Last updated: 27/10/2026
“This translation is provided for information purposes only. In the event of a dispute, only the French version shall prevail.”
Table of contents
- Introduction
- Data controller
- Data we collect
- Purposes and legal bases of processing
- Recipients of your data
- International transfers
- Data retention
- Your rights
- Cookies and similar technologies
- Data security
- Protection of minors
- Changes to this policy
- Contact
1. Introduction
SAKEPIXEL S.à r.l.-S, whose registered office is located at 13, rue Anna Lindh, L-4547 Differdange, Luxembourg (hereinafter “ekomfort“, “we“, “our“), operates the website ekomfort.lu (hereinafter “the Site“).
ekomfort is an online store for responsible fashion that makes sustainable brands accessible to consumers in Luxembourg, France, Germany and Belgium.
We are committed to protecting your privacy and your personal data. This Privacy Policy describes how we collect, use, share and protect your personal data when you use our Site, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation — “GDPR“) and applicable Luxembourg law.
2. Data controller
The controller of your personal data is:
- SAKEPIXEL S.à r.l.-S
- Address: 13, rue Anna Lindh, L-4547 Differdange, Luxembourg
- E-mail: [email protected]
- Phone: +352 661 201 619
Data protection contact point
SAKEPIXEL S.à r.l.-S has not appointed a Data Protection Officer (DPO). For any question relating to the processing of your personal data or the exercise of your rights, you may contact our data protection contact point:
- E-mail: [email protected]
- Postal address: Data Protection — SAKEPIXEL S.à r.l.-S, 13, rue Anna Lindh, L-4547 Differdange, Luxembourg
3. Data we collect
3.1 Data you provide to us directly
| Category | Data | When collected |
|---|---|---|
| Identity | Surname, first name, title | Account creation |
| Contact | E-mail address, phone number | Account creation, order |
| Address | Postal address (delivery and billing) | Order |
| Account | Username, password (hashed) | Account creation |
| Payment | Bank card details* | Order |
| Orders | Purchase history, preferences | Use of the Site |
| Communication | Messages to customer service, reviews | Contact, after-sales |
| Preferences | Size, style, favourite brands | Use of the Site |
| ekomfort emails | Email address, language, first and last name if you give them at checkout, date and proof of your confirmation, version of the text you accepted; if you answer our optional questions: country of residence, who you choose for, main interest, day and month of your birthday (with your separate consent); if you agreed to it on the “Your preferences” page: the links you click in our emails, and when; your orders and your current basket | Sign-up (home page or checkout), “Your preferences” page, use of the Site |
* Bank card details are processed directly by our payment provider Stripe and are never stored on our servers. See the Stripe Privacy Policy.
3.2 Data collected automatically
| Category | Data | Technology |
|---|---|---|
| Browsing | Pages visited, time spent, browsing path | Cookies, server logs |
| Technical | IP address, browser type, operating system, screen resolution | Server logs |
| Device | Device identifier, type (mobile/desktop) | Cookies, fingerprinting |
| Geolocation | Country, region (approximate, based on IP) | IP address |
3.3 Data received from third parties
| Source | Data | Purpose |
|---|---|---|
| Stripe | Payment confirmation, transaction status | Order processing |
| Carriers | Delivery status, receipt confirmation | Delivery tracking |
4. Purposes and legal bases of processing
| Purpose | Legal basis (Art. 6 GDPR) | Details |
|---|---|---|
| Management of your account | Performance of a contract (Art. 6(1)(b)) | Creation, management and deletion of your user account |
| Processing of your orders | Performance of a contract (Art. 6(1)(b)) | Order handling, payment, delivery, invoicing |
| After-sales service | Performance of a contract (Art. 6(1)(b)) | Handling of returns, refunds, complaints |
| Personalisation of your experience | Legitimate interest (Art. 6(1)(f)) | Product recommendations and tailored content on the Site (not in emails: see “Tailoring our emails”) |
| Fraud prevention | Legitimate interest (Art. 6(1)(f)) | Detection and prevention of payment fraud |
| Legal obligations | Legal obligation (Art. 6(1)(c)) | Retention of invoices (10 years — Luxembourg commercial law), tax obligations, responses to official requests |
| Dispute management | Legitimate interest (Art. 6(1)(f)) | Gathering of evidence, legal defence |
| Improvement of the Site | Legitimate interest (Art. 6(1)(f)) | Testing, bug fixing, performance optimisation |
| Sending our emails | Consent (Art. 6(1)(a)) | A few emails a week at most: new pieces, care tips, offers and welcome code, after double confirmation of your address. You can withdraw your consent at any time using the unsubscribe link in every email, without affecting the lawfulness of earlier mailings. |
| Tailoring our emails | Consent (Art. 6(1)(a)), given when you subscribe; for your clicks, separate consent (Art. 6(1)(a)) given on the “Your preferences” page | We choose the content and timing of our emails according to your answers, your orders and your current basket. We take the links you click into account only if you ticked the “Tailor your emails to my clicks” box on the “Your preferences” page: we then record, under your name, which link you opened and when. You can withdraw this consent at any time by unticking the box: we immediately stop using your clicks and erase those already recorded; you keep receiving our emails. Without this consent, we only count an anonymous total per link. No decision with legal effects on you, or similarly significant effects, results from this (Art. 22). You can also withdraw your consent to any tailoring, without unsubscribing, by writing to [email protected], or stop everything with the unsubscribe link. |
| Basket reminder | Consent (Art. 6(1)(a)) | Only if you subscribe to our emails: we may remind you of a basket left open. Without a subscription, no reminder. |
| Birthday email | Separate consent (Art. 6(1)(a)) | Only if you tick the dedicated box: we keep the day and month, never the year. You can withdraw this at any time on the “Your preferences” page. |
5. Recipients of your data
Your personal data may be disclosed to the following categories of recipients, in strict compliance with the data minimisation principle:
5.1 Internal recipients
- Sales, customer service, logistics, marketing, technical and management teams
5.2 Processors
| Processor | Function | Country |
|---|---|---|
| Stripe Payments Europe Ltd | Payment processing | Ireland (group established in the United States — standard contractual clauses) |
| Hostinger International Ltd | Site hosting | Cyprus (servers located in the EU) |
| Cloudflare Inc. | CDN, security and routing of incoming email (@ekomfort.lu addresses) | United States (standard contractual clauses) |
| EU logistics partner | Order preparation and dispatch | Portugal |
| Spring GDS | Standard parcel delivery | Netherlands |
| DHL Express | Express parcel delivery | Germany |
| FedEx Express | Express parcel delivery | European Union (group established in the United States — standard contractual clauses) |
| Google LLC | Fonts (Google Fonts) loaded when the Site is displayed | United States |
| Amazon Web Services EMEA SARL | Delivery of emails (orders, our emails and customer service replies) via Amazon SES | Luxembourg (servers in Paris; group established in the United States — standard contractual clauses) |
No audience analytics tool is currently active. Our emails are managed with the FluentCRM software, installed on our own server: the subscriber list is not entrusted to any email service provider. If you agreed to it on the “Your preferences” page, our emails record, under your name, the links you click; otherwise we only count an anonymous total per link. No cookie is set when you click a link in our emails, except the subscription confirmation, unsubscribe and “Your preferences” links, which set one to recognise you on those pages without a password (see our cookie policy); we do not measure whether our emails are opened.
Each processor listed in the table above is bound by a data processing agreement (Art. 28 GDPR) guaranteeing an adequate level of protection.
5.3 Customer service
Messages you send to our @ekomfort.lu addresses are routed by Cloudflare (email routing) and then kept in a Gmail mailbox provided by Google Ireland Limited (Ireland). To prepare our replies, we use a writing assistance tool provided by Anthropic Ireland, Limited (Ireland): it suggests a draft reply, which a person reads, corrects and sends. No decision concerning you is made by this tool. Our replies are sent via Amazon SES (Amazon Web Services EMEA SARL). The legal basis is the performance of the contract when your message concerns an order (Art. 6(1)(b) GDPR) and, for writing assistance, our legitimate interest in replying to you promptly (Art. 6(1)(f) GDPR). Google states that it bases transfers to the United States on the EU-US Data Privacy Framework adequacy decision and on standard contractual clauses; Anthropic, on standard contractual clauses. Correspondence is kept for the periods in section 7: ten years when it concerns an order, five years otherwise.
5.4 Authorities
Your data may be disclosed to the competent authorities (tax administration, judicial authorities) where we are legally required to do so.
6. International transfers
Some of our processors may be established outside the European Economic Area (EEA). In that case, we ensure that your data benefits from an adequate level of protection through one of the following mechanisms:
- Adequacy decision of the European Commission (Art. 45 GDPR)
- Standard contractual clauses (SCCs) adopted by the European Commission (Art. 46(2)(c) GDPR)
- Approved binding corporate rules (BCRs) (Art. 47 GDPR)
| Processor | Country | Transfer mechanism |
|---|---|---|
| Stripe Payments Europe Ltd | Ireland (group established in the United States) | Standard contractual clauses |
| Cloudflare Inc. | United States | Standard contractual clauses |
| Google LLC | United States | EU-US Data Privacy Framework adequacy decision |
| Amazon Web Services EMEA SARL | Luxembourg (group established in the United States) | Standard contractual clauses |
You may obtain a copy of the appropriate safeguards by contacting us at [email protected].
7. Data retention
| Data category | Retention period | Justification |
|---|---|---|
| Account data | Duration of the account + 3 years after the last activity | Civil limitation period (Luxembourg) |
| Order data | 10 years from the close of the financial year of the order | Legal retention obligation (Luxembourg Commercial Code, Art. 14 and 16) |
| Billing data | 10 years | Legal tax obligation |
| Payment data (Stripe) | In accordance with Stripe’s policy | Processor |
| Delivery data | Time required for delivery + 3 years | Dispute management |
| Correspondence about an order | 10 years from the close of the financial year of the last message | Legal retention obligation (Luxembourg Commercial Code, Art. 14 and 16) |
| Other customer service exchanges | 5 years after the last message | Legitimate interest: handling your requests |
| Withdrawal data | 10 years from the close of the financial year of the order | Legal retention obligation (Luxembourg Commercial Code, Art. 14 and 16) |
| Connection logs | 1 year | Legal obligation (Luxembourg law) |
| Data related to our emails | For as long as you are subscribed; your clicks, however, are kept for 12 months, then erased at our weekly review, and immediately if you withdraw your consent to their tracking. When you unsubscribe, your answers, your birthday and your clicks are erased within a month; your address and the proof of your consent and of your unsubscription are kept for 3 years, then deleted. A subscription that is never confirmed is deleted after 30 days, at our weekly review. Our automatic backups are replaced within 7 days; a copy made before technical work is erased no later than 30 days afterwards. | Proof of consent (Art. 7(1) GDPR), respecting your unsubscription |
Correspondence relating to a dispute or to a request to exercise your rights is kept until the dispute or request is finally settled, and at least for the periods above.
At the end of these periods, your data is deleted or irreversibly anonymised.
8. Your rights
In accordance with the GDPR, you have the following rights:
| Right | Description | GDPR article |
|---|---|---|
| Access | Obtain confirmation of processing and a copy of your data | Art. 15 |
| Rectification | Correct inaccurate or incomplete data | Art. 16 |
| Erasure (“right to be forgotten”) | Obtain the deletion of your data in certain cases | Art. 17 |
| Restriction | Obtain the restriction of processing in certain cases | Art. 18 |
| Portability | Receive your data in a structured, machine-readable format | Art. 20 |
| Objection | Object to processing based on legitimate interest | Art. 21 |
| Withdrawal of consent | Withdraw your consent at any time, without affecting the lawfulness of prior processing | Art. 7(3) |
| Automated decision-making | Not be subject to a decision based solely on automated processing | Art. 22 |
How to exercise your rights
You can exercise your rights in several ways:
- By e-mail: [email protected]
- By post: SAKEPIXEL S.à r.l.-S, Data Protection, 13, rue Anna Lindh, L-4547 Differdange, Luxembourg
- From your account: “My personal data” section (for access, rectification, account deletion and portability)
We respond to your request within one month of receiving it. This period may be extended by two further months where the complexity of the request justifies it (we will inform you).
Proof of identity may be requested in the event of reasonable doubt as to your identity.
Lodging a complaint with a supervisory authority
If you consider that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority:
| Country | Authority | Website |
|---|---|---|
| Luxembourg | Commission Nationale pour la Protection des Données (CNPD, the Luxembourg data protection authority) | cnpd.public.lu |
| France | Commission Nationale de l’Informatique et des Libertés (CNIL, the French data protection authority) | cnil.fr |
| Belgium | Autorité de Protection des Données (APD, the Belgian data protection authority) | autoriteprotectiondonnees.be |
| Germany | Bundesbeauftragte(r) für den Datenschutz (BfDI, the German Federal Data Protection Commissioner) and the authorities of the Länder | bfdi.bund.de |
9. Cookies and similar technologies
We use cookies and similar technologies on our Site. The Site currently uses only technical cookies (session, cart, security, and recognition on the pages you open from our emails) strictly necessary for the operation of the store — no analytics or advertising cookies are set. For detailed information about the cookies we use, their purposes and how to manage your preferences, please see our Cookie Policy.
10. Data security
We implement appropriate technical and organisational measures to protect your personal data against any unauthorised access, alteration, disclosure or destruction, including:
- Encryption of data in transit (TLS/SSL) and at rest
- Strict access control (least-privilege principle)
- Two-factor authentication for administrative access
- Regular encrypted backups
- Regular security testing
- Staff training in data protection
- Processing agreements including security obligations (Art. 28 GDPR)
Payment data is processed by Stripe, certified PCI DSS Level 1, the highest level of security certification in the payments industry.
11. Protection of minors
The Site is not intended for persons under the age of 16. We do not knowingly collect personal data from minors under 16. If we learn that a minor’s data has been collected, we will delete it as soon as possible.
Note: The age of digital consent is 16 in Luxembourg (Art. 8 GDPR, maintained by the law of 1 August 2018). It is 15 in France, 13 in Belgium and 16 in Germany. As a precaution, the threshold of 16 has been adopted.
12. Changes to this policy
We may update this Privacy Policy at any time to reflect changes in our practices or in applicable regulations.
In the event of a substantial change, we will inform you by:
- An information banner on the Site
- An e-mail to the address associated with your account (if you have one)
The “last updated” date at the top of this page will be updated accordingly.
13. Contact
For any question relating to this Privacy Policy or to the processing of your personal data:
- E-mail: [email protected]
- Post: SAKEPIXEL S.à r.l.-S, 13, rue Anna Lindh, L-4547 Differdange, Luxembourg
Legal basis: Regulation (EU) 2016/679 (GDPR), Articles 12, 13 and 14; Luxembourg law of 1 August 2018 organising the CNPD.