Privacy policy
Privacy Policy
At Lunaire Works, protecting your personal information is a responsibility we take seriously. This Privacy Policy explains precisely what data we collect when you shop with us, how and why we use it, who we share it with, how long we retain it, and what rights you hold under UK law.
1. Who We Are
Lunaire Works is the trading name of STERZEAL HATS LIMITED, a company registered in England and Wales. We design and supply decorative interior wall panelling products — including MDF shaker panels, dado kits, pine moulding kits, and feature wall solutions — directly to residential customers across the United Kingdom. When you browse our website, create an account, place an order, or get in touch with us, we act as the Data Controller in respect of your personal information as defined by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Registered Business Details
Company Name
STERZEAL HATS LIMITED
Trading As
Lunaire Works
Company Registration
13249070
VAT Number
GB433989551
EORI Number
GB084160128000
Registered Address
126 Newark Avenue, Peterborough, PE1 4NP England, United Kingdom
Phone
Website
Business Hours
Mon–Fri, 9:00 AM – 5:00 PM (GMT)
We are registered as a data controller with the Information Commissioner's Office (ICO). If you have any questions about how your personal data is handled, you can reach us at info@lunaireworks.com or call us on +44 33 0043 9923.
2. Information We Collect
We only collect personal information that is necessary to fulfil your orders, operate our website, improve your experience, and meet our legal obligations. Below is a complete account of every category of data we may collect.
Identity & Contact Details
Full name, billing and delivery address, email address, and telephone number. You provide these directly when placing an order or registering an account.
Transaction & Payment Data
Order reference numbers, items purchased, order values, payment method type (e.g. card or PayPal), and transaction status. We do not store your full card number, CVV, or any sensitive payment credentials — these are handled entirely by our payment processors.
Technical & Usage Data
IP address, browser type and version, operating system, device type, pages visited on our website, time and date of your visit, pages viewed before and after ours, and referring URL. This information is collected automatically via cookies and analytics tools.
Communications & Enquiry Data
The content and date of messages you send us by email, via our contact page, or through live chat — including any enquiries about products, orders, or returns — and our responses to you.
Preference & Account Data
If you create an account, we store your saved addresses, order history, and any wishlist items. We also record your marketing consent preference so we can respect your choices about receiving promotional emails from us.
Delivery & Shipping Data
Delivery name and address, any delivery instructions you provide, and tracking information generated by our courier partners. This is required to dispatch and track your order through to successful delivery.
What We Do Not Collect
We do not collect or process any special categories of personal data as defined by Article 9 of the UK GDPR — this includes health data, racial or ethnic origin, political opinions, religious beliefs, biometric data, genetic data, or data about sexual orientation. We do not collect data from children under the age of 16. We never purchase, rent, or receive personal data from third-party data brokers. We do not collect full payment card numbers, CVV codes, or bank account details at any point in the checkout process.
3. How We Collect Your Information
Directly From You
When you place an order, create an account, contact our customer service team, sign up for emails, or engage with a live chat session on our website.
Automatically via Your Device
When you browse our website, your browser and device automatically transmit technical data including your IP address, browser type, and browsing behaviour. We capture this via cookies and analytics tools as described in Section 6.
From Our Service Partners
Our payment and logistics partners may share transaction confirmations or delivery status updates with us to allow us to fulfil your order, resolve disputes, and provide accurate customer support.
4. Legal Basis for Processing Your Data
Under UK GDPR Article 6, every instance of personal data processing must rest on a lawful basis. We rely on the four bases below — and we have identified the specific basis that applies to each of our processing activities.
Article 6(1)(b) — Contract
Processing is necessary to fulfil your purchase contract: processing your order, handling payment, arranging delivery, and managing returns and refunds.
Article 6(1)(c) — Legal Obligation
Processing is required to comply with our legal duties under UK tax law, consumer protection regulations, and anti-fraud obligations — for example, retaining invoice records for HMRC.
Article 6(1)(f) — Legitimate Interests
Processing that serves our legitimate business interests and does not override your rights — including website performance analytics, fraud prevention, security monitoring, and service improvement. You may object to this processing at any time (see Section 11).
Article 6(1)(a) — Consent
Processing that requires your freely given, specific, and informed consent — namely, sending you promotional and marketing emails, and placing non-essential cookies on your device. You can withdraw consent at any time without affecting prior processing.
5. How We Use Your Information
The table below sets out each purpose for which we process your personal data, the categories of data used, and the legal basis that justifies each activity.
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Processing and fulfilling your order | Identity, contact, transaction, delivery data | Contract |
| Taking and processing payment | Identity, contact, transaction data | Contract |
| Coordinating delivery with our courier partners | Identity, contact, delivery data | Contract |
| Sending order confirmations, dispatch notifications, and tracking updates | Identity, contact, transaction, delivery data | Contract |
| Handling returns, refunds, and warranty claims | Identity, contact, transaction data | Contract |
| Retaining financial and transaction records for HMRC and VAT obligations | Identity, transaction data | Legal Obligation |
| Preventing, detecting, and investigating fraud or suspicious activity | Identity, technical, transaction data | Legitimate Interests |
| Analysing website traffic and improving site performance | Technical & usage data | Legitimate Interests |
| Responding to customer enquiries and complaints | Identity, contact, communications data | Legitimate Interests |
| Sending promotional emails and marketing communications | Identity, contact, preference data | Consent |
We will never use your personal data for any purpose that is incompatible with those described above, and we will never sell your data to any third party for their own marketing purposes.
6. Cookies & Tracking Technologies
Our website uses cookies and similar tracking technologies in accordance with the UK Privacy and Electronic Communications Regulations (PECR) 2003 and UK GDPR. We use a cookie consent tool to obtain your consent before placing any non-essential cookies on your device. You can update your cookie preferences at any time.
Essential Cookies
Required for core website functionality. These cookies enable you to add items to your cart, proceed through checkout securely, and remain logged into your account. They cannot be disabled without breaking the site.
Basis: Strictly necessary — no consent required
Analytics Cookies
Used by Google Analytics to collect anonymised data about how visitors use our website — such as which pages are most popular, how long visits last, and where visitors come from. This helps us make improvements. Data is aggregated and does not identify individuals.
Basis: Consent (UK PECR)
Marketing & Advertising Cookies
Placed by Google Ads and similar platforms to enable product advertising. These cookies track whether you have visited our website so that we can show you relevant product advertisements on other websites and platforms. They do not store personally identifiable information directly.
Basis: Consent (UK PECR)
Preference Cookies
These cookies remember your site preferences — such as your selected currency or language — so that we can provide a more personalised experience on return visits without requiring you to re-select options each time.
Basis: Consent (UK PECR)
How to Manage Cookies
When you first visit our website, you will be presented with a cookie consent banner that allows you to accept or decline non-essential cookies. You can change your preferences at any time by accessing the cookie settings from the footer of our website. Additionally, most browsers allow you to delete or block cookies through their settings menus. Please note that disabling essential cookies will impair the functionality of our website and may prevent you from completing a purchase.
7. Email Marketing & Communications
We send two distinct categories of emails, and it is important to understand the difference between them:
Transactional Emails
These are operational communications you automatically receive when you place an order with us — including order confirmations, payment receipts, dispatch notifications with tracking links, delivery confirmations, and refund confirmations. These emails are sent as part of your contract with us. You cannot unsubscribe from transactional emails while an order is active, as they contain information essential to your purchase.
Marketing Emails
These are optional promotional emails we send only with your explicit consent — such as new product announcements, seasonal sale notifications, design inspiration content, and exclusive discount offers. You will be asked to opt in to these during checkout or account registration. We will never add you to our marketing list without your active consent.
How to Unsubscribe from Marketing Emails
You can withdraw your marketing consent and unsubscribe at any time in any of the following ways:
- Click the "Unsubscribe" link in the footer of any marketing email we send you.
- Email us at info@lunaireworks.com with the subject line "Unsubscribe" and we will remove you within 10 business days.
- Submit a privacy opt-out request via our Privacy Opt-Out Request Form.
Withdrawing your marketing consent does not affect the lawfulness of any processing we carried out before you withdrew it, and it does not affect any transactional emails relating to an active order.
8. Sharing Your Information with Third Parties
We do not sell, trade, or rent your personal information to any third party for their own commercial use. We share your data only with carefully selected service providers who help us operate our business and serve your order. Every third party we work with is bound by contractual data processing agreements and is required to protect your information in line with UK data protection law.
The following details every category of third party with whom we share your personal data:
Shopify Inc. — E-Commerce Platform
Our website is built and hosted on the Shopify platform. Shopify processes your order data, stores your account information, and handles the checkout flow on our behalf. Shopify acts as a data processor under our instruction and is bound by Shopify's own privacy commitments and our data processing agreement. For full details, see Shopify's Privacy Policy.
Data shared: Identity, contact, transaction, delivery, technical data
Payment Processors — Shopify Payments (Stripe) & PayPal
When you complete a purchase, your payment is securely processed by Shopify Payments (powered by Stripe) or PayPal, depending on your chosen payment method. These processors receive your name, billing address, and payment card details to authorise and complete the transaction. We never see or store your full card number or CVV at any point. Both processors are PCI DSS-compliant and FCA-regulated. For details, see Stripe's Privacy Policy and PayPal's Privacy Policy.
Data shared: Identity, billing address, transaction data (payment credentials processed directly by the provider)
Courier & Delivery Partners — Royal Mail, DPD, Evri
To deliver your order, we share your full name, delivery address, and contact telephone number with the courier service responsible for your shipment. This is necessary to generate shipping labels, track your parcel, and arrange delivery or redelivery. Couriers may contact you directly via SMS or email to arrange convenient delivery times or to provide tracking updates.
Data shared: Identity, delivery address, contact telephone number
Analytics & Advertising — Google LLC
We use Google Analytics to understand how visitors interact with our website. Google Analytics collects anonymised usage data including session duration, pages visited, and traffic sources. We also use Google Ads to display our products in search and shopping results. Both services use cookies on your device (with your consent) to function. Google processes this data in accordance with the Google Ads Data Processing Terms and Google's Privacy Policy. You can opt out of Google Analytics tracking via the Google Analytics Opt-out Browser Add-on.
Data shared: Anonymised technical & usage data (subject to your cookie consent)
Legal & Regulatory Authorities
We may disclose personal data to HMRC, law enforcement agencies, or courts of law where we are legally required to do so — for example, to comply with a court order, to investigate fraud, or to respond to a lawful request from a regulatory body. We will only disclose the minimum data necessary and will notify you where we are legally permitted to do so.
Legal basis: Legal obligation (Article 6(1)(c) UK GDPR)
9. International Data Transfers
Our website, order management, and customer data are primarily hosted and processed within the United Kingdom and the European Economic Area (EEA) by Shopify's infrastructure. Some of our service providers — including Shopify Inc. (headquartered in Canada) and Google LLC (headquartered in the United States) — may process your personal data outside the UK.
Where personal data is transferred outside the UK, we ensure that appropriate safeguards are in place in accordance with Chapter V of the UK GDPR. These safeguards include:
- UK Adequacy Regulations: Transfers to countries that the UK Government has deemed to provide an adequate level of data protection.
- International Data Transfer Agreements (IDTAs): Standard contractual clauses approved by the ICO that legally oblige the recipient to protect your data to UK standards.
- Binding Corporate Rules: Where applicable, internal policies adopted by multinational organisations to govern the transfer of personal data across their global operations.
Canada benefits from a UK adequacy decision. The United States does not currently hold a UK adequacy decision; however, transfers to US-based processors such as Google and Stripe are made under the relevant ICO-approved IDTAs. If you would like further information about the specific safeguards we have in place for international transfers, please contact us at info@lunaireworks.com.
10. How Long We Keep Your Data
We retain personal data only for as long as it is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention schedule applies:
| Data Type | Retention Period | Reason |
|---|---|---|
| Order & transaction records | 7 years | HMRC requirement under the Taxes Management Act 1970 and Companies Act 2006 |
| Customer account information | Duration of account + 2 years | Retained while the account is active and for a reasonable period thereafter to support warranty claims or disputes |
| Delivery address data | Up to 7 years | Retained as part of the order record for accounting and dispute resolution purposes |
| Customer service correspondence | 3 years | Retained to manage ongoing service queries, complaints, and potential legal disputes within the standard limitation period |
| Email marketing consent records | Until consent is withdrawn | Required by UK PECR to demonstrate lawful basis for marketing communications |
| Website analytics data | 26 months (anonymised) | Standard Google Analytics retention window; data is anonymised and not personally identifiable |
When your personal data is no longer required, we will securely delete or anonymise it. Where deletion is not immediately possible (for example, because data is stored in backup archives), we will ensure it is isolated from further processing and deleted as soon as feasible.
11. Your Rights Under UK Data Protection Law
Under the UK GDPR and Data Protection Act 2018, you hold the following rights in relation to your personal data. These rights are not absolute — they may be subject to certain conditions and exemptions — but we will respond to all requests within one calendar month and will only decline where we have a lawful reason to do so.
Right of Access
You have the right to request a copy of all personal data we hold about you (known as a Subject Access Request or SAR). We will respond within one month at no charge.
Right to Rectification
If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it without undue delay.
Right to Erasure
Also known as the "right to be forgotten." You can request that we delete your personal data where it is no longer necessary for the purpose it was collected, or where you withdraw consent and no other lawful basis applies. This right is subject to our legal retention obligations.
Right to Restriction
You have the right to request that we temporarily halt the processing of your personal data — for example, while you contest its accuracy or while we are considering an objection — without requiring us to delete it outright.
Right to Data Portability
Where we process your data by automated means based on your consent or a contract with you, you have the right to receive a copy of your data in a structured, commonly used, and machine-readable format, and to request that we transfer it to another controller where technically feasible.
Right to Object
You have the right to object to our processing of your personal data where we rely on legitimate interests (Article 6(1)(f)) as our lawful basis. You also have an absolute right to object to processing your data for direct marketing purposes at any time.
Right re: Automated Decisions
You have the right not to be subject to a decision that is made solely by automated processing (including profiling) and that produces significant legal or similarly significant effects on you. We do not carry out any such automated decision-making in relation to our customers.
Right to Withdraw Consent
Where we process your data on the basis of consent, you may withdraw that consent at any time. Withdrawal will not affect the lawfulness of any processing we carried out prior to withdrawal. Use our Privacy Opt-Out Request Form to exercise this right quickly.
How to Exercise Your Rights
To exercise any of the rights listed above, you may contact us using the following channels. We will acknowledge your request within 5 working days and respond in full within one calendar month. In complex cases, we may extend this period by a further two months, in which case we will notify you and explain the reason for the delay.
We do not charge a fee for processing data subject requests unless they are manifestly unfounded, excessive, or repetitive, in which case we reserve the right to apply a reasonable administrative charge.
Right to Lodge a Complaint with the ICO
If you are not satisfied with how we have handled your personal data or responded to a rights request, you have the right to lodge a complaint with the UK's data protection supervisory authority, the Information Commissioner's Office (ICO). You can contact the ICO at ico.org.uk/make-a-complaint or by calling their helpline on 0303 123 1113. We would always appreciate the opportunity to address your concerns before you contact the ICO, so please do reach out to us first.
12. How We Protect Your Data
We implement and maintain appropriate technical and organisational security measures to protect your personal data against accidental loss, unauthorised disclosure, unlawful access, alteration, or destruction. Our security measures include:
SSL / TLS Encryption
All data transmitted between your browser and our website is encrypted via HTTPS using TLS, protecting it from interception in transit.
PCI DSS-Compliant Payments
All payment transactions are handled by PCI DSS Level 1-certified processors (Stripe via Shopify Payments and PayPal). We never store card data on our own servers.
Restricted Staff Access
Access to customer data is strictly limited to authorised personnel who require it to perform their job functions. We enforce role-based access controls and strong password policies.
Secure Platform Hosting
Our store runs on Shopify's SOC 2 Type II-certified infrastructure, which includes built-in DDoS protection, intrusion detection, and continuous security monitoring.
Despite our best efforts, no method of transmission over the internet or electronic storage is completely secure. If you believe your personal data may have been compromised, or if you discover a potential security vulnerability on our website, please notify us immediately at info@lunaireworks.com or by calling +44 33 0043 9923. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours in accordance with Article 33 of the UK GDPR, and will contact you directly where required.
13. Children's Privacy
Our website and products are designed for, and intended to be used by, adults aged 18 and over. We do not knowingly collect, solicit, or process personal data from individuals under the age of 16, as required by Article 8 of the UK GDPR.
If you are the parent or guardian of a child under 16 and believe they may have submitted personal data to us, please contact us immediately at info@lunaireworks.com. We will promptly investigate and delete any such data from our records.
By using our website and completing a purchase, you confirm that you are at least 18 years of age.
14. Changes to This Privacy Policy
We review and update this Privacy Policy periodically to reflect changes in our business operations, applicable law, or regulatory guidance. The most recent version will always be available on this page, with the "Last Updated" date at the top clearly indicating when it was last revised.
Where we make a material change to this Policy that significantly affects how we process your personal data, we will notify you directly by email (using the email address associated with your account or most recent order) and, where appropriate, will seek your renewed consent before processing your data under the revised terms.
Your continued use of our website following the publication of any updated Privacy Policy constitutes your acknowledgement of the changes. We encourage you to review this Policy each time you visit our website.
15. How to Contact Us About Privacy
For all data protection enquiries, subject access requests, opt-out requests, or to exercise any of your rights under UK GDPR, please use any of the following contact methods. We aim to respond promptly and will always acknowledge receipt of your request.
Post
STERZEAL HATS LIMITED
126 Newark Avenue, Peterborough, PE1 4NP England, United Kingdom
Privacy Opt-Out Request Form
To quickly and easily submit a request to opt out of marketing communications, request deletion of your data, or exercise any other privacy right, use our dedicated online form:
Submit a Privacy Request© 2026 Lunaire Works · STERZEAL HATS LIMITED (Reg. 13249070) · VAT GB433989551 · 126 Newark Avenue, Peterborough, PE1 4NP England, United Kingdom
