Privacy Policy.

Last updated: 10 October 2026

This policy explains what personal data we collect, why, and the rights you have under the GDPR and the Dutch GDPR Implementation Act (UAVG).

In plain English: we collect only what we need to sell you a Vault, hold a call or deliver a service. No tracking cookies, no data selling. Your Vault tools save to your own browser, not to us. You can ask us to see or delete your data at any time.

1. Who is responsible for your data

The data controller is G.d.Sales, trading as Lunazure, registered with the Dutch Chamber of Commerce (KvK) under number 88991199, Lena Blok-Woutsstraat 35, 3066 GK Rotterdam, the Netherlands. Contact: gillroy@lunazuremarketing.com.

2. What we collect

When you buy a Vault: Lemon Squeezy, our reseller, collects your name, email, country, billing details and payment information. We receive your name, email, country and order details. We never see your full card details.
When you book a fit call: Calendly collects your name, email and any answers you give in the booking form.
When you email us or reply to our emails: your name, email address and what you write.
When you become a client: business contact details, billing information, and the information, assets and account access you provide for the Services.
When you visit the site: our host, Netlify, processes technical data such as IP address, browser type and pages requested, to deliver and secure the site. Our fonts load from Google Fonts, which means your browser sends your IP address to Google.
In the Vaults: features such as your test board, saved fields and checklist are stored only in your own browser's local storage. That data stays on your device and is never sent to us.

We don't use analytics, advertising or tracking cookies on this site.

3. Why we use it, and our legal basis

To deliver your Vault, its updates and support — performance of our contract with you (Art. 6(1)(b) GDPR).
To hold fit calls and prepare proposals — steps you ask us to take before a contract (Art. 6(1)(b)).
To deliver the Services — performance of our contract (Art. 6(1)(b)).
To send Vault buyers a few emails about using the Vault and about our related services — our legitimate interest and the existing-customer exception in Article 11.7 of the Dutch Telecommunications Act (Art. 6(1)(f)). Every email has a one-click way to opt out, and opting out never affects your access.
To keep invoices and accounting records — legal obligation (Art. 6(1)(c)).
To keep the site secure and prevent fraud or misuse of Vault links — our legitimate interest (Art. 6(1)(f)).

We don't sell your data, and we don't use it for automated decisions that have legal or similarly significant effects on you.

We share personal data only with providers who help us run Lunazure, under contracts that protect it:

Lemon Squeezy — checkout, payments, tax and invoicing (it also acts as an independent controller for payment data);
Calendly — call scheduling;
Netlify — website and Vault hosting;
Google — web fonts;
contractors and team members who help deliver the Services, bound by confidentiality — some of whom may be based outside the European Economic Area;
professional advisers and authorities where the law requires it.

For the outbound Services, we process prospect data on our clients' behalf as their processor, under a separate data processing agreement.

5. International transfers

Some of these providers and contractors are located outside the EEA, including in the United States and the Philippines. Where that happens, we rely on an adequacy decision (such as the EU–US Data Privacy Framework, for certified US providers) or the European Commission's Standard Contractual Clauses, with additional safeguards where needed.

6. How long we keep it

Purchase and invoicing records: seven years, as Dutch tax law requires.
Vault buyer contact details: for as long as you have access to the Vault, so we can send updates.
Fit-call and prospect details: up to 24 months after our last contact, unless you become a client.
Client records: for the engagement and up to seven years afterwards for legal claims and accounting.
Website server logs: kept by Netlify for a short period, in line with its own policy.

7. Your rights

You can ask us to access, correct, delete, restrict or transfer your personal data, and you can object to our processing based on legitimate interest, including direct marketing at any time. Where we rely on consent, you can withdraw it at any time. Email us and we'll respond within one month.

You also have the right to complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or the authority in your own country.

8. Security

We use reputable providers, strong passwords and two-factor authentication on our accounts, and limit access to people who need it. No system is perfectly secure, but we'll tell you and the authorities promptly if a breach affects you, as the law requires.

9. Children

Our products and services are for businesses and adults. We don't knowingly collect data from anyone under 18.

10. Changes to this policy

We'll update this policy when our practices change; the date at the top shows the latest version. We'll email you about significant changes that affect you.

11. Contact

For any privacy question or request: gillroy@lunazuremarketing.com.