Privacy policy

This policy explains which personal data I process when you visit lumenaryvision.com, order a product or contact me, for what purpose and on which legal basis, and which rights you have.

1. Controller

Sebastian Koch, trading as Lumenary Vision
Grewenbrink 3A, 33619 Bielefeld, Germany
Email: sebastian@lumenaryvision.com
Phone: Show phone number

In this policy, "I" and "me" mean Sebastian Koch. I have not appointed a data protection officer because the law does not require one for my business.

2. Hosting and visiting the website

The shop runs on Shopify. The provider for customers in Europe is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, Ireland. When you open a page, Shopify processes technical data on my behalf: IP address, date and time, the page requested, the referring page, browser and device information.

Purpose: delivering the website, keeping it stable and secure. Legal basis: Art. 6 (1) (f) GDPR. My legitimate interest is a working and secure shop.

3. Orders and delivery

When you order, I process your name, email address, billing address, the products ordered, the payment status, your VAT identification number if you enter one (the app Exemptify checks it against the VIES database of the European Commission), and the consent you give in the cart for immediate delivery together with its date and time. If you order a version for Capture One, I also process the camera model you choose on the product page.

Purpose: concluding and performing the contract, delivering the download, invoicing, answering questions about your order, and proving that the contract was concluded properly. Legal basis: Art. 6 (1) (b) GDPR, for tax and accounting records Art. 6 (1) (c) GDPR, for keeping proof Art. 6 (1) (f) GDPR.

The download is delivered through the app Digital Products inside my Shopify store, which sends the download link to your email address.

To protect the shop against fraud and abuse I use the app Blockify. It checks the IP address and the country of a visit and can block access. Legal basis: Art. 6 (1) (f) GDPR. My legitimate interest is preventing fraudulent orders and chargebacks.

4. Payment

Payments are handled by the payment provider you choose in the checkout. I do not receive your full card or account details.

Shopify Payments, including Shop Pay: Shopify International Limited, Ireland, together with its payment processing partners.
PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg.

Legal basis: Art. 6 (1) (b) GDPR. The providers process your data under their own responsibility as far as they need it for the payment, for fraud prevention and to meet their legal duties.

5. Customer account

You can order as a guest. If you use a customer account, Shopify stores your contact details and order history so that you can see your orders and downloads. Legal basis: Art. 6 (1) (b) GDPR.

6. Installer and licence activation

To install the products you can use the Analog Vision Studio Installer. When you sign in with your email address and order number, the installer sends them to my licence server together with an identifier of your computer. This identifier is a one-way hash of your computer's hardware ID; the hardware ID itself does not leave your computer. The server checks whether the order exists, has been paid and has not been refunded, and counts the computers on which the order is installed (up to three).

The server stores your email address only as a keyed hash, together with the order number, the products in the order, the hashed computer identifiers, the operating system, the installer version, and the dates of the first and the last activation on each computer. For a version for Capture One it also stores the camera model you chose and the date you chose it. Failed sign-in attempts are stored with the IP address for one hour, so that order numbers cannot be guessed.

The film profiles and styles the installer installs carry an invisible code derived from your order. The code contains neither your name nor your email address. It lets me trace copies that are shared or sold without permission back to the order they come from.

Purpose: delivering the products you bought, applying the licence (personal use on up to three computers), protecting the products against unauthorised distribution, and preventing abuse. Legal basis: Art. 6 (1) (b) GDPR for delivery and the licence; Art. 6 (1) (f) GDPR for protecting the products and preventing abuse. My legitimate interest is protecting my copyright and my business against piracy.

The licence server and the download storage run on Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA), which processes the data on my behalf. The data is stored in the EU (Western Europe). So that the server knows about new orders, my Shopify store sends the order data listed above to it when an order is paid, changed or cancelled.

7. Contact and support

If you write to me by email, through the contact page or through Instagram or Facebook, I process your message, your contact details and, where needed, your order data in order to answer you. Support requests are managed in the helpdesk software Commslayer. The software can prepare draft replies with the help of artificial intelligence.

Legal basis: Art. 6 (1) (b) GDPR where your request concerns an order, otherwise Art. 6 (1) (f) GDPR. My legitimate interest is answering requests efficiently.

Withdrawal form: if you send a withdrawal through the form at lumenaryvision.com/pages/withdraw-from-contract, I process your name, the order number, your email address and the date and time of your statement in order to handle the withdrawal and to send you the confirmation of receipt the law requires. The confirmation email is sent through Klaviyo (see section 8). Legal basis: Art. 6 (1) (c) GDPR.

8. Email newsletter and product emails

If you subscribe, I send you emails about new products, updates and offers. For sending and for measuring opens and clicks I use Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA. Klaviyo stores your email address, the time of your subscription and your interaction with the emails.

Legal basis: your consent, Art. 6 (1) (a) GDPR. You can withdraw it at any time through the unsubscribe link in every email or by writing to me.

After a purchase I send you emails that belong to your order, such as installation instructions and information about updates to the product you bought. Legal basis: Art. 6 (1) (b) GDPR.

9. Product reviews

After a purchase I may ask you by email for a review. If you submit one, I publish the review with the name you enter. Reviews are collected and shown through Klaviyo. Legal basis: Art. 6 (1) (f) GDPR for the request, Art. 6 (1) (a) GDPR for publishing your review. You can ask me to remove your review at any time.

10. Cookies and consent

The shop uses cookies and similar technologies. Those that are technically necessary, for example for the cart, the checkout and your cookie choice, are set without consent on the basis of § 25 (2) TDDDG and Art. 6 (1) (f) GDPR.

All other technologies listed in section 11 are used only if you agree in the cookie banner, on the basis of § 25 (1) TDDDG and Art. 6 (1) (a) GDPR. You can change your choice at any time through the link "Cookie preferences" at the bottom of every page.

11. Analytics and advertising

With your consent I use the following services:

Meta Pixel and Conversions API, Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. They record page views and purchases so that I can measure my ads on Facebook and Instagram and show ads to people who are likely to be interested.
Google Ads conversion tracking, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It records whether a visit that came from a Google ad led to a purchase.
Microsoft Clarity, Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. It records how pages are used, such as clicks, scrolling and anonymised session recordings, so that I can improve the shop.
Klaviyo onsite tracking, Klaviyo, Inc., USA. If you are a subscriber, it links the products you view to your email profile.
Triple Whale, Triple Whale Inc., USA. It records visits and purchases so that I can see which ads and channels lead to orders.
WeTracked (wetracked.io). It passes purchase events to the advertising platforms named above so that conversions are counted correctly.

Shopify also provides me with statistics about visits and orders.

12. Affiliate programme

I run an affiliate programme through the app UpPromote (Secomapp). UpPromote handles the tracking, the reporting and the payouts and processes the data of affiliates on my behalf.

Visitors: if you reach the shop through an affiliate link, a cookie records which partner referred you so that the partner can be credited for a purchase. The cookie is kept for 30 days. Legal basis: your consent, Art. 6 (1) (a) GDPR, § 25 (1) TDDDG.

Applicants and affiliates: if you apply to the programme, I process the details you enter in the application form at lumenaryvision.com/pages/affiliate-questions (your name, email address, channels and audience figures, and your answers about your reach, your plans and the app you edit in). Once you take part, I also process the data of your affiliate account, such as your payment details, your tracking link, the sales credited to you and your commissions.

Purpose: reviewing your application, running the programme, paying commissions and keeping the records the law requires. Legal basis: Art. 6 (1) (b) GDPR, for tax and accounting records Art. 6 (1) (c) GDPR. I delete the data of declined applications as soon as it is no longer needed to handle the application. The data of affiliates is kept until the agreement ends and for the retention periods of tax law.

Emails about your application and about the programme are sent through Klaviyo (see section 8). You agree to receive them with the checkbox in the application form. Legal basis: Art. 6 (1) (a) GDPR. You can withdraw your consent at any time through the unsubscribe link or by writing to me.

13. Fonts and social media links

All fonts are loaded from my own shop. No font provider receives your data.

The links to Instagram and Facebook are plain links. Data goes to these platforms only when you click a link.

14. Recipients and transfers outside the EU

The providers named in this policy receive your data as far as they need it for their task. Some of them, or their parent companies, are based in the USA or process data there. Transfers are based on the adequacy decision for the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the standard contractual clauses of the European Commission. You can ask me for a copy of the safeguards.

I also pass on data where the law requires it, for example to tax authorities, and to my tax adviser.

15. How long data is kept

Order and invoice data: for the retention periods of German commercial and tax law, which are up to ten years.
Licence and activation data from the installer: as long as the products in the order can be installed, and no longer than the retention period for the order data.
Failed sign-in attempts in the installer: one hour.
Support messages: as long as needed to handle your request and for possible follow-up questions, and no longer than the statutory limitation periods.
Newsletter data: until you unsubscribe.
Data processed on the basis of consent: until you withdraw consent or the purpose no longer applies.

16. Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), erased (Art. 17) or its processing restricted (Art. 18), and the right to data portability (Art. 20). You can withdraw any consent at any time with effect for the future (Art. 7 (3)).

Right to object: where I process your data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you can object at any time on grounds relating to your particular situation. You can object to direct marketing at any time without giving reasons (Art. 21 GDPR).

To exercise your rights, write to sebastian@lumenaryvision.com.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for me is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.

17. Whether you have to provide data

You need to provide the data marked as required in the checkout so that I can conclude and perform the contract. Without it you cannot order. I do not use automated decision-making or profiling that has legal effects on you.

18. Residents of US states

Depending on where you live, you may have the right to opt out of the sharing of your data for targeted advertising. You can do so on the page Your Privacy Choices.