Privacy policy

Last updated: 2 October 2026

In this privacy policy, we inform you which personal data we process when you visit lampisto.com, use our luminaire configurator, place an order with us or contact us.

1. Controller

Luxoo GmbH
Industriestraße 17
46240 Bottrop, Germany
Managing Director: Sebastian Däbler
Telephone: +49 2041 3709011
Email: info@lampisto.com

We have not appointed a data protection officer, as the statutory requirements for doing so are not met. If you have any questions about data protection, please contact us at the address given above.

2. General information

Legal bases

We process personal data on the basis of the General Data Protection Regulation (GDPR) and the Telecommunications Digital Services Data Protection Act (TDDDG), in particular:

  • Art. 6(1)(a) GDPR – your consent;
  • Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures;
  • Art. 6(1)(c) GDPR – compliance with legal obligations (e.g. retention obligations);
  • Art. 6(1)(f) GDPR – our legitimate interests, e.g. in a secure and functioning online shop;
  • § 25(1) TDDDG – consent to the storage of, or access to, information on your terminal device (e.g. cookies); § 25(2) TDDDG, insofar as this is strictly necessary for the service you have requested.

Storage period

We delete personal data as soon as the purpose of processing no longer applies, you withdraw your consent or object, and no statutory retention obligations prevent deletion. We retain documents relevant under commercial and tax law (e.g. invoices, accounting vouchers) for six or eight years respectively in accordance with § 257 HGB and § 147 AO.

Transfers to third countries

Some of our service providers are based outside the EU or the EEA or transfer data there (in particular to the USA and Canada). An adequacy decision of the EU Commission exists for Canada. For transfers to the USA, we rely on the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR) insofar as the recipient is certified, and otherwise on EU standard contractual clauses (Art. 46(2)(c) GDPR).

3. Shop system and hosting: Shopify

Our online shop runs on the Shopify platform. The provider for merchants in Europe is Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”). Shopify provides the shop software, hosting, the content delivery network, the ordering process (checkout) and the customer account, and in doing so processes on our behalf all data that you enter in the shop or that arise during your visit. We have concluded a data processing agreement (Art. 28 GDPR) with Shopify. Shopify may transfer data to Shopify Inc. in Canada and to service providers in the USA (see section 2, third countries).

When you access our shop, technically necessary data are processed: IP address, date and time, page accessed, referrer URL, browser and device information. This is necessary in order to display the shop to you and to protect it against attacks (Art. 6(1)(f) GDPR). In addition, Shopify sets technically necessary cookies, e.g. for the shopping basket, language and country settings, login to the customer account, the checkout and storage of your cookie choices (§ 25(2) no. 2 TDDDG, Art. 6(1)(b) and (f) GDPR).

Further information: shopify.com/de/legal/datenschutz

4. Cookie banner and consent

We only use analytics and marketing services (section 12) if you have given your consent via our cookie banner (Art. 6(1)(a) GDPR, § 25(1) TDDDG). The banner is provided via Shopify's privacy function; your choice is stored in a cookie so that we do not have to ask you again on every visit.

You can withdraw or change your consent at any time with effect for the future by clicking “Cookie settings” at the bottom of any page. The lawfulness of processing carried out before the withdrawal remains unaffected.

5. Orders and contract processing

When you place an order, we process the data you provide during the ordering process: name, delivery and billing address, email address, telephone number if applicable, ordered items and configurations, payment method and communication relating to the order. We need these data to perform the contract, deliver the goods, process payments, handle returns and guarantee claims and inform you about the order status (Art. 6(1)(b) GDPR). We retain invoices and accounting vouchers on the basis of legal obligations (Art. 6(1)(c) GDPR).

Disclosure to manufacturers (direct shipping)

Many items are shipped to you directly by the manufacturer. For this purpose, we pass on your name, your delivery address, the items ordered and – where necessary for delivery – your telephone number to the respective manufacturer (Art. 6(1)(b) GDPR):

  • Mosaic S.p.A. (Creative-Cables brand), Lungo Dora P. Colletta 113/9, 10153 Turin, Italy
  • Nowodvorski Lighting Sp. z o.o., ul. Mariusza Bojemskiego 11, 42-202 Częstochowa, Poland
  • EMIBIG S.C., ul. Przejazdowa 4B, 42-280 Częstochowa, Poland
  • SEGULA GmbH, Bergwiesenäcker 15, 72160 Horb am Neckar, Germany

Shipping service providers

For delivery, we or the manufacturer pass on your name and delivery address to the commissioned transport company (e.g. DHL, DPD, GLS, UPS, BRT, InPost or a freight forwarder; Art. 6(1)(b) GDPR). We only pass on your email address or telephone number to the shipping service provider insofar as this is necessary for delivery (e.g. arranging an appointment for freight goods) or you have consented to this so that the provider can inform you about the delivery. You can withdraw your consent at any time.

6. Payment processing

Depending on the payment method selected, we pass on the data required for payment (e.g. name, address, email address, order amount, order number) to the respective payment service provider (Art. 6(1)(b) GDPR). Card details are collected directly by the payment service provider; we do not receive them. Payment service providers may carry out their own checks for fraud prevention and, in the case of purchase on invoice or in instalments, credit checks; they are themselves responsible for these.

  • Shopify Payments (credit and debit cards, Apple Pay, Google Pay and local payment methods such as iDEAL, Bancontact, EPS, BLIK, Przelewy24): Shopify International Limited (address see section 3) in cooperation with Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. stripe.com/de/privacy
  • PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. paypal.com/de/legalhub/privacy-full
  • Klarna: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. klarna.com/de/datenschutz
  • Apple Pay: Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Google Pay: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

You can see which payment methods are offered at checkout. To detect fraud attempts, Shopify automatically analyses order data (e.g. IP address, address matching) (Art. 6(1)(f) GDPR; our legitimate interest is protection against payment defaults and misuse). We do not make any decisions based solely on automated processing within the meaning of Art. 22 GDPR.

7. Customer account

You can create a customer account or log in with a code sent to you by email. We then store your email address, your name, your addresses and your orders so that you can view them and complete future orders more quickly (Art. 6(1)(b) GDPR). You can request the deletion of your account at any time by email; statutory retention obligations remain unaffected.

8. Contacting us

If you write to us by email, telephone or via the contact form, we process your details (e.g. name, email address, order number, message) in order to respond to your enquiry (Art. 6(1)(b) GDPR if the enquiry concerns a contract or an order, otherwise Art. 6(1)(f) GDPR). Messages sent via the contact form are forwarded to us via Shopify. We delete the enquiry once it has been fully dealt with and no retention obligations apply. Our email mailbox is operated by our hosting provider united-domains GmbH, Gautinger Straße 10, 82319 Starnberg, Germany (data processing, Art. 28 GDPR).

9. Online withdrawal (“Withdraw from contract here”)

If you declare your withdrawal using the “Withdraw from contract here” function, we process your name, your order number, your email address and any information you provide voluntarily (e.g. items concerned, reason) in order to process the withdrawal and confirm its receipt to you (Art. 6(1)(c) GDPR in conjunction with § 356a BGB, and Art. 6(1)(b) GDPR).

10. Newsletter

If you subscribe to our newsletter, we use your email address to send you information about new products, colours and instructions approximately once a month (Art. 6(1)(a) GDPR). Subscription takes place using the double opt-in procedure: you first receive an email in which you confirm your subscription. We store the time of subscription and confirmation as well as the IP address in order to be able to prove the subscription (Art. 6(1)(c) and (f) GDPR).

The newsletter is sent via Shopify Email (provider: Shopify, see section 3). In doing so, we analyse whether a newsletter has been opened and which links have been clicked in order to improve the newsletter; this analysis forms part of your consent. You can unsubscribe from the newsletter at any time via the unsubscribe link in every email or by sending a message to info@lampisto.com. After you unsubscribe, we may store your email address on a block list so that you do not receive any further newsletters (Art. 6(1)(f) GDPR).

11. Luminaire configurator

Our configurator is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA; the image files for the luminaire preview are delivered by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (data storage location: EU). When the configurator is accessed, technically necessary connection data (IP address, time, browser, device) are processed in order to deliver the configurator (Art. 6(1)(f) GDPR; legitimate interest in a stable and fast display). Both providers are certified under the EU-US Data Privacy Framework; data processing agreements are in place with both.

When you click “Add to basket”, your configuration is transferred to our shop (Shopify). The configurator also reports which models and options are selected to the analytics services in section 12 – this only happens if you have consented to the respective services. No names, email addresses or other directly identifying data are transmitted in this process.

12. Analytics and marketing (only with consent)

We only use the following services if you have given your consent in the cookie banner (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Without consent, they are not loaded or do not send any data. You can withdraw your consent at any time via “Cookie settings”.

12.1 Shopify statistics

Shopify compiles statistics for us on the use of the shop (e.g. visits, origin, sales) and sets cookies for this purpose such as _shopify_y and _shopify_s (storage period up to 1 year and 30 minutes respectively).

12.2 Google Analytics 4

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”); integrated via the Shopify app “Google & YouTube”. Purpose: We learn how visitors reach our shop, which pages they view and at what point they abandon a purchase or the configurator. Data: pages visited and length of stay, origin of the visit (referring website, campaign parameters), events (e.g. “add to basket”, configurator steps), device, browser, screen resolution, approximate location, a random identifier; IP addresses are not stored by Google Analytics 4. Third country: Google LLC (USA) is certified under the EU-US Data Privacy Framework; a data processing agreement is in place with Google. Storage period: cookies _ga, _ga_<ID> up to 2 years; analytics data are deleted after 14 months. Further information: policies.google.com/privacy

12.3 Meta Pixel and Conversions API (Facebook, Instagram)

Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”); integrated via the Shopify app “Facebook & Instagram”. Purpose: We measure whether visits and purchases result from our posts and adverts on Facebook and Instagram, and can display advertising in a more targeted way to people who are interested in our products. Data: pages visited, events (product viewed, add to basket, purchase incl. value of goods), IP address, browser and device information, a random identifier, click identifiers from Meta adverts. Via the Conversions API, these events are additionally transmitted directly from our shop server to Meta; in this process, contact data from an order (e.g. email address, telephone number) may be transmitted in encrypted (hashed) form. Joint controllership: We are jointly responsible with Meta for the collection on our website and the transmission to Meta (Art. 26 GDPR); the agreement can be found at facebook.com/legal/controller_addendum. Meta is solely responsible for any further processing. Third country: Meta Platforms, Inc. (USA) is certified under the EU-US Data Privacy Framework. Storage period: cookies _fbp and _fbc up to 90 days. Further information: facebook.com/privacy/policy

12.4 Pinterest Tag and Conversions API

Provider: Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland (“Pinterest”); integrated via the Shopify app “Pinterest”. Purpose: We measure whether visits and purchases result from our Pins and adverts, and can display Pinterest advertising in a more targeted way. Data: pages visited, events (page view, product viewed, add to basket, purchase incl. value of goods), IP address, browser and device information, a random identifier, click identifiers; with the Conversions API, contact data from the order in hashed form where applicable. Third country: transfer to Pinterest, Inc. (USA) on the basis of the EU-US Data Privacy Framework or EU standard contractual clauses. Storage period: cookies _pin_unauth, _pinterest_ct_ua, _epik up to 1 year. Further information: policy.pinterest.com/de/privacy-policy

12.5 Microsoft Clarity

Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland (“Microsoft”); integrated via the Shopify app “Microsoft Clarity”. Purpose: Clarity shows us in aggregated form (heatmaps) and as session recordings how visitors use the shop and the configurator, so that we can identify and fix usability problems. Data: mouse movements, clicks, scrolling behaviour, pages visited, configurator events, device, browser, screen resolution, approximate location, IP address, a random identifier. Entries in form fields are masked and not recorded; the checkout is not recorded. Third country: Microsoft Corporation (USA) is certified under the EU-US Data Privacy Framework. Storage period: cookies _clck (1 year), _clsk (1 day), and where applicable MUID, CLID, MR, SM, ANONCHK; recordings are deleted after 30 days, analyses after 13 months at the latest. Further information: privacy.microsoft.com

12.6 Campaign parameters (UTM)

Links in our social media profiles, posts and newsletters contain campaign parameters (e.g. utm_source=instagram). They only show the channel through which a visit came about, contain no personal data and do not themselves set any cookies. They are only analysed by the services mentioned above and only with your consent.

13. Social media profiles

On our website, we link to our profiles on Instagram, Facebook and Pinterest. These are simple links; no data are transmitted to these networks as a result of your visit to our shop. Only when you click on a link do the data protection provisions of the respective network apply.

14. Your rights

You have the following rights vis-à-vis us with regard to the personal data concerning you:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to withdraw consent given, with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): Insofar as we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. You may object to processing for direct marketing purposes at any time without giving reasons.

To exercise your rights, a message to info@lampisto.com is sufficient.

Right to lodge a complaint: You may lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your residence. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia), Kavalleriestraße 2–4, 40213 Düsseldorf, www.ldi.nrw.de.

15. Data security

Our shop and the configurator are transmitted exclusively in encrypted form (TLS/HTTPS). We and our service providers take technical and organisational measures to protect your data against loss and unauthorised access.

16. Changes

We will amend this privacy policy if our offer or the legal situation changes. The version published on this page at the time applies.