Datenschutzrichtlinie

01

Overview & Data Controller

This Privacy Policy explains how Luxfi collects, uses, discloses, and protects your personal data when you visit luxfi.de, place an order, or otherwise contact us. Luxfi sells everyday home, kitchen, and garden products to customers in Germany, Austria, and Switzerland.

Please read carefully

By using our website and services, you acknowledge that you have read this Privacy Policy and understand how your personal data is collected, used, and disclosed. We apply the EU General Data Protection Regulation (GDPR) to customers in Germany and Austria, and the Swiss Federal Act on Data Protection (FADP) to customers in Switzerland, as explained in sections 07 and 08 below.

Data controller

Ecomvest LLC (trading as Luxfi)

30 N Gould St, STE R
Sheridan, WY 82801
United States of America

Registration No: 32-0819180 · Tel: +1 740 272-5703 · info@luxfi.de

02

Information We Collect

We collect only the personal data necessary to operate our store and serve you as a customer. The table below sets out the categories of data we collect and where it comes from.

Category Data collected Source

Identity & contact Full name, email address, phone number (if provided) Provided by you at checkout

Delivery & billing address Street address, city, postal code, country (Germany, Austria, or Switzerland) Provided by you at checkout

Order & transaction data Items ordered, quantities, prices, order number, currency (EUR), transaction reference Generated at checkout

Payment data Payment method and confirmation status (we do not store full card numbers, CVV codes, or expiry dates) Received from our payment processor

Communications Emails, support requests, return enquiries, and any message you send us Provided by you when you contact us

Technical & browsing data IP address, browser type, device type, pages visited, session data, referral source Collected automatically via cookies and site analytics

Marketing preferences Opt-in/opt-out status for email marketing Provided by you at checkout or via unsubscribe

What we do not collect

We do not collect special categories of personal data (sensitive data under the GDPR) such as health data, racial or ethnic origin, religious beliefs, or biometric data. We do not knowingly collect data from children under 16. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

03

How We Use Your Data

We use your personal data only for the purposes described below. We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects on you.

Order fulfilment

✓ Processing and confirming your order

✓ Arranging shipping and providing tracking information

✓ Managing returns, refunds, and exchanges

✓ Meeting customs and import documentation requirements where applicable

Customer support

✓ Responding to your questions, complaints, and support requests

✓ Handling warranty and product-quality queries

✓ Providing after-sales service

Legal & compliance

✓ Meeting tax and accounting obligations

✓ Detecting and preventing fraud and payment abuse

✓ Responding to lawful requests from courts or supervisory authorities

Marketing (with consent)

✓ Sending promotional emails, newsletters, and product updates — only if you have opted in

› You may unsubscribe at any time via the link in any marketing email

✗ We do not send marketing without your prior consent

04

Legal Basis for Processing (GDPR)

For customers in Germany and Austria, every processing activity must have a lawful basis under Article 6 of the GDPR. The table below sets out the basis we rely on for each purpose.

Processing purpose Legal basis (GDPR Art. 6) Explanation

Order processing & fulfilment Art. 6(1)(b) — Performance of a contract Necessary to fulfil our sales contract with you

Payment processing Art. 6(1)(b) — Performance of a contract Necessary to process payment for your order

Customer support Art. 6(1)(b) — Performance of a contract Necessary to handle your enquiries and after-sales service

Tax & accounting compliance Art. 6(1)(c) — Legal obligation Required by applicable German, Austrian, and US accounting/tax law

Fraud prevention Art. 6(1)(f) — Legitimate interest Our legitimate interest in preventing fraud and protecting customers

Website analytics Art. 6(1)(f) — Legitimate interest Our legitimate interest in improving site performance and reliability

Email marketing Art. 6(1)(a) — Consent Only where you have given explicit opt-in consent; withdrawable at any time

Balancing of legitimate interests

Where we rely on legitimate interest, we have assessed that our interests do not override your fundamental rights and freedoms as a data subject. For fraud prevention, processing is proportionate and necessary. For website analytics, data is aggregated and not used to profile you individually in a way that disproportionately affects your privacy. You may object at any time to processing based on legitimate interest — see section 07.

05

How We Share Your Data — Processors & Third Parties

We do not sell your personal data. We only share data with service providers that are essential to running our store and fulfilling your order. Each of these processors is bound by data processing agreements and confidentiality obligations.

Essential service providers

› Our e-commerce platform: hosts our online store and processes order, customer, and payment data on our behalf.

› Our payment processor: securely processes your payment. We only share what is necessary to authorise and complete your transaction.

› Delivery carriers: receive your name and delivery address to fulfil shipment and provide tracking.

› Our email service provider: sends order confirmations and, where you have consented, marketing communications.

› Hosting & analytics providers: support the technical operation of our website and help us understand aggregate site usage.

We do not share with

✗ Data brokers or data aggregators

✗ Social media platforms for ad targeting without your consent

✗ Any third party for their own independent marketing purposes

✗ Anyone outside the scope of order fulfilment and support without your explicit consent or a legal obligation

Legal & business transfers

We may also disclose your data where required to comply with law, to respond to valid legal process, to enforce our Terms of Service, or in connection with a merger, acquisition, or sale of business assets. In such cases, we take steps to ensure your data continues to be protected in accordance with this Privacy Policy.

06

Data Retention

We retain personal data only for as long as necessary for the purposes it was collected, or as required by applicable law. When data is no longer needed, we securely delete or anonymise it.

Order & accounting records

Retained for up to 10 years from the date of the transaction to comply with German commercial and tax law record-keeping requirements (Handelsgesetzbuch / Abgabenordnung) applicable to invoices and accounting records.

Customer support communications

Retained for 3 years from the date of the last communication, aligned with the general statute of limitations for civil claims under German law (§195 BGB).

Marketing data

Retained for as long as you remain subscribed. If you unsubscribe, we keep a record of your opt-out so we do not email you again. If no email has been sent for 3 years, we delete the marketing record unless you are also an active customer.

Website analytics

Aggregated analytics data is retained for up to 14 months, consistent with common EU analytics retention practice. IP addresses used for fraud prevention are retained for 12 months from the relevant transaction date.

Requesting erasure

You may request erasure of your personal data at any time — see section 07 (right to erasure). We will delete your data promptly unless we are legally required to retain it (e.g. for tax records), in which case we will explain the basis for retention and delete the data once the legal obligation lapses.

07

Your Rights Under the GDPR (Germany & Austria)

As a data subject in Germany or Austria, you have the following rights under the GDPR. All requests are free of charge and answered within one month (extendable by two further months for complex requests, with notice to you).

Your right What it means

Right to access (Art. 15) You can request a copy of all personal data we hold about you, including categories, purposes, retention periods, and any third parties we share it with.

Right to rectification (Art. 16) You can request correction of inaccurate or incomplete personal data. We will correct it promptly and notify any third parties who received the incorrect data.

Right to erasure (Art. 17) You can request deletion of your personal data where it is no longer necessary, you withdraw consent, you object and we have no overriding legitimate ground, or the processing was unlawful. Exceptions apply where we are legally required to retain data.

Right to restriction (Art. 18) You can request that we restrict processing of your data (store but not use it) while you dispute its accuracy, object to processing, or during an assessment of whether our legitimate interest overrides yours.

Right to data portability (Art. 20) Where processing is based on consent or contract and carried out by automated means, you can request your data in a structured, commonly used, machine-readable format for transfer to another controller.

Right to object (Art. 21) You can object at any time to processing based on legitimate interest. We will stop processing unless we can demonstrate compelling legitimate grounds. You have an absolute right to object to direct marketing, which we honour immediately.

Right to withdraw consent Where processing is based on your consent (e.g. email marketing), you can withdraw it at any time without affecting the lawfulness of processing before withdrawal — via the unsubscribe link or by contacting us directly.

Right to lodge a complaint You have the right to lodge a complaint with your competent supervisory authority at any time — the state Data Protection Authority (Landesdatenschutzbehörde) responsible for your German state, or the Austrian Data Protection Authority (Österreichische Datenschutzbehörde) if you reside in Austria. See section 11 for details.

How to exercise your rights

Send your request to info@luxfi.de with the subject line “GDPR request – [right you wish to exercise]”. Please include your full name, email address, and a brief description of your request. We may ask you to verify your identity before processing. We confirm receipt within 3 business days and provide a full response within one month.

08

Switzerland & the Swiss FADP

Switzerland is not a member of the European Union or the EEA. As a result, the processing of personal data of our Swiss customers is not governed by the GDPR, but by the Swiss Federal Act on Data Protection (FADP), as revised (revFADP), which has been in force since 1 September 2023.

Our approach for Swiss customers

Although the GDPR does not directly apply, we apply GDPR-equivalent safeguards to Swiss customers as a matter of practice.

Given the substantial overlap between the FADP and the GDPR, Luxfi voluntarily extends the same standards of transparency, data minimisation, security, and data-subject rights described throughout this Policy to personal data collected from customers in Switzerland.

Swiss regulator

The Federal Data Protection and Information Commissioner (FDPIC), known in German as the Eidgenössische Datenschutz- und Öffentlichkeitsbeauftragte (EDÖB), is the competent supervisory authority for data subjects in Switzerland.

Your Swiss data-subject rights

Swiss residents have the right to access, rectify, and request deletion of their personal data, and to object to its processing, on terms equivalent to those described in section 07. Contact info@luxfi.de to exercise these rights.

Cross-border processing from Switzerland

Because Ecomvest LLC is based in the United States, personal data collected from Swiss customers may be processed and stored outside Switzerland, including in the United States and other countries where our processors operate. We apply appropriate contractual safeguards for such transfers — see section 10 for details.

If you are not satisfied with our response to a request, you have the right to lodge a complaint with the FDPIC / EDÖB — see section 11 for contact details.

09

Cookies & Consent

We use cookies and similar technologies on luxfi.de. Under the ePrivacy rules applicable in Germany and Austria (and the equivalent Swiss principles) together with the GDPR, we ask for your consent before placing non-essential cookies.

Essential cookies (no consent required)

✓ Session cookies: keep your shopping cart and login status active during your visit

✓ Security cookies: prevent cross-site request forgery and detect fraud

✓ Preference cookies: remember your cookie choice and currency preference

Non-essential cookies (consent required)

› Analytics cookies: help us understand how visitors use our site (page views, referral source, device type). Data is aggregated.

› Marketing cookies: placed only where you have given explicit opt-in consent for targeted advertising.

✗ We do not place marketing cookies without explicit opt-in consent.

Managing your cookie preferences

You can manage your cookie preferences at any time through the cookie consent banner shown on your first visit to our website, or by adjusting your browser settings to block or delete cookies. Disabling essential cookies may affect site functionality (e.g. your cart may not work correctly). You may withdraw marketing consent at any time by contacting us at info@luxfi.de.

10

International Data Transfers & Security

Ecomvest LLC is incorporated in Wyoming, United States. As a result, personal data collected from customers in Germany, Austria, and Switzerland is processed and stored in the United States, and potentially in other countries where our processors operate.

Safeguards for cross-border transfers

We use recognised transfer mechanisms to protect your data when it crosses borders.

For transfers of personal data originating in the EU/EEA (Germany and Austria), we rely on the European Commission’s Standard Contractual Clauses (SCCs), or an equivalent recognised safeguard, to ensure a level of protection essentially equivalent to that guaranteed within the EU. For transfers of personal data originating in Switzerland, we apply the SCCs as recognised for use under Swiss law, or an equivalent contractual safeguard.

Technical measures

HTTPS / TLS encryption on all pages, PCI-DSS compliant payment processing, access controls on internal systems, and regular security monitoring of our store platform.

Organisational measures

Access to personal data limited to staff who need it to fulfil orders or provide support. Data processing agreements in place with all processors. Incident response procedures in place.

Data breach notification

In the event of a data breach likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, as required by GDPR Article 34. We will also notify the relevant supervisory authority within 72 hours of becoming aware of the breach, in accordance with GDPR Article 33 (or the equivalent FADP notification obligation for Swiss data subjects).

11

Contact & Supervisory Authorities

For any privacy-related questions, requests, or complaints, please contact us first. You also have the right at any time to lodge a complaint with your national or state data protection authority.

Contact us for privacy matters

Email: info@luxfi.de

Phone: +1 740 272-5703

We respond to all privacy requests within one month (GDPR Art. 12), extendable by up to two further months for complex requests, with notice to you.

Policy updates

We review and update this Privacy Policy periodically. For material changes, we will notify you by email (if you are a customer) or post a prominent notice on our website before the changes take effect. The effective date at the top of this page always reflects the current version.

Germany

Competent state Data Protection Authority (Landesdatenschutzbehörde)

The regulator depends on the German federal state (Bundesland) in which you reside. A full list of the state authorities is published by the Federal Commissioner for Data Protection and Freedom of Information (BfDI).

bfdi.bund.de

Austria

Österreichische Datenschutzbehörde

Barichgasse 40–42
1030 Vienna, Austria

dsb.gv.at

Switzerland

Federal Data Protection and Information Commissioner (FDPIC / EDÖB)

Feldeggweg 1
3003 Bern, Switzerland

edoeb.admin.ch

We would rather resolve it directly

We take all privacy concerns seriously and aim to answer your query quickly and fairly. While you always have the right to contact your national supervisory authority, we ask that you contact us first at info@luxfi.de so we have the opportunity to resolve your concern directly before any escalation.