Privacy policy

Privacy Policy (UK)

Last updated: 24.07.2026

This Privacy Policy explains how we collect, use, process, store and protect your personal data when you visit or interact with this website.

We process personal data in accordance with:

  • the UK General Data Protection Regulation (UK GDPR),

  • the Data Protection Act 2018, and

  • the Privacy and Electronic Communications Regulations 2003 (PECR).

 

1. Overview of Data Protection

1.1 General Information

Personal data means any information relating to an identified or identifiable natural person.

This Privacy Policy provides a clear overview of:

  • what personal data we collect,

  • how and why we process it,

  • the legal bases relied upon, and

  • your rights as a data subject.

 

1.2 Data Collection on This Website

Who is responsible for data processing?

The controller responsible for data processing on this website is identified in Section 3 below.

 

How do we collect your data?

We collect your personal data in the following ways:

  • Data provided directly by you, for example:

    • via contact forms,

    • newsletter registrations,

    • purchase and checkout processes,

    • communications by email or telephone.

  • Data collected automatically, including:

    • IP address,

    • browser type and version,

    • operating system,

    • referrer URL,

    • date and time of access,

    • pages viewed and interactions.

Automatic data collection occurs when you visit the website or where you have consented to cookies and similar technologies.

 

Why do we process your data?

We process personal data for the following purposes:

  • ensuring secure and error‑free website operation;

  • analysing website usage and user behaviour;

  • responding to enquiries and customer requests;

  • initiating and fulfilling contracts;

  • processing payments and deliveries;

  • sending marketing communications where permitted;

  • complying with legal and regulatory obligations.

 

1.3 Your Rights

Under UK GDPR, you have the right to:

  • request access to your personal data;

  • request rectification of inaccurate data;

  • request erasure of your data;

  • request restriction of processing;

  • object to processing, including profiling;

  • withdraw consent at any time;

  • request data portability;

  • lodge a complaint with the Information Commissioner’s Office (ICO).

You may exercise these rights at any time by contacting us.

 

2. Hosting

2.1 Shopify

This website is hosted by:

Shopify International Limited
Victoria Buildings
1–2 Haddington Road
Dublin 4, D04 XN32
Ireland

Shopify provides the technical infrastructure and e‑commerce platform.

When you access our website, Shopify may collect:

  • IP address,

  • device and browser information,

  • usage data,

  • transaction data when purchases are made.

Shopify uses cookies and similar technologies for functionality, analytics, and fraud prevention.

Legal basis:

  • Legitimate interests (Article 6(1)(f) UK GDPR)

  • Consent where required under PECR (Article 6(1)(a) UK GDPR)

A Data Processing Agreement (DPA) is in place with Shopify.

Shopify privacy policy:
https://www.shopify.com/legal/privacy

 

3. Data Controller

The controller responsible for processing your personal data is:

Luceo Lighting Ltd (trading as Zweibruder UK)
C/O Saffery, St John's Court, Easton Street
High Wycombe HP11 1JX
United Kingdom

📞 +44 7917 321300
📧 store@zweibruder.co.uk

Customer service: https://zweibruder.co.uk/

 

4. Storage Duration

Unless a specific retention period is stated, personal data is stored only for as long as necessary to fulfil the purpose for which it was collected.

Data will be deleted where:

  • the purpose no longer applies,

  • consent is withdrawn, or

  • deletion is requested,

unless statutory retention obligations (e.g. tax or commercial law) require continued storage.

 

5. Legal Bases for Processing

We process personal data on the following legal bases:

  • Consent – Article 6(1)(a) UK GDPR

  • Contractual necessity – Article 6(1)(b) UK GDPR

  • Legal obligation – Article 6(1)(c) UK GDPR

  • Legitimate interests – Article 6(1)(f) UK GDPR

Where cookies or tracking technologies are used, PECR requirements are observed.

 

6. Recipients of Personal Data

We may share personal data with:

  • IT and hosting providers,

  • analytics and marketing service providers,

  • payment and logistics providers,

  • professional advisers and authorities where legally required.

All recipients are bound by appropriate contractual and data protection obligations.

 

7. Withdrawal of Consent

Where processing is based on consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing prior to withdrawal.

 

8. Right to Object

Where data is processed on the basis of legitimate interests, you may object at any time.

Where personal data is processed for direct marketing, you have an absolute right to object, including profiling related to such marketing.

 

9. Complaints

You may lodge a complaint with:

Information Commissioner’s Office (ICO)
https://www.ico.org.uk

This is without prejudice to any other legal remedies.

 

10. Cookies

This website uses cookies and similar technologies.

Cookies may be:

  • session cookies,

  • persistent cookies,

  • first‑party or third‑party cookies.

Necessary cookies are used on the basis of legitimate interests.
All other cookies are used only with your consent under PECR.

You can manage cookie preferences through your browser or our cookie banner.

 

11. Server Log Files

Server log files automatically collect:

  • browser type and version,

  • operating system,

  • referrer URL,

  • hostname,

  • date and time of request,

  • IP address.

This data is not merged with other data sources.

Legal basis: legitimate interests (Article 6(1)(f) UK GDPR).

 

12. Contact Forms and Communications

When you contact us via forms, email or telephone, we process the data provided to respond to your enquiry.

Legal basis:

  • contractual necessity or pre‑contractual steps; or

  • legitimate interests.

Data is deleted once the enquiry is concluded, subject to legal retention obligations.

 

13. Comments Function

When posting comments, we store:

  • comment content,

  • timestamp,

  • email address,

  • IP address.

IP addresses are stored to protect against unlawful content.

Legal basis: consent (Article 6(1)(a) UK GDPR).

 

14. Analytics and Advertising Tools

With your consent, we use:

  • Google Tag Manager

  • Google Analytics (with IP anonymisation)

  • Google Signals

  • Google Ads, Conversion Tracking & Remarketing

  • Meta Pixel, Meta Conversion API & Custom Audiences

  • Klaviyo (email, SMS and marketing automation)

These tools may involve international data transfers safeguarded by:

  • Standard Contractual Clauses, and/or

  • UK‑recognised Data Privacy Framework mechanisms.

 

15. Newsletter

Newsletter subscriptions require explicit consent.

You may unsubscribe at any time via the link in each email.

We may also send marketing emails to existing customers in line with PECR, with an opt‑out in every message.

 

16. eCommerce and Payments

We process customer and contract data for order fulfilment.

Payment data is processed securely via third‑party providers such as Shopify Payments, using SSL/TLS encryption.

 

17. Security

We use appropriate technical and organisational measures to protect personal data, including encryption.

 

18. Changes to This Policy

This Privacy Policy may be updated periodically. The current version is published on this website.