Privacy policy

Last updated: 13 October 2026

This Privacy Policy explains how Luren London ("Luren", "we", "us", "our") collects, uses and protects your personal data when you visit luren.co.uk (the "Site"), buy from us, or otherwise interact with us. We are the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Luren London is a trading name of Luren Limited, a company registered in England and Wales under company number 17126682, with its registered office at Venture X Chiswick Park, Fifth Floor, Building 7, 566 Chiswick High Road, London W4 5YG, United Kingdom.

If you have any questions about this policy or how we handle your data, contact us at info@luren.co.uk or write to the address above.

2. The personal data we collect

Depending on how you interact with us, we may collect:

Identity and contact data – name, email address, telephone number, billing address and delivery address.
Order and payment data – the products you buy, order history, and payment details. Card details are processed by our payment providers and are never stored on our systems.
Account data – if you create an account, your login details and saved addresses.
Communications – messages you send us through the contact form, email or social media, and our replies.
Marketing preferences – whether you have asked to receive our emails, and how you interact with them.
Technical and usage data – IP address, browser type and version, device identifiers, time-zone, pages viewed, products viewed, referring site, and how you navigate the Site. Some of this is collected through cookies (see section 8).

We do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, please contact us and we will delete it.

3. How we use your data and our legal bases

Purpose	Legal basis
Processing and delivering your order, taking payment, sending order confirmations and shipping updates	Performance of a contract with you
Handling returns, refunds, exchanges and customer-service requests	Performance of a contract; legal obligation (consumer law)
Keeping accounting, tax and fraud-prevention records	Legal obligation; legitimate interests (running a lawful business)
Sending marketing emails about new styles, restocks and offers	Consent (you can withdraw it at any time); or, for existing customers, our legitimate interest in telling you about similar products, with an unsubscribe link in every email
Improving the Site, understanding which products and pages are popular, and fixing problems	Legitimate interests (improving our shop); consent for non-essential cookies
Preventing fraud and keeping the Site secure	Legitimate interests; legal obligation
Responding to your messages	Legitimate interests (customer care); performance of a contract

4. Who we share your data with

We share personal data only where necessary to run our shop:

Shopify International Limited – hosts our store, checkout and customer database. Shopify's privacy policy is at shopify.com/legal/privacy.
Payment providers – Shopify Payments, PayPal, Apple Pay, Google Pay, Shop Pay and similar services process your payment and may carry out fraud checks.
Delivery partners – Royal Mail and other couriers receive your name, address, and contact details so they can deliver your parcel and send tracking updates.
Email and marketing tools – the service we use to send newsletters, only if you have opted in.
Analytics and advertising providers – such as Google Analytics and Meta, subject to your cookie choices.
Professional advisers and authorities – accountants, lawyers, insurers, HMRC, regulators or law enforcement where the law requires it.

We never sell your personal data.

5. International transfers

Some of our service providers (including Shopify and its sub-processors) store or process data outside the United Kingdom, for example in the European Economic Area, Canada and the United States. Where this happens we rely on the UK Government's adequacy regulations or on contracts incorporating the UK International Data Transfer Addendum / Standard Contractual Clauses, so that your data receives a level of protection equivalent to UK law.

6. How long we keep your data

Order records – 6 years after the end of the financial year of the order, as required by UK tax law.
Account data – for as long as your account is open; you can ask us to close it at any time.
Marketing data – until you unsubscribe or ask us to stop, after which we keep a minimal suppression record so that we do not contact you again.
Customer-service messages – up to 2 years after the matter is closed.
Technical/analytics data – according to the retention periods of the relevant cookie (see section 8), typically no longer than 26 months.

7. Your rights

Under UK data-protection law you have the right to:

Access the personal data we hold about you;
Correct inaccurate or incomplete data;
Erase your data in certain circumstances;
Restrict or object to our processing, including objecting to direct marketing at any time;
Data portability – receive the data you gave us in a machine-readable format;
Withdraw consent where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

To exercise any right, email info@luren.co.uk. We will respond within one month. We may ask you to confirm your identity first. You will not usually have to pay a fee.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113. We would appreciate the chance to resolve your concern first.

8. Cookies and similar technologies

Our Site uses cookies and similar technologies. Some are strictly necessary for the Site and checkout to work; others help us understand how the Site is used or show you relevant advertising. We only set non-essential cookies with your consent, which you can give or change through the cookie banner or your browser settings.

Category	Examples	Purpose
Strictly necessary	_secure_session_id, cart, cart_sig, cart_ts, checkout_token, secret, storefront_digest, _shopify_country	Keep your basket, run checkout, remember your country/currency and keep the Site secure. Cannot be switched off.
Analytics and performance	_shopify_s, _shopify_y, _landing_page, _orig_referrer, _ga, _gid	Understand how visitors use the Site so we can improve it. Session cookies expire when you close your browser; others last up to 2 years.
Marketing	_fbp, _shopify_sa_p, _shopify_sa_t	Measure the effectiveness of our advertising and show you relevant ads on other sites.

Most browsers let you refuse or delete cookies. If you block strictly necessary cookies, parts of the Site, including checkout, may not work.

9. Security

Our Site runs on Shopify's PCI-DSS Level 1 certified platform, and all pages are served over HTTPS. Access to customer data is restricted to the people who need it to run the business. No method of transmission over the internet is completely secure, so we cannot guarantee absolute security, but we take reasonable steps to protect your data.

10. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date at the top. Significant changes will be announced on the Site or by email where appropriate.