Privacy policy

Last updated: 20 August 2026

Who we are

Lumenza is a trading name of Nexa Global Ventures Ltd, a company registered in England and Wales under company number 17398049, whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

We sell decorative lighting online at lumenza.co.uk to customers in the United Kingdom. In this policy, "we", "us" and "our" mean Nexa Global Ventures Ltd trading as Lumenza.

We are the controller of the personal data described here. That means we decide why your personal data is used and how, and we are responsible for it under the UK GDPR and the Data Protection Act 2018.

This policy explains what we collect when you visit our website, place an order or contact us; why we use it and on what lawful basis; who we share it with; how long we keep it; and what rights you have. Our website may link to other websites, and this policy does not cover those.

Nothing in this policy takes away or limits your rights under the UK GDPR, the Data Protection Act 2018 or the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR"). Where the law gives you more than this policy does, the law applies.

Who to contact about your personal data

Email support@lumenza.co.uk, call us on +44 7732 725821, or write to us at the registered office address above.

The personal data we collect

We collect only what we need in order to sell to you and run the shop. We do not ask you for special category data, such as information about your health, your beliefs or your ethnic origin.

Identification and contact details

  • your name;
  • your email address;
  • your telephone number, where you give it to us;
  • your billing address.

Delivery details

  • the delivery address for your order;
  • the name of the person receiving the order, if that is not you;
  • any delivery instructions you give us.

Where you ask us to deliver to someone else, we use that person's name, address and delivery instructions only to deliver the order. They are passed to the carriers and they appear on the customs paperwork, as described in this policy. Please show this policy to that person, so that they know how their details are used.

Order history

  • what you bought, the order number, the amount paid in pounds and the date of the order;
  • what we know about the progress and delivery of your order;
  • any cancellation, return, refund or fault you report, and what we did about it;
  • messages between you and us about your order or your enquiry.

Payment information

Payments are taken at the checkout by Shopify Payments, which is the only way to pay for an order with us. Shopify Payments collects and processes your card details. Your full card number is never held on our own systems. We receive confirmation that a payment has been made or declined, and limited details of the payment method used.

Technical information about your visit

  • your IP address;
  • the type of device and browser you use, and your language and country settings;
  • identifiers set by cookies and similar technologies.

Your choices

  • the cookie choices you make, and when you made them;
  • whether you have signed up for marketing emails, and when.

Why we use your personal data, and our lawful basis

The UK GDPR requires us to have a lawful basis for each purpose. Ours are set out below.

Taking, fulfilling and delivering your order

We use your name, contact details, delivery address, order details and payment confirmation to accept your order, take payment, prepare and dispatch it, keep you informed, and deal with returns, cancellations, refunds and faulty goods.

Orders are dispatched from outside the United Kingdom. Your delivery details therefore go to the carriers that carry your parcel, and the recipient's name and delivery address appear on the customs paperwork that travels with it. We pay any customs duty and import charges ourselves, so there is nothing for you to pay on delivery.

Lawful basis: performance of our contract with you (Article 6(1)(b) UK GDPR). Without this data we cannot sell to you.

Answering your questions

We use your contact details and whatever you tell us to reply to your enquiry and to keep a record of what was said.

Lawful basis: performance of our contract with you where your message is about an order; our legitimate interests in replying to the people who contact us where it is not (Article 6(1)(f)).

Running and protecting our website

When you visit lumenza.co.uk, technical information such as your IP address and the type of device and browser you use is processed so that the pages you ask for can be sent to you, so that your basket and the checkout work, and so that the website can be protected against misuse.

Lawful basis: our legitimate interests in providing and protecting our own website (Article 6(1)(f)).

Marketing emails

Our website has a newsletter sign-up. If you sign up, we use your email address to send you marketing emails about our products. We only send marketing emails to people who have asked us for them. You can stop them at any time, either through the unsubscribe link in any marketing email we send you or by emailing us, and stopping them does not affect your order or your other rights.

Lawful basis: your consent (Article 6(1)(a) UK GDPR, and regulation 22 of PECR).

Cookies that are not strictly necessary

See the cookie section below for what these do.

Lawful basis: your consent (Article 6(1)(a) UK GDPR, and regulation 6 of PECR). For cookies that are strictly necessary to provide the website and checkout you have asked for, we rely on our legitimate interests (Article 6(1)(f)), and no consent is required for them.

Keeping business records and dealing with claims

We keep records of orders, payments and refunds for our accounts, and we use them to deal with complaints, disputes and legal claims.

Lawful basis: compliance with our legal obligations (Article 6(1)(c)) for the records we are required to keep, and our legitimate interests in establishing, exercising or defending legal claims (Article 6(1)(f)).

Cookies and similar technologies

Cookies are small files placed on your device when you visit a website. Some are needed for the site to work, and some are not.

Strictly necessary cookies keep the website working. They remember what is in your basket, carry you through the checkout, keep that checkout secure and remember the cookie choice you have made. The law allows us to set these without asking you first, because the shop cannot work without them.

Cookies that are not strictly necessary, including any used to measure how the site is used or to advertise, need your consent under PECR. We use the Avada Cookie Consent app to ask for that consent and to record the choice you make.

You can withdraw your consent at any time, and it must be as easy to withdraw it as it was to give it.

  • Marketing emails: use the unsubscribe link in any marketing email we send you, or email support@lumenza.co.uk. We act on it as soon as we receive it.
  • Cookies that are not strictly necessary: email support@lumenza.co.uk and tell us you are withdrawing your cookie consent. You can also block or delete cookies through your browser settings at any time, which is what removes from your device cookies that are already stored on it.

Withdrawing your consent does not affect anything we did lawfully before you withdrew it, and it never affects your order or any other right you have.

If you would like to know which cookies our website uses, what each one does and how long it lasts, email us and we will tell you.

Who we share your personal data with

We do not sell your personal data. We share it only with the organisations below, and only with what each of them needs.

  • Shopify. Our website, our checkout and our order and customer records run on Shopify's platform, so the personal data described in this policy is held there.
  • Shopify Payments. Takes your payment and handles your card details. It is the only payment provider we use.
  • The carriers that deliver your order. Your order is dispatched from outside the United Kingdom, and which carrier handles it depends on the product, its weight, the destination and the route. The carriers we use are YunExpress, CNE Express, 4PX Express, Yanwen, UBI Smart Parcel, DHL and FedEx, together with postal operators and local delivery partners in the United Kingdom. On some parcels one company carries the international leg and another makes the final delivery, so more than one of them may hold your delivery details for the same order. Each of them receives the recipient's name, the delivery address and any delivery instructions, and, where the carrier needs it in order to deliver or to arrange delivery, a telephone number or email address.
  • Customs and tax authorities. Because your parcel crosses a border, the recipient's name and the delivery address appear on the customs paperwork for the shipment. Any customs duty and import charges are paid by us, not by you.
  • Avada Cookie Consent. Shows our cookie banner and stores a record of the choice you made.
  • The service that sends our newsletter. If you have signed up for marketing emails, your email address is held by the service we use to send them, so that those emails can be sent to you.
  • Professional advisers and public authorities. Where we use accountants or solicitors, they see what they need in order to advise us. We will also disclose personal data where the law requires it, or in order to establish, exercise or defend legal claims.

If the business is sold or transferred, customer records may transfer with it. We would tell you if that changed anything in this policy.

Sending your personal data outside the United Kingdom

Your order is dispatched from outside the United Kingdom, so getting your parcel to you involves sending some of your personal data outside the United Kingdom. We tell you this plainly rather than leave it to be inferred from the rest of this policy.

What is transferred. The name of the person receiving the order, the delivery address, any delivery instructions and, where a carrier needs it in order to deliver or to arrange delivery, a telephone number or an email address. The recipient's name and the delivery address also appear on the customs paperwork that travels with the parcel.

Who receives it. The carriers that carry your order and the postal operators and local delivery partners involved in it, and the customs and tax authorities of the countries your parcel leaves, passes through or enters. Which of them receives your data depends on the product, its weight, the delivery address and the route, and on some orders one company carries the international leg while another makes the final delivery.

Why. So that your order can be dispatched, cleared through customs and delivered to you. This is necessary for the performance of our contract with you (Article 6(1)(b) UK GDPR). Without it we cannot deliver to you.

Our website, our checkout and our order and customer records are held on Shopify's platform, and payments are handled by Shopify Payments, so your personal data may also be processed outside the United Kingdom by those services.

The safeguards. A transfer of personal data out of the United Kingdom has to be covered either by UK adequacy regulations or by an appropriate safeguard under Article 46 of the UK GDPR. If you would like to know which of these applies to a transfer of your personal data, and to ask for a copy of the relevant safeguard where one is in place, email support@lumenza.co.uk and we will tell you.

How long we keep your personal data

  • Order, payment and refund records: for as long as the law requires us to keep them. HMRC requires the records behind a company tax return to be kept for six years from the end of the accounting period they relate to.
  • Customer records held on our platform: for as long as we may still need them to deal with you as a customer, after which we delete them or anonymise them.
  • Enquiries and correspondence: while we deal with your enquiry, and for a period afterwards in case you come back to us or a complaint or claim follows.
  • Marketing consent: until you withdraw it. If you unsubscribe, we keep a minimal record of that so that we do not email you again.
  • Cookies and cookie consent records: for the period set for each cookie, and for as long as our cookie banner keeps the record of your choice.

When we no longer need personal data, we delete it or anonymise it so that you can no longer be identified from it. You can ask us at any time how long we expect to keep something about you, and we will tell you.

Keeping your personal data secure

Our website, our checkout and our customer records are hosted on Shopify's platform, and payments are handled by Shopify Payments rather than by us, so your full card number never reaches our own systems.

No online service can be completely secure. If personal data is lost or exposed and that is likely to put your rights at risk, we will report it to the Information Commissioner's Office and, where the law requires, tell you.

Your rights under the UK GDPR

You have the following rights over your personal data. They apply whether or not you have bought anything from us, and nothing in this policy limits them.

  • Access. Ask us whether we hold personal data about you and, if we do, get a copy of it along with this information.
  • Rectification. Have inaccurate personal data corrected, and incomplete data completed.
  • Erasure. Ask us to delete personal data where we no longer need it, where you withdraw consent that we relied on, or where you object and we have no overriding reason to continue. This right is not absolute: we may have to keep some records, such as the order records the law requires us to keep. If we cannot delete something, we will tell you why.
  • Restriction. Ask us to pause our use of your data, for example while we check whether it is accurate or whether our reason for using it overrides your objection.
  • Portability. Receive the personal data you gave us in a structured, commonly used and machine-readable format, or have it sent to another organisation, where we use it on the basis of your consent or of our contract with you and by automated means.
  • Object. Object to any use we base on our legitimate interests, on grounds relating to your situation. If you object to direct marketing, we must stop: that right has no exceptions and you do not have to give a reason.
  • Withdraw consent. Withdraw your consent at any time where we relied on it, such as for marketing emails or cookies that are not strictly necessary. That does not affect anything we did lawfully before you withdrew it.
  • Complain. Complain to the Information Commissioner's Office, as set out below.

How to use your rights

Email support@lumenza.co.uk or write to us at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Tell us which right you want to use and, if it helps, what your request is about.

We may ask you for information that confirms who you are, so that we do not give your personal data to somebody else.

Using your rights is free. We will answer within one month of receiving your request. If your request is complex, or if you make several, we may need up to two further months, and we will tell you within the first month if that happens and why. The law allows us to charge a reasonable fee, or to refuse, where a request is manifestly unfounded or excessive; if we ever do that, we will explain why and tell you how to challenge it.

Complaining to the ICO

If you are unhappy with how we have handled your personal data, please tell us first, so that we have the chance to put it right. You can also complain to the Information Commissioner's Office, the UK's data protection regulator, at any time. You do not have to come to us first, and complaining to us does not affect your right to complain to them.

  • Website: ico.org.uk
  • Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom

Changes to this policy

We may update this policy, for example when we start using a new supplier or a new tool on the website. The date at the top shows when it was last changed. Where a change materially affects how we use your personal data, we will bring it to your attention.

How to contact us

Nexa Global Ventures Ltd, trading as Lumenza.

  • Email: support@lumenza.co.uk
  • Telephone: +44 7732 725821
  • Post: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

We reply to enquiries within 24 hours, Monday to Friday. Our opening hours are set out on our contact page.

Requests to use your data protection rights are answered within the periods set out above.

If you want to know where your order has got to, email us and we will tell you what we know. If you think a decision we have made about your order is wrong, email us and a person will look at it again.