The controller for the processing of personal data on this website is:

© LUCID LOOM
Eric Kroschwald
c/o Autorenglück #21884
Albert-Einstein-Straße 47
02977 Hoyerswerda
Germany

Email: info@lucidloom.shop

We process personal data exclusively within the framework of applicable data protection regulations, in particular the General Data Protection Regulation (GDPR) and – where applicable – regulations on accessing information in end devices.

Personal data refers to all information relating to an identified or identifiable natural person.

This privacy policy informs you about what data we process on our website and in connection with our online shop, for what purposes this is done, on what legal basis the processing takes place, to whom data may be passed on, and what rights you have.

• Inventory data: Name, billing and delivery address, email address, phone number
• Order data: ordered products, order history, payment status, delivery status
• Payment data: Payment information is processed by the respective payment service providers used; we usually do not receive complete credit card or account details ourselves
• Account data: Information about your customer account, login status, and associated account-related information
• Technical data: IP address, browser type, device data, operating system, referrer, access times
• Communication data: Contents of inquiries via email, contact form, or other contact methods
• Review data: Submitted reviews, star ratings, texts, images, videos, name or displayed alias, as well as associated order or verification information
• Vault/Invite data: Email address, invite code, activation status, time of code request and redemption
• Optional Circle Updates: Consent status, consent text, source of consent, IP address, user agent, and time of declaration
• WhatsApp Access Data: The entered phone number in international format, time of request, technical message identifier, and information on the processing of the requested access message
• WhatsApp Marketing Consent Data: Registration status (requested, confirmed, or revoked), consent text and version, source of declaration, times of request, confirmation, and revocation, technical confirmation data, and meta message identifiers
• Marketing and Usage Data: Information about website usage, page views, interactions, conversions, campaign attributions, and similar event data, to the extent that corresponding services have been used and approved

• Provision of the website and ensuring technical stability
• Processing and handling of orders
• Communication related to orders, deliveries, or support inquiries
• Setting up and managing customer accounts
• Checking, sending, and redeeming invite codes for the Lucid Circle Vault
• Sending a shop password via WhatsApp at your explicit request
• Performing and documenting the double opt-in procedure for optional WhatsApp updates
• Managing confirmations and revocations, especially via the "STOP" reply
• Documenting optional consents for Circle Updates
• Displaying and managing product and shop reviews
• Reach measurement, conversion measurement, and marketing, provided that corresponding services have been approved
• Fulfillment of legal obligations, particularly commercial and tax law requirements
• Prevention of abuse, IT security, and optimization of our services

• Art. 6 para. 1 lit. b GDPR – Processing for the performance of pre-contractual measures and for contract fulfillment, particularly for orders, payment processing, customer accounts, vault access, and when sending the shop password at your request
• Art. 6 para. 1 lit. c GDPR – Processing for compliance with legal obligations, particularly commercial and tax law retention obligations
• Art. 6 para. 1 lit. f GDPR – Processing based on our legitimate interest in security, prevention of abuse, technical stability, efficient business organization, error analysis, and the processing of support and review cases
• Art. 6 para. 1 lit. a GDPR – Processing based on your consent, provided you have consented to optional technologies or optional communication, in particular Circle updates or WhatsApp marketing updates

Our online shop is operated via Shopify. In this context, Shopify processes, in particular, technical access data, customer account data, order data, and data necessary for the provision of the checkout, payment processing, security, and shop functionality.

We also use the features of Shopify Customer Privacy or the Shopify Customer Privacy Banner to manage visitors' consent decisions and to consider consent signals for Shopify-related data processing.

Processing is carried out for the provision and secure operation of our online shop and – where necessary – for the management of consents.

On our password page, you can voluntarily provide your phone number to receive the shop password once via WhatsApp. For this purpose, we process the phone number, the time of the request, and technical message identifiers. The message is sent via Meta's WhatsApp Business Platform. The phone number is also processed for security checks and protection against multiple submissions.

The additional checkbox for exclusive drops, early access, restocks, and selected offers is voluntary and not required to receive the shop password. If the checkbox is activated, we initially save the registration with the status "pending" and send a separate confirmation message. Only after pressing the "CONFIRM UPDATES" button will consent be saved as confirmed, and the phone number used for WhatsApp marketing. Without confirmation, no marketing updates will be sent.

The confirmation process is technically valid for seven days. To prove consent, we store, in particular, the phone number, status, the displayed consent text and its version, the source of registration, the times of request, confirmation, and revocation, as well as technical meta message identifiers. The actual confirmation code is only stored in hashed form. We do not store the content of other incoming WhatsApp messages in the consent database; upon unsubscription, only the revocation event is documented.

You can revoke consent at any time with effect for the future, particularly by replying "STOP" in the WhatsApp chat or by email to info@lucidloom.shop. After a revocation, the status is set to "withdrawn" and the phone number is blocked for further WhatsApp marketing messages. The legality of the processing carried out until the revocation remains unaffected.

For technical provision, we use Cloudflare Workers, Cloudflare Turnstile, protection against multiple submissions, and a Cloudflare D1 database. This may involve processing the phone number, technical request data, IP address within the framework of security checks, consent status, and timestamps. Meta or WhatsApp processes the data required for sending, delivery, and interaction according to the terms applicable to the WhatsApp Business Platform.

When you place an order in our shop, we process your data for contract fulfillment, particularly for order acceptance, payment processing, shipping handling, communication about your order, and compliance with legal obligations.

• Payment service providers – e.g., PayPal, Stripe, or Klarna, if selected by you
• Shipping and logistics service providers – e.g., DHL or UPS, if actually used
• Fulfillment service providers – e.g., Printful, if used for production, shipping, or returns processing

Data will only be transferred to the extent necessary.

We use Judge.me for the collection, management, and display of product and shop reviews. This may involve processing, in particular, your name or displayed alias, email address, order reference, review texts, star ratings, and, if applicable, uploaded images or videos.

Processing is carried out to display authentic customer reviews, improve our offerings, and build trust among prospective customers. Where reviews are linked to an actual purchase or are verified, a link to order information may also be established for this purpose.

If review functions or optional technologies use optional technologies on your end device or pursue further analysis or marketing purposes, this will only occur within the framework of the relevant legal provisions or on the basis of your consent, if required.

We use Google services for analysis, reach measurement, and marketing purposes. Depending on the specific integration, this may involve processing usage data, device information, referrer, IP address in truncated or otherwise processed form, page views, interactions, and conversion and campaign data.

Where Google Tags or similar Google services are used, their use for non-technically essential purposes only occurs on the basis of your consent. If a consent management system is used, consent signals are transmitted to Google services accordingly.

Processing is carried out to analyze the use of our website, measure the success of campaigns, optimize our offering, and measure conversions.

We use services from Meta and Instagram for marketing, remarketing, and reach measurement purposes. Depending on the specific integration, information about page views, interactions, conversions, technical device data, and similar event data may be transmitted to Meta.

If Meta Pixel or similar Meta Business Tools are used, this is done for non-technically necessary purposes only on the basis of your consent.

Processing is carried out to measure the effectiveness of our advertising, to build target audiences, and to optimize campaigns on Meta and Instagram services.

We use services from TikTok for marketing, analytics, and conversion purposes. Depending on the specific integration, this may involve processing usage data, device information, interaction data, and conversion events.

If TikTok Pixel or similar TikTok Business Tools are used, this is done for non-technically necessary purposes only on the basis of your consent.

Processing is carried out to analyze the use of our website, measure the effectiveness of advertising campaigns, and optimize our targeting on TikTok.

Our website uses technically necessary cookies and similar technologies, insofar as this is required for the operation of the website, the shopping cart, the checkout, the customer account, security, or other explicitly requested functions.

In addition, analytics, convenience, review, or marketing technologies may be used. Such technologies, which are not technically necessary, will only be used if you have given us your consent, to the extent that consent is required.

To manage your consent decisions, we use functions from Shopify Customer Privacy. Your consent decision can be saved so that your selection is taken into account on subsequent page views.

You can change or withdraw your consent at any time with effect for the future via the consent or cookie settings we provide.

You can also use your browser settings to restrict or delete cookies. However, this may result in individual functions of the website not being usable or only partially usable.

For access to selected areas of our Lucid Circle Vault, we process additional data, in particular the email address of the logged-in customer account, the generated invite code, the status of the code, and the time of dispatch and redemption.

If the optional declaration for Circle updates is provided, we additionally store the content of the consent, the source of the declaration, the IP address, the browser or user agent used, and the time of consent, in order to document this declaration and, if necessary, prove it.

The processing is carried out to provide protected access, to prevent misuse, for technical documentation of the activation process, and – in the case of the optional declaration – to carry out the email communication you requested.

We only transfer personal data if it is necessary to fulfill the stated purposes, if you have consented, or if there is a legal obligation.

• Shopify – operation of the online shop, checkout, customer account, consent management
• Payment service providers – e.g., PayPal, Stripe, Klarna
• Shipping and fulfillment service providers – e.g., DHL, UPS, Printful
• Google – analytics, reach, and marketing services
• Meta / Instagram / WhatsApp – sending and processing of WhatsApp messages, confirmations and revocations, as well as marketing, remarketing, and reach measurement services
• TikTok – marketing, analytics, and conversion services
• Judge.me – rating and review functions
• Cloudflare – technical infrastructure for Workers, Turnstile, D1 database, protection against multiple submissions, and invite/vault functions
• IT and support service providers – as far as necessary for maintenance, error analysis, or technical support

When using individual service providers, personal data may be transferred to countries outside the European Union or the European Economic Area, especially if providers or their subcontractors are located there or operate servers there.

To the extent that such a transfer occurs, we ensure that an adequate level of data protection is guaranteed. This can be achieved in particular by an adequacy decision or by appropriate safeguards such as standard contractual clauses, where applicable.

We store personal data only for as long as necessary for the respective purposes or as long as statutory retention obligations exist.

• We store order and invoice data within the framework of statutory commercial and tax law obligations
• We generally store customer account data until the customer account is deleted, unless longer legal retention is required
• We store communication data for as long as necessary to process the respective request and for legal defense
• We generally store review data for as long as the respective review is actively displayed or required for proof or audit reasons
• We store invite code data for the duration of access processing and only beyond that if necessary for documentation, misuse prevention, or legal defense
• We store WhatsApp access data only for as long as necessary for sending, error analysis, misuse prevention, and proof of the requested message
• Unconfirmed WhatsApp marketing registrations are not used for marketing; the technical confirmation is valid for seven days. We store the associated data only for as long as necessary for processing, misuse prevention, and documentation
• We store confirmed or revoked WhatsApp consent data until revocation and only beyond that if necessary to prove the previously given consent, to comply with the revocation, or for legal defense
• We store consent data until a revocation and only beyond that if necessary to prove the previously given consent
• We store cookie/consent information in accordance with the selected settings, technical necessity, and the respective applicable retention periods

To the extent that certain personal data is required for the conclusion or execution of a contract, the provision of this data is contractually necessary. This applies in particular to name, billing and delivery address, email address, and payment and order-related information.

Without this data, an order cannot be completed or processed. The provision of other data is generally voluntary.

Automated decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place, unless explicitly stated otherwise in this privacy policy.

Within the framework of legal provisions, you have the following rights in particular:

• Right to information about the data stored about you
• Right to rectification of incorrect or incomplete data
• Right to erasure of your data, unless legal retention obligations prevent this
• Right to restriction of processing
• Right to data portability
• Right to object to processing based on legitimate interests
• Right to withdraw granted consents with effect for the future

To exercise your rights, you can contact us at info@lucidloom.shop.

You can also withdraw consent to WhatsApp updates at any time directly in the WhatsApp chat by replying "STOP". The withdrawal applies for the future; the lawfulness of the processing carried out until then remains unaffected.

Furthermore, you have the right to lodge a complaint with a data protection supervisory authority.

We take technical and organizational security measures to protect your data from loss, manipulation, unauthorized access, or other unauthorized processing.

Our security measures are continuously adapted in line with technological developments.

We reserve the right to adapt this privacy policy if this becomes necessary due to legal, technical, or organizational changes.

Status: 07/2026