1. Who is responsible for your data
Lunii SAS, registered at 90 rue Notre-Dame de Nazareth, 75003 Paris, France, operates this online toy shop and is the data controller. For any privacy question, write to [email protected] or call +33 1 40 37 41 55; we reply within 30 days.
2. What data we collect
- Order data: name, delivery address, email address, phone number, the products you ordered and the amount paid.
- Account data: email address, password (stored only as a cryptographic hash), saved addresses and wishlist items.
- Technical data: IP address, browser type, device type, pages viewed and referring page, used to keep the shop secure and working.
- Communication data: the content of messages you send us about an order, return or product question.
We do not knowingly collect data from children. Accounts and orders are for adults; toys are chosen by grown-ups on behalf of children.
3. Why we process it and on what legal basis
- Performance of a contract (Art. 6(1)(b) GDPR): processing your order, delivery, returns and customer support.
- Legal obligation (Art. 6(1)(c)): keeping invoices and tax records for the period required by the applicable EU member-state law.
- Legitimate interest (Art. 6(1)(f)): fraud prevention, shop security, and improving the catalogue and site performance.
- Consent (Art. 6(1)(a)): optional analytics cookies. You may withdraw consent at any time.
4. Who we share data with
We share data only with processors that help us run the shop: hosting and database providers, payment providers, delivery carriers and email delivery services. Each acts on our instructions under a data processing agreement. We never sell personal data.
5. International transfers
Data is stored inside the European Economic Area where possible. If a provider processes data outside the EEA, the transfer relies on an adequacy decision or the European Commission's Standard Contractual Clauses.
6. How long we keep data
- Order and invoice records: for the statutory retention period, normally up to 10 years.
- Account data: until you delete your account, then removed within 30 days.
- Support messages: up to 24 months after the case is closed.
- Analytics data: up to 14 months, and only if you accepted analytics cookies.
7. Your rights
You have the right to access your data, correct it, have it erased, restrict or object to processing, receive it in a portable format, and withdraw consent. You may also lodge a complaint with your national data protection authority. To exercise any right, contact [email protected].
8. Security
Traffic is encrypted with TLS, passwords are hashed, database access is restricted by row-level security rules, and administrative access is limited to named staff accounts.
9. Changes to this policy
We update this policy when our processing changes. The date above always shows the current version; material changes are announced on the shop before they take effect.