Privacy policy

1. Controller

The controller of your personal data is Luula Ltd., VAT No. LV41203064310, Ezeru laukuma 1, Talsi, LV-3201, Talsu novads, Latvia, e-mail hello@luu.la.

Last updated: 10 October 2026.

2. Data we process

Order data: name, e-mail, phone, delivery and billing address, ordered products, payment status. Account data if you create an account: e-mail and password (stored encrypted). Messages you send us. Technical data needed to run the website securely (e.g. IP address in server logs).

3. Purposes and legal bases

To process and deliver your order and handle returns — performance of a contract (Art. 6(1)(b) GDPR).

To keep accounting and tax records — legal obligation (Art. 6(1)(c)).

To keep the website secure and prevent fraud — legitimate interest (Art. 6(1)(f)).

Analytics or marketing only with your consent (Art. 6(1)(a)), which you may withdraw at any time.

4. Recipients

We share data only as needed with: delivery companies (name, address, phone), our bank and payment providers, our website hosting and e-mail providers, and our accountant. All processors are bound by data processing agreements. Where data is transferred outside the EEA, this is done under EU standard contractual clauses or an adequacy decision.

5. Storage periods

Order and invoice records: 5 years as required by Latvian accounting law. Account data: until you delete your account. Messages: up to 2 years after the matter is closed.

6. Your rights

You have the right to access, correct and delete your data, to restrict or object to processing, to data portability, and to withdraw consent. Write to hello@luu.la. You may also complain to the Data State Inspectorate of Latvia (www.dvi.gov.lv) or the supervisory authority in your country.

7. Children

Our shop is intended for adults. We do not knowingly collect personal data from children.