1. Controller within the meaning of the GDPR

The controller responsible for the processing of personal data on this website is:

Colour and Life SARL, a limited liability company under Luxembourg law (société à responsabilité limitée)

1 rue des Romains, L-8284 Kehlen, Grand Duchy of Luxembourg

Represented by the managing director (gérante) Christine Kayser

RCS Luxembourg B305842

VAT ID (TVA): LU37446340

Business licence (autorisation d'établissement): N° 10192713 / 0

Email: info@colourand.life

Phone: +352 621 141 873

Website: www.colourand.life

In the following, "we" or "us" refers to Colour and Life SARL as the controller.

 

2. Competent supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is:

Commission nationale pour la protection des données (CNPD)

15 Boulevard du Jazz, L-4370 Belvaux, Luxembourg

Website: www.cnpd.lu

As this website is also directed at audiences in Germany and France, you may alternatively contact the supervisory authority of your habitual residence.

 

3. General information and legal bases

We process personal data only within the framework of applicable data protection law, in particular the GDPR and Luxembourg data protection law. Depending on the processing, we rely on the following legal bases:

• Art. 6(1)(a) GDPR (consent), for example for consent-based analytics and non-necessary cookies.

• Art. 6(1)(b) GDPR (contract or pre-contractual measures), for example for orders in the online shop and the handling of enquiries.

• Art. 6(1)(c) GDPR (legal obligation), for example for tax and commercial retention obligations.

• Art. 6(1)(f) GDPR (legitimate interest), for example for the technically secure operation of the website and technically necessary cookies.

• Art. 8 GDPR for the processing of children's data in the context of personalised works (see section 12).

 

4. Hosting and provision of the website (Wix)

This website is hosted by Wix.com Ltd. Wix provides the technical infrastructure, delivers content via the content delivery domains static.parastorage.com and static.wixstatic.com, and operates the functions Wix Stores (online shop, shopping cart, checkout) and Wix Forms (contact form). For reach and error analysis, Wix uses its own tools (frog.wix.com, Wix Panorama) as well as the error monitoring service Sentry. When the website is accessed, technically necessary cookies are set, namely XSRF-TOKEN and bSession.

Purpose: provision, security and stability of the website. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in technically reliable and secure operation). Wix acts as a processor on our behalf on the basis of a data processing agreement.

 

5. Server log files and technically necessary cookies

When the website is accessed, information transmitted by your browser is processed automatically, in particular the IP address, the date and time of access, the page accessed, the referrer, and browser and operating system details. This processing is necessary for the delivery and security of the website. The technically necessary cookies XSRF-TOKEN and bSession serve session security and protection against attacks. Legal basis: Art. 6(1)(f) GDPR.

 

6. Cookies and consent management (Consent Mode)

This website uses a cookie consent banner. Non-necessary cookies and analytics tools are only set or executed after you have given active consent. We use Google Consent Mode v2, so that Google services are only triggered after your consent. Technically necessary cookies are set regardless of consent because they are essential for the operation of the website.

Your consent is voluntary and can be withdrawn at any time with effect for the future. You can adjust your choices in the consent banner at any time. Legal basis for consent-based cookies: Art. 6(1)(a) GDPR.

 

7. Google Analytics 4 and Google Tag Manager

We use Google Analytics 4 (measurement ID G-J1JQRHBXV7) and Google Tag Manager provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics 4 is used for the statistical analysis of website usage, and Google Tag Manager for managing the tags used.

These services are only loaded and executed after your active consent (Consent Mode v2). Legal basis: Art. 6(1)(a) GDPR. Without consent, no analysis takes place. In the course of their use, data may be transferred to the USA (see section 16). You can withdraw your consent at any time with effect for the future via the consent banner.

We also operate a Google Business Profile. This is located outside this website; Google's privacy information applies to processing carried out within the Google services.

 

8. Online shop and order processing (Wix Stores)

To operate the online shop, we process the data required to perform the contract, in particular name, billing and delivery address, email address, ordered goods, and payment and shipping information. Purpose: conclusion and performance of the purchase contract, including invoicing, shipping and customer communication. Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(c) GDPR for statutory retention obligations.

 

9. Payment service providers

For payment processing we use the following providers, which act as separate controllers or as own processors of Colour and Life SARL. These providers are expressly not sub-processors of our service provider:

• Stripe

• PayPal

• Apple Pay

• Google Pay

Depending on the payment method chosen, the data required for the payment is transmitted to the respective provider. Purpose: processing of the payment. Legal basis: Art. 6(1)(b) GDPR. Data may be transferred to the USA (see section 16).

 

10. Shipping (Post Luxembourg)

To deliver ordered goods, we pass on the necessary shipping data (in particular name and delivery address) to Post Luxembourg and the delivery services engaged. Purpose: delivery of the goods. Legal basis: Art. 6(1)(b) GDPR.

 

11. Contact form (Wix Forms)

If you contact us via the contact form, we process the data you provide (in particular name, email address and your message) in order to handle your enquiry. Legal basis: Art. 6(1)(b) GDPR where the enquiry is aimed at concluding or performing a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).

 

12. Personalised works and processing of children's data

For the creation of personalised works ("Light Guardians" or "Soul Portraits"), we process the name and age of the child. This constitutes children's data within the meaning of Art. 8 GDPR. This data is used exclusively for the creation of the respective work. No transfer for marketing purposes takes place.

Legal basis: Art. 6(1)(b) GDPR in conjunction with Art. 8 GDPR. The information is provided by the person with parental responsibility who places the order. After the work has been created and delivered, the information is deleted as soon as no statutory retention obligations remain.

 

13. Social media

We maintain profiles on Instagram and Facebook (Meta Platforms Ireland Ltd.) as well as on Pinterest (Pinterest Europe Ltd.). No social media plugins and no pixels are currently integrated into this website. Where applicable, there are only simple links to these profiles. Only when you click such a link are you redirected to the respective service, whose privacy information then applies to the processing.

 

14. External partner link (fearite.com)

On the card decks page there is an external link to fearite.com (Cathy Lehmann). When you click it, you leave this website. The processing of your data on the linked site is the responsibility of its operator. We have no influence over the content and data processing of third-party websites.

 

15. Automation (Make, currently inactive)

The service Make (Make.com) is envisaged as a possible future processor for optional automations. Make is currently not engaged, and no data flow from this website passes through Make. Should Make be activated in the future, we will update this privacy policy accordingly before any processing takes place.

 

16. Data transfers to third countries

When using Google services, possible Wix sub-processors, and the payment service providers Stripe and PayPal, personal data may be transferred to the USA. The transfer is based on the EU-US Data Privacy Framework, insofar as the respective recipient is certified, supplemented by the Standard Contractual Clauses (SCC) of the European Commission. An adequate level of data protection is thereby contractually safeguarded.

 

17. Retention period

We store personal data only for as long as is necessary for the respective purposes or as required by statutory retention periods. Contract and invoice data are subject to the statutory commercial and tax retention periods. Data from enquiries and consent-based services are deleted as soon as the purpose ceases to apply or you withdraw your consent and no other legal basis exists.

 

18. Your rights as a data subject

Under the GDPR you have the following rights:

• Right of access (Art. 15 GDPR)

• Right to rectification (Art. 16 GDPR)

• Right to erasure (Art. 17 GDPR)

• Right to restriction of processing (Art. 18 GDPR)

• Right to data portability (Art. 20 GDPR)

• Right to object to processing based on legitimate interests (Art. 21 GDPR)

• Right to withdraw a given consent with effect for the future (Art. 7(3) GDPR), without affecting the lawfulness of processing carried out before the withdrawal

• Right to lodge a complaint with a supervisory authority, in particular the CNPD (Art. 77 GDPR)

To exercise your rights, an informal message to info@colourand.life is sufficient.

 

19. Currency of this privacy policy

This privacy policy is dated 14 July 2026. Further development of the website or changed legal requirements may make an adjustment necessary. The version published on this page applies.