Legal
Privacy notice
How LaLuxury collects, uses and protects your personal data — and what you can ask us to do with it.
Last updated 6 September 2026
This notice covers everything you do on this site: browsing, ordering, creating an account, signing up to the list, and contacting us. It is written to the EU and UK General Data Protection Regulation and to Ghana’s Data Protection Act, 2012 (Act 843).
Who is responsible for your data
LaLuxury, Accra, Ghana is the data controller — we decide why and how your personal data is used.
Privacy questions and requests go to laluxurys@laluxurys.com. We answer within one month, as the GDPR requires.
What we collect, why, and on what basis
We do not collect anything we have no use for, and every purpose below has a lawful basis behind it.
| What | Why | Lawful basis |
|---|---|---|
| Name, phone number and password (hashed, never stored in the clear) | Creating and securing your account | Performance of a contract |
| A one-time code sent to your phone | Proving the number is yours, and keeping other people out of your account | Performance of a contract, and our legitimate interest in preventing fraud |
| Delivery address, email, order contents and order notes | Taking payment, packing the order and getting it to you | Performance of a contract |
| Payment result and reference (we never see or store your card or wallet PIN) | Confirming an order is paid, and handling disputes | Performance of a contract, and a legal obligation to keep sales records |
| Email address given to the newsletter, and the marketing box on sign-up | Sending you new arrivals and restocks | Your consent, withdrawable at any time |
| Messages you send us, by form, email or WhatsApp | Answering you | Our legitimate interest in running a shop that replies |
| Pages and products viewed, if you allow analytics cookies | Understanding what to stock more of | Your consent |
| Server logs and security records, including IP address | Keeping the site up and detecting abuse | Our legitimate interest in the security of the service |
Where the basis is consent, you can withdraw it whenever you like and it costs you nothing: marketing is a switch on your account and an unsubscribe link on every message, and cookie choices are changed with the link. Withdrawing consent does not undo anything done lawfully before you withdrew it.
We do not sell your data, and we make no decisions about you by automated means alone that would have a legal or similarly significant effect.
Who else processes it
We use a small number of service providers. They act on our written instructions, may only use the data to do the job we gave them, and are bound to protect it.
| Processor | What it does | Where |
|---|---|---|
| Paystack | Takes card, Mobile Money and bank payments | Nigeria / South Africa |
| Vynfy | Sends the one-time codes and order text messages | Ghana |
| Railway | Hosts the site and the database | United States / EU |
| Cloudinary | Stores and serves product photography | United States / EU |
| Our email provider | Delivers receipts and replies | Depends on the provider in use |
| Meta (WhatsApp Business) | Carries WhatsApp conversations, if you start one | United States / Ireland |
| Slack | Notifies our team of new orders and messages | United States |
| Anthropic / OpenRouter | Powers the assistant that drafts replies to customer messages | United States |
| Couriers and delivery partners | Deliver your order — they get your name, address and phone number only | Ghana |
We also disclose data where the law requires it — to tax authorities, or in response to a valid legal order.
Sending data outside Ghana and the EEA
Some of those providers are outside Ghana and outside the European Economic Area. Where personal data moves to a country without an adequacy decision, the transfer is covered by the European Commission’s Standard Contractual Clauses in the provider’s data processing agreement, together with encryption in transit and at rest. You can ask us for a copy of the safeguards that apply to a particular transfer.
How long we keep it
| Record | Kept for |
|---|---|
| Account details | Until you ask us to close the account, then deleted within 30 days |
| Orders, invoices and payment records | Six years from the end of the tax year, as accounting law requires |
| One-time verification codes | Minutes — they expire and are discarded; we never store the code itself |
| Marketing list membership | Until you unsubscribe |
| Contact messages | Two years after the conversation ends |
| Cookie consent record | Six months, then we ask again |
| Server and security logs | 90 days |
Closing an account does not delete an order that we are legally required to keep a record of. What we keep in that case is the minimum the law asks for.
Your rights
You can ask us to:
- Give you a copy of the personal data we hold about you, and tell you what we do with it.
- Correct anything that is wrong or out of date.
- Delete it, where we have no overriding reason to keep it.
- Restrict what we do with it while a dispute about it is resolved.
- Hand it over to you or to another provider in a portable, machine-readable form.
- Stop — object to processing we do on the basis of legitimate interests, and to direct marketing at any time, with no reason needed.
- Withdraw consent you previously gave, without affecting what was done before.
Email laluxurys@laluxurys.com with what you want and we will action it within one month, free of charge. We may ask you to confirm your identity first, so that nobody else can use these rights to get at your data.
If you think we have got it wrong, tell us and we will try to put it right. You also have the right to complain to a supervisory authority — Ghana’s Data Protection Commission, or the authority in your EU or UK country of residence.
Security
Traffic runs over HTTPS. Passwords are stored as bcrypt hashes and never in readable form. Sessions are held in a signed, HTTP-only cookie. Card and Mobile Money credentials are entered on Paystack’s own screens and never touch our servers. Access to the back office is limited to staff who need it, is role-restricted, and is logged.
Cookies
Only strictly necessary cookies are set before you choose. What each one does, and how to change your mind, is in the cookie policy.
Children
This shop is not aimed at children, and we do not knowingly hold data about anyone under 16. If you believe we do, tell us and we will delete it.
Changes
When this notice changes we update the date at the top. If the change is significant — a new purpose, or a new category of recipient — we will ask for your consent again where consent is the basis, and tell account holders directly.