Privacy policy

Privacy Policy

Last updated: 2 November 2026

1. Data controller

Lunary Agency, digitalni marketing in spletne storitve, Žana Žižek s.p.
Sv. Ana v Slov. goricah 3, 2233 Sv. Ana v Slov. goricah, Slovenia
Registration number: 9125744000, VAT ID: SI40529037
Email: hello@moon-loom.com

This policy explains how we process personal data when you use moon-loom.com, place an order or contact us. We process data in line with the General Data Protection Regulation (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2).

2. What we process, why, and on what basis

  • Orders and delivery: name, contact and delivery details, order and payment status. We need these to perform our contract with you (Art. 6(1)(b) GDPR). Without them we cannot fulfil your order.
  • Accounting and legal duties: invoices and order records. We must keep these by law (Art. 6(1)(c) GDPR).
  • Customer support, returns and complaints: your messages and order details, to perform our contract and meet legal duties and, where needed, to protect our legal claims (Art. 6(1)(b), (c) and (f) GDPR).
  • Email and SMS marketing: your contact details and how you interact with our messages, based on your consent (Art. 6(1)(a) GDPR). We may also email existing customers about our similar products where the law allows, based on our legitimate interest (Art. 6(1)(f) GDPR). You can opt out at any time, free of charge.
  • Cart reminders: your contact details and cart contents, only where you have given the required consent or the law otherwise allows it.
  • Reviews: your name, review and order details if you choose to submit a review, based on your consent (Art. 6(1)(a) GDPR).
  • Website security and operation: device, browser and IP data, based on our legitimate interest in keeping the store secure and working (Art. 6(1)(f) GDPR).
  • Analytics and advertising: cookie and pixel data about how you use the site and respond to ads, based on your consent where required (Art. 6(1)(a) GDPR).

We do not ask for health information. Please do not send it to us unless you need to for a specific enquiry. We do not make decisions about you that are solely automated and have legal or similarly significant effects.

3. Who receives your data

We share data only as needed for the purposes above, with:

  • Store platform and store apps: Shopify, and apps that provide store functions such as product bundles, offers, variants and pop-ups (Selleasy, Dealeasy, Candy Rack, Bundles, SA Variants, Pop Convert).
  • Payment providers shown at checkout.
  • Delivery: GLS and other carriers used for your order.
  • Email and SMS: Klaviyo and CartBoss.
  • Reviews: Judge.me.
  • Analytics and advertising: Meta (Facebook and Instagram), Google (including YouTube and Google Ads) and Pinterest.
  • Affiliate tracking: Simple Affiliate.
  • Accountants, advisers and public authorities where necessary or required by law.

4. Transfers outside the EEA

Some providers process data outside the European Economic Area, including in the United States and Canada. In those cases, we rely on an adequacy decision of the European Commission or on Standard Contractual Clauses. You can ask us for details of these safeguards.

5. How long we keep data

  • Invoices and accounting documents: for the period required by law, generally 10 years for invoices.
  • Order and complaint data: for as long as needed to perform the contract and until claims can no longer be brought.
  • Marketing data: until you withdraw consent or opt out. We keep a record that you opted out so we can respect it.
  • Reviews: until you ask us to remove them, unless we need to keep them for a legal reason.
  • Cookies: for the period shown in your browser or cookie settings.

6. Cookies and similar technologies

We use cookies needed for the store to work, such as those for the cart and checkout. Analytics, marketing and advertising cookies and pixels are used only with your consent where required. You can change your choice in the cookie settings where they are available, and in your browser.

7. Your rights

You have the right to access your data, have it corrected or erased, restrict its processing, receive it in a portable format, and object to processing based on legitimate interests. You can object to direct marketing at any time. Where processing is based on consent, you can withdraw consent at any time. This does not affect processing carried out before you withdrew.

To exercise these rights, email hello@moon-loom.com. We reply within one month, and may need to confirm your identity first.

You can also complain to the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, or to the data protection authority in your own country.

8. Children

Our store is not directed at children. We do not knowingly collect data from children under 15 without the consent of a parent or guardian. If you think we have, please contact us.

9. Security and changes

We use appropriate technical and organisational measures to protect personal data, but no system is completely secure. We publish any changes to this policy on this page and update the date above.