Datenschutzerklärung

Last updated: 2 November 2026

Who we are

This policy explains how Lykyn, operating through its Shopify EU store, collects and uses personal data when you visit lykyn.eu, place an order, or contact us. The data controller is Lykyn, operating through its Shopify EU store, [TO CONFIRM: registered legal entity name and address]. You can contact us at info@lykyn.com.

What data we collect

Order details. Your name, email address, delivery and billing address, the phone number you give for delivery, the items you ordered, and the order total.
Payment details. We do not see or store your full card number. Payments are handled by Shopify Payments and the payment method you choose. We receive confirmation that your payment succeeded, and a payment reference.
Account details. If you create a customer account, your email address and a password, stored in encrypted form.
Marketing preferences. Whether you have subscribed to our emails, and whether you have opened or clicked them.
Technical data. Your IP address, browser type, device type, language, and the pages you visit on our store.
Support messages. What you write to us, and any photos or videos you send about a product.
Grow Box and app data. [TO CONFIRM: describe what the Grow Box and the Lykyn app send to Lykyn, if anything, before publishing.]

Why we use your data, and our legal basis

The GDPR and the UK GDPR require a legal basis for each use of personal data. We use these bases:

To process, deliver and support your order, including returns and warranty claims. Contract (Article 6(1)(b) GDPR and UK GDPR).
To keep tax and accounting records. Legal obligation (Article 6(1)(c)).
To send marketing emails. Consent (Article 6(1)(a)). You can withdraw consent at any time, and withdrawing does not affect your order.
To set analytics and marketing cookies. Consent, given through our cookie banner.
To prevent fraud, keep the store secure, and fix technical faults. Legitimate interests (Article 6(1)(f)).
To answer your enquiries before you buy. Legitimate interests, or steps at your request before a contract (Article 6(1)(b)).

Who we share your data with

Shopify hosts the store, runs checkout, and processes payments through Shopify Payments.
Klaviyo sends our marketing emails.
Payment providers, when you pay with a method such as Klarna, iDEAL or Bancontact. The provider processes your payment under its own privacy policy.
Carriers, such as DPD, DHL, UPS or a local courier. They need your name, delivery address and phone number to deliver your parcel.
Customs and import agents, for orders that are delivered duty paid outside the EU. We share the details needed to clear the parcel through customs.
Tax authorities, when the law requires it.
Accountants and lawyers, who are bound by confidentiality.

We do not sell your personal data.

International transfers

Some of our providers, including Shopify and Klaviyo, process data outside the European Economic Area and the UK. Where we transfer data to a country without an adequacy decision, we rely on the EU-US Data Privacy Framework and the UK Extension where the provider is certified under it. Otherwise we rely on the European Commission's Standard Contractual Clauses. You can ask us for details of the safeguard that applies to your data.

Cookies

We use cookies the store needs to work, such as those that keep your basket and checkout secure. These do not need your consent. We set analytics and marketing cookies only if you accept them in our cookie banner. You can change your choice at any time using Cookie settings in the footer.

How long we keep your data

Order records: up to 10 years after the order. Tax and accounting rules in some of the countries we sell to require records to be kept this long.
Customer accounts: until you delete your account, unless we need the data for an open order or a legal claim.
Marketing emails: until you unsubscribe. We keep a record of your unsubscribe so that we do not email you again.
Analytics data: up to 2 years.
Support correspondence: for as long as needed to resolve your enquiry and to deal with any legal claim, then deleted.

Your rights

Under the GDPR and the UK GDPR, you have the right to:

Access the personal data we hold about you, and receive a copy
Correct data that is inaccurate or incomplete
Erase your data, in the cases the law allows
Restrict how we use your data, in the cases the law allows
Receive your data in a commonly used, machine-readable format, and ask us to send it to another provider
Object to processing based on our legitimate interests, and to direct marketing at any time
Withdraw consent at any time for processing based on consent. Withdrawing does not affect processing that happened before you withdrew.

To use any of these rights, email info@lykyn.com. We reply within one month, as the law requires. If we need longer for a complex request, we tell you why.

You can complain to a data protection authority. In the EU, that is the authority in the country where you live or work, or where the alleged breach happened. In the UK, it is the Information Commissioner's Office (ICO). We would welcome the chance to put things right first, but you do not have to contact us before complaining.

Children

Our store is not aimed at children under 16, and we do not knowingly collect data from them. If you think a child has given us personal data, email us and we will delete it.

Changes to this policy

We update this policy when our data practices change. The date at the top shows when it last changed. If a change is significant, we will tell you by email before it takes effect.

Contact

For any question about your personal data, email info@lykyn.com.