Privacy Policy

1. Introduction

Luxotics ("we", "us", "our") is an online retail store based in Sri Lanka selling watches and handbags. This policy explains what personal information we collect when you use our website, why we collect it, how long we keep it, and what rights you have over it.

This policy applies to [INSERT WEBSITE DOMAIN — e.g. www.luxotics.lk] and to any orders placed through it. It is written to comply with Sri Lanka's Personal Data Protection Act No. 9 of 2022.

The data controller responsible for your information is [INSERT REGISTERED COMPANY NAME AND BUSINESS REGISTRATION NUMBER], of [INSERT REGISTERED BUSINESS ADDRESS].

2. Information We Collect

We only collect information we actually need to run the store. Here is every category we collect and why.

Information you give us

• Name — to identify your account, address you personally, and label your deliveries.
• Email address — to create your account, send order confirmations and delivery updates, allow password resets, and (only if you opt in) send offers.
• Phone number — so we and our delivery partners can contact you about your order.
• Billing and delivery address — to deliver your order and to issue an accurate invoice.
• Password — stored only as a one-way hash, never as readable text. See section 9.

Information from Google Sign-In

• Google account ID — a unique identifier used to link your Google account to your Luxotics account so you can sign in again.
• Name and email address from your Google profile — to create the account without you having to type them.
• Profile picture — the link to your Google profile picture is included in the sign-in response. We do not currently store or display it. [CONFIRM — update this line if you begin storing or showing profile pictures]

We never receive your Google password. See section 4 for the limits on how we use this data.

Information created by using the store

• Order history — what you bought, when, for how much, and the delivery status. Needed to fulfil orders, handle returns and warranty claims, and meet tax and accounting obligations.
• IP address — recorded for security, fraud prevention and abuse investigation.
• Device and browser information — device type, operating system, browser and screen size, used to make the site work correctly on your device and to diagnose faults.
• Cookies — see section 6.

3. How We Use Your Information

We use your information to:

• Create and secure your account, and sign you in.
• Process, pack and deliver your orders, and keep you updated on their progress.
• Handle returns, refunds, warranty claims and customer support enquiries.
• Detect and prevent fraud, abuse and unauthorised access.
• Meet our legal, tax and accounting obligations in Sri Lanka.
• Understand how the store is used so we can improve it.
• Send marketing messages — only if you have opted in, and you can opt out at any time.

We do not sell your personal information to anyone, and we do not use it for automated decision-making or profiling that produces legal effects for you.

4. Google Sign-In and Google User Data

If you choose to sign in with Google, we receive a limited set of information from your Google account, as listed in section 2.

We use the data received through Google Sign-In only to create your Luxotics account and to authenticate you when you sign in. We do not use it for advertising, we do not sell it, and we do not transfer it to third parties except as strictly necessary to provide the service, comply with the law, or as part of a merger or acquisition.

Luxotics' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Luxotics from your Google account at any time through your Google account permissions page. Doing so stops future Google Sign-In access; to remove data we already hold, see section 11.

5. Payments and Card Data

Payments are handled entirely by [INSERT PAYMENT GATEWAY NAME], a PCI-DSS compliant payment provider.

We never collect or store your full card number, CVV or card expiry date. When you pay by card, those details are entered directly with the payment gateway and are never transmitted to or held on our systems.

What we do store against your order is limited to the payment method used, whether the payment succeeded or failed, and a payment reference supplied by the gateway so we can reconcile and refund the transaction.

The payment gateway processes your data under its own privacy policy: [INSERT PAYMENT GATEWAY PRIVACY POLICY URL].

6. Cookies

Cookies are small files stored by your browser. We use them for these purposes:

• Essential cookies — keep you signed in, remember your shopping cart and wishlist, and protect forms against cross-site request forgery. The store cannot work without these.
• Preference cookies — remember choices such as your selected currency.
• Analytics cookies — help us understand which pages are visited and where people run into problems, so we can improve the store. Provider: [INSERT ANALYTICS PROVIDER — e.g. Google Analytics, or "none"].

You can block or delete cookies in your browser settings. If you block essential cookies, signing in and checking out will stop working.

7. Who We Share Your Data With

We share only what is necessary, only with the following categories of third party, and only so they can perform a service for us:

• Payment gateway ([INSERT PAYMENT GATEWAY NAME]) — receives the payment amount and the details you enter to authorise the transaction.
• Courier and delivery partners ([INSERT COURIER PARTNER NAMES]) — receive your name, delivery address and phone number so they can deliver your order.
• Hosting provider ([INSERT HOSTING PROVIDER NAME AND COUNTRY OF HOSTING]) — stores the website and its database on our behalf.
• Analytics provider ([INSERT ANALYTICS PROVIDER — e.g. Google Analytics, or "none"]) — receives usage data as described in section 6.
• Email service provider ([INSERT EMAIL SERVICE PROVIDER NAME]) — sends order confirmations, password resets and notifications.
• Authorities — where we are legally required to disclose information.

We do not sell, rent or trade your personal information.

8. How Long We Keep Your Data

We keep personal data only as long as we need it for the purpose it was collected, or as long as the law requires.

• Account details (name, email, phone, Google account ID, profile picture) — kept while your account is open, and deleted [INSERT PERIOD — e.g. 30 days] after you close it.
• Addresses — kept while your account is open, or until you delete them.
• Order and invoice records — kept for [INSERT RETENTION PERIOD — e.g. 6 years] to meet Sri Lankan tax and accounting requirements, even after an account is closed.
• Payment references — kept with the order record for the same period, for reconciliation and refunds.
• IP address, device and server logs — kept for [INSERT PERIOD — e.g. 90 days], then deleted.
• Marketing consent records — kept until you withdraw consent, plus [INSERT PERIOD — e.g. 2 years] as proof the consent was given.

9. How We Protect Your Data

• Encryption in transit — the site is served over HTTPS, so data between your browser and us is encrypted.
• Hashed passwords — passwords are stored as one-way hashes. Nobody at Luxotics can read your password, and we cannot recover it for you — only reset it.
• Access control — administrative access to customer data is restricted to authorised staff on a role basis, and admin accounts support two-factor authentication.
• Card data isolation — card details never reach our systems at all, as described in section 5.

No system is completely secure. If a data breach occurs that is likely to affect your rights, we will notify you and the relevant authority as required by the Personal Data Protection Act.

10. Your Rights Under the Personal Data Protection Act

Under the Personal Data Protection Act No. 9 of 2022, you have the following rights over your personal data:

• Right of access — ask us to confirm what personal data we hold about you and receive a copy of it.
• Right of correction — ask us to correct data that is inaccurate, incomplete or out of date. You can also edit most of it yourself in your account.
• Right of deletion — ask us to delete your personal data, subject to records we are legally required to keep (see section 8).
• Right to withdraw consent — where we rely on your consent, such as marketing emails, you can withdraw it at any time. This does not affect processing carried out before you withdrew it.
• Right to object — object to processing of your data for a particular purpose, including direct marketing.

How to exercise these rights

Email info@luxotics.lk with the subject line "Data request", telling us which right you want to exercise. We may ask you to verify your identity before we act, so that we do not disclose your data to someone else.

We will respond within [INSERT RESPONSE PERIOD — e.g. 21 days]. If you are not satisfied with our response, you may complain to the Data Protection Authority of Sri Lanka.

11. Deleting Your Account

You can delete your account yourself from your profile settings, or by emailing info@luxotics.lk.

When your account is deleted:

• Your name, email, phone number, saved addresses, password hash, Google account link, cart and wishlist are removed.
• You are signed out and can no longer sign in, including through Google.
• Order and invoice records are retained for the period in section 8 because Sri Lankan tax and accounting law requires it. Where possible these are reduced to the minimum needed for that legal purpose.
• Deletion is permanent. We cannot restore a deleted account or its order history to you afterwards.

12. Children

Luxotics is not intended for children. You must be at least [INSERT MINIMUM AGE — e.g. 18] years old to create an account or place an order. We do not knowingly collect personal data from anyone under that age. If you believe a child has given us their data, contact us and we will delete it.

13. Changes to This Policy

We may update this policy as the store or the law changes. The "Last updated" date at the top always shows the current version. If a change materially affects how we use your data, we will give notice by [INSERT NOTIFICATION METHOD — e.g. email to registered customers and a banner on the website] before it takes effect.

14. Contact Us

For any question about this policy or your personal data:

• Email: info@luxotics.lk
• Phone: +94 11 234 5678
• Postal address: [INSERT REGISTERED BUSINESS ADDRESS]
• Or use our contact form.