Privacy Policy

Last updated: September 16, 2026

At LUMORYN, we value the trust you place in us when you browse our collections, make a purchase or get in touch. Part of earning that trust is being clear about how your personal information is used and the choices you have.

This Privacy Policy explains what information we collect, why we use it, who receives it and how you can exercise your privacy rights when you use lumoryn.com and our related services (the “Services”).

LUMORYN is operated by Mavora International Limited, referred to in this policy as “we,” “us” and “our.” We are the data controller or equivalent responsible organisation for processing whose purposes and means we determine. Our company and contact details are provided in Section 13.

Our store is powered by Shopify. Shopify also acts independently for certain processing, as explained below. This policy provides information about our practices; visiting our website does not, by itself, constitute consent to optional marketing or advertising technologies.

1. Information We Collect and Its Sources

The information we process depends on your interaction with us:

• Contact and delivery details: your name, email address, telephone number, billing address and shipping address.

• Orders and transactions: products ordered, purchase history, payment status, delivery records, cancellations, returns, refunds and related correspondence.

• Payment details: information processed by Shopify and the relevant payment providers to complete your transaction. The information available to us depends on your payment method and may include payment status, transaction references and limited payment-method details. Please do not send full payment card details by email.

• Account and preferences: information associated with your customer account, saved preferences, and marketing and privacy choices.

• Communications: enquiries, feedback, attachments and other information you choose to provide to us.

• Device and website activity: IP address, browser and device information, identifiers, pages or products viewed, cart activity and interactions with our website or communications, subject to applicable privacy choices.

• Inferred preferences: interests inferred from shopping or browsing activity when used for the personalisation and advertising described in this policy.

We receive information directly from you, automatically through the Services and cookies or similar technologies, and from Shopify and providers supporting payments, security, communications and delivery. For example, payment providers supply payment confirmations and carriers supply delivery updates.

Information required at checkout is needed to process and deliver your order. Without it, we may be unable to complete your purchase. You do not have to subscribe to marketing to make a purchase.

2. How and Why We Use Information

We use personal information for the following purposes. Where European or UK data protection law requires a legal basis, the corresponding bases are described below.

• Orders and customer service: to process purchases and payments, arrange delivery, handle returns and refunds, and answer order-related enquiries. We rely on performance of our contract with you or steps taken at your request before entering a contract. Statutory consumer obligations may also require this processing.

• Customer accounts and requested services: to provide account access, order history and preferences you choose to save. We rely on performance of the requested service and, where relevant, our legitimate interests in administering customer relationships.

• Security and fraud prevention: to protect the store and payment process, investigate suspicious activity and resolve disputes. We rely on our legitimate interests in protecting customers and our business, and applicable legal obligations.

• Website operation and improvement: to maintain the store, diagnose faults and understand performance. We rely on our legitimate interests in providing a functioning and useful website, with consent for cookies and related processing wherever required.

• Marketing and personalisation: to send permitted promotional communications, recommend relevant products and support advertising. We obtain consent where required. Where the law permits marketing on another basis, we rely on our legitimate interests in promoting our products, subject to your rights and choices.

• Business records and legal matters: to maintain necessary accounting and transaction records, meet legal requirements, respond to valid legal requests and establish, exercise or defend claims. We rely on legal obligations recognised under the relevant data protection law: EU or Member State law for that basis under the EU GDPR, and UK law under the UK GDPR. For obligations arising under other countries’ laws, any reliance on legitimate interests in maintaining necessary business records and protecting our legal rights is subject to an assessment of necessity, proportionality and your rights.

Where we rely on legitimate interests, we assess and document the purpose, necessity and impact of the processing on your rights. We do not treat legitimate interests as an automatic alternative to another legal basis or use them to bypass a requirement for consent. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing.

3. Cookies and Privacy Choices

We and our service providers, including Shopify, use cookies and similar technologies for:

• Essential functions: security, checkout, shopping-cart operation and other functions needed to provide the Services.

• Preferences: remembering choices such as language or region.

• Analytics: understanding how visitors interact with the store and identifying improvements.

• Marketing and personalisation: measuring advertising and providing relevant content or advertisements.

Where consent is required, we ask for permission before using non-essential technologies and the associated processing. You can accept or reject optional uses through the consent controls presented to you and adjust individual categories where those options are provided. You can withdraw or change consent through the store’s available cookie preferences controls. If you cannot find or use those controls, contact us for assistance. You do not have to consent to optional advertising or analytics to make a purchase.

Cookies may last for a browser session or remain for a longer period, depending on their purpose and provider. Shopify explains its cookies and their duration in its Cookie Policy. Other providers’ technologies, when used, may have different durations. You can contact us for information about technologies used on our store.

You can also manage cookies in your browser. Blocking necessary cookies may affect checkout and other store functions. Browser settings alone may not control all forms of server-side data processing; use our privacy controls or contact us to exercise the rights described below.

4. Marketing Communications

We use contact information and relevant preferences to send marketing about our products where permitted by law and with consent where required. You can stop promotional emails by using their unsubscribe link or emailing support@lumoryn.com.

After you unsubscribe, we may retain a limited suppression record to avoid contacting you again. We may still send necessary messages about orders, delivery, returns, account security or enquiries.

5. Order Handling and Who Receives Information

Our team prepares and dispatches orders from China and handles returned products there. We use relevant order information in Shopify to prepare parcels, coordinate delivery and match returns to purchases. Where messaging services are used to coordinate a shipment or return, relevant delivery information may also be processed through those services.

We disclose information as needed for the purposes in this policy to:

• Shopify: to host and operate the store and provide the services described in Section 6.

• Payment and security providers: to process transactions, confirm payment and manage fraud or payment disputes.

• Carriers and delivery providers: to transport and deliver parcels and handle returns. We provide the shipping address and, where needed, a telephone number and other delivery details necessary for the shipment. The providers involved depend on the destination and delivery service.

• Technical and administrative providers: to support store administration, communications, shipment coordination, customer service, translation, analytics and other operational functions, to the extent those services require personal information.

• Advertising and personalisation providers: for the advertising-related purposes described here, subject to applicable consent and opt-out requirements.

• Professional advisers, authorities and transaction parties: where necessary for advice, compliance, legal claims or a proposed or completed business reorganisation or transfer, subject to applicable protections.

• Parties you authorise: when you ask or permit us to disclose information.

Service providers processing information on our behalf receive it for their assigned services. Some recipients, such as payment providers and Shopify for certain services, determine their own purposes and have their own privacy responsibilities.

6. Shopify and Enhanced Services

Shopify processes personal information when you visit and purchase from our store. We have Shopify Network Intelligence enabled. Shopify uses information from interactions with our store together with information from interactions with other merchants and Shopify to support enhanced services, including personalisation and advertising.

For these enhanced services, Shopify acts as an independent controller or business and handles requests relating to its own processing. Information is shared with Shopify and relevant third parties, including outside your country. For other store services, Shopify processes information on our behalf.

See the Shopify Consumer Privacy Policy for details. The Shopify Privacy Portal explains available rights and how to exercise them, including withdrawing consent or objecting to relevant processing. You may also contact us about our own handling of your information.

7. Advertising Opt-Outs and US Privacy Choices

Advertising-related disclosures of identifiers, device information, browsing activity, transaction information or inferred interests may constitute “sale,” “sharing” or “targeted advertising” under applicable US state laws, even without payment for the information.

You can use our Data Sharing Opt-Out page or email support@lumoryn.com to request an opt-out. For an email request, please describe the choice you wish to exercise so we can apply it to the relevant processing and coordinate with providers as required. Unsubscribing from promotional emails is a separate choice and does not, by itself, opt you out of targeted advertising or advertising-related data sharing. These choices do not prevent necessary processing for your order or store security.

Where required by law, we recognise supported opt-out preference signals, including Global Privacy Control. A signal applies to the browser or device sending it and, where it can be linked as required to an account, to that account. You may need to express choices on other browsers or devices. We do not treat every browser “Do Not Track” setting as an equivalent supported signal.

The rights and procedures that apply depend on your jurisdiction and the applicable law. Section 10 explains how to submit other privacy requests.

8. International Processing

Personal information is processed across the locations involved in operating our store and delivering your purchases. These include China, where our team prepares orders and handles returns; Hong Kong, where our operating company is registered and business administration may take place; and the United States, which our Shopify settings identify as the store’s data-hosting location. Company registration does not mean that all customer information is stored in Hong Kong.

Shopify, payment, communications and delivery providers may also process information in other countries, including your delivery country. Data-hosting location alone does not identify every location from which information may be accessed or processed. Privacy laws may differ between these locations.

Where information is subject to European, UK or Swiss transfer restrictions, the relevant transfer must have a lawful basis and required safeguards. Shopify describes its arrangements in its Data Processing Addendum and Consumer Privacy Policy. Depending on the transfer, these include adequacy decisions, binding corporate rules or approved contractual safeguards, including the EU Standard Contractual Clauses and the UK Addendum where relevant.

Shopify’s arrangements do not automatically cover transfers we arrange separately with other providers. Those transfers require their own applicable protections. For information about the recipients, processing countries and safeguards relevant to your information, or to request a copy of applicable safeguards subject to necessary redactions, contact support@lumoryn.com.

9. How Long We Keep Information

We retain information according to its purpose and applicable obligations, rather than applying one period to all customer data:

• Order, invoice and accounting records: for the applicable statutory period. Where Hong Kong business-record requirements apply, relevant records are retained for at least seven years from the date of the transaction to which they relate. We retain the personal information needed to support those records, not every item of customer correspondence, browsing activity or marketing data. Any longer retention must have a specific legal or other lawful justification, such as an ongoing dispute or investigation.

• Customer account information: while needed to provide your account and requested services. An account-closure or deletion request is assessed separately from records we must retain for orders, legal obligations or claims.

• Support, return and dispute records: while needed to resolve the matter and any related follow-up, and thereafter where necessary for applicable claim periods, chargebacks or legal requirements.

• Marketing information: while we have a lawful basis to use it for that purpose. When you opt out, we stop the relevant marketing and retain only information still needed for another lawful purpose, including a limited record of your objection.

• Consent, opt-out and privacy-request records: for as long as needed to honour your choices, handle the request and demonstrate compliance with applicable requirements.

• Cookie, analytics and security information: according to the technology’s lifetime and the period needed for its stated purpose. Data connected to an identified security incident may be needed longer for investigation or legal claims.

When information is no longer needed, it is deleted or anonymised. Information awaiting removal from backups is subject to the relevant backup cycle and applicable protections. Shopify and other independent controllers determine retention for processing they control under their own policies.

10. Your Rights and How to Make a Request

Depending on applicable law, you may have rights to access your information, correct inaccuracies, request deletion, receive a portable copy, restrict processing, withdraw consent, opt out of covered advertising uses or appeal a decision about a privacy request.

You may also have the right to object to processing based on legitimate interests. You can object to direct marketing, including related profiling, at any time.

Email support@lumoryn.com with a description of your request and enough information for us to locate the relevant records, such as the email used for your order. An order number can help if the request concerns a purchase. You do not need to create an account to make a request.

We may ask for proportionate verification where needed to protect your information. Please do not send identity documents or full payment details unless we specifically request an appropriate verification method. Where allowed, an authorised agent may act for you, subject to evidence of authority and any required identity checks.

We respond within the deadline applicable to your request. For requests governed by the EU or UK GDPR, this is generally within one month, subject to lawful extensions. Other laws may prescribe different periods. If an extension is permitted and needed, we explain the delay as required by law. If we decline all or part of a request, we explain the reason and available review or complaint options.

Deletion may not cover records we must lawfully retain, such as required accounting records. We do not discriminate against you for exercising your privacy rights.

11. Complaints and Appeals

To raise a concern, email support@lumoryn.com with the issue, relevant dates or correspondence, and your preferred contact details. We will review the matter and explain our response. We aim to respond to privacy complaints within 30 days, without limiting any shorter legal deadline or other rights you have. If more time is needed, we will explain why and the next steps.

If you disagree with our response, you can request a further review at the same address. Where the law provides a formal right of appeal, we handle it according to that law.

You may also complain to a competent privacy authority, including the Hong Kong Privacy Commissioner for Personal Data, the UK Information Commissioner’s Office, your relevant EEA data protection authority or the Office of the Australian Information Commissioner. Local procedures and jurisdiction determine how those complaints are handled. Contacting us does not remove any right to approach an authority directly.

12. Security, Children and External Websites

We take reasonable steps to protect personal information against unauthorised access, loss or misuse. No online service can guarantee absolute security. Keep account access details confidential and contact us if you suspect misuse involving our store.

Our Services are not directed to children under 16. We do not knowingly collect their personal information or knowingly sell or share it for targeted advertising. If we learn that we have collected a child’s information contrary to applicable requirements, we will take appropriate steps to stop the relevant processing and delete the information, except where retention is legally required or otherwise permitted. A parent or guardian who believes a child has provided information can contact us to request a review. This policy does not imply that we verify every visitor’s age.

Links to external websites do not make us responsible for their data practices. Review their privacy notices before providing information to them.

13. Updates and Contact Details

We update this policy when our practices or relevant requirements change. The date above identifies the latest version. We provide additional notice or obtain consent when required; an updated policy alone does not replace a requirement for consent.

For enquiries, privacy requests or complaints:

Mavora International Limited, operating as LUMORYN
Company registration: Hong Kong
Email: support@lumoryn.com
Business address: Unit 29, 10/F, Enterprise Centre, 11 On Lai Street, Sha Tin, New Territories, Hong Kong SAR.

This is our business correspondence address, not a product return address. Please contact support@lumoryn.com for return instructions before sending a parcel.