Last updated: 7 November 2026
1. Who we are
This privacy policy explains how stem.lu collects and uses personal information when you visit our website, purchase products, create an account or contact us.
The controller responsible for your personal information is:
- Legal name: Aumint.io SARL-s
- Business address: 6 Rue Jean-Pierre Pierrard, 4279 Esch-sur-Alzette, Luxembourg
- Privacy contact: dpo@aumint.io
We process personal information in accordance with the General Data Protection Regulation (GDPR) and applicable Luxembourg data-protection and electronic-communications legislation.
2. Our approach to privacy
We aim to collect only the information needed to operate our website, fulfill orders, respond to enquiries and meet our legal obligations.
We use short retention periods for routine shop data and distinguish those periods from longer retention required for accounting or other legal purposes.
Optional advertising tracking is separate from purchasing or contacting us. You do not need to accept marketing tracking to place an order or submit an enquiry.
3. Information we collect and why
Orders and customer service
When you place an order, we process information such as your name, email address, billing and delivery addresses, telephone number where required, products ordered and transaction details.
We use this information to:
- Process and fulfill your order.
- Arrange delivery or collection.
- Send order and service communications.
- Handle returns, refunds, warranties and customer enquiries.
The legal basis is performance of our contract with you, or taking steps at your request before entering into a contract.
Customer accounts
You may purchase as a guest without creating an account. If you choose to create an account after checkout, we process the information needed to manage your account and provide access to its features. New users receive an email link to set up their password.
The legal basis is performance of the account service you request.
Enquiries and bookings
When you contact us, we process the contact details and information you provide so that we can respond and arrange any requested services.
The legal basis is taking steps at your request before entering into a contract, or our legitimate interest in responding to other correspondence.
Please provide only information relevant to your request.
Payments
Payments are processed through Stripe.
We receive the payment status and transaction information needed to manage orders, refunds and accounting. Payment providers process payment information under their own applicable privacy notices.
https://stripe.com/en-nl/privacy
Accounting and legal obligations
We process and retain the information necessary to comply with bookkeeping, tax and other applicable legal requirements.
The legal basis is compliance with legal obligations.
Website operation and security
Our website and hosting systems process technical information, such as: IP addresses, request timestamps, browser details and security logs, where needed to deliver the website, diagnose faults and prevent misuse.
The legal basis is our legitimate interest in maintaining a functioning and secure website. Where information is stored on or accessed from your device, we obtain consent unless an applicable exemption covers that operation.
4. Cookies, Meta Pixel and advertising measurement
Necessary website functions
We use cookies or similar technologies necessary to operate requested website functions, such as maintaining your shopping basket, supporting checkout, managing login sessions and remembering your privacy choices.
Optional Meta Pixel tracking
We use Meta Pixel, provided by Meta Platforms Ireland Limited, to measure the effectiveness of our advertising on Facebook and Instagram and understand interactions with our website.
Our Meta Pixel dataset ID is 1175829251463572.
When you accept marketing tracking, Meta Pixel may transmit information about your visit and interactions to Meta. Depending on the events configured on our website, this may include pages visited, actions taken, browser and device information, IP address and online identifiers.
Meta may associate this information with information it already holds, including information associated with a Facebook or Instagram account, in accordance with its applicable terms and privacy policy.
Enabled additional features
Our Meta configuration includes the following optional features:
Automatic inclusion of additional page and product information
We enable Meta’s feature for automatically including more detailed page and product information.
This feature uses artificial intelligence to identify and send additional website details, such as basic page information, reviews and pricing, alongside existing Meta Pixel data.
Conversion measurement on customer devices
We have enabled Meta’s feature for measuring advertising conversions on customers’ devices. Meta currently indicates that measurement under this feature will begin on 12 November 2026.
According to Meta’s description of this feature, conversion measurement takes place on the customer’s device rather than exclusively on Meta’s servers. This does not mean that all Meta Pixel processing takes place solely on your device or that no information is transmitted to Meta.
Other optional features
All other optional features in the Meta settings reviewed for this policy are disabled.
This describes our Meta settings, not an independent guarantee about every third-party integration. Any material change to our tracking configuration will be reflected in this policy and, where required, in our consent choices before activation.
Your choice and consent
Meta advertising tracking is optional. We activate it only after you accept marketing tracking through our cookie-consent controls.
You can reject marketing tracking and still browse our website, purchase products and contact us.
You can change your choice or withdraw consent for future tracking at any time. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
Retention and information received by Meta
The short retention periods configured in our WooCommerce shop apply to information held in that shop. They do not determine how long Meta retains information it has already received.
Deleting or anonymising a WooCommerce order does not automatically delete corresponding information held by Meta. Meta’s processing and retention are governed by its applicable terms and privacy information.
Further information and international transfers
For information about Meta’s processing, privacy controls and applicable arrangements, see:
5. Who receives your information
We disclose information where necessary to provide our services, operate the website or meet legal obligations.
Recipients may include:
- Website hosting and technical support: Aumint.io SARL-s.
- Payment processing: Stripe.
- Delivery services: Depends on the address can be Post.lu, Post.fr, and any other delivery service.
- Meta, when you consent to the relevant tracking.
- Public authorities where disclosure is legally required.
Providers receive only the information relevant to their services or legal responsibilities.
6. How long we retain information
Our WooCommerce shop is configured with the following retention periods:
| Record category | Configured period | Scheduled cleanup action |
|---|---|---|
| Inactive customer accounts | 3 months of inactivity | Eligible inactive accounts are deleted. |
| Pending orders | 3 days | Eligible orders are moved to the trash. |
| Failed orders | 5 days | Eligible orders are moved to the trash. |
| Cancelled orders | 1 day | Eligible orders are moved to the trash. |
| Refunded orders | 3 months | Personal information in eligible orders is anonymised. |
| Completed orders | 3 months | Personal information in eligible orders is anonymised. |
Cleanup is scheduled rather than instantaneous. Moving an order to the trash is not the same as permanently deleting it. Sales information that no longer identifies a person may remain for reporting.
These shop settings do not automatically remove information from payment providers, email correspondence, accounting systems, exports or backups.
Stripe-related information
Our website also has a “Retain Stripe Data” setting configured to three days.
Accounting records and legal exceptions
We retain invoices, credit notes and other legally required accounting records separately for the applicable statutory period—generally 10 years from the end of the relevant financial year under Luxembourg accounting rules.
We may retain specific information longer where necessary to handle an unresolved complaint, warranty, refund, dispute or legal claim. Such exceptions do not justify retaining unrelated information indefinitely.
Enquiries, logs and backups
- Website and security logs: 3 months.
- Backups: 1 year.
Backup copies may remain until their scheduled expiry. Where a backup is restored, applicable deletion and retention rules will be reapplied.
7. Information concerning children
Our products and activities may be intended for children, but purchases and bookings should be made by an adult.
Please do not provide a child’s personal information unless it is necessary to arrange the requested activity. In particular, avoid including unnecessary health information or other sensitive details in general enquiry fields.
8. How we protect information
We apply technical and organisational measures appropriate to the nature of the information and the risks involved.
These measures include – encrypted connections, restricted administrative access, multifactor authentication, software updates and protected backups.
No website or transmission method can guarantee absolute security.
9. Your rights
Depending on the circumstances and applicable legal conditions, you have the right to:
- Obtain access to your personal information.
- Request correction of inaccurate or incomplete information.
- Request erasure of information.
- Request restriction of processing.
- Receive certain information in a portable format.
- Object to processing based on legitimate interests.
- Withdraw consent where processing relies on consent.
These rights are subject to applicable conditions and exceptions. For example, we may need to retain accounting records even when you request deletion of your customer account.
To exercise your rights, contact dpo@aumint.io. We may request proportionate information to verify your identity.
We normally respond within one month. Where GDPR permits an extension, we will inform you within that initial period and explain the reason.
You may lodge a complaint with Luxembourg’s Commission nationale pour la protection des données (CNPD), at https://cnpd.public.lu, or another competent supervisory authority.
10. Required information
Fields marked as required are necessary to process the relevant order or request. If you do not provide that information, we may be unable to fulfil the order or respond appropriately.
Marketing tracking is optional and is not a condition of purchasing.
11. Changes to this policy
We may update this policy when our services, providers or processing practices change. The current version and its update date will appear on this page.