Privacy policy

Version of 20 October 2026.

Who is responsible for your data

Lunéa, Lda, Caminho da Várzea da Mó Grande n.º 840, 3270-088 Pedrógão Grande, Portugal — NIPC 519 163 028 — contact@wonderluneya.com.

The principle behind everything else

This shop handles three things that have neither the same status nor the same useful life: your details as a buyer, the child's first name you entrust to us to make your copy, and a minimal record of that production kept in case it is disputed. We keep them strictly apart: the child's first name never enters our accounts or appears on the invoice, and it is never kept longer than necessary at each stage.

What data, why, and for how long

Data	Why	Legal basis	Retention
The child's first name, in plain text, in the print file	To compose and print your copy	Performance of the contract with you; with regard to the child, legitimate interest, with a written balancing test (see below)	File deleted from our server 24 hours after the printer downloads it
Proof record of your order (cryptographic fingerprint of the first name, never in readable form)	To be able to show, in case of dispute, which first name was approved and printed	Legitimate interest (establishment, exercise or defence of legal claims)	3 years after shipping if there is no dispute; if there is a dispute, until it is closed and all appeals are exhausted
Encrypted first name attached to the order (at Shopify)	Technical consequence of the order; Shopify never receives or stores it other than encrypted	Legitimate interest	Made permanently unreadable, for us as for Shopify, once the key for that period is destroyed (see below) — the order line itself remains in the Shopify history like any order
Name, delivery address and phone number, on our server	To pass your order to the printer	Performance of the contract	Deleted from our server as soon as the printer has accepted the order (usually a few minutes after payment)
Print file and delivery data, at the printer	To print and ship your copy; to handle any quality complaint	Performance of the contract; after shipping, legitimate interest (handling a quality complaint or a reprint)	File deleted by the printer no later than 90 days after shipping, with no backup copy. The printer then keeps, for its own accounts, the order data needed for its invoicing (order number, name and delivery address — never the child's first name) for the period required by the accounting and tax laws of its country
Name, delivery address and phone number, in the order (Shopify)	To deliver the order; the phone number is required by the carrier for delivery	Performance of the contract	Kept with the order for the legal retention period for accounting records (ten years)
Billing details	Invoicing, accounting and tax obligations	Legal obligation	Ten years
Email address	Order confirmation, tracking, customer service	Performance of the contract	Kept with the order (ten years); never used for marketing without your consent

Without the first name, the delivery address, the phone number and the email address, we cannot make or deliver your order: this information is necessary to enter into the contract.

We never add these periods together. A proof record kept for three years after shipping does not become five years because a dispute starts in the second year — it is extended until that dispute is closed, and no further.

How the first name is technically protected

The first name you enter is encrypted directly in your browser before it is sent (RSA-OAEP public-key encryption). Our sales platform (Shopify) receives and stores it only in this encrypted form, unreadable to Shopify and to anyone who does not hold the corresponding private key. This private key is held only by us, on our own server.

We renew this key periodically. Once all orders for a period have been made, delivered, not disputed, and the retention period for the proof record has expired, the private key for that period is destroyed. The encrypted form remaining in the Shopify history then becomes permanently unreadable — including to us.

What we do with the child's first name, step by step

You enter it on the book page; it is shown to you exactly as it will be printed and you confirm it before payment. It is encrypted in your browser before it reaches us.
After payment, our server decrypts it and composes the print file for your copy. The first name is never written to our database or to our technical logs.
Our server sends you a confirmation email showing the first name that will be printed (Shopify cannot do this, since it never receives it in plain text). This email is sent from our address contact@wonderluneya.com, whose mailbox is hosted by IONOS SE (Germany). Our server keeps no copy of it.
Our server then passes the order to the printer: your name, your delivery address, your phone number and a secure link to the print file. For delivery in the European Union or Norway, the printer is Drukātava (Latvia); your email address is not passed to it (only our shop's address appears on the order). For delivery in the United Kingdom, the United States or Canada, the order goes through Cloudprinter.com and a partner printer in the country of delivery. As soon as the printer has accepted the order, your delivery address is deleted from our server.
24 hours after the printer downloads it, the print file is deleted from our server. We do not keep the first name in plain text anywhere else; the printer deletes its own copy within the period shown in the table above. If a reprint is needed later — including under the legal guarantee — we will ask you to give us the first name again. This is free of charge and does not reduce any of your rights.
When the parcel is handed to the carrier, our server receives the tracking number from the printer and adds it to your order at Shopify, which sends you the shipping email. To do this, our server reads in Shopify only the technical shipping references of your order.
All that then remains is a pseudonymised proof record (see below) and, at Shopify, the encrypted form, made unreadable once the key is destroyed.

The book never reveals the child's sex and nowhere indicates which of the twenty thousand printed first names is the one you chose. The child's first name is never used for marketing, profiling or automated decision-making, and is never disclosed to any third party beyond what is strictly necessary to make and deliver your copy.

The proof record of your order

To be able to respond to a dispute about the first name actually printed, we keep separately, with restricted access, a technical record of the personalisation you approved before payment (order reference, cryptographic fingerprint of the approved first name, language, timestamp, version of the terms and conditions accepted). This record never contains the first name in directly readable form: it makes it possible to check a match in the event of a dispute, not to recover the first name from it.

Why the child's first name has a separate legal basis

Your own details (name, address, billing) are processed to perform the contract you enter into with us. The child's first name is the very subject of the personalisation you order; but the child is not a party to the contract. With regard to the child, we process it on the basis of our legitimate interest in making the personalised product you order from us, after balancing the purpose (making a personalised gift that you yourself chose to entrust to us), the necessity (there is no less intrusive way to compose a game book whose solution is this specific first name) and the safeguards in place for the child (encryption, restricted access, minimal retention, no marketing or profiling, the child's sex never revealed).

Who else is involved

Shopify International Limited (Ireland) — shop hosting and order processing, on our behalf (processor); receives and stores the first name only in encrypted form. Our shop also uses the “Shopify Network Intelligence” services: for these services (analytics, shop personalisation and, only if you accept it in the cookie banner, targeted advertising), Shopify processes certain data about your use of the shop and your purchases under its own responsibility, as a controller, and may combine it with data from other Shopify shops; no other merchant can see your data. The same applies if you yourself use a Shopify consumer service (for example the Shop app or Shop Pay). The child's first name is never involved, since Shopify only receives it encrypted. To find out more and to exercise your rights with Shopify: Shopify consumer privacy policy and Shopify privacy portal.
OVH SAS (France) — hosting of our server, which decrypts the first name and composes the print file.
IONOS SE (Germany) — mailbox for our address contact@wonderluneya.com, from which the confirmation email containing the first name is sent.
Drukātava (Latvia) — printer of copies delivered in the European Union and Norway; receives the print file and your delivery data (without your email address) and hands the parcel to the carrier FedEx.
Cloudprinter.com (Netherlands) — print-on-demand platform for copies delivered in the United Kingdom, the United States and Canada; the printing itself is done by a partner printer in the country of delivery (see “Transfers outside the European Economic Area” below).
Moloni (Portugal) — certified invoicing software, which issues invoices from the order's billing data; it never receives the child's first name.

These providers act on our behalf, as processors within the meaning of Article 28 GDPR. The payment provider shown at checkout and the carriers (FedEx in the European Union and Norway) process the data needed for payment and delivery under their own responsibility. We never have access to your full bank details. Billing data is sent to the Portuguese tax authority as required by law.

Transfers outside the European Economic Area

For orders delivered in the European Union or Norway, your copy is printed in Latvia by Drukātava: your data does not leave the European Economic Area. For orders delivered in the United Kingdom, the United States or Canada, it is printed locally, by a Cloudprinter.com partner printer located in the country of delivery, which then receives the print file and your delivery data. These transfers rely on an adequacy decision of the European Commission where the country has one, and otherwise on the appropriate safeguards provided for by the GDPR, in particular standard contractual clauses. You can ask us for a copy of these safeguards at contact@wonderluneya.com. For the processing it carries out under its own responsibility, Shopify may transfer certain data to other countries, in particular Canada and the United States, under the conditions described in its own privacy policy.

Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability over your data and, as legal representative, over your child's. You can exercise them at contact@wonderluneya.com. You can also lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese supervisory authority, or with the authority of your country of residence.

Cookies

The shop uses the cookies necessary for it to work (cart, session, security). Analytics and advertising cookies, if enabled, are only set with your consent, collected through the banner shown on your first visit; you can withdraw this consent at any time from that same banner.