Privacy and Security

At CasaLumio, part of LichtXpert B.V., we place great value on your privacy and the security of your personal data. When you visit our website or place an order, we process personal data. In this privacy policy, we explain what data we process, why we do this, and how we protect your data.

This privacy policy applies to the use of our website and to all orders placed with CasaLumio.

1. Responsible for Data Processing

CasaLumio is a trading name of LichtXpert B.V.
LichtXpert B.V.
Laan van de Ram 40
7324 BV Apeldoorn
Netherlands

Chamber of Commerce number: 63221039
VAT number: NL855143198B01
Email address: info@casalumio.com

LichtXpert B.V. is the data controller for the processing of personal data as referred to in the General Data Protection Regulation (GDPR).

2. What Personal Data Do We Process

We only process personal data that is necessary for our services, customer service, and the functioning of the webshop.

We may process the following data:

• Name and address details
• Email address and phone number
• Order, payment, and invoice details
• Correspondence with our customer service
• Technical data such as IP address, browser, and device type
• Data about website usage, such as page views and click behaviour

3. Why Do We Process Personal Data

We only process personal data for clear and justified purposes.

This includes, among other things:

• Processing and delivering orders
• Processing payments and returns
• Answering questions and handling complaints
• Fraud prevention and securing our webshop
• Meeting legal obligations
• Improving our website and services
• Marketing and advertising purposes, when consent has been given

We process personal data solely on the basis of valid legal grounds, such as the performance of a contract, a legal obligation, legitimate interest, or consent.

4. Sharing Data with Third Parties

For our services, we make use of external parties. These parties process personal data only to the extent necessary for their services to CasaLumio.

We collaborate with:

• Shopify, as an e-commerce platform
• DPD, for shipping and delivery
• MultiSafepay, for payment processing
• Zendesk, for customer service and ticket handling
• Google Analytics and Google Ads, for analysis and advertising measurements
• Meta, Pinterest, and TikTok, for advertising purposes and retargeting
• Hotjar, for analysis of website usage and user experience

We never sell personal data to third parties.

5. Cookies and Similar Technologies

We use cookies and similar technologies to ensure our website functions properly, to analyse the use of the website, and to support marketing activities.

During your first visit to our website, you can set your cookie preferences via the cookie banner. You can always adjust these preferences later.

We use, among other things:

• Functional cookies for the proper functioning of the webshop
• Analytical cookies for statistics and website improvement
• Marketing cookies for advertisements and retargeting via, among other things, Meta, Google, Pinterest, and TikTok

6. Security of Personal Data

We take appropriate technical and organisational measures to protect personal data against loss, misuse, and unauthorised access.

We use, among other things:

• SSL encryption on our website
• Secure storage and access restrictions
• Strict password policy and two-factor authentication where possible
• Regular checks and updates of systems

7. Retention Periods

We do not retain personal data longer than necessary for the purposes for which it was collected, unless we are legally obliged to retain data longer.

• Order and invoice details are typically retained for 7 years due to tax retention obligations
• Customer service contacts and tickets are typically retained for 24 months
• Account details are retained as long as an account is active or until deletion is requested

8. Your Rights

Under the GDPR, you have various rights regarding your personal data.

You can request:

• Access to your personal data
• Correction of inaccurate data
• Deletion of data, where legally permitted
• Restriction of processing
• Data portability, where applicable
• Objection to processing based on legitimate interest
• Withdrawal of consent, where processing is based on this

Would you like to exercise these rights? Please contact us at info@casalumio.com.

To prevent abuse, we may ask for confirmation of your identity.

You also have the right to file a complaint with the Data Protection Authority.

9. Transfer Outside the European Economic Area

Some of our service providers, such as Shopify and advertising platforms, may process personal data outside the European Economic Area.

When this occurs, we ensure appropriate safeguards, for example through standard contractual clauses approved by the European Commission or other valid transfer mechanisms.

10. Minors

Our website and products are not aimed at individuals under the age of 16. We do not knowingly collect personal data from children under the age of 16.

If you believe we have processed data from a minor, please contact us at info@casalumio.com so we can investigate and remove it if necessary.

11. Changes to this Privacy Policy

We may adjust this privacy policy when our services change or when legislation requires. The most recent version is always available on this page.

Last updated on: 7 May 2026