Privacy Policy
1. Introduction
At Elinluma (hereinafter referred to as “I”), I respect your privacy and am committed to handling personal information responsibly. This Privacy Policy explains how I collect, use, disclose, store, and protect personal information when you visit my website, browse products, place an order, make a payment, or contact customer support.
This policy applies to personal information processed in connection with my online store and related services. It describes the purposes of processing, the categories of recipients who may receive personal information, the countries in which information may be processed, the safeguards applicable to international transfers, and the privacy rights available to you.
Depending on your location and the circumstances of the processing, applicable requirements may include U.S. federal and state privacy laws and, where applicable, the General Data Protection Regulation (GDPR) and other relevant data protection requirements.
2. Categories of Personal Information Collected
The personal information I collect depends on how you interact with my website and which services you use.
Contact and Identification Information
I may collect your name, email address, telephone number, billing address, shipping address, and other contact details you provide when placing an order or contacting customer support.
I use this information to identify your order, communicate with you, arrange delivery, and respond to requests.
Order and Transaction Information
I may collect order numbers, purchased products, quantities, purchase dates, order status, delivery details, return requests, cancellation records, refund information, and related transaction records.
This information is used to process purchases, manage fulfillment, maintain transaction records, and handle customer service matters.
Payment Information
Payments are processed through the payment methods and providers made available at checkout. Depending on the payment method, relevant information may include payment status, transaction references, billing details, payment method type, and limited payment card information.
Full payment credentials may be processed by the relevant payment provider. I do not intentionally request full card security codes or unnecessary sensitive payment credentials through ordinary email or customer support messages.
The information available to me depends on the payment provider and the payment method selected.
Device, Log, and Website Usage Information
When you visit the website, information may be collected about your browser, device, IP address, access times, pages viewed, referring pages, navigation activity, and interactions with website features.
Cookies, pixels, and similar technologies may also collect information about website sessions, preferences, and interactions, subject to applicable consent requirements and your privacy choices.
Customer Communications
If you contact me about an order, delivery, return, exchange, refund, complaint, or other matter, I may retain the contents of your communication, the contact details you provide, and relevant records of the response.
Marketing Preferences
If you subscribe to marketing communications or interact with optional marketing features, I may process your subscription status, communication preferences, and relevant consent or opt-out records.
You may withdraw consent or unsubscribe from marketing communications as described in this policy.
3. Purposes and Legal Bases for Processing
I use personal information only for appropriate purposes connected with operating the website, providing the services requested, and meeting applicable obligations.
Order Processing and Contract Performance
I use contact details, order information, and relevant payment and delivery information to process purchases, confirm orders, arrange shipment, provide tracking information, handle cancellations, and manage eligible returns and refunds.
Where the GDPR applies, this processing is generally necessary to perform a contract with you or take steps at your request before entering into a contract.
Customer Support and Complaint Handling
I use relevant order records and communications to answer questions, investigate delivery problems, handle product concerns, process return requests, and respond to complaints.
Where applicable, processing may be necessary to perform a contract, comply with a legal obligation, or pursue legitimate interests in providing customer service and resolving disputes.
Website Operation and Improvement
I may use technical and usage information to maintain website functionality, understand how visitors use the website, identify errors, improve navigation, and evaluate service performance.
Where the GDPR applies, the legal basis may be legitimate interests or consent, depending on the activity and whether consent is required for the relevant tracking technology.
Payment Security and Fraud Prevention
Relevant transaction, device, and order information may be processed to verify payments, identify suspicious activity, prevent fraud, protect website security, and investigate potentially unauthorized transactions.
Where the GDPR applies, this processing may be based on legitimate interests, contractual necessity, or a legal obligation, depending on the specific activity.
Accounting and Legal Compliance
I may retain and process relevant transaction and customer information to meet applicable tax, accounting, recordkeeping, consumer protection, and other legal requirements.
Where required, the legal basis is compliance with a legal obligation.
Marketing Communications
Where permitted, I may send promotional communications if you have subscribed or otherwise provided the required permission. You may unsubscribe or withdraw consent at any time.
Where consent is required, marketing processing will be based on that consent. Where another legal basis is permitted, I will apply the relevant requirements and honor applicable opt-out rights.
4. Categories of Recipients and Disclosure of Personal Information
I do not sell personal information for monetary payment. However, personal information may be disclosed to service providers and other recipients where necessary to operate the website, complete transactions, provide requested services, protect security, or meet legal obligations.
The categories below describe the types of recipients that may receive information. Whether a particular recipient receives information depends on the services enabled on the website, the payment method selected, the order being processed, and the circumstances of the request.
E-Commerce Platform and Hosting Providers
The website operates through the Shopify e-commerce platform. Shopify and relevant affiliated entities or subprocessors may process information needed to host and operate the store, manage customer accounts, maintain shopping carts, process orders, provide checkout functionality, and support website security.
Information may include contact details, order information, transaction records, device information, and website interaction data, as required for the relevant service.
Payment Processors and Financial Service Providers
Payment providers, payment gateways, card networks, and relevant financial institutions may receive information necessary to authorize, process, verify, settle, or refund transactions.
Depending on the payment method selected at checkout, information may include payment details, billing information, transaction identifiers, purchase amounts, and fraud-prevention signals.
The specific recipient depends on the payment methods enabled for the store and the method selected for your purchase.
Shipping Carriers and Delivery Service Providers
Shipping carriers and other delivery service providers may receive your name, shipping address, telephone number where required, order reference, package details, and other information necessary to transport and deliver your purchase.
These recipients use the information to arrange collection, deliver packages, provide tracking updates, and investigate delivery issues.
Customer Support and Communications Providers
Email, customer service, messaging, and related communications providers may process contact information, order references, and the contents of messages to support customer inquiries, order notifications, and complaint handling.
Website Analytics and Performance Providers
If analytics tools are enabled, analytics and performance service providers may receive technical identifiers, IP addresses, device and browser information, page views, interaction events, and other usage information necessary to measure website performance and improve the shopping experience.
Nonessential tracking technologies will be used in accordance with applicable consent requirements and the privacy choices available to you.
Advertising and Marketing Providers
If advertising, remarketing, or marketing measurement tools are enabled, relevant advertising and marketing providers may receive identifiers, cookie or pixel data, device information, and website interaction events to measure campaign performance, manage advertising, or deliver relevant advertisements.
Where applicable law requires consent or an opt-out opportunity for these activities, I will provide the relevant controls. Under certain U.S. state privacy laws, some advertising-related disclosures may qualify as sharing for cross-context behavioral advertising even where no money is exchanged.
Fraud Prevention and Security Providers
Security, fraud detection, identity verification, and risk management providers may receive relevant order, transaction, device, and technical information to identify suspicious activity, prevent unauthorized transactions, and protect the website and customers.
Professional Advisers and Legal or Regulatory Authorities
Where reasonably necessary, information may be disclosed to professional advisers, accountants, auditors, insurers, courts, law enforcement agencies, regulators, or other authorized authorities.
Such disclosures may occur to obtain professional advice, establish or defend legal claims, comply with legal obligations, respond to valid legal requests, or protect the rights and safety of individuals.
Business Transfers
If a business restructuring, merger, acquisition, financing, or sale of relevant business assets occurs, personal information may be disclosed to prospective or actual transaction parties and their advisers where necessary and permitted by law.
Any such disclosure will be subject to appropriate confidentiality and other protections where required.
Information You Direct Me to Share
I may disclose information to another recipient when you specifically request or authorize the disclosure, or when the disclosure is otherwise permitted by applicable law.
I do not authorize service providers to use personal information received on my behalf for unrelated purposes where such use is prohibited by the applicable contractual or legal requirements.
5. Cookies and Similar Technologies
The website may use cookies, pixels, tags, and similar technologies to support essential website functions and, where enabled, analytics, personalization, and advertising.
Strictly Necessary Technologies
These technologies may support shopping cart functionality, checkout, security, session management, and other features necessary to provide the service you request.
Analytics Technologies
If enabled, analytics technologies may help measure traffic, understand website usage, detect technical problems, and improve website performance.
Advertising Technologies
If enabled, advertising technologies may support campaign measurement, advertising attribution, remarketing, or personalized advertising.
Cookie Preferences and Consent
Where consent is required, optional analytics or advertising technologies will not be activated before the required consent has been obtained. You may change your preferences through the available cookie settings.
You can also use browser controls to restrict or delete cookies, although doing so may affect certain website functions.
The actual cookies and technologies used depend on the Shopify configuration, installed applications, and enabled integrations. I will maintain the applicable cookie disclosures and consent controls to reflect the technologies in use.
6. International Data Transfers and Processing Locations
Elinluma operates from the United States. Personal information collected through the website may be processed in the United States and in other countries where the e-commerce platform, its affiliated entities, payment providers, delivery-related service providers, communications providers, analytics providers, or other enabled service providers operate.
United States
The United States is a principal destination for information handled in connection with the operation of this store, customer service, order administration, and related business activities.
Canada, Ireland, Singapore, and Other Potential Shopify Processing Locations
Shopify's published documentation identifies processing by Shopify entities and subprocessors in multiple countries. These include the United States, Canada, Ireland, Singapore, and other countries in which relevant Shopify affiliates or subprocessors operate.
Depending on the applicable Shopify services, infrastructure, and enabled integrations, information may be processed or transferred to these countries or other countries identified in Shopify's current subprocessor documentation.
The countries listed above describe known potential destinations within the Shopify processing chain; they do not mean that every customer's information is necessarily transferred to every listed country.
Other Service Provider Destinations
Payment processors, shipping-related service providers, communications tools, analytics services, advertising platforms, and other applications may process information in additional countries depending on the services actually enabled and the relevant provider's arrangements.
The specific destinations for these providers depend on the integrations in use. I will not represent a country as an actual destination for a particular provider unless that destination is supported by the applicable service documentation or contractual arrangements.
For information about a particular provider's processing locations, please consult its applicable privacy documentation or contact me using the details in Section 13.
Transfer Safeguards Where the GDPR Applies
Where personal information subject to the GDPR is transferred outside the European Economic Area (EEA), I will rely on an applicable transfer mechanism where required.
Depending on the destination, recipient, and circumstances, the applicable mechanism may include:
-
An adequacy decision adopted by the European Commission, where the destination or recipient is covered by that decision.
-
Standard Contractual Clauses (SCCs) adopted by the European Commission, together with any required assessment of the transfer and supplementary measures where appropriate.
-
An applicable approved certification or other transfer mechanism where legally available and properly implemented.
-
Another permitted exception under applicable data protection law, where its specific conditions are satisfied.
For transfers within the Shopify processing chain, Shopify publishes information about its international transfer arrangements, including its Binding Corporate Rules and contractual safeguards where applicable.
The applicable safeguard depends on the specific transfer and recipient. The existence of a safeguard for one provider does not mean that the same mechanism automatically applies to every other provider or country.
United Kingdom and Switzerland
Where personal information is subject to UK or Swiss data protection requirements, transfers will be handled under the applicable transfer rules and safeguards. Depending on the transfer, this may involve an applicable adequacy decision, approved contractual safeguards, or another permitted mechanism.
Government and Legal Requests
Personal information may be disclosed to a government authority, court, regulator, or law enforcement agency where disclosure is required or permitted by applicable law. Such disclosures are assessed according to the relevant legal requirements.
How to Obtain Further Transfer Information
You may contact me at team@elinluma.com to request further information about the countries involved in a particular transfer, the relevant recipient category, and the applicable transfer safeguard.
Where permitted and reasonably available, I will provide information about the relevant safeguards or explain how you can access the applicable contractual or provider documentation. Confidential commercial information or information that cannot lawfully be disclosed may be redacted where necessary.
7. Data Retention
I retain personal information only for as long as reasonably necessary for the purposes described in this policy, unless a longer period is required or permitted by applicable law.
Order and transaction records may be retained to fulfill purchases, administer returns and refunds, maintain accounting records, handle disputes, and meet applicable recordkeeping obligations.
Customer communications may be retained for the period reasonably necessary to respond to requests, document resolutions, and protect legitimate legal interests.
Technical, analytics, and cookie information may be retained according to the purpose, configuration, and retention period of the relevant service.
Retention periods may differ by information category and provider. When information is no longer required and no valid retention obligation applies, I will take reasonable steps to delete or anonymize it.
8. Security of Personal Information
I take reasonable technical and organizational measures to protect personal information against unauthorized access, disclosure, alteration, loss, and misuse.
These measures may include access controls, appropriate handling of order records, platform security features, and the use of service providers that maintain relevant security protections.
No method of electronic storage or transmission is completely secure. If a personal data incident occurs, I will assess the circumstances and take the notification and remediation steps required by applicable law.
9. Your Privacy Rights Under the GDPR
Where the GDPR applies, you may have the following rights, subject to applicable conditions and exceptions.
Right of Access
You may request confirmation of whether your personal information is being processed and request access to that information and relevant details about the processing.
Right to Rectification
You may request correction of inaccurate personal information or completion of incomplete information.
Right to Erasure
You may request deletion of personal information where the applicable conditions are met. Certain information may need to be retained where a legal obligation or another permitted ground applies.
Right to Restriction of Processing
You may request restriction of processing in circumstances recognized by the GDPR.
Right to Data Portability
Where the legal conditions are met, you may request personal information that you have provided to me in a structured, commonly used, machine-readable format.
Where technically feasible and the relevant conditions apply, you may also request transmission of that information to another controller.
This right generally applies to processing based on consent or contract and carried out by automated means, subject to the GDPR's conditions.
Right to Object
Where processing is based on legitimate interests or carried out for a task in the public interest, you may have the right to object on grounds relating to your particular situation.
You have the right to object at any time to the processing of your personal information for direct marketing purposes, including related profiling. If you object to direct marketing, I will stop processing your personal information for that purpose as required by applicable law.
Right to Withdraw Consent
Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Right to Lodge a Complaint
You may lodge a complaint with a competent data protection supervisory authority, particularly in the EEA country where you live, work, or believe an infringement occurred, where the GDPR provides that right.
Automated Decisions
Where applicable, you may have rights concerning decisions based solely on automated processing that produce legal effects or similarly significant effects, subject to the conditions and exceptions in the GDPR.
To exercise these rights, contact me at team@elinluma.com. I may request reasonable information to verify your identity and will respond within the time required by applicable law.
10. Privacy Rights for U.S. Residents
Depending on the state in which you reside and whether the applicable law covers my business and the relevant processing activity, you may have rights concerning your personal information.
These rights may include the right to know or access personal information, obtain a portable copy, correct inaccuracies, request deletion, and receive information about certain categories of information collected, disclosed, sold, or shared.
Where applicable, you may also have the right to opt out of the sale of personal information, sharing for cross-context behavioral advertising, or certain targeted advertising or profiling activities.
I do not sell personal information for monetary payment. However, certain disclosures to advertising or analytics providers may be treated as a sale or sharing under particular state privacy laws, depending on the technology used and the circumstances. Where such requirements apply, I will provide the required opt-out mechanism.
Where supported and required by applicable law, I will process recognized universal opt-out preference signals, such as Global Privacy Control (GPC), for the relevant processing activities.
You may exercise applicable rights by contacting team@elinluma.com. I will verify requests as required by law, respond within the applicable timeframe, and explain any lawful reason why a request cannot be fulfilled in full.
You will not be unlawfully discriminated against for exercising a privacy right.
11. Marketing Choices and Communications
You may receive transactional communications necessary to administer an order, provide delivery updates, respond to customer service requests, or communicate about a refund or return.
Where you have subscribed to marketing communications, you may unsubscribe using the link provided in the message, where available, or contact team@elinluma.com to request removal from the relevant marketing list.
Unsubscribing from promotional communications does not prevent me from sending essential messages about an existing order or another matter where communication is necessary and permitted by law.
12. Children's Privacy
This website is intended for general consumers and is not directed toward children under 13.
I do not knowingly collect personal information directly from children under 13 in violation of applicable requirements. If you believe a child has provided personal information in a manner that violates applicable law, please contact me so I can review the matter and take appropriate action.
Where additional protections apply to minors under applicable law, I will follow those requirements.
13. Contact Information and Privacy Requests
For questions about this Privacy Policy, requests to access or correct personal information, deletion or portability requests, objections to processing, marketing opt-outs, or questions about international transfers, please contact me using the information below.
Address: 16208 SE 173rd Pl, Renton, WA 98058, United States
Phone: +1 (425) 638-2749
Email: team@elinluma.com
Business Hours: Monday through Friday, 9:00 AM to 6:00 PM Eastern Time (ET), excluding applicable holidays.
When submitting a privacy request, please identify the right you wish to exercise and provide enough information for me to locate the relevant records. Please do not include full payment card numbers, card security codes, passwords, or other unnecessary sensitive information in your request.
I will review and respond to privacy requests within the period required by applicable law. If additional information is needed to verify your identity or clarify the request, I will contact you using the information provided.
14. Changes to This Privacy Policy
I may update this Privacy Policy when my processing activities, website configuration, service providers, or applicable requirements change.
The updated version will be published on this page, with the effective date revised where appropriate. If a material change requires notice or consent, I will provide the necessary notice or obtain consent before carrying out the relevant processing where required.
Please review this page periodically to remain informed about how personal information is handled.