cookies and similar technologies: see section 12 and Part 2: Cookie Notice.
Information from others
- Payment providers: Stripe tells us whether a payment was successful, and may flag a payment if they suspect fraud.
- Couriers: Royal Mail and other couriers may give us delivery updates (for example, that a parcel has been delivered or couldn’t be delivered).
- Search engines: we use Google Search Console and Bing Webmaster Tools, which give us summary reports about how our website appears in Google and Bing search results (for example, which search terms led to our pages and how often they were shown and clicked). These reports are based on Google’s and Microsoft’s own search data and don’t identify individual visitors.
We don’t collect any “special category” information (such as health information) and we ask you not to send us any. If you do mention something like this in a message (for example, if you need help with an order), we’ll only use it to help you.
3. Why we use your information and our lawful basis
The law says we must have a valid reason (a “lawful basis”) for using your personal information. Here’s what we use it for and the basis we rely on:
| What we use it for | Our lawful basis |
|---|---|
| Taking, processing and delivering your order, taking payment, and sending order and delivery updates | Contract – we need it to fulfil our contract with you (or to take steps you’ve asked for before buying) |
| Handling cancellations, returns, refunds and faulty items | Contract and legal obligation (your consumer rights) |
| Running your customer account, if you choose to create one | Contract |
| Answering your questions and requests, including custom orders | Legitimate interests (responding to people who contact us), or contract if it relates to an order |
| Keeping accounting, tax and company records | Legal obligation (HMRC and Companies Act requirements) |
| Keeping our website working and secure, and preventing fraud and spam | Legitimate interests (running a safe and secure online shop) |
| Using Google Search Console and Bing Webmaster Tools to see how our website appears in search results | Legitimate interests (making sure people can find our shop) |
| Setting strictly necessary cookies (basket, checkout, login and payment security) | No consent needed: these cookies are strictly necessary for the service you ask for (PECR exemption). We don’t set non-essential cookies. |
| Sending marketing emails or newsletters (if we start doing this) | Consent |
| Dealing with legal claims or disputes | Legitimate interests (protecting our business) and legal obligation |
Where we rely on legitimate interests, we’ve considered your interests and rights and believe our use is reasonable and what you’d expect. You have the right to object (see section 10).
If you don’t give us the information we need to process your order (such as a delivery address), we won’t be able to complete it.
We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects. Our payment providers use automated tools to screen payments for fraud; if a payment is declined, you can contact us and we’ll help where we can.
4. Who we share your information with
We only share your information where we need to, and only what’s necessary. The companies we use to run our shop are:
- Royal Mail and other couriers – to deliver your order. Items priced £20 or under (such as keyrings) may go by Royal Mail untracked Large Letter, so we only share your name and delivery address. Anything over £20 goes by a Royal Mail tracked service, and bags go by Royal Mail Tracked 48 (signed for), so Royal Mail may also receive your email address or phone number to send tracking updates, and will record a signature on delivery.
- Stripe – to process your payments.
- zFast – our website hosting and email provider. zFast hosts our website and the information held on it (including order details), and our sales@lumengin.co.uk email (managed through cPanel), so it also stores emails you send us and our replies.
- Our accountants – to prepare our accounts and tax returns.
- Google and Microsoft (Bing) – we use Google Search Console and Bing Webmaster Tools to check how our website performs in search results. We don’t send them your order or contact details, and these tools don’t set any cookies on our website.
- WordPress and WooCommerce plugins – our online shop runs on WordPress and WooCommerce, and some plugins (for example for payments, shipping, security, spam protection or backups) may process information to provide their features.
These companies act on our instructions and must keep your information secure. Some of them, such as Stripe and Royal Mail, also use information as independent organisations for their own legal and regulatory purposes (for example, fraud prevention and anti-money-laundering checks). When they do, their own privacy policies apply.
We may also share information if we must by law (for example, with HMRC or the police), to protect our rights or deal with a legal claim, or if our business is ever sold or restructured (in which case the new owner would have to look after your information in line with this policy).
We never sell your personal information, and we don’t share it with anyone for their own marketing. WooCommerce usage tracking is switched off on our website, so no data about how our shop is used is sent to WooCommerce or Automattic, and we don’t share it with anyone.
5. International transfers
We aim to keep your information in the UK where we can. Some of our providers, such as Stripe, are international companies and may process your information outside the UK, including in the European Economic Area (EEA) and the United States.
Where information is transferred outside the UK, we make sure it’s protected by appropriate safeguards required by UK data protection law. These include:
- transfers to countries the UK has recognised as providing adequate protection (for example, the EEA, or US companies certified under the UK Extension to the EU–US Data Privacy Framework); or
- legal contracts approved for UK transfers, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
You can contact us for more information about these safeguards.
6. How long we keep your information
We only keep your information for as long as we need it. These are our retention periods:
| Information | How long we keep it |
|---|---|
| Orders, invoices, payment and refund records | 6 years from the end of the financial year they relate to, to meet HMRC and Companies Act record-keeping requirements |
| Records of returns, complaints and faulty items | 6 years after the order |
| Enquiries and messages that don’t lead to an order | 2 years from our last contact |
| Customer accounts (if you create one) | Until you ask us to close your account, or 3 years after your last order or login, whichever comes first. Order records are kept as above, even after an account is closed. Guest checkout doesn’t create an account. |
| Website technical and security logs | Kept for a limited period by our hosting provider |
| Basket and session data | Usually deleted automatically within 48 hours (WooCommerce default) |
| Order attribution summaries saved with orders (only on orders placed before we switched the feature off) | Kept with the order record, as below |
| Marketing consent and preferences (if we start marketing) | Until you unsubscribe. After that, we keep a minimal record of your email address on a “do not contact” list so we respect your choice. |
When we no longer need information, we delete it securely or anonymise it.
7. Marketing
We don’t currently send marketing emails or newsletters.
If we start, we’ll only send you marketing if you’ve clearly agreed to it (for example, by ticking an unticked box at checkout or signing up on our website). Every marketing email will include a simple “unsubscribe” link, and you can also opt out at any time by emailing sales@lumengin.co.uk. We’ll update this policy to name any newsletter provider we use.
We’ll still send you service messages about your orders (such as order confirmations and delivery updates), as these aren’t marketing.
8. How we keep your information safe
We take sensible steps to protect your information, including:
- using a secure (HTTPS) connection across our website;
- using trusted payment providers, so we never handle or store your full card details;
- using strong passwords and two-factor authentication on our business logins (such as our website, cPanel and email) where available;
- keeping WordPress, WooCommerce, our theme and plugins up to date;
- limiting access to your information to people who need it (at the moment, that’s just us and our accountants for accounting records);
- regular backups of our website.
No system is completely secure, but if something does go wrong we’ll act quickly. If a data breach is likely to put you at high risk, we’ll tell you, and we’ll report it to the ICO where the law requires.
9. Children
Our website and products are not aimed at children, and we don’t knowingly collect personal information from children. If you think a child has given us their information, please contact us and we’ll delete it.
10. Your rights
Under UK data protection law, you have the right to:
- Access – ask for a copy of the personal information we hold about you.
- Rectification – ask us to correct information that’s wrong or incomplete.
- Erasure – ask us to delete your information. (We may need to keep some records, such as order and tax records, where the law requires.)
- Restriction – ask us to limit how we use your information, for example while we check it’s accurate.
- Data portability – ask for information you’ve given us in a commonly used electronic format, or ask us to send it to another organisation, where we use it based on contract or consent.
- Object – object to us using your information where we rely on legitimate interests. You have an absolute right to object to direct marketing.
- Withdraw consent – where we rely on your consent (for example, for marketing or non-essential cookies), you can withdraw it at any time. This won’t affect anything we did before you withdrew it.
To use any of these rights, email us at sales@lumengin.co.uk. You can also ask us to close your customer account at any time. There’s usually no charge. We’ll reply within one month (we may extend this by up to two more months if a request is complex, and we’ll tell you if so). We may ask you to confirm your identity before we act on a request.
Complaints: if you’re unhappy with how we’ve handled your information, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection:
- Website: ico.org.uk
- Helpline: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
11. Links to other websites
Our website may link to other websites and social media. We’re not responsible for how those sites handle your information, so please read their privacy policies.
12. Cookies
Cookies are small files stored on your device when you visit a website. We only use strictly necessary cookies: ones that make our basket and checkout work, and ones our payment provider, Stripe, uses to process payments securely and prevent fraud. We don’t use analytics or marketing cookies. Full details are in Part 2: Cookie Notice below.
13. Changes to this policy
We may update this policy from time to time, for example if we start a newsletter or change the companies we work with. We’ll post the updated version on this page and change the “Last updated” date at the top. If we make important changes, we’ll let you know more directly where appropriate (for example, by email if you have an account with us).
14. Contact us
If you have any questions about this policy or your information, please get in touch:
- Email: sales@lumengin.co.uk
- Post: Lumengin Ltd, 21 Hunter Street, Shrewsbury, Shropshire, SY3 8QN
Part 2: Cookie Notice
This short notice explains the cookies we use on lumengin.com. We don’t use analytics or marketing cookies, and WooCommerce order attribution is switched off, so the only cookies on our website are strictly necessary ones. Because of that, we don’t show a cookie banner. It forms part of our Privacy Policy.
What are cookies?
Cookies are small text files a website stores on your device. Similar technologies (such as local storage and tracking pixels) work in a similar way, and we use “cookies” to cover all of them here.
The cookies we use
1. Essential cookies (always on)
These are needed for the website to work, so they don’t need your consent. They’re set by WordPress and WooCommerce, our shop software:
| Cookie | What it does | How long it lasts |
|---|---|---|
| woocommerce_cart_hash, woocommerce_items_in_cart | Remember what’s in your basket | Until you close your browser |
| wp_woocommerce_session_[id] | Links you to your basket and checkout session | Up to 2 days |
| wordpress_logged_in_[id], wordpress_sec_[id] | Keep you securely logged in to your customer account (only if you create an account and log in) | Until you close your browser, or up to 14 days if you tick “Remember me” |
| wordpress_test_cookie | Checks your browser accepts cookies when you log in | Until you close your browser |
If you check out as a guest, no login cookies are set. We also use these login cookies when we log in to manage our own website.
2. Payment cookies (checkout)
When you pay, Stripe sets cookies needed to process your payment securely and to help prevent fraud. For example, Stripe uses cookies called __stripe_mid (up to 1 year) and __stripe_sid (30 minutes) for fraud prevention. These are treated as essential because they’re needed to complete your payment safely. You can find out more in Stripe’s own cookie policy.
3. Order attribution and analytics (switched off)
We’ve switched off WooCommerce’s “order attribution” feature, so our website doesn’t set any cookies to record how you arrived or which pages you view. We don’t use a visitor-analytics tool such as Google Analytics either, and WooCommerce usage tracking is also switched off.
4. Google Search Console and Bing Webmaster Tools
We use these free tools from Google and Microsoft to see how our website appears in their search results. They give us summary reports based on their own search data (for example, which search terms led to our pages and how often they were clicked). They don’t set any cookies on our website, and we haven’t added any tracking code for them. A one-off verification code only proves to Google and Microsoft that we own the site. How Google and Microsoft handle your searches is covered by their own privacy policies.
We don’t use advertising, marketing, analytics or social media tracking cookies.
Your cookie choices
Since we only use strictly necessary cookies, there are no optional cookies for you to switch on or off.
Managing cookies in your browser
- Your browser: you can block or delete cookies in your browser settings. If you block essential cookies, the basket and checkout won’t work properly.
- For more about cookies and how to manage them, visit ico.org.uk.
If you have any questions about our cookies, email us at sales@lumengin.co.uk.