Privacy policy

This website is operated by [Company legal name] LLC ([Street, Area], Dubai, United Arab Emirates, trade licence [Trade licence number]). We are responsible for the personal data you share with us. Questions about privacy can be sent to hello@lulua-fragrance.ae.

• Account details: name, email address and a securely hashed password. We cannot see your password.
• Order details: delivery name, phone number, address, the items you buy and the amounts paid.
• Payment: card payments are handled entirely by our payment provider. We receive only a payment reference and status — never your card number.
• Messages: what you send us through the contact or feedback forms.
• Technical data: the minimum needed to keep the site working and secure, such as session cookies and, for security logs, your IP address.

• To process, deliver and support your orders.
• To run your account, including password resets and order history.
• To prevent fraud and protect the site (for example, limiting repeated login attempts).
• To send marketing emails — only if you opted in. You can opt out at any time.
• To meet our legal obligations, such as keeping invoices.

We use only the cookies the shop needs to work:

• sid — keeps you signed in (30 days).
• cart — remembers a guest's shopping cart.
• order_access — lets a guest view the order they just placed.

We do not use advertising or cross-site tracking cookies.

Your browser also keeps a random visitor number (lulua-visitor, in local storage, not a cookie). While a page is open it tells us which page is being viewed so we can see how many people are in the shop right now. It is not linked to your name, account or IP address and is forgotten by our server after about a minute.

We never sell your data. We share it only with the companies that help us run the shop — our delivery partner (name, phone and address), our payment provider (for card payments), and our hosting and email providers — and only as much as they need. We may disclose information when required by UAE law.

Account data is kept while your account is active. Order records are kept for as long as UAE accounting and tax rules require. Security logs are deleted after a limited period.

In line with the UAE Personal Data Protection Law, you may ask to access, correct or delete your personal data, or object to marketing. Email us and we'll respond within 30 days. Some data (such as invoices) may need to be kept for legal reasons.

The site runs over HTTPS. Passwords are stored as one-way hashes, sessions use secure cookies, and access to customer data is limited to staff who need it. Every admin action is logged.

If we change this policy we'll update the date at the top of this page.