Privacy Policy
Last updated: 14 October 2026
We collect as little personal data as possible, only for clear purposes, and never sell it. This policy explains what we process, why, for how long and what your rights are under the EU General Data Protection Regulation (GDPR).
Some business details are still being completed and are marked in brackets.
1. Controller
[Business name][Registered address]
Registration number: [Registration no. (matična številka)]
Tax number: [Tax no. (davčna številka)]
Email: info@lushrituals.com
For any privacy question or request, write to info@lushrituals.com.
2. What we process and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Orders and delivery | Email (entered on our site before payment), purchased products, order number, payment status, consent to immediate delivery, download activity | Performance of a contract (Art. 6(1)(b) GDPR); legal accounting obligations (Art. 6(1)(c)) | 10 years after the end of the year of purchase (tax and accounting law); checkouts that are not completed are deleted after 30 days |
| Licence protection | Your email and order number printed in your personal files | Performance of a contract and our legitimate interest in protecting our copyright (Art. 6(1)(b), (f)) | As long as the files exist; copies stored by us are deleted with the order record |
| Payments | Payment details are entered directly with Stripe; we receive only the payment result and the last digits/type of card where Stripe provides them | Performance of a contract (Art. 6(1)(b)) | Together with the order record |
| “Notify me” and readings waitlists | Email, the product or service you are waiting for, date of sign-up | Consent (Art. 6(1)(a)) | Until we notify you, plus up to 12 months, or until you withdraw consent |
| Newsletter (only if you opted in) | Email, sources and date of consent, unsubscribe status | Consent (Art. 6(1)(a)) | Until you unsubscribe; proof of consent for up to 3 years afterwards |
| Reading subscriptions (once open) | Name, email, company name, date, time and place of birth or founding, your notes, subscription and payment status | Performance of a contract (Art. 6(1)(b)); accounting obligations (Art. 6(1)(c)) | Duration of the subscription plus 12 months; invoices 10 years |
| Contact form | Name, email, your message | Our legitimate interest in answering you (Art. 6(1)(f)); pre-contractual steps (Art. 6(1)(b)) | Up to 2 years after the conversation ends |
| Visit statistics | Page visited, referring website, campaign tags, device type, country, a pseudonymous visitor code that changes daily. No cookies, no IP address stored. | Our legitimate interest in understanding and improving the store (Art. 6(1)(f)) | 13 months |
| Security and abuse prevention | Temporary rate-limit entries derived from your IP address | Our legitimate interest in protecting the store (Art. 6(1)(f)) | 24 hours |
Providing your email is necessary to buy and receive digital content. Everything else — waitlists, newsletter — is voluntary. We do not use your data for automated decision-making or profiling with legal or similarly significant effects.
3. Newsletter and waitlists
When you join a waitlist we use your email only to tell you when that product or service becomes available. We send news, new guides and offers only if you tick the optional newsletter box or join our newsletter. Every newsletter email contains an unsubscribe link, and you can withdraw consent at any time by writing to us. Withdrawal does not affect processing before it.
4. Visit statistics without cookies
We measure visits with our own privacy-friendly analytics. No cookies or similar technologies are stored on your device, no IP addresses are saved, and visitors cannot be recognised from one day to the next. We see aggregated information such as which pages are popular and which websites send visitors to us. You can object to this processing at any time.
5. Recipients and processors
We share data only with service providers who process it on our behalf under data processing agreements:
| Provider | Purpose | Location and safeguards |
|---|---|---|
| Stripe Payments Europe Ltd. (Ireland) | Payment processing and fraud prevention | EU; transfers to Stripe, Inc. (USA) under the EU–US Data Privacy Framework and Standard Contractual Clauses |
| Supabase, Inc. | Database and private file storage | Data hosted in the United Kingdom (London) — covered by an EU adequacy decision; Standard Contractual Clauses |
| Resend (Plus Five Five, Inc.) | Sending order and service emails | USA — Standard Contractual Clauses / EU–US Data Privacy Framework |
| Vercel, Inc. | Website hosting | Servers in London; company in the USA — Standard Contractual Clauses / EU–US Data Privacy Framework |
| Namecheap, Inc. (Private Email) | Our email inbox for messages you send to us | USA — Standard Contractual Clauses |
We may also disclose data to tax authorities, accountants or courts where required by law. When you pay, Stripe also acts as an independent controller for some processing (e.g. fraud prevention); see Stripe’s privacy policy.
6. Your rights
- access to your data and a copy of it;
- correction of inaccurate data;
- erasure (“right to be forgotten”), unless we must keep data by law, e.g. accounting records;
- restriction of processing;
- data portability;
- objection to processing based on legitimate interest, including visit statistics;
- withdrawal of consent at any time, with effect for the future.
Write to info@lushrituals.com; we reply within one month. You also have the right to lodge a complaint with a supervisory authority — in Slovenia: Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si, www.ip-rs.si.
7. Security
Data is transmitted over encrypted connections (HTTPS). Files are stored privately and served only through time-limited links. Download tokens are stored only in hashed form, and access to our admin area is protected and limited.
8. Cookies
Details on cookies and how to change your choice are in our Cookie notice.
9. Changes
We will update this policy when our processing changes. The current version is always available on this page.