Privacy Policy

Last updated: July 30, 2026</ strong>

This Privacy Policy describes how LULUMARY collects, uses, stores, and protects the personal data of users of the website www.lulumary. com.

It applies, in particular, when browsing the website, creating a customer account, placing an order, subscribing to the newsletter, or contacting LULUMARY.

1. Data Controller

The data controller is:

LULUMARY
Simplified Joint-Stock Company (SAS)
SIREN: 484 675 699
SIRET of the registered office: 484 675 699 00033
Intra-Community VAT Number: FR19 484 675 699

Headquarters:
Fashion Center – Lot No. 26
70 Avenue Victor-Hugo
93300 Aubervilliers
France

Email address: lulumary@lulumary.com
Website: www.lulumary.com

LULUMARY determines the purposes and means of processing personal data in connection with the operation of the website and the management of its commercial activities.

2. Personal Data Collected

Depending on your use of the website, LULUMARY may collect the following data.

Identification and contact information

• first and last name;
• mailing address;
• email address;
• phone number;
• title, if requested;
• customer account credentials.

order amount and date;

• billing and shipping addresses;
• shipping method;
• order history;
• information regarding returns, exchanges, and refunds.

Payment Information

For credit card payments, the information required for payment is transmitted directly to the secure payment service provider used by LULUMARY.</ p>

LULUMARY does not store complete credit card data, including the full card number and security code.</ p>

For payments by bank transfer, LULUMARY may receive the information included in the transfer description or provided by the bank in order to identify and match the payment to the corresponding order.

Customer account information

• login ID;
• password stored in an encrypted format;
• saved addresses;
• order history;
• products added to a wish list;
• saved preferences.

Browsing Data

The website may collect:

• the browser and operating system;
• the pages viewed;
• data collected through cookies and other trackers.

3. Purposes and Legal Bases

Personal data is processed for the following purposes:

Order processing is part of the performance of the contract, while the retention of accounting documents is a legal obligation.

4. Mandatory Information

Fields marked as mandatory are required to create an account, process an order, ensure its delivery, or respond to a request.

If this information is not provided, LULUMARY may not be able to process the order or request in question.

Fields not marked as required are optional.

5. Recipients of the Data

Personal data is accessible only to individuals and organizations that need it to perform their duties.

In particular, it may be disclosed to:

to the website host;
• the service provider responsible for the website’s development, maintenance, or security;
• the credit card payment service provider;
• the bank responsible for processing transfers;
• Colissimo and Chronopost for delivery;
• service providers responsible for sending transactional emails;</ li>
• to Google Analytics, subject to the user’s consent;
• to LULUMARY’s advisors, insurers, and certified public accountants;
• to legally authorized administrative or judicial authorities.

Shipping carriers receive only the data necessary for delivery, including name, address, phone number, and package information.</ p>

LULUMARY does not sell or rent its customers’ personal data to third parties.

6. Website Hosting

The website is hosted by:

Hostinger International Limited
61 Lordou Vironos Street
6023 Larnaca
Cyprus

Hostinger acts as a technical service provider and may process data necessary for hosting, security, backups, and the operation of the website.

Hostinger International Limited is the contracting entity designated by Hostinger for customers based in the European Union, unless otherwise specified in the contract.

7. Payments

The website accepts the following payment methods:

• by credit card;
• by bank transfer.

Credit card payments are processed using a secure payment solution. LULUMARY does not have access to the customer’s full banking information.

The payment service provider may collect the data necessary to:

• authorize the payment;
• fraud prevention;
• refund processing;
• resolving payment disputes.

The name of the payment service provider may be added to this policy once a final solution has been selected.

8. Delivery

To ensure the delivery of orders, the necessary information is transmitted, depending on the selected shipping method, to:</ p>

• Colissimo</ strong> ;
• Chronopost.

This information may include your last name, first name, shipping address, email address, phone number, and the tracking information needed to track your package.

Carriers also process certain data in accordance with their own privacy policies.

9. Newsletter</ h2>

Users can subscribe to the newsletter to receive information about LULUMARY’s collections, products, offers, and news.

Subscription is based on the user’s consent.

Users can unsubscribe at any time:

• by clicking the unsubscribe link included in each newsletter;
• by writing to lulumary@lulumary.com ;
• through your customer account when this feature is available.

No external newsletter provider is currently designated. If LULUMARY subsequently uses a specialized platform, this policy will be updated before email addresses are transmitted to that provider.

Withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal.

10. Google Analytics

LULUMARY uses Google Analytics to measure the website’s audience and better understand how it is used.

Google Analytics may collect information related to:</ p>

• the pages viewed;
• the general source of traffic;
• interactions on the site;
• the IP address and identifiers associated with Analytics cookies.</ li>

Google Analytics is enabled only after the user’s consent has been obtained via the Advanced Cookie Banner module.

Google Analytics user and event data is intended to be retained for a maximum period of 14 months. Google Analytics allows you to set a retention period of two or fourteen months for a standard property.

LULUMARY currently does not use any advertising pixels, including Meta Pixel, TikTok Pixel, or any other similar advertising trackers.

11. Cookies and Other Trackers

The site uses the Advanced Cookie Banner module to inform users and collect their cookie preferences.

Strictly Necessary Cookies

These cookies are essential for the website to function. In particular, they allow:

• the contents of the shopping cart to be saved;
• maintain the connection to the customer account;
• save the selected language;
• to secure the website;
• to manage the ordering process;
• to remember cookie preferences.

These cookies do not require consent when they are strictly necessary for the requested service.

Audience measurement cookies

Google Analytics cookies may only be set after the user has given consent.

The user may:</ p>

• accept all cookies;
• reject non-essential cookies;
• select the categories you allow;
• change or withdraw your consent at any time.</ li>

Rejecting Analytics cookies does not prevent the use of the site’s essential features.

The CNIL reminds users that no tracker subject to consent may be placed on the device before the user has given clear, affirmative consent.

The choice to accept or decline is retained for a period of six months, after which the user may be asked again. The CNIL generally considers this duration to be best practice.

A link or button labeled “Manage my cookies” must remain accessible on the website to allow users to easily change their choice.

12. Retention Periods

Personal data is not retained indefinitely. The retention period depends on the purpose of the processing.

Invoices must be retained for ten years to comply with accounting requirements. Marketing data is generally retained for the duration of the business relationship and for three years after the last purchase or contact.

13. Data Transfers Outside the European Economic Area

Certain technical service providers, including Google, may process data on servers located outside the user’s country of residence.

When data is transferred outside the European Economic Area, such transfers must be governed by a mechanism recognized by applicable regulations, such as:

• an adequacy decision by the European Commission;
• standard contractual clauses;
• or another legally recognized mechanism.

Google states that it has servers in several countries and governs its data transfers through various legal mechanisms.

14. Data Security

LULUMARY implements technical and organizational measures designed to protect personal data against:

• unauthorized access;
• unlawful use;
• loss;
• tampering;
• disclosure;
• accidental destruction.

These measures include, in particular:

• the use of an HTTPS connection;
• restricting access to data;
• protecting administrator accounts;
• updating the website and its modules;
• performing backups;
• monitoring technical incidents;
• the use of specialized service providers.

15. User Rights

In accordance with applicable regulations, the user has, in particular:

• the right to access their data;
• the right to rectification;
• the right to erasure;
• the right to restriction of processing;
• the right to object;
• the right to withdraw consent at any time;
• the right to set guidelines regarding the handling of their data after their death, under the conditions provided for by French law.

To exercise these rights, the user may contact:

LULUMARY
Fashion Center – Lot No. 26
70 avenue Victor-Hugo
93300 Aubervilliers
France

Email: lulumary@lulumary.com

The request must specify the right being exercised and include information that identifies the account, order, or data in question.

Proof of identity may be requested only when there is reasonable doubt regarding the requester’s identity.

16. Filing a Complaint with the CNIL

CNIL.</ p>

17. External Links and Services

The website may contain links to external websites or services.

LULUMARY is not responsible for the privacy practices of these services. Users are encouraged to review their own privacy policies before providing them with personal data.

18. Changes to the Privacy Policy

LULUMARY may modify this policy to reflect:

• changes to the website;
• the addition or replacement of a service provider;
• the implementation of a new tool;
• legal or regulatory changes;
• recommendations from the relevant authorities.

The applicable version is the one published on the website on the date it is viewed.

Two settings to check before publication

In 14 months so that it matches the text.</ p>

In Advanced Cookie Banner, verify that Google Analytics is actually blocked until the user has accepted audience measurement cookies. The name of the credit card payment provider will also need to be added once the solution has been definitively chosen.