Privacy Information of LUIBAN GmbH (as of October 2026)

Below we inform you about the processing of personal data by LUIBAN GmbH in accordance with the General Data Protection Regulation (GDPR). If you have any questions, you can contact us at any time at the address given in section 2.

1. Overview

Data processing by LUIBAN GmbH falls essentially into two categories:

Performance of contracts: We process data that is required to carry out your purchase. This includes the transfer of data to logistics partners (e.g. DHL), payment service providers (e.g. Stripe, PayPal) and services for checking the delivery address (Google, OpenStreetMap).
Website optimisation & marketing: When you visit our website, technical data is exchanged in order to make the site secure and user-friendly and (with your consent) to carry out anonymised analyses.

2. Name and Contact Details of the Controller

Controller: LUIBAN GmbH, Rosa-Luxemburg-Str. 28, 10178 Berlin, Germany.
E-mail: info@luiban.com. Website: www.luiban.com

3. Details of Data Processing

3.1 Accessing the Website

When you visit the site, log files (IP address, date, browser type) are stored automatically. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in security and stability). The data is deleted after 90 days.

3.2 Performance of Contracts and Payment Services

To perform the purchase contract (Art. 6(1)(b) GDPR), we process your name, address, e-mail address and payment data.

3.2.1 Shipping by DHL

We pass your address data on to DHL (Deutsche Post AG). We transmit your e-mail address for the parcel notification only where this is necessary for the performance of the contract or on the basis of your legitimate interest in tracking the shipment.

3.2.2 Payment Service Provider Stripe

If you choose a payment method provided by Stripe, the payment data you enter is transmitted to Stripe (Stripe Payments Europe Ltd., Ireland). In this respect, Stripe acts in part as an independent controller. Stripe may process data for identity verification and fraud prevention. Details can be found in the Stripe Privacy Policy.

3.2.3 Payment Service Provider PayPal

If you pay via PayPal, we pass your order data on to PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. PayPal reserves the right to carry out a credit check. Mathematical and statistical methods (score values) are used for this purpose. Details: PayPal Privacy Statement.

3.2.4 Checking the Delivery Address

To ensure that your order arrives and is not returned to us as undeliverable, we automatically check the delivery address after receiving your order. We do not check again an address to which we have already delivered successfully.

For the check, we transmit only the address components street, house number, postcode, town and country. We do not transmit your name, your e-mail address or your order data. The check is run from our own server in Germany; your IP address is not passed on in the process.

Google Address Validation: For delivery addresses in the countries covered by the service, we use the address validation of the Google Maps Platform. The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes the transmitted address data as an independent controller; Google’s Privacy Policy (https://policies.google.com/privacy) and the Google Maps Additional Terms of Service (https://maps.google.com/help/terms_maps/) apply. This may involve a transfer to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework; an adequacy decision of the EU Commission therefore exists for the USA (Art. 45 GDPR).
OpenStreetMap (Nominatim): For delivery addresses in countries not covered by Google, we compare postcode, town and street with the public Nominatim service. The provider is the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom, acting as an independent controller (privacy policy: https://osmfoundation.org/wiki/Privacy_Policy). An adequacy decision of the EU Commission exists for the United Kingdom.

If the check reveals only an obvious spelling or formatting error (e.g. spelling of the street, house number in the wrong field, format of a Packstation address), we correct the address on your delivery. We do not change the address stored in your customer account. If the address is unclear, a member of our staff checks it and we contact you by e-mail. No decision based solely on the automated check that would have legal effects for you is made.

The legal basis is Art. 6(1)(b) GDPR (performance of the purchase contract, insofar as we correct your delivery address) and Art. 6(1)(f) GDPR. Our legitimate interest lies in avoiding misdeliveries, returns and the associated costs and delays; this is also in your interest.

We store the result of the check only until the address has been clarified, for a maximum of 30 days. After that, only a record without address data (checksum, result, date) remains. The corrected delivery address is stored with your order in accordance with the statutory retention periods.

You may object to the checking of your address by external services (see section 4). In that case, we check your address internally only.

3.3 Advertising and Newsletter

We use your data for direct marketing (Art. 6(1)(f) GDPR) unless you have objected to this. You can object to the use of your data for advertising purposes at any time (see section 3.3.3).

3.4 Online Presence and Analysis

3.4.1 Cookies

We use technically necessary cookies (session cookies) and (if you consent) analysis cookies. You can deactivate cookies in your browser at any time.

3.4.2 Google Analytics

We use Google Analytics for web analysis. IP addresses are anonymised. As data may be transferred to the USA, this is done on the basis of standard contractual clauses and the EU-U.S. Data Privacy Framework.

3.4.3 Own Web Analysis (LUIBAN Analytics)

In addition to Google Analytics, we use our own, self-hosted analysis tool to better understand how our website is used and to improve our offering. The following data is collected:

Page views: URL, page title, time spent on the page, scroll depth
Technical data: screen resolution, browser window size, browser language
Interactions: clicks on buy buttons and marked elements
Product views: which product pages are visited (item name, price)
Origin: referrer URL and UTM campaign parameters

The data is stored on our own server in Germany (Hetzner, Falkenstein) and is not passed on to third parties. IP addresses are pseudonymised before storage (hash rotated daily). No cookies are set; sessions are assigned exclusively via your browser’s session storage and end when you close the browser tab.

Logged-in customers: If you are logged in to your customer account, your customer number is additionally recorded in pseudonymised form (one-way hash) in order to recognise repeat visits across several sessions. Re-identification is possible only by us and serves to improve our product range and service.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in optimising our online shop). You can object to this data collection at any time by contacting us at the address given in section 2.

3.5 Recipients outside the EU

Some of our service providers (e.g. Google, Stripe, Cloudflare) have their headquarters in the USA. We base transfers to the USA on the adequacy decision of the EU Commission on the EU-U.S. Data Privacy Framework, insofar as the recipient is certified under it, and otherwise on the standard contractual clauses of the EU Commission (Art. 46(2)(c) GDPR). An adequacy decision of the EU Commission exists for the OpenStreetMap Foundation in the United Kingdom (Art. 45 GDPR).

3.6 CAPTCHA (Cloudflare Turnstile)

To protect our forms (e.g. contact form, newsletter sign-up) against abusive requests by bots and automated scripts, we use Cloudflare Turnstile. The provider is Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA.

Turnstile analyses the behaviour of the website visitor on the basis of various characteristics (e.g. IP address, time spent on the page, mouse movements) in order to recognise whether an entry originates from a human or a bot. The data collected in this process is transferred to Cloudflare servers, which may also be located in the USA. We have concluded a data processing agreement (DPA) and the standard contractual clauses of the EU Commission with Cloudflare to ensure an adequate level of data protection.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest consists in protecting our web services against spam and abusive automated use.

Further information can be found in Cloudflare’s privacy policy: https://www.cloudflare.com/privacypolicy/

4. Your Rights

You have the right of access, rectification, erasure and restriction of processing of your data as well as the right to data portability.

Right to object: Insofar as we process your data on the basis of Art. 6(1)(f) GDPR (e.g. checking the delivery address, section 3.2.4; web analysis, section 3.4.3), you may object at any time on grounds relating to your particular situation. You may object to the use of your data for direct marketing (section 3.3) at any time without giving reasons. A message to info@luiban.com is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).