Legal
Privacy policy
LUNA&MAX is a trade name of Alta Badia BV. We respect your privacy and only process personal data where we need it to do business with you. This policy explains what we collect, why, and what your rights are.
1. Who is responsible
Alta Badia BV, Postbus 58, 5268 ZH Helvoirt, the Netherlands (Chamber of Commerce 99674610) is the controller for the processing described here. For any privacy question, e-mail info@lunamax.eu.
2. What data we collect
- Shelf plan requests. When you use the form on our retailer page: your name, retail chain, work e-mail address, country and number of stores.
- E-mail and calls. When you contact us: your name, contact details and the content of your message.
- Appointments. When you book a call through our online calendar: your name, e-mail address and the time you choose.
- Technical data. When you visit the website, our hosting provider automatically processes your IP address, browser type and the pages you request, to deliver and secure the website.
We do not ask for, and do not want to receive, sensitive personal data.
3. Why we use it, and on what basis
- To prepare a shelf plan or proposal you requested, and to follow up on it: steps prior to entering into a contract and our legitimate interest in doing business with retailers.
- To answer your questions: our legitimate interest in responding to contacts.
- To run, secure and improve the website: our legitimate interest in a working, safe website.
- To meet legal obligations, such as tax record-keeping: legal obligation.
We do not sell your data and do not use it for automated decision-making or profiling.
4. Who we share it with
We only share data with service providers that help us run our business, under a data processing agreement: our website host, our e-mail provider, the service that processes our request form and our online calendar tool. We may also share data where the law requires it.
5. Fonts
This website loads its fonts from Google Fonts. When a page loads, your browser connects to Google servers, which receive your IP address. Google may process this data outside the European Economic Area.
6. Transfers outside the EEA
Where a service provider processes data outside the European Economic Area, we make sure appropriate safeguards are in place, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
7. How long we keep it
- Requests and correspondence with prospects: up to 2 years after our last contact.
- Data of customers: for the duration of the business relationship, and financial records for the statutory period of 7 years.
- Server logs: up to 90 days.
8. Cookies
This website does not use tracking or advertising cookies, and does not use analytics.
9. Security
We take appropriate technical and organisational measures to protect your data, including an encrypted (HTTPS) connection and restricted access to our systems.
10. Your rights
You have the right to access, correct or delete your data, to restrict or object to its processing, and to receive your data in a portable format. You can exercise these rights by e-mailing us. We respond within one month. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
11. Changes
We may update this policy. The latest version is always published on this page.
Last updated: 23 October 2026