This policy explains how Luna by Jaimin handles your personal data when you visit lunabyjaimin.fr, order a ring, ask us to design one, or write to us. We collect as little as we can: no analytics, no advertising, no tracking cookies.
Effective date: October 21, 2026.
1. Who is responsible for your data
The controller of your personal data is LE FIG, SASU, 25 rue Edgar Quinet, 93120 La Courneuve, France, registered under RCS Bobigny 109 907 832 (SIRET 109 907 832 00017) (“Luna by Jaimin”, “we”, “us”).
- Privacy questions and requests: contact@lunabyjaimin.fr
- General contact: contact@lunabyjaimin.fr
We have not appointed a data protection officer (DPO): we are a small business whose core activities do not involve large-scale monitoring of people or large-scale processing of sensitive data, so the GDPR does not require one (art. 37). The person above answers all privacy requests.
2. The data we collect and where it comes from
We collect data directly from you, except where stated.
| Situation | Data | Source |
|---|---|---|
| Placing an order | Name; email; phone number; delivery and billing address; delivery country; ring choices (model, metal, stone, size, engraving text, IGI certificate option); order number, amounts, currency, dates; the version of the terms of sale you accepted | You |
| Paying | Payment status, payment method, transaction reference, amount and currency; for cards, sometimes the card brand and last four digits. We never see or store your full card number or security code | Mollie (our payment provider) |
| Delivery and customs | Tracking events, delivery confirmation, customs status and any query from the carrier or customs | UPS, DHL, customs brokers |
| “Design with Jaimin” (custom design) | Your brief, up to 6 photos or videos (up to 50 MB each), your messages, the sketches, 3D views and quotes we send you, your approval, the deposit payment | You (and Mollie for the deposit) |
| Withdrawal, cancellation, return or guarantee claim | Your request, the order concerned, the reason if you give one, photos of a defect if you send them, refund details | You |
| Writing to us by email | Your email address, name and the content of your messages and attachments | You |
| Your customer account (your space), opened when you sign in, or for you when you place an order or send Jaimin a first message | Your email address, used to sign in with a link we email you (no password); the first name, last name, phone number, country, language, site edition and, if you choose to give it, postal address that you give or that we copy from your order or first message; how the account was opened (sign-in, order, message or design request) and when, and when it was last used; the link between your account and the orders and design requests made with the same email address; a request to delete the account | You; for the sign-in, Google Firebase Authentication |
| Writing to Jaimin without being signed in (a first message) | Your first name, last name, email address and phone number, your message (no attachments), the site edition and language, and the 6-digit code we email you to confirm your address (we keep only a scrambled form of it). Until you enter the code, the message waits at most 24 hours | You |
| Messages with Jaimin in your account (“Talk to Jaimin”) | The text of your messages and ours, the photos and videos you attach (up to 6 per message, up to 50 MB each), what a message is about (an order, a design request, a ring number), dates and whether each message was read; automatic messages that record the steps of your order or design request (request received, payment, making stages, shipping, delivery, refund) | You, us, and our order system |
| Partner programme: a shop applies, or is invited, and signs in to its partner space (professionals only) | The shop’s name; the contact person’s name, email address, phone number and postal address; the website or Instagram account the shop gave; the shop’s message with an application; the 6-digit code we email to confirm the address of an application (we keep only a scrambled form of it); the shop’s sign-in (Google Firebase Authentication, with a link we email); the partner terms accepted and when; the rate agreed; the shop’s sales with its code (order reference, ring, delivery country, amounts, status), its monthly commission statements and payments (with its bank details: the account holder’s name and IBAN, which we store encrypted and use only to pay it, and which are revealed to us only when we make a payment), its requests for printed cards (quantity, delivery address, note) and our private notes about the partner. Customer details are never part of it | The shop; for sales, our order system |
| Placing an order with a partner code | The partner code you type in the “promo code” field, or that the link or QR code on a partner’s card brings (kept in your browser only for the visit), the shop it belongs to, and the rate at that date; they are kept with the order. The partner shop itself never receives your name, contact details, address or order contents | You |
| Writing to us on Instagram | Your Instagram username and profile name, and the content of your messages | You, via Instagram (Meta) |
| Visiting the website | Technical data recorded automatically by the web server: IP address, date and time, page requested, browser type (user agent), referring page, error codes | Your browser, logged by our host |
What we do not collect (apart from the above): we use no analytics, no advertising or tracking cookies, no social media plugins, no fingerprinting, and our fonts and media are served from our own site. Your bag and your country and currency choice are stored only in your own browser and are not sent to us until you place an order (see our Cookies and browser storage notice). We do not track the visitors a partner sends us: the partner code is kept in your browser only for the visit, and reaches us only if you order with it. The country we suggest is worked out inside your browser from its time zone and language settings and is never sent to us.
Images you send for a custom design or attach to a message are re-encoded on receipt: their hidden metadata (such as camera details and GPS location) is removed. Videos are kept as you send them, so their metadata (such as the location) may remain. Please do not send images or videos showing other people’s faces or personal details unless they have agreed.
Engraving texts may contain names or dates of other people (for example your partner’s). Only send them if you are entitled to.
Giving us your name, contact and delivery details is necessary to conclude and perform the contract: without them we cannot make, ship or support your order. Everything else is optional.
3. Why we use your data and on what legal basis
| Purpose | Legal basis (GDPR / UK GDPR art. 6(1)) |
|---|---|
| Taking your order, making your ring in our atelier, shipping it, keeping you informed, customer service | Performance of the contract (b) |
| Processing your payment and refunds through Mollie | Performance of the contract (b) |
| Answering a custom-design brief: sketch, quote, deposit, design approval, making | Steps at your request before a contract, then performance of the contract (b) |
| Your customer account: signing you in with a link we email you; opening it for you when you place an order or send a first message with an email address you have confirmed with the code we emailed you, so you can follow that order or conversation; showing your orders, how their making and delivery are going, your invoices and credit notes, and your details | Performance of the contract (b), or steps at your request before a contract when you have not ordered yet (b) |
| Checking that a first message really comes from the owner of the email address (the emailed code), then posting it to Jaimin | Steps at your request before a contract (b), and our legitimate interest in preventing abuse of the contact form (f) |
| Messages with Jaimin in your account: following up your order, the design service and customer support, in one conversation that also records the steps of your order; an email telling you that you have a reply (at most one every 15 minutes, with only the start of the message and a link) | Performance of the contract, or steps at your request before a contract (b) |
| Handling withdrawals, cancellations, returns, the legal guarantee of conformity and hidden-defect claims | Legal obligation (c) (consumer law) and performance of the contract (b) |
| Invoices, bookkeeping, tax (VAT/OSS/IOSS and equivalents), export and import customs declarations | Legal obligation (c) |
| Running the partner programme: assessing applications, giving partners access to their space, recording their sales and commissions, issuing statements and paying them, sending printed cards, emailing the partner about a sale, an adjustment, a payment or a shipment (never with customer details) | Performance of the contract with the partner (b); steps at the partner’s request before a contract (b) for an application |
| Recording a partner code with an order and the commission that follows | Performance of the contract with the partner (b); our legitimate interest in running and checking the programme (f) |
| Keeping the commission ledger, statements and payments | Legal obligation (c) (accounting) |
| Answering questions you send by email or Instagram that are not about an order | Our legitimate interest in replying to people who contact us (f) |
| Keeping the website and our systems secure (server logs, preventing abuse and fraud, limits on how many sign-in links and codes can be asked for) | Our legitimate interest in security (f) |
| Keeping evidence and establishing, exercising or defending legal claims | Our legitimate interest (f), and legal obligation (c) where the law sets a retention period |
| Answering authorities’ lawful requests | Legal obligation (c) |
| Anything we specifically ask your permission for (for example, showing a photo of your finished custom ring on our Instagram) | Consent (a), which you may withdraw at any time without affecting earlier use |
Where we rely on legitimate interest, we have checked that it does not override your interests and rights; you may object at any time (section 8).
Your customer account and your messages are never used for marketing. We do not send newsletters or marketing emails. If we start, we will ask for your consent first where the law requires it, and every message will include a one-click unsubscribe link.
The bag and preferences kept in your browser are not processed by us; they are stored on your device at your request, as explained in the Cookies and browser storage notice.
4. Who receives your data
We never sell or rent your personal data. We share only what each recipient needs.
Our service providers (processors). They act only on our instructions, under a contract that meets art. 28 GDPR:
| Recipient | Role | Location of data |
|---|---|---|
| Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus | Website hosting, including web-server logs | 61 Lordou Vironos Street, 6023 Larnaca, Cyprus |
| Hostinger | Our mail provider: sending order and service emails, and our mailboxes | European Union |
| Google Ireland Ltd (Google Firebase / Google Cloud), with Google LLC as sub-processor | Order database and order processing; storage of the files you send for a custom design or attach to a message; customer accounts and sign-in (Firebase Authentication, which makes the sign-in links; we send the emails that carry them through our mail provider); messages with Jaimin | Firestore database and file storage in Paris (europe-west9); Firebase Authentication is a global Google service; possible access from the USA (section 5) |
| Precious World Manufacturing Pvt Ltd, Surat, India (our own atelier) | Making your ring, packing it, handing it to the carrier | India |
| Our accountant | Bookkeeping and tax filings | France |
Independent recipients. They decide for themselves how they use the data, under their own privacy policies:
- Mollie B.V. (Amsterdam, Netherlands), our payment provider. As a licensed payment institution, Mollie acts as an independent controller for payment data, including fraud prevention and anti-money-laundering checks. The payment method you choose (card networks, Apple Pay, PayPal, Klarna, your bank, etc.) also receives your data as its own controller. Klarna may run its own checks when you choose it.
- Our bank, to pay a partner’s commission by transfer (the partner’s name, account holder and the amount).
- Partner shops: they receive only their own data and the sales made with their code in the form of a reference, the ring, the delivery country and the amounts. They never receive a customer’s name, email address, phone number, postal address or order contents.
- Carriers and customs brokers, mainly UPS and DHL: your name, address, phone number, email (for delivery notifications), and the description and value of the parcel, to deliver it and clear customs.
- Customs and tax authorities in India and in the destination country, through the export and import declarations required by law.
- Meta Platforms Ireland Ltd, only if you write to us on Instagram: Meta processes those messages under its own policy.
- Professional advisers (lawyers, auditors, insurers), courts or authorities, when needed to handle a dispute, comply with the law, or answer a lawful request.
- A buyer of our business, if the business is ever sold, under the same commitments as this policy.
5. Transfers outside Europe
Your ring is made by hand in India and shipped from there, so some data leave the European Economic Area (EEA) and the UK.
- India (our atelier, carriers’ Indian operations, Indian customs). India has no EU or UK adequacy decision. Our atelier receives only what it needs to make and ship your ring (name, delivery address, phone, ring details, engraving, order number). This transfer is covered by the European Commission’s standard contractual clauses (SCCs) signed with our atelier (and the UK addendum for UK data). Where a transfer is strictly necessary to perform your contract, such as handing your parcel to the carrier and customs in India, it is also allowed under art. 49(1)(b) GDPR. Your parcel’s data then travel with the carrier to the destination country.
- United States (Google, Meta, carriers and payment methods using US services). Google LLC participates in the EU-US Data Privacy Framework (and its UK extension), which the European Commission recognises as giving adequate protection; Google’s data processing terms also include SCCs. Other providers rely on the Data Privacy Framework or SCCs under their own terms.
- If you live outside Europe (for example in the USA or India), your order data are processed in France and the EU and in India as described here.
You can ask for a copy of the safeguards by writing to contact@lunabyjaimin.fr (commercial terms may be removed).
6. How long we keep your data
| Data | How long | Why |
|---|---|---|
| Order and contract (order details, terms accepted, confirmation, delivery, design approval for a custom ring) | 10 years from delivery | French Consumer Code L213-1 and D213-2 (contracts concluded at a distance for €120 or more) and proof |
| Invoices and accounting records | 10 years from the end of the financial year | French Commercial Code L123-22 |
| Customer-service emails and messages about an order, withdrawal, return and guarantee files | 5 years from the end of the last exchange or of the guarantee, whichever is later; longer if a dispute is ongoing, until it is finally settled | Limitation period for claims (Civil Code art. 2224) |
| Custom-design brief and inspiration photos or videos when no order follows | Photos and videos: 12 months from upload. Brief and messages: 3 years from our last exchange | Photos and videos: our design-service rule. Messages: CNIL guidance on prospective customers |
| Inspiration photos and videos when an order follows | 12 months from upload (the approved sketch or 3D view is kept with the order) | Our design-service rule |
| Questions not linked to an order (email, Instagram) | 3 years from our last exchange | CNIL guidance on prospective customers |
| Customer account (sign-in email, profile, how and when it was opened, link to your orders and requests), also when we opened it for you on an order or a first message | Until the account is deleted, at your request (section 8). The orders, invoices and messages we must keep are then kept for the periods in this table | Performance of the contract; your choice |
| A first message waiting for its emailed code, and the code (kept only in a scrambled form; valid 15 minutes) | 24 hours from when you sent the form, whether or not you enter the code; once you enter it, the message moves to your account (row above and below) | Only as long as needed to confirm your email address |
| Messages with Jaimin and their photos and videos | 3 years from the last message, or until your account is deleted if that comes first; longer when they relate to an order whose records we must keep (then as long as that order’s file above) | CNIL guidance on prospective customers; consumer and limitation-period rules for orders |
| Partner programme: the partner’s profile and sign-in, while the partnership lasts; then only what the ledger needs. Bank details: until 10 years after the last payment (accounting records), and removed earlier if the partner asks and no payment is pending | The relationship, then the accounting rules below | |
| Partner commission ledger (commissions, adjustments, statements and their PDFs) and payments | 10 years | Commercial Code L123-22 (accounting records) |
| A partner application that was rejected (name, contact, address, message) | 12 months from the rejection, then the personal data are deleted | Time to answer a question or a dispute about the refusal |
| A partner application waiting for its emailed code | 24 hours | Only as long as needed to confirm the address |
| Printed-card requests (quantity, delivery address, note, status) | 3 years from the request | Proof of what was sent and limitation period |
| Payment data we receive from Mollie (status, reference, method) | With the accounting records (10 years). We never hold full card numbers | Commercial Code L123-22 |
| Export and import documents | As long as customs law of the countries concerned requires, and at least as long as the accounting records | Customs law |
| Web-server logs | Up to 12 months, kept by our host | Security; French rules on data kept by hosting providers |
| Requests to exercise your rights and our answers | 5 years from our answer | Proof that we answered |
| Bag and preferences in your browser | On your device until you clear them (we cannot see or delete them) | See the cookies notice |
When a period ends, we delete the data or anonymise them.
7. Security
We protect your data with measures suited to the risk, including: encrypted connections (HTTPS) on the whole site; payment on Mollie’s secure page, so card data never reach us; an order database hosted in Paris with restricted access, strong authentication and access logs; prices and orders checked on our server, never trusted from the browser; removal of metadata from uploaded images; access to personal data limited to people who need it, bound by confidentiality; and contracts with our providers that require equivalent protection.
If a data breach is likely to put you at risk, we will notify the competent authority within 72 hours and tell you without undue delay when the law requires it.
8. Your rights
Under the GDPR, the UK GDPR and French law, you have the right to:
- access your data and get a copy;
- rectify inaccurate or incomplete data;
- erase your data, unless we must keep them (for example invoices);
- restrict processing while a request is examined;
- data portability: receive the data you gave us for the contract in a structured, machine-readable format, or have them sent to another company;
- object at any time to processing based on our legitimate interest, for reasons relating to your situation, and at any time and without reason to any direct marketing;
- withdraw your consent at any time, where we rely on it;
- in France, give instructions about what happens to your data after your death (Act no. 78-17 of 6 January 1978, art. 85).
Accounts we open for you. When you place an order, or send Jaimin a first message, with an email address you have confirmed with the code we emailed you, we open your customer space for that address if it has none, so you can follow your order or the conversation; the confirmation email gives you a sign-in link (valid 1 hour) and the address of your space. If the address already has an account, we only add what was missing (we never change what you entered or your sign-in email). The account is never used for marketing, and you can have it deleted at any time, as below.
Deleting your customer account. In your account, under “My details”, ask for the account to be deleted, or write to contact@lunabyjaimin.fr. We then close the account and delete your profile and the messages we do not have to keep, within the response time below. What the law requires us to keep (orders, invoices, the messages about an order) stays for the periods in section 6, kept apart and used for nothing else. You can also simply stop using the account and sign out.
How to exercise them. Write to contact@lunabyjaimin.fr or to our postal address in section 1. Tell us what you want and, if possible, your order number. We may ask for information to confirm your identity if we have reasonable doubt, but only what is needed.
Response time. We answer within one month of receiving your request. If the request is complex or we receive many, we may extend this by two months; we will tell you within the first month and explain why. Exercising your rights is free, unless a request is manifestly unfounded or excessive.
Complaints. You can complain to a data protection authority, in particular:
- in France: the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr;
- in the United Kingdom: the Information Commissioner’s Office (ICO), ico.org.uk;
- in another EU or EEA country: the authority of the country where you live, work, or where the issue occurred.
We would appreciate the chance to resolve your concern first at contact@lunabyjaimin.fr.
9. Automated decisions
We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects. Mollie and the payment method you choose may run their own automated fraud and risk checks under their own responsibility; you may contact them about these.
10. Children
Our website and rings are intended for adults. We do not knowingly collect personal data from children under 13, nor from minors under the age set by the law of their country (15 in France, 13 to 16 elsewhere in Europe depending on the country, 18 in India). Our site is not directed to children under 13 within the meaning of the US Children’s Online Privacy Protection Act (COPPA). If you believe a child has sent us personal data, write to contact@lunabyjaimin.fr and we will delete it.
11. Additional information for residents of the United States
This section applies to residents of US states with consumer privacy laws, including California (CCPA as amended by the CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others. It also serves as our notice at collection.
Categories of personal information we collected in the last 12 months, from the sources and for the purposes described in sections 2 and 3:
| Category | Examples | Disclosed for a business purpose to |
|---|---|---|
| Identifiers | Name, email, postal address, phone, Instagram username, IP address | Service providers and contractors (section 4), carriers, payment providers |
| Customer records (Cal. Civ. Code §1798.80(e)) | Name, address, phone, limited payment information (payment method, card brand and last four digits) | Service providers, carriers, payment providers |
| Commercial information | Products ordered, order history, returns | Service providers, carriers, customs, payment providers |
| Internet or network activity | Web-server logs | Our host |
| Audio, visual or similar information | Photos and videos you send for a custom design | Our atelier |
We do not collect sensitive personal information as defined by these laws, and we do not use personal information to infer characteristics about you. Retention: see section 6.
No sale, no sharing, no targeted advertising. We do not sell personal information, we do not “share” it for cross-context behavioural advertising, we do not use it for targeted advertising, and we do not profile consumers in furtherance of decisions with legal or similarly significant effects. We have not done so in the last 12 months. We have no actual knowledge of selling or sharing personal information of consumers under 16. We honour Global Privacy Control (GPC) browser signals as a request to opt out, although there is nothing to opt out of.
Your rights, depending on your state: to know what personal information we collected, used and disclosed, and to access it; to delete it; to correct it; to receive a portable copy; to opt out of sale, sharing, targeted advertising and profiling (we do none of these); to limit the use of sensitive personal information (we collect none); and not to be discriminated against for exercising these rights.
How to make a request. Email contact@lunabyjaimin.fr with the subject “US privacy request”. We will confirm receipt within 10 business days and answer within 45 days (extendable once by 45 days, with notice). We will verify your identity by matching the information you give with what we hold (for example your email and an order number). You may use an authorised agent, who must provide your signed permission; we may still ask you to confirm your identity.
Appeals. If we refuse your request, you may appeal by replying to our answer with the subject “Appeal”. We will respond within 45 days (60 days in Colorado). If you are not satisfied, you may contact your state Attorney General.
California “Shine the Light”. We do not disclose personal information to third parties for their own direct-marketing purposes.
12. Additional information for users in India
For buyers in India, we are a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act) and its Rules.
- Personal data and purposes: as described in sections 2 and 3. We process your data because you gave it voluntarily for a specific purpose (your order or request) (section 7(a) DPDP Act), or with your consent where we ask for it, or to comply with law.
- Your rights: to obtain a summary of your personal data and of the processing, and the identities of the Data Fiduciaries and Data Processors we shared it with; to have it corrected, completed, updated or erased; to withdraw consent as easily as you gave it; to grievance redressal; and to nominate a person to exercise your rights in case of death or incapacity.
- Grievances: write to contact@lunabyjaimin.fr. We acknowledge grievances within 48 hours and resolve them within the period set by law, and in any case within 90 days.
- Complaint: if you are not satisfied with our answer, you may complain to the Data Protection Board of India.
- Transfers: your data are processed in India, France and the EU as described in section 5.
- Children: we do not knowingly process data of anyone under 18 without verifiable parental consent.
13. Changes to this policy
We may update this policy when our services or the law change. The date at the top shows the latest version. If a change significantly affects how we use data you have already given us, we will tell you by email or on the site before it applies, and ask for your consent where the law requires it.