​

1. Controller responsible for data processing
 

The controller responsible for processing personal data through this website is:
 

*Jessa Marie Schild*
Trading as:
*Lux by Jes*
Schulstr. 34
64572 Büttelborn
Germany

*Email:* [luxbyjes@gmail.com](mailto:luxbyjes@gmail.com)
*Phone:* +49 176 87913602
*Website:* [www.luxbyjes.com](http://www.luxbyjes.com)

In this Privacy Policy, “Lux by Jes,” “we,” “us,” and “our” refer to the business identified above.
 

2. Purpose of this Privacy Policy

​

This Privacy Policy explains how Lux by Jes collects, uses, stores, and shares personal data when you: * Visit our website * Browse or purchase products * Create or use a customer account * Contact us * Submit a return or withdrawal request * Subscribe to marketing communications, where offered * Interact with website features * Otherwise use our services Personal data is information relating to an identified or identifiable natural person. This may include your name, address, email address, telephone number, order information, payment-related information, IP address, and online identifiers.
 

3. Categories of Personal Data We Process

​

Depending on how you use our website and services, we may process the following categories of personal data.

### Contact and Identity Information

This may include:

* Full name
* Billing address
* Delivery address
* Email address
* Telephone number
* Customer account information

### Order and Transaction Information

This may include:

* Products ordered
* Order number
* Purchase price
* Payment method
* Payment and refund status
* Delivery method
* Tracking information
* Returns, withdrawals, and complaints
* Previous communications concerning an order

### Payment-Related Information

Depending on the payment method you select, payment information may be processed directly by the relevant payment provider.

We may receive limited information such as:

* Transaction reference
* Payment method
* Payment confirmation
* Payment status
* Refund status
* Limited account or card information made available by the payment provider

Lux by Jes does not intentionally store complete payment-card information where payment details are processed directly by an external payment provider.

### Communication Information

This may include information contained in:

* Contact-form submissions
* Withdrawal requests
* Return requests
* Emails
* Customer-service communications
* Social-media messages
* Reviews or feedback

### Technical and Usage Information

This may include:

* IP address
* Browser type
* Device type
* Operating system
* Language settings
* Approximate location derived from an IP address
* Date and time of access
* Referring website
* Pages viewed
* Website interactions
* Session information
* Cookie or similar technology identifiers
 

4.  Purposes and Legal Bases for Processing

We process personal data only where we have an appropriate legal basis.

### Processing Orders and Providing

Our Services We process personal data to:

* Receive and process orders
* Confirm purchases
* Arrange payment
* Prepare and dispatch products
* Provide tracking information
* Manage returns and refunds
* Handle withdrawal requests
* Communicate with you about your order
* Fulfil our contractual obligations The legal basis is
*Article 6(1)(b) GDPR*, where processing is necessary to perform a contract or take steps at your request before entering into a contract.

### Compliance With Legal Obligations

We process and retain personal data where necessary to comply with legal obligations applicable to our business, including:

* Tax and accounting obligations
* Commercial recordkeeping requirements
* Consumer-protection obligations
* Product-safety obligations, where applicable
* Legally binding requests from courts, tax authorities, regulators, or other competent public authorities

The legal basis is *Article 6(1)(c) GDPR*.

### Legitimate Interests

Where necessary, we may process personal data for legitimate interests including:

* Maintaining the security and reliable operation of our website
* Preventing and investigating fraud, misuse, and unauthorised activity
* Responding to general business enquiries * Establishing, exercising, or defending legal claims
* Maintaining appropriate customer-service and business records

The legal basis is *Article 6(1)(f) GDPR*. Where we rely on legitimate interests, we consider whether our interests are overridden by your interests, fundamental rights, or freedoms.

### Consent

Where processing requires your consent, such as certain optional cookies, marketing communications, or similar technologies, the legal basis is *Article 6(1)(a) GDPR*.

You may withdraw your consent at any time with effect for the future.
 

5. Wix Website Platform and Hosting
 

Our website and online shop are created and hosted using services provided by *Wix.com Ltd. and its affiliated companies (“Wix”)*.

Wix provides the technical infrastructure necessary to operate our website and online shop.

Depending on the website functions we use, Wix services may include:

* Website hosting
* Website and account security
* Data storage
* Wix Stores
* Customer accounts
* Forms
* Order management
* Transactional email notifications
* Cookie and consent-management functions
* Other technical website services

When you visit or use our website, Wix may process information such as your IP address, browser and device information, website activity, cookie information, and information you submit through the website.

Where Wix processes personal data on our behalf in connection with operating our website, Wix acts as a processor in accordance with the applicable data-processing arrangements.

Wix may also process certain personal data for its own purposes as an independent controller.

Such processing is governed by Wix's own privacy information.

Wix.com Ltd. is located in Israel.

Israel is recognised by the European Commission as providing an adequate level of protection for personal data.

Wix may also use affiliated companies and subprocessors in other countries.

Further information about international data transfers is provided below.
 

6. Server log information
 

When you access our website, technical information may automatically be recorded in server logs.

This may include:

* IP address
* Date and time of access
* Requested page or file
* Browser type and version
* Operating system
* Referring website
* Device information
* Error or security information

This information may be processed to deliver the website, identify technical problems, maintain security, and prevent misuse.

The legal basis is *Article 6(1)(f) GDPR*.

Our legitimate interest is the secure and reliable operation of our website.

Server log information is deleted or anonymised when it is no longer required for these purposes, unless longer retention is necessary to investigate a security incident or comply with a legal obligation.
 

7. Online Orders and Wix Stores
 

When you place an order, we process the information necessary to complete the transaction.

This may include:

* Your name
* Email address
* Billing address
* Delivery address
* Telephone number
* Products ordered
* Order value
* Selected payment method
* Delivery method
* Order notes
* Transaction and order history

Required information is identified during checkout.

Without the information necessary to process and deliver an order, we may be unable to complete the purchase contract.

The legal bases are:

* *Article 6(1)(b) GDPR* for processing and fulfilling the order; and
* *Article 6(1)(c) GDPR* for applicable accounting, tax, and recordkeeping requirements.
 

8. Customer accounts
 

Where our website allows customer accounts, you may create an account to review orders, save certain details, or use other customer features.

We may process:

* Your name
* Email address
* Login credentials
* Saved delivery information
* Order history
* Account preferences

The legal basis is *Article 6(1)(b) GDPR* where the account is used to provide services requested by you.

You may request closure of your customer account.

Information that must be retained for legal, contractual, accounting, or other lawful purposes will not necessarily be deleted immediately when an account is closed.
 

9. Contact Forms and Customer Communications
 

When you contact us by contact form, email, telephone, or social media, we process the information you provide to respond to your request.

The legal basis is: * *Article 6(1)(b) GDPR* where your request concerns an order, potential purchase, return, withdrawal, or other contractual matter; or * *Article 6(1)(f) GDPR* for general business enquiries and customer-service communications.

Our legitimate interest is responding to enquiries and maintaining appropriate business records.

Please do not send sensitive personal information unless it is necessary for us to handle your request.
 

10. Withdrawal and Return Requests
 

When you submit a withdrawal or return request, we may process:

* Your name
* Address
* Email address
* Order number
* Product information
* Order and delivery dates
* Reason for return, where voluntarily provided
* Photographs or supporting documentation
* Additional information provided by you

We may use this information to:

* Record your withdrawal notice
* Process a return * Provide return instructions
* Investigate damaged or incorrect products
* Provide a refund
* Comply with applicable consumer-law obligations

The legal bases may include *Article 6(1)(b) and Article 6(1)(c) GDPR*.
 

11. Payment Processing
 

Payments are processed using the payment methods made available during checkout.

Our current external payment provider is:

*PayPal*

Depending on the checkout options available, PayPal may also process eligible credit or debit card payments.

Where bank transfer is offered, the information necessary to identify and process the payment may also be processed by the banks involved in the transaction.

Information transferred to a payment provider may include:

* Your name
* Billing address
* Email address
* Order value
* Currency
* Transaction information
* Payment details
* Information used for fraud prevention

Payment providers may process personal data as independent controllers under their own privacy policies.

Some payment providers may perform identity, security, credit, or fraud-prevention checks where applicable to the selected payment method.

The legal basis for transferring information necessary to process a payment is generally *Article 6(1)(b) GDPR*.

Where processing is necessary to prevent payment fraud or protect our business, *Article 6(1)(f) GDPR* may also apply.
 

12. Shipping and Delivery
 

We share the personal data necessary to deliver your order with the relevant shipping or logistics provider.

Our current primary shipping provider is:

*DHL*

Information shared may include:

* Recipient's name
* Delivery address
* Email address
* Telephone number
* Parcel information
* Order or shipment reference
* Delivery instructions

The legal basis is generally *Article 6(1)(b) GDPR* where the processing is necessary to fulfil and deliver your order.

Where an email address or telephone number is used for an optional delivery-notification service that is not necessary to perform the delivery contract, we will use an appropriate legal basis, including consent under
*Article 6(1)(a) GDPR* where required.
 

13. Transactional Email Notifications
 

We may send transactional communications concerning:

* Order confirmations
* Payment confirmations
* Dispatch and delivery
* Account activity
* Returns and refunds
* Withdrawal requests
* Customer-service matters

These communications are used to process your order or respond to your request and are not promotional newsletters.

The legal basis is generally *Article 6(1)(b) GDPR* or, where applicable, *Article 6(1)(c) GDPR*.
 

14. Marketing Communications
 

Where we offer newsletters or other electronic marketing communications, we will send them only where we have an appropriate legal basis.

Where consent is required, marketing communications will only be sent after you have provided your consent.

You may withdraw your consent or unsubscribe from marketing communications at any time.

The legal basis for consent-based marketing is *Article 6(1)(a) GDPR*.

Transactional communications relating to your order, account, return, refund, or customer-service request are not considered marketing communications.
 

15. Website Analytics and Advertising Technologies
 

Our website platform may process technical information necessary to operate, secure, and maintain the website.

We do not state that separate third-party analytics or advertising services are active unless such services have actually been enabled on our website.

If we use optional analytics, advertising, tracking, or similar technologies that require consent, they will only be activated after the required consent has been obtained.

Where applicable, information about such technologies and providers will be made available through our cookie information, Cookie Settings, or this Privacy Policy.
 

16. Social-Media Links and Content
 

Our website may contain links to our profiles on services such as:

* Facebook
* Instagram
* TikTok
* Other social-media platforms

Where these are ordinary links, information is generally transferred to the social-media provider when you select the link and visit the relevant platform.

Where embedded social-media content, feeds, videos, or plugins are used, the provider may receive technical information when the content is loaded.

Where consent is legally required for such content, it will only be activated after the required consent has been obtained.

Social-media providers process personal information according to their own privacy policies.

We do not control how those platforms process personal information after you leave our website.
 

17. Cookies and Similar Technologies
 

Our website uses cookies and similar technologies.

Cookies are small files or pieces of information that may be stored on or accessed from your device when you use our website.

### Strictly Necessary Technologies

Certain cookies and similar technologies are necessary for the operation of our website and online shop.

These may be used for purposes such as:

* Website and account security
* Shopping-cart functionality
* Checkout
* Customer login
* Network management
* Fraud and abuse prevention
* Remembering your privacy and cookie preferences

Where storing or accessing information on your device is strictly necessary to provide a digital service expressly requested by you, consent is not required under *Section 25(2) TDDDG*.

Where personal data is processed through these technologies, the applicable legal basis under the GDPR may include *Article 6(1)(b) GDPR* where processing is necessary for a requested contractual service, or *Article 6(1)(f) GDPR* where processing is necessary for purposes such as website and information security.

### Optional Technologies

Cookies and similar technologies that are not strictly necessary, including analytics, advertising, or personalisation technologies where applicable, will only be activated after obtaining your consent where consent is legally required.

The legal basis for storing or accessing information on your device is *Section 25(1) TDDDG* together with your consent.

Where personal data is subsequently processed on the basis of that consent, the legal basis is *Article 6(1)(a) GDPR*.

You may accept, reject, or adjust optional cookies through our cookie banner.

You may withdraw or change your consent at any time through the *Cookie Settings* available on our website.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Rejecting optional cookies does not prevent you from using the essential functions of our website and online shop, although certain optional features may not be available.
 

18. Recipients of Personal Data
 

We disclose personal data only where necessary and legally permitted.

Depending on the circumstances, recipients may include:

* Wix and its affiliated service providers
* Payment providers
* Banks and financial institutions
* Shipping and logistics providers
* Email and communication providers
* IT and website-support providers
* Analytics or advertising providers, where activated with the required legal basis
* Accountants and tax advisers
* Legal advisers
* Fraud-prevention and security providers
* Public authorities, courts, or regulators where legally required
* Other service providers necessary to operate our business

Service providers processing information on our behalf are required to process personal data in accordance with applicable legal requirements and contractual arrangements.

Certain recipients, such as payment providers, social-media companies, banks, or public authorities, may process personal data as independent controllers.
 

19. International Data Transfers
 

Some service providers involved in operating our website and processing orders may process personal data outside Germany or the European Economic Area (EEA).

Wix.com Ltd. is located in Israel. Israel is recognised by the European Commission as providing an adequate level of protection for personal data.

Wix and other service providers may also use affiliated companies or subprocessors located in other countries.

Where personal data is transferred to a country for which the European Commission has adopted an adequacy decision, the transfer may be based on that decision.

Where no adequacy decision applies, transfers will be protected using an appropriate mechanism required by applicable data-protection law.

This may include:

* European Commission Standard Contractual Clauses
* Additional technical, contractual, or organisational safeguards
* Another legally recognised transfer mechanism

You may contact us if you would like further information about safeguards applicable to a particular transfer.
 

20. Your data-protection rights
 

We retain personal data only for as long as necessary for the purpose for which it was collected or as required by law.

Retention periods are determined by considering:

* The duration of the customer relationship
* The time required to process an order, delivery, return, or refund
* Applicable commercial, tax, and accounting retention requirements
* Warranty and consumer-law requirements
* Limitation periods for legal claims
* Fraud-prevention and security requirements
* The duration of valid consent
* Whether an unresolved complaint or dispute exists

Depending on the type of information and applicable legal requirements:

* Invoices, accounting vouchers, and related accounting documentation may generally be retained for *8 years* where required under German law.
* Certain books, records, annual financial statements, and similar records may be retained for *10 years* where required by law.
* Commercial or business correspondence may generally be retained for *6 years* where statutory retention requirements apply.
* Order and contract information may also be retained for the period necessary to establish, exercise, or defend legal claims.
* Customer-service communications are retained for as long as necessary to resolve the enquiry and, where appropriate, for a reasonable period afterwards.
* Customer-account information is generally retained while the account remains active and may be deleted following closure unless statutory retention requirements or another lawful basis requires continued storage. * Consent records may be retained for an appropriate period to demonstrate that valid consent was obtained.

Where different retention requirements apply to the same information, the information may be retained for the longest applicable period.

After the relevant retention period expires, personal data will be deleted, anonymised, or restricted where continued storage is no longer required.
 

21. Your Data-Protection Rights
 

Subject to the requirements and limitations of applicable law, you may have the following rights:

### Right of Access

You may request confirmation as to whether we process your personal data and request access to that information.

### Right to Rectification

You may ask us to correct inaccurate personal data or complete incomplete information.

### Right to Erasure

You may ask us to delete personal data where the legal requirements are met.

The right to erasure does not apply where processing or retention is required by law or is necessary for another legally recognised purpose.

### Right to Restriction of Processing

You may ask us to restrict the processing of your personal data in circumstances provided by law.

### Right to Data Portability

Where processing is based on consent or a contract and carried out by automated means, you may be entitled to receive certain personal data in a structured, commonly used, and machine-readable format.

### Right to Object

You may object to processing based on *Article 6(1)(e) or Article 6(1)(f) GDPR* for reasons arising from your particular situation.

Where personal data is processed for direct marketing purposes, you may object at any time.

We will stop processing your personal data for direct marketing after receiving your objection.

### Right to Withdraw Consent

Where processing is based on your consent, you may withdraw your consent at any time with effect for the future.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
 

22. Exercising Your Rights
 

If you wish to exercise your data-protection rights, please contact:

*Jessa Marie Schild / Lux by Jes*
Email: [luxbyjes@gmail.com](mailto:luxbyjes@gmail.com)

We may need to verify your identity before responding to a request where reasonably necessary to protect your personal information.
 

23. Right to Lodge a Complaint
 

If you believe that the processing of your personal data infringes applicable data-protection law, you have the right to lodge a complaint with a competent data-protection supervisory authority.

For Lux by Jes, the competent supervisory authority in Hesse is:

*Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI)*

Wilhelmstraße 7
65185 Wiesbaden
Germany

Telephone: +49 611 1408-0
Email: [poststelle@datenschutz.hessen.de](mailto:poststelle@datenschutz.hessen.de)

You may also contact another competent supervisory authority, particularly in the EU Member State of your habitual residence, place of work, or the place of the alleged infringement.
 

24. Automated Decision-Making
 

Lux by Jes does not currently make decisions based solely on automated processing, including profiling, that produce legal effects concerning customers or similarly significantly affect them.

Payment providers, fraud-prevention providers, or other third parties may carry out automated checks under their own responsibility and in accordance with their own privacy policies.
 

25. Data Security
 

We use appropriate technical and organisational measures designed to protect personal data against:

* Unauthorised access
* Accidental loss
* Destruction
* Alteration
* Unlawful disclosure
* Other unlawful processing

These measures may include access controls, account security, encrypted transmission, software updates, backups, and restrictions on access to personal information.

No internet transmission or storage system can be guaranteed to be completely secure.

Customers should protect their account passwords and avoid sending confidential payment information through ordinary email.
 

26. Children's Information
 

Our products and online shop are intended primarily for adults and are not specifically directed at children.

We do not knowingly request unnecessary personal information from children.

Where a minor enters into a purchase contract, the validity of that transaction is subject to applicable law concerning legal capacity and, where required, the consent of a parent or legal guardian.
 

27. External Links

Our website may contain links to third-party websites.

We are not responsible for the privacy practices or content of external websites.

You should review the privacy information of the relevant third party before providing personal information through an external website.

28. Changes to This Privacy Policy

We may update this Privacy Policy where necessary, including when:

* Website functions change
* New service providers are introduced
* Processing activities change
* Legal requirements change
* Our business operations change

The current version will be published on our website with an updated revision date.

Material changes will be communicated where required by law.

29. Contact

For questions about this Privacy Policy or the processing of your personal data, please contact:

*Controller:* Jessa Marie Schild 
*Trading as:* Lux by Jes

Schulstr. 34
64572 Büttelborn
Germany

*Email:* [luxbyjes@gmail.com](mailto:luxbyjes@gmail.com)
*Phone:* +49 176 87913602
*Website:* [www.luxbyjes.com](http://www.luxbyjes.com)