Data protection

1. Controller

The controller within the meaning of the revFADP is:

• LUMÉA Sàrl (in formation), Chemin des Vendanges 17, 3960 Sierre, Switzerland
• Email: contact@lumealight.ch
• Contact person: Diogo Ribeiro

2. Data processed

Depending on how you use the website, we process:

• Identification and contact data: surname, first name, postal address, email address, and telephone number where you provide it.
• Order data: items, quantities, finishes, amounts, order history, correspondence relating to an order.
• Payment data: amount, date, status of the transaction and reference. Complete card data never reaches us; it is processed directly by the payment provider.
• Technical connection data: IP address, date and time of the request, page consulted, type of browser and operating system, referrer — recorded by the hosting provider in its logs.
• The content of your messages when you write to us, including the information you choose to attach to them.

3. Purposes and grounds of justification

Swiss law does not make every processing operation subject to a legal basis within the meaning of the European regulation: processing is lawful provided it does not unlawfully breach personality rights. We nevertheless indicate below the ground that justifies each purpose.

• Processing an order, dispatching it, invoicing it and providing after-sales service — performance of the contract.
• Answering your questions and your sample requests — performance of the contract or pre-contractual measures.
• Complying with our legal obligations, in particular the retention of accounting records — legal obligation.
• Ensuring the security, availability and maintenance of the website, and preventing misuse and fraud — overriding legitimate interest.
• Sending you commercial information — only if you have consented to it; that consent may be revoked at any time, free of charge and with effect for the future.

4. Retention period

We keep your data for as long as the purpose pursued requires, and thereafter for the applicable statutory periods.

• Order data and accounting records: ten years from the end of the financial year, in accordance with the Swiss Code of Obligations.
• Correspondence with no commercial follow-up: two years from the last exchange.
• Technical logs kept by the hosting provider: in accordance with the policy of Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, United States, the domain name being managed by Infomaniak Network SA, Geneva; as a rule, a few months at most.
• Address entered on a mailing list: until you revoke your consent.

5. Recipients and processors

We neither sell nor rent your data. It is disclosed only to the providers required for the performance of the contract, who are bound by a processing agreement imposing confidentiality on them and prohibiting any use of their own:

• Website hosting and technical logging: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, United States; the domain name is managed by Infomaniak Network SA, Geneva.
• Payment processing: no provider is involved, as orders are concluded by exchange of emails, without online payment.
• Dispatch and parcel tracking: Swiss Post, which receives the data necessary for delivery.
• Sending of order and service emails: Infomaniak Network SA, Geneva, which hosts our email service. The data remains in Switzerland and no additional provider is involved in the routing of your requests.
• Authorities, courts and professional advisers, where the law requires it of us or in order to assert our rights.

6. Disclosure abroad

Some of the providers mentioned above may process data outside Switzerland. Such disclosure takes place only to a State whose legislation the Federal Council recognises as affording adequate protection, or subject to appropriate safeguards — standard data protection clauses recognised by the Federal Data Protection and Information Commissioner, or binding corporate rules.

7. Cookies and audience measurement

The website uses the cookies that are technically necessary for it to function, in particular to remember your language and the contents of your basket. They do not serve to profile you and cannot be disabled without rendering the website unusable.

Any audience measurement or advertising cookie that may come to be installed will be installed only with your prior consent, and this page will be updated accordingly. Your browser allows you at any time to refuse or delete the cookies that have been set.

8. Security

Exchanges with the website are encrypted in transit. We take the appropriate technical and organisational measures to protect your data against unauthorised access, loss and alteration, and we limit access to the persons who need it in order to process your order. No transmission over the internet can, however, be guaranteed free of all risk; never send us a password or a card number by email.

9. Your rights

The revFADP grants you, as a data subject, the following rights, which may be exercised free of charge upon a simple written request addressed to contact@lumealight.ch:

• Right of access: to know whether we process data concerning you and to obtain that data.
• Right to rectification of inaccurate data.
• Right to request the erasure or destruction of the data, subject to statutory retention obligations.
• Right to object to processing, in particular to the sending of commercial information.
• Right to the release or transfer of your data in a commonly used electronic format, where the statutory conditions are met.
• Right to revoke at any time a consent that has been given, without affecting the lawfulness of the processing carried out beforehand.

10. Identity verification and legal remedies

We may ask you to provide proof of your identity before acting on a request, in order to avoid disclosing your data to a third party. We reply within thirty days as a rule.

If you consider that the processing of your data breaches the law, you may contact the Federal Data Protection and Information Commissioner (FDPIC) in Bern, or bring the matter before the competent civil courts.

11. Amendment of this policy

We may adapt this policy to changes in our processing operations or in the applicable law. The version in force is the one published on this page, the date of which appears at the head of the page.