LUFIO Choose a plan

Privacy Policy

How LUFIO LTD collects, uses and protects personal data.

Last updated: 20 October 2026

1. Who we are

LUFIO LTD (“LUFIO”, “we”, “us”, “our”) provides e-commerce management, product catalogue support and online customer support services to businesses. For the personal data described in this policy, LUFIO LTD is the data controller.

This policy explains how we collect and use personal data when you visit lufio.shop, contact us or buy one of our plans. It does not cover the personal data of our clients’ own customers, which we handle on our clients’ behalf (see section 5).

LUFIO LTD
International House, 45-55 Commercial Street, London, E1 6BD, United Kingdom
Email: info@lufio.shop
Phone: 07449 709282

2. The personal data we collect

  • Enquiry details: your name, company, email address, phone number, website and anything you include in a message or the contact form.
  • Order and billing details: billing name, company name, billing address, email, phone number, VAT or tax ID, the plan you bought and your payment status. Payments are handled by Stripe. We never receive or store your full card number.
  • Service details: communications with your account lead, the access we’re given to your systems, and the notes and reports we produce while delivering the service.
  • Technical data: IP address, browser type and pages visited, recorded in server logs by our hosting provider for security and performance.

3. How we use your data and our lawful bases

  • To answer enquiries and prepare proposals. Lawful basis: taking steps at your request before entering into a contract, and our legitimate interest in responding to business enquiries.
  • To set up and deliver services, take payments and send service messages and receipts. Lawful basis: performance of our contract with you.
  • To keep accounting and tax records. Lawful basis: legal obligation.
  • To protect our website, systems and clients against fraud and misuse. Lawful basis: legitimate interests.
  • To send occasional updates about our services to business contacts. Lawful basis: legitimate interests, or consent where the Privacy and Electronic Communications Regulations require it. You can opt out at any time using the link in the email or by contacting us.

4. Who we share data with

We share personal data only where needed to run our business and deliver the services:

  • Stripe, for payment processing and fraud prevention.
  • Netlify, for website hosting and contact form handling.
  • The email, productivity and helpdesk providers we use to communicate with you and deliver the service.
  • Our professional advisers, such as accountants, lawyers and insurers.
  • Law enforcement, regulators or courts, where we are legally required to.

We do not sell personal data.

5. Data we process on behalf of our clients

When we deliver our services, we access personal data about our clients’ customers, such as names, delivery addresses, order details and messages. For this data, our client is the controller and LUFIO acts as a processor. We process it only on the client’s documented instructions, under the data processing terms in our Terms of Service, keep it confidential, and delete or return it when the service ends. If you are a customer of one of our clients, please contact that business about your data.

6. International transfers

Some of our service providers process data outside the UK. Where they do, the transfer is protected by UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another safeguard recognised under UK data protection law.

7. How long we keep data

  • Enquiries that don’t lead to a contract: up to 24 months after our last contact.
  • Client, contract and billing records: six years after the end of the financial year in which the contract ends, to meet tax and accounting requirements.
  • Client customer data processed to deliver services: for the length of the service, then deleted or returned within 30 days of the service ending, unless the law requires us to keep it.
  • Server logs: for the period set by our hosting provider, usually no longer than 30 days.

8. Cookies and similar technologies

Our website does not use advertising or analytics cookies. Stripe sets cookies on its own checkout pages for fraud prevention and to process payments. Our pages load fonts from Google Fonts, which means your IP address is shared with Google when a page loads. If we introduce analytics in future, we will update this policy and ask for your consent where required.

9. Your rights

Under UK data protection law you have the right to:

  • access the personal data we hold about you;
  • ask us to correct inaccurate data;
  • ask us to delete your data;
  • ask us to restrict how we use your data;
  • object to our use of your data based on legitimate interests, including direct marketing;
  • receive your data in a portable format;
  • withdraw consent at any time, where we rely on consent.

To make a request, email info@lufio.shop. We respond within one month and don’t usually charge a fee.

10. Security

We protect personal data with access controls, least-privilege access to client systems, password managers, multi-factor authentication where available and encrypted connections. Our team members are bound by confidentiality obligations.

11. Complaints

If you’re unhappy with how we’ve handled your data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.

12. Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it was last changed. Significant changes will be communicated to active clients by email.