Privacy Notice

1. Who we are

Luna Plants is a trading name of Lunaplants. We are the data controller for personal data collected through lunaplants.co.uk. Our address is The Fairmont, Kitty Lane, FY4 5EG, United Kingdom. Contact us at hello@lunaplants.co.uk.

2. What data we collect

We may collect and process the following personal data:

• Identity and contact data: name, email address, delivery address, phone number
• Order data: products purchased, order value, payment status
• Communications: messages you send us via email or the contact form
• Technical data: IP address, browser type, device information, pages visited (see our Cookie Policy)
• Marketing preferences: whether you have opted in to our newsletter

3. How we use your data

We use your personal data for the following purposes and legal bases:

• Fulfilling orders (contractual necessity): processing payment, printing and dispatching your order, sending order confirmations and delivery updates
• Customer service (contractual necessity / legitimate interest): responding to enquiries, handling returns and resolving complaints
• Marketing (consent): sending our newsletter if you have opted in. You can unsubscribe at any time using the link in any email
• Legal obligations (legal obligation): keeping financial records, responding to lawful requests from authorities
• Site improvement (legitimate interest): understanding how visitors use our site to improve functionality and content

4. Who we share data with

We share personal data only where necessary:

• Stripe: payment processing. Stripe acts as an independent controller. See Stripe's privacy policy
• Delivery carriers: name and address to fulfil delivery
• Vercel: website hosting
• Zoho: email services

We do not sell your personal data to third parties.

5. Data retention

We keep order data for 6 years to meet tax and accounting obligations. Contact form messages are retained for 2 years. Newsletter subscriber data is kept until you unsubscribe. We delete or anonymise data when it is no longer needed.

6. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data (where there is no legal reason for us to keep it)
• Restrict or object to processing
• Data portability
• Withdraw consent at any time (where processing is based on consent)

To exercise any of these rights, email hello@lunaplants.co.uk. We will respond within one month.

7. Security

We use HTTPS encryption across our site, process payments through Stripe's PCI-compliant infrastructure and limit access to personal data to those who need it. While no system is completely secure, we take reasonable steps to protect your data.

8. Complaints

If you are unhappy with how we handle your data, please contact us first so we can try to resolve the issue. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. Changes to this notice

We may update this notice from time to time. The date at the top of this page shows when it was last revised.