Privacy & Cookie Policy

JP Lumina (KVK 42139234) is the controller for everything described in this policy. Questions about your data? Email [email protected] or use our contact page, which also lists our address.

What we hold depends on what you do with us:

• Browsing the site: nothing that identifies you. To prevent abuse — someone trying a password a hundred times, for instance — we briefly record which IP address a form is sent from.
• Contact form and email: your name, your email address and your message. The form sends your message to our inbox; it is not stored on the website itself.
• Your account: your email address, your password (hashed — we cannot read it), and if you fill them in, your name, your language and your addresses. If you turn on two-step verification, we also store its encrypted key. A new Dutch address is checked against the government's public address register (see below). We don't accept disposable email addresses.
• Orders: what you buy, your name, your delivery address — and your phone number if you give it for the courier —, your email address, how you paid and your invoices. To enforce a per-household limit on scarce items, we also keep an encrypted fingerprint of a delivery address: a code from which the address itself cannot be recovered.
• The Lumina tools: what you put in Lumina Collection, your wishlist, your binders and your decks, and what the card scanner recognised, is kept in your account — for you. The scanner works on your own device: no photo is sent to us, only a few numbers used to recognise the card. If you share a deck by link, anyone with that link can see the deck, without your name.
• Emails: messages about your order and your account are always sent. An email when a card from your wishlist comes in, or when an item is back in stock, only if you ask for it. Our newsletter only if you sign up; you can unsubscribe in your account.
• Auctions: your bids (amount and time) and, if you bid automatically, your maximum; the outcome of your 18+ declaration (18+ or not, with the date — we only use your date of birth to work that out and don't store it); a bidding limit if we set one for you; and whether you didn't pay for a won auction. Other visitors only see your bids under a letter (Bidder A, B …), never with your name. If the winner doesn't pay, we e-mail the next bidder an offer.
• Visit statistics (Google Analytics): only if you accept analytics cookies, we use Google Analytics to see how the site is used — pages visited, approximate location (country or city), and device and browser type. Your IP address is shortened; nothing that identifies you personally.

• Contract: your account and your orders — without this data we cannot deliver.
• Legal obligation: Dutch tax law requires us to keep orders and invoices for seven years.
• Legitimate interest: answering your messages; securing the site and your account (login attempts, the log); preventing abuse, such as resellers using several accounts to get around a limit or bidders who don't pay for a won auction; and checking an address so your parcel arrives.
• Auctions: your bids and a won lot fall under the agreement. The 18+ declaration, your bidding limit and keeping track of who didn't pay for a won auction are based on legitimate interest: selling responsibly and preventing abuse.
• Consent: visit statistics, the newsletter and the wishlist and stock emails. You can withdraw that consent at any time — via Cookie Settings in the footer or in your account.

• Your account: for as long as you have it. If you close it (in your account, under Privacy), we delete it straight away. If orders are attached, we remove everything except what has to stay on the invoice.
• Orders and invoices: seven years, as Dutch tax law requires.
• Contact messages: no longer than two years after our last exchange.
• Security: the log (sign-ins and changes, with IP address) 24 months; login attempts and abuse checks one day; staying signed in lasts until two weeks after your last visit.
• Shipping labels: 90 days.
• Auctions: your bids until two years after the auction ends; the winning bid belongs to the order (seven years). If you close your account while bidding, your bids lapse. Your 18+ declaration and whether you didn't pay for a won auction, for as long as your account exists.
• Backups: encrypted; the last fourteen days on the server, and a copy on our own storage that we keep for no longer than three months.
• Visit statistics: up to 14 months.

• Hostnet B.V. hosts this website, the database and our email in the Netherlands.
• Mollie B.V. (Amsterdam) processes your payment. We only send Mollie the amount and your order number; you give your payment details directly to Mollie, and Mollie's privacy policy applies to them.
• DHL Parcel and PostNL receive your name and delivery address for the shipping label. If we make a label by hand, your email address and phone number may be included too, for delivery notifications.
• The Dutch Land Registry (Kadaster, via PDOK) receives only the postcode and house number of a new Dutch address — no name — to check that the address exists. That request goes through our server, so your IP address isn't sent either.
• Google Ireland Ltd processes visit statistics if you accept analytics cookies. Google may transfer data to the United States; Google is certified under the EU-US Data Privacy Framework.
• We never sell personal data, and nobody else receives it.

• Everything runs over an encrypted connection (https).
• Passwords are stored only as a hash (Argon2id): we cannot read them either. Addresses, phone numbers and the key of your two-step verification are stored encrypted.
• Only people with two-step verification turned on can use the admin area, and anyone who opens a customer record is recorded in our log.
• Backups are encrypted.

JP Lumina does not process or store any payment data on this website: checkout runs through our payment provider Mollie.

We only use what the site needs, and — if you allow it — Google Analytics cookies:

• lumina_sessie — keeps you signed in; expires two weeks after your last visit.
• PHPSESSID — protects forms against abuse; removed when you close your browser.
• taal — your language choice; one year.
• In your browser (local storage): your cookie choice, your language, light or dark mode, your current deck in the DeckBuilder, your colouring book and two display settings of the Master Binder. These stay on your own device.
• Google Analytics — only after you accept them in the cookie banner.

None of this is used to track you. You can change your choice at any time via Cookie Settings in the footer, or clear cookies via your browser settings.

You have the right to access, correct, or delete your personal data, to receive a copy of it, to restrict or object to its processing, and to withdraw consent at any time.

• Do it yourself: in your account, under Privacy, you can download a copy of your data and close your account.
• Through us: contact us — we respond within a month.
• You also have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens.