Privacy Policy

Last updated: 07.08.2026

At Moda Lucia, we take the protection of your personal data very seriously. This Privacy Policy explains what data we collect, for what purposes, on what legal basis, and what rights you have. We process your data in accordance with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Organic Law 3/2018 on Personal Data Protection and the Guarantee of Digital Rights (LOPDGDD).

1. Data controller

The data controller responsible for your personal data is:

Moda Lucia, a brand operated by BUsinessMAestro
Trade Register number (KvK): 93826141
VAT number (BTW): NL005046367B13
Address: Wilhelminastraat 15, 6812 CW Arnhem, Netherlands
Email: info@modalucia.com
Phone: +31 6 58 01 26 74

For any questions related to data protection, you can contact info@modalucia.com.

2. What data we collect

Depending on how you use our website, we process the following categories of data:

a) Data you provide to us directly:

• Identification and contact data: first name, last name, delivery and billing address, email address, phone number.
• Order data: products purchased, amount, order history.
• Payment data: payment method used. Important: your full card details are processed exclusively by our certified payment providers; Moda Lucia never stores them.
• Communications: the content of messages you send us by email or through the contact form.
• Subscription data: your email address, if you subscribe to our newsletter.

b) Data we collect automatically:

• Technical data: IP address, browser and device type, operating system, language, approximate country.
• Usage data: pages visited, products viewed, visit duration, source of visit.
• Cookies and similar technologies, in accordance with our Cookie Policy.

We do not process special categories of data (such as health data or beliefs) and do not intend to collect them.

3. Purposes and legal bases for processing

When processing is based on your consent, you can withdraw it at any time with effect for the future, without affecting the lawfulness of prior processing.

4. Data recipients

We only share your data with third parties when necessary for the purposes described, and always with appropriate safeguards:

• Shopify Inc. — e-commerce platform that hosts our store and processes order data.
• Payment providers — to process your payment securely (depending on the method chosen: Shop Pay, Visa, Mastercard, American Express, Maestro, Apple Pay, Google Pay, Bancontact, BLIK, MobilePay, TWINT).
• Logistics and transport partners — to prepare, ship and deliver your order, including tracking information.
• Email marketing service providers — to send the newsletter, only if you have subscribed.
• Order tracking providers — so you can check the status of your shipment.
• Analytics and advertising providers (for example, Google, Meta) — only with your consent through the cookie banner.
• Advisors and authorities — when there is a legal obligation (for example, tax authorities).

We have entered into the relevant data processing agreements (Art. 28 GDPR) with all providers that process data on our behalf. We do not sell your personal data to third parties.

5. International transfers

Some of our providers are established outside the European Economic Area (for example, in the United States or in countries from which logistics are managed). In these cases, we ensure an adequate level of protection through:

• adequacy decisions by the European Commission (Art. 45 GDPR), including the EU-U.S. Data Privacy Framework for certified providers; or
• standard contractual clauses approved by the European Commission (Art. 46 GDPR), supplemented with additional measures when necessary.

You can request more information about the safeguards in place by writing to info@modalucia.com.

6. Retention periods

We retain your data only for as long as necessary for each purpose:

• Order and billing data: during the contractual relationship and, thereafter, for the applicable statutory tax and commercial retention periods, as well as for the duration of the legal warranty.
• Customer service communications: until your inquiry has been fully resolved and, thereafter, for the applicable limitation periods for potential claims.
• Newsletter: until you withdraw your consent or unsubscribe.
• Cookies: according to the periods indicated in our Cookie Policy.

Once these periods have elapsed, the data is securely deleted or anonymized.

7. Your rights

As a data subject, you have the following rights:

• Access (Art. 15 GDPR): find out what data we process about you.
• Rectification (Art. 16 GDPR): correct inaccurate or incomplete data.
• Erasure (Art. 17 GDPR): request the deletion of your data ("right to be forgotten").
• Restriction of processing (Art. 18 GDPR).
• Data portability (Art. 20 GDPR): receive your data in a structured, commonly used format.
• Objection (Art. 21 GDPR): object to processing based on legitimate interest and, in any case, to processing for direct marketing purposes.
• Withdrawal of consent at any time, effective for the future.

You can exercise these rights free of charge by writing to info@modalucia.com, specifying the right you wish to exercise and attaching information that allows us to verify your identity. We will respond within a maximum of one month.

You also have the right to lodge a complaint with a supervisory authority. In Spain, the competent authority is the Spanish Data Protection Agency (AEPD), www.aepd.es. If you live in another EU country, you can contact your country's authority; you will find the full list on the website of the European Data Protection Board.

8. Cookies

We use cookies and similar technologies. Strictly necessary cookies are always installed; analytics and marketing cookies are used only with your consent through the cookie banner, which you can change at any time. You can find all the information in our Cookie Policy. You can also manage your privacy preferences on the Your Privacy Choices page.

9. Security

We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss, alteration, or destruction: SSL/TLS encryption throughout the website, payment processing through certified providers (PCI-DSS), restricted access to data, and regular reviews of our security measures.

10. Minors

Our website is not intended for anyone under the age of 18, and we do not knowingly collect data from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it.

11. Automated decisions

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Our payment providers may perform automated fraud checks; if a payment is declined, you can contact us for a manual review.

12. Changes to this policy

We may update this Privacy Policy to reflect legal, technical, or operational changes. The current version is always available on this page, along with the date it was last updated. In the event of substantial changes, we will notify you appropriately.

---

Do you have a question, need help with your order, or simply want to get in touch? We're here to help.
Our team usually responds within 24 hours on business days.
Tell us how we can help.

✉️ Email us:
info@modalucia.com
Monday to Friday, 9:00 – 17:00 (CET)

📍 Address:
Wilhelminastraat 15, 6812 CW Arnhem, Netherlands

💬 Prefer to do it online?
Use our contact form — we usually respond within 24 hours.

Company number: 60689584419