Legal
Privacy Policy
Last updated: September 2026
1. Data Controller
Lume Studio GmbH
Managing Directors: Jakob Dürnberger, Johannes Ruisinger
Radetzkystraße 8, 1030 Wien, Austria
FN 676071y · Commercial Court Vienna
E-Mail: lumestudiovienna@gmail.com
Website: https://www.lume-studio.at
2. Data We Collect
When you use our website, book a workshop, purchase products in our shop, or contact us, we may collect the following personal data:
- Name (first and last name)
- Email address
- Phone number (if provided)
- Shipping address (for shop orders)
- Payment data (processed by Stripe; we do not store your card details)
- Usage data (IP address, browser type, pages visited)
3. Purpose of Data Processing
We process your data for the following purposes:
- Processing and managing workshop bookings
- Processing shop orders and shipping
- Issuing and redeeming gift cards
- Creating invoices and fulfilling legal accounting obligations
- Customer communication (booking confirmations, order updates)
- Improving our website and services
4. Legal Basis
We process your personal data on the following legal bases under the GDPR:
- Art. 6 Abs. 1 lit. a DSGVO: Consent: Google Analytics and the Meta Pixel, only if you click “Accept” in the cookie banner (see section 5).
- Art. 6 Abs. 1 lit. b DSGVO: Performance of a contract: processing necessary for workshop bookings, shop orders, and gift card transactions.
- Art. 6 Abs. 1 lit. c DSGVO: Legal obligation: e.g., retention of invoices as required by Austrian tax law.
- Art. 6 Abs. 1 lit. f DSGVO: Legitimate interest: secure operation of the website and cookie-free performance measurement (Vercel Analytics, Speed Insights).
5. Cookies and Tracking
Your choice in the cookie banner: Google Analytics and the Meta Pixel are only loaded after you click “Accept” in our cookie banner (legal basis: Art. 6(1)(a) GDPR and § 165(3) TKG 2021). If you click “Decline” or make no choice, neither service is loaded. You can withdraw your consent at any time via the “Cookie settings” link at the bottom of every page; the cookies set by these services are then deleted.
Google Analytics: With your consent, we use Google Analytics 4 from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) to understand how our website is used. Google Analytics sets cookies and does not store full IP addresses. Data may also be processed by Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework. Google Privacy Policy: https://policies.google.com/privacy
Vercel Analytics & Speed Insights: We use Vercel Analytics and Vercel Speed Insights to measure visitor numbers and page speed. Both work without cookies and only collect aggregated, anonymous data (legal basis: Art. 6(1)(f) GDPR).
Meta Pixel (Facebook/Instagram): With your consent, we use the Meta Pixel from Meta Platforms Ireland Ltd. (4 Grand Canal Square, Dublin 2, Ireland) to measure the effectiveness of our advertising on Facebook and Instagram. The pixel records page views, add-to-cart actions, and completed purchases, and sets cookies. This data is transmitted to Meta and may be linked to your Facebook/Instagram account if you are logged in. Data may also be processed by Meta Platforms Inc. in the USA; Meta is certified under the EU-US Data Privacy Framework. Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time via “Cookie settings” at the bottom of the page, and additionally manage ads in your Facebook ad preferences or via youronlinechoices.com. Meta Privacy Policy: https://www.facebook.com/privacy/policy
6. Payment Provider
We use Stripe Inc. (510 Townsend Street, San Francisco, CA 94103, USA) to process payments. When you make a purchase, your payment data is transmitted directly to Stripe and processed on their servers. We do not store your credit card or payment details on our servers. Stripe is PCI-DSS Level 1 certified.
Stripe Privacy Policy: https://stripe.com/privacy
7. Email Service
We use Resend (Resend Inc.) to send transactional emails such as booking confirmations, order confirmations, and gift card deliveries. Your email address and name are transmitted to Resend solely for the purpose of sending these emails. No marketing emails are sent without your explicit consent.
8. Hosting
Our website is hosted by Vercel Inc. (340 S Lemon Ave #4133, Walnut, CA 91789, USA). Vercel processes data on servers in the EU and the USA. A data processing agreement (DPA) is in place with Vercel in accordance with Art. 28 GDPR.
9. Database
We use Supabase (Supabase Inc.) as our database provider. Your data is stored securely with encryption at rest and in transit. Supabase servers are located in the EU.
10. Data Retention
We retain your personal data only as long as necessary for the purposes described above. Specifically:
- Booking and order data: for the duration of the contractual relationship, plus the statutory retention period.
- Invoices and accounting records: 7 years (as required by Austrian tax law, § 132 BAO).
- Analytics data: automatically anonymized and aggregated.
11. Your Rights
Under the GDPR, you have the following rights regarding your personal data:
- Right of access (Art. 15 DSGVO)
- Right to rectification (Art. 16 DSGVO)
- Right to erasure (Art. 17 DSGVO)
- Right to restriction of processing (Art. 18 DSGVO)
- Right to data portability (Art. 20 DSGVO)
- Right to object (Art. 21 DSGVO)
To exercise any of these rights, please contact us at lumestudiovienna@gmail.com.
12. Right to Lodge a Complaint
If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with the supervisory authority:
Austrian Data Protection Authority
Barichgasse 40-42, 1030 Wien
Website: https://www.dsb.gv.at
E-Mail: dsb@dsb.gv.at
13. Contact
For any questions regarding data protection, please contact us:
Lume Studio GmbH
Radetzkystraße 8, 1030 Wien, Austria
FN 676071y · Commercial Court Vienna
E-Mail: lumestudiovienna@gmail.com