Privacy Policy

Last updated: 22 August 2026

Lumsy Limited | Registered in England and Wales | Company No. 16594068
91 Walm Lane, London, NW2 4QG, United Kingdom | info@lumsyorganic.co.uk

This Privacy Policy explains how Lumsy Limited ("Lumsy", "we", "us" or "our") collects, uses, shares and protects personal information when you visit www.lumsyorganic.co.uk, contact us, join our mailing list or purchase our products.

1. Who we are

Lumsy Limited is the controller responsible for your personal information. We are registered in England and Wales under company number 16594068.

Contact us about privacy at info@lumsyorganic.co.uk or write to: 91 Walm Lane, London, NW2 4QG, United Kingdom.

2. Personal information we collect

• Identity and contact information, such as your name, billing and delivery address, email address and telephone number.

• Order and transaction information, including products purchased, order value, delivery details, refunds and correspondence.

• Payment-related information. Payments are processed by our payment service providers; we do not receive or store your complete payment-card details.

• Account and preference information, if account functionality is available, including login details, saved preferences and marketing choices.

• Technical and usage information, such as IP address, browser type, device identifiers, pages viewed, referral source and cookie choices.

• Communications, including messages, enquiries, feedback, complaints and survey responses.

• Marketing information, including whether you have consented to receive marketing and how you interact with our messages.

Please do not provide information about a child unless it is genuinely necessary to deal with a specific enquiry. Our website and online shop are intended for adults purchasing products for children, not for children to use directly.

3. How we collect information

• Directly from you when you place an order, join the mailing list, complete a form or contact us.

• Automatically through cookies and similar technologies when you use the website.

• From service providers involved in website hosting, payments, delivery, analytics, customer support and marketing.

4. How and why we use personal information

Purpose

Lawful basis

Process, deliver and manage orders; take payment; provide order updates; handle returns and refunds.

Performance of a contract.

Answer enquiries and provide customer service.

Contractual steps or our legitimate interest in supporting customers.

Comply with tax, accounting, food-safety, product-recall and other legal obligations.

Legal obligation.

Prevent fraud, secure the website, protect our business and establish or defend legal claims.

Legitimate interests and, where applicable, legal obligation.

Send marketing emails where you have opted in, or where another lawful PECR route applies.

Consent or, where legally permitted, legitimate interests.

Measure and improve the website using non-essential analytics technologies.

Consent for the relevant cookies or similar technologies.

5. Marketing

We will send electronic marketing only where permitted by law. You can unsubscribe at any time by using the unsubscribe link in an email or contacting us. Withdrawing consent does not affect processing carried out before withdrawal. We may retain limited suppression information so that we respect your opt-out.

6. Cookies and similar technologies

We use essential technologies to operate the website and may use optional analytics, preference or advertising technologies with your consent. Please see our Cookie Policy and cookie settings for further details. You can change or withdraw your choices at any time through the cookie settings link.

7. Who we share information with

• Website, ecommerce and cloud-hosting providers.

• Payment processors and fraud-prevention providers.

• Delivery, fulfilment and logistics providers.

• Email, marketing, analytics and customer-support providers, where permitted.

• Professional advisers, insurers, auditors, regulators, courts, law-enforcement bodies or public authorities where necessary.

• A buyer, investor or successor if our business or assets are reorganised, sold or transferred, subject to appropriate safeguards.

We require service providers to use personal information only for authorised purposes and to protect it appropriately.

8. International transfers

Some service providers may process information outside the United Kingdom. Where required, we use an approved transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, together with appropriate safeguards.

9. How long we keep information

• Order, payment and tax records: generally six years after the end of the relevant financial year, unless a longer period is required.

• Customer-service enquiries and complaints: generally up to two years after closure, or longer if needed for a legal claim, safety investigation or recall.

• Marketing records: until you unsubscribe or we determine the information is no longer needed; limited suppression records may be kept to respect your choice.

• Cookie and analytics information: for the periods described in the cookie settings tool or Cookie Policy.

We may keep information longer where necessary to comply with law, manage a food-safety issue or recall, prevent fraud, or establish, exercise or defend legal claims.

10. Your rights

Depending on the circumstances, you may have rights to access, correct, erase or restrict your information; object to certain processing; receive certain information in a portable format; and withdraw consent. These rights are not absolute and legal exceptions may apply.

Your right to object: You may object at any time to our use of your personal information for direct marketing. You may also object to processing based on legitimate interests, although we may continue where we have compelling lawful grounds.

To exercise a right, contact info@lumsyorganic.co.uk. We may need to verify your identity. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk, although we would welcome the opportunity to address your concern first.

11. Security

We use appropriate organisational and technical measures designed to protect personal information. No internet transmission or storage system is completely secure, and you should protect your account credentials and devices.

12. Changes to this policy

We may update this policy to reflect changes to our practices, services or legal obligations. The latest version will be published on the website with a revised update date. If a change materially affects how we use personal information, we will take reasonable steps to bring it to your attention.

Lumsy Limited  |  Company No. 16594068  |