Last updated: 18/07/2026
“This translation is provided for information purposes only. In the event of a dispute, only the French version shall prevail.”
Table of contents
- Introduction
- Data controller
- Data we collect
- Purposes and legal bases of processing
- Recipients of your data
- International transfers
- Data retention
- Your rights
- Cookies and similar technologies
- Data security
- Protection of minors
- Changes to this policy
- Contact
1. Introduction
SAKEPIXEL S.à r.l.-S, whose registered office is located at 13, rue Anna Lindh, L-4547 Differdange, Luxembourg (hereinafter “ekomfort“, “we“, “our“), operates the website ekomfort.lu (hereinafter “the Site“).
ekomfort is an online store for responsible fashion that makes sustainable brands accessible to consumers in Luxembourg, France, Germany and Belgium.
We are committed to protecting your privacy and your personal data. This Privacy Policy describes how we collect, use, share and protect your personal data when you use our Site, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation — “GDPR“) and applicable Luxembourg law.
2. Data controller
The controller of your personal data is:
- SAKEPIXEL S.à r.l.-S
- Address: 13, rue Anna Lindh, L-4547 Differdange, Luxembourg
- E-mail: [email protected]
- Phone: +352 661 201 619
Data protection contact point
SAKEPIXEL S.à r.l.-S has not appointed a Data Protection Officer (DPO). For any question relating to the processing of your personal data or the exercise of your rights, you may contact our data protection contact point:
- E-mail: [email protected]
- Postal address: Data Protection — SAKEPIXEL S.à r.l.-S, 13, rue Anna Lindh, L-4547 Differdange, Luxembourg
3. Data we collect
3.1 Data you provide to us directly
| Category | Data | When collected |
|---|---|---|
| Identity | Surname, first name, title | Account creation |
| Contact | E-mail address, phone number | Account creation, order |
| Address | Postal address (delivery and billing) | Order |
| Account | Username, password (hashed) | Account creation |
| Payment | Bank card details* | Order |
| Orders | Purchase history, preferences | Use of the Site |
| Communication | Messages to customer service, reviews | Contact, after-sales |
| Preferences | Size, style, favourite brands | Use of the Site |
* Bank card details are processed directly by our payment provider Stripe and are never stored on our servers. See the Stripe Privacy Policy.
3.2 Data collected automatically
| Category | Data | Technology |
|---|---|---|
| Browsing | Pages visited, time spent, browsing path | Cookies, server logs |
| Technical | IP address, browser type, operating system, screen resolution | Server logs |
| Device | Device identifier, type (mobile/desktop) | Cookies, fingerprinting |
| Geolocation | Country, region (approximate, based on IP) | IP address |
3.3 Data received from third parties
| Source | Data | Purpose |
|---|---|---|
| Stripe | Payment confirmation, transaction status | Order processing |
| Carriers | Delivery status, receipt confirmation | Delivery tracking |
4. Purposes and legal bases of processing
| Purpose | Legal basis (Art. 6 GDPR) | Details |
|---|---|---|
| Management of your account | Performance of a contract (Art. 6(1)(b)) | Creation, management and deletion of your user account |
| Processing of your orders | Performance of a contract (Art. 6(1)(b)) | Order handling, payment, delivery, invoicing |
| After-sales service | Performance of a contract (Art. 6(1)(b)) | Handling of returns, refunds, complaints |
| Personalisation of your experience | Legitimate interest (Art. 6(1)(f)) | Product recommendations, tailored content |
| Fraud prevention | Legitimate interest (Art. 6(1)(f)) | Detection and prevention of payment fraud |
| Legal obligations | Legal obligation (Art. 6(1)(c)) | Retention of invoices (10 years — Luxembourg commercial law), tax obligations, responses to official requests |
| Dispute management | Legitimate interest (Art. 6(1)(f)) | Gathering of evidence, legal defence |
| Improvement of the Site | Legitimate interest (Art. 6(1)(f)) | Testing, bug fixing, performance optimisation |
5. Recipients of your data
Your personal data may be disclosed to the following categories of recipients, in strict compliance with the data minimisation principle:
5.1 Internal recipients
- Sales, customer service, logistics, marketing, technical and management teams
5.2 Processors
| Processor | Function | Country |
|---|---|---|
| Stripe Payments Europe Ltd | Payment processing | Ireland (group established in the United States — standard contractual clauses) |
| Hostinger International Ltd | Site hosting | Cyprus (servers located in the EU) |
| Cloudflare Inc. | CDN and security | United States (standard contractual clauses) |
| EU logistics partner | Order preparation and dispatch | Portugal |
| [TRANSPORTEUR] | Parcel delivery | LU, FR, BE, DE |
| Google LLC | Fonts (Google Fonts) loaded when the Site is displayed | United States |
No audience analytics tool or marketing e-mail service is currently active.
Each processor is bound by a data processing agreement (Art. 28 GDPR) guaranteeing an adequate level of protection.
5.3 Authorities
Your data may be disclosed to the competent authorities (tax administration, judicial authorities) where we are legally required to do so.
6. International transfers
Some of our processors may be established outside the European Economic Area (EEA). In that case, we ensure that your data benefits from an adequate level of protection through one of the following mechanisms:
- Adequacy decision of the European Commission (Art. 45 GDPR)
- Standard contractual clauses (SCCs) adopted by the European Commission (Art. 46(2)(c) GDPR)
- Approved binding corporate rules (BCRs) (Art. 47 GDPR)
| Processor | Country | Transfer mechanism |
|---|---|---|
| Stripe Payments Europe Ltd | Ireland (group established in the United States) | Standard contractual clauses |
| Cloudflare Inc. | United States | Standard contractual clauses |
| Google LLC | United States | EU-US Data Privacy Framework adequacy decision |
You may obtain a copy of the appropriate safeguards by contacting us at [email protected].
7. Data retention
| Data category | Retention period | Justification |
|---|---|---|
| Account data | Duration of the account + 3 years after the last activity | Civil limitation period (Luxembourg) |
| Order data | 10 years after the order | Legal accounting obligation (Luxembourg Commercial Code, Art. 16) |
| Billing data | 10 years | Legal tax obligation |
| Payment data (Stripe) | In accordance with Stripe’s policy | Processor |
| Delivery data | Time required for delivery + 3 years | Dispute management |
| Prospecting data | 3 years after the last contact | CNPD / CNIL recommendation |
| Customer service data | 5 years after the file is closed | Statutory limitation period |
| Withdrawal data | 5 years | Commercial limitation period |
| Connection logs | 1 year | Legal obligation (Luxembourg law) |
At the end of these periods, your data is deleted or irreversibly anonymised.
8. Your rights
In accordance with the GDPR, you have the following rights:
| Right | Description | GDPR article |
|---|---|---|
| Access | Obtain confirmation of processing and a copy of your data | Art. 15 |
| Rectification | Correct inaccurate or incomplete data | Art. 16 |
| Erasure (“right to be forgotten”) | Obtain the deletion of your data in certain cases | Art. 17 |
| Restriction | Obtain the restriction of processing in certain cases | Art. 18 |
| Portability | Receive your data in a structured, machine-readable format | Art. 20 |
| Objection | Object to processing based on legitimate interest | Art. 21 |
| Withdrawal of consent | Withdraw your consent at any time, without affecting the lawfulness of prior processing | Art. 7(3) |
| Automated decision-making | Not be subject to a decision based solely on automated processing | Art. 22 |
How to exercise your rights
You can exercise your rights in several ways:
- By e-mail: [email protected]
- By post: SAKEPIXEL S.à r.l.-S, Data Protection, 13, rue Anna Lindh, L-4547 Differdange, Luxembourg
- From your account: “My personal data” section (for access, rectification, account deletion and portability)
We respond to your request within one month of receiving it. This period may be extended by two further months where the complexity of the request justifies it (we will inform you).
Proof of identity may be requested in the event of reasonable doubt as to your identity.
Lodging a complaint with a supervisory authority
If you consider that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority:
| Country | Authority | Website |
|---|---|---|
| Luxembourg | Commission Nationale pour la Protection des Données (CNPD, the Luxembourg data protection authority) | cnpd.public.lu |
| France | Commission Nationale de l’Informatique et des Libertés (CNIL, the French data protection authority) | cnil.fr |
| Belgium | Autorité de Protection des Données (APD, the Belgian data protection authority) | autoriteprotectiondonnees.be |
| Germany | Bundesbeauftragte(r) für den Datenschutz (BfDI, the German Federal Data Protection Commissioner) and the authorities of the Länder | bfdi.bund.de |
9. Cookies and similar technologies
We use cookies and similar technologies on our Site. The Site currently uses only technical cookies (session, cart, security) strictly necessary for the operation of the store — no analytics or advertising cookies are set. For detailed information about the cookies we use, their purposes and how to manage your preferences, please see our Cookie Policy.
10. Data security
We implement appropriate technical and organisational measures to protect your personal data against any unauthorised access, alteration, disclosure or destruction, including:
- Encryption of data in transit (TLS/SSL) and at rest
- Strict access control (least-privilege principle)
- Two-factor authentication for administrative access
- Regular encrypted backups
- Regular security testing
- Staff training in data protection
- Processing agreements including security obligations (Art. 28 GDPR)
Payment data is processed by Stripe, certified PCI DSS Level 1, the highest level of security certification in the payments industry.
11. Protection of minors
The Site is not intended for persons under the age of 16. We do not knowingly collect personal data from minors under 16. If we learn that a minor’s data has been collected, we will delete it as soon as possible.
Note: The age of digital consent is 16 in Luxembourg (Art. 8 GDPR, maintained by the law of 1 August 2018). It is 15 in France, 13 in Belgium and 16 in Germany. As a precaution, the threshold of 16 has been adopted.
12. Changes to this policy
We may update this Privacy Policy at any time to reflect changes in our practices or in applicable regulations.
In the event of a substantial change, we will inform you by:
– An information banner on the Site
– An e-mail to the address associated with your account (if you have one)
The “last updated” date at the top of this page will be updated accordingly.
13. Contact
For any question relating to this Privacy Policy or to the processing of your personal data:
- E-mail: [email protected]
- Post: SAKEPIXEL S.à r.l.-S, 13, rue Anna Lindh, L-4547 Differdange, Luxembourg
Legal basis: Regulation (EU) 2016/679 (GDPR), Articles 12, 13 and 14; Luxembourg law of 1 August 2018 organising the CNPD.