Privacy policy

Privacy Policy

Last updated: August 18, 2026

CLAUZZET.LUX ("we", “us”, “our”) operates this website and all related e-commerce services (the “Services”). The Services are hosted on Shopify’s e-commerce infrastructure.

This policy sets out how we collect, use, disclose and protect your personal data. If any conflict arises between our Terms of Service and this Privacy Policy, this policy prevails for all personal data matters.

By using the Services, you confirm you have read and understood this policy.

1. Personal Data We Collect

“Personal data” means information that identifies or can be reasonably linked to you. We collect the following categories:

1.1 Information you provide directly

  • Full name, billing and shipping address, phone number, email address
  • Payment details and transaction records
  • Order details, purchase history, return and exchange records
  • Content of customer service enquiries and order notes

1.2 Information collected automatically

  • Device type, browser version, operating system, language settings
  • IP address, unique device identifiers, cookie IDs
  • Browsing behaviour: pages viewed, products clicked, session duration, referral sources, search queries
  • Click and interaction metrics

We collect automated data via:

  • Cookies: text files stored on your device to recognise repeat visits
  • Server logs: records of IP address, entry/exit pages and timestamps
  • Web beacons and pixels: files to measure engagement and ad performance

1.3 Voluntarily submitted information

Account credentials, wishlists, marketing preferences and contact form submissions.

2. How We Use Your Personal Data

We process personal data for the following purposes. For EEA/UK users, the legal basis under GDPR is noted:

  1. Order fulfilment – process payments, arrange delivery, send confirmations, handle returns and support requests.Legal basis (EEA/UK): performance of a contract (Art. 6(1)(b))
  2. Security and fraud prevention – verify identity, detect fraud and unlawful activity, protect platform integrity.Legal basis (EEA/UK): legitimate interests (Art. 6(1)(f)); legal obligation (Art. 6(1)(c))
  3. Service improvement – analyse user behaviour, optimise website performance, personalise product recommendations.Legal basis (EEA/UK): legitimate interests (Art. 6(1)(f))
  4. Marketing – send promotional emails and SMS, serve targeted ads on third-party platforms.Legal basis (EEA/UK): consent (Art. 6(1)(a)) or legitimate interests where permitted
  5. Legal compliance – meet statutory obligations, respond to lawful authority requests, enforce our terms.Legal basis (EEA/UK): legal obligation (Art. 6(1)(c))

3. How We Share Personal Data

We only share data with third parties under the following circumstances. All service providers are required to implement appropriate data security measures.

  • Service providers: Shopify, payment processors, logistics partners, cloud hosts, IT vendors and support tools, strictly to deliver the Services.
  • Advertising partners: pseudonymised device and browsing data shared with ad networks (Google, Meta) for targeted ads and performance measurement.
  • Legal requirements: disclosure required by law, court order, subpoena or government request, or to protect our rights and safety.
  • Business transfers: data may transfer in a merger, acquisition, asset sale or insolvency. We will notify you before data becomes subject to a different privacy policy.
  • With your consent: disclosure where you have explicitly requested or agreed to it.

We do not sell, rent or license your personal data to third parties for their own independent marketing purposes.

3.1 Shopify

Shopify provides our e-commerce platform. For certain platform-level activities (cross-merchant fraud prevention, security, personalised advertising), Shopify acts as an independent data controller.

For Shopify-controlled processing, Shopify is responsible for its own compliance. To learn more or exercise rights directly with Shopify, visit:

4. Targeted Advertising

We use your browsing and purchase data to show you relevant ads and promotions.

How to opt out

Opting out does not remove all ads; it stops ads tailored to your behaviour.

Google Analytics

We use Google Analytics to measure site usage. Google processes data under its own privacy policy: https://www.google.com/intl/en/policies/privacy/. To opt out of Google Analytics, install the official browser add-on: https://tools.google.com/dlpage/gaoptout.

5. Cookies and Tracking Technologies

We use cookies and similar technologies to operate the Services and remember your preferences.

Cookie categories:

  • Necessary cookies: required for core functions such as checkout sessions. Cannot be disabled.
  • Analytics cookies: collect anonymous usage data to improve site performance.
  • Marketing cookies: enable personalised ads and conversion tracking.
  • Functional cookies: remember your language, currency and other preferences.

You can manage cookies via your browser settings. Disabling some cookies may reduce site functionality. General cookie guidance: http://www.allaboutcookies.org

6. SMS Messaging Privacy

If you opt in to our SMS program, we only use your phone number to send order updates and agreed promotional messages.

We do not sell, lease or monetise your mobile number for third-party marketing. We may share numbers only with trusted service providers under confidentiality obligations.

You may opt out at any time by replying “STOP”. Standard carrier rates apply.

7. Data Security

We maintain physical, technical and organisational safeguards to protect personal data against unauthorised access, alteration or disclosure.

Payment security: We do not store full card numbers or CVV on our servers. All transactions are processed via PCI-DSS compliant gateways using TLS encryption. Card data is sent directly to our payment processor.

No data transmission over the internet can be guaranteed 100% secure.

8. Data Retention

We retain data only as long as required for the purposes set out in this policy and to meet legal obligations. Standard retention periods:

  • Order and transaction records: 7 years (Hong Kong tax and commercial records requirement)
  • Account data: duration of active account plus reasonable post-closure period
  • Marketing contact data: until you opt out, or 3 years after last interaction
  • Device and browsing data: 12 months, then anonymised or deleted
  • Support correspondence: 3 years from last contact

9. International Data Transfers

Your data may be transferred to, stored and processed in jurisdictions outside your country of residence, including Hong Kong SAR, the United States, Canada and other locations where Shopify and our service providers operate.

For transfers from the EEA or UK to non-adequate jurisdictions, we use European Commission Standard Contractual Clauses (SCCs) or UK International Data Transfer Agreements (IDTAs).

10. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights. Rights are subject to legal exceptions. We will verify your identity before processing requests.

10.1 General rights

  • Access: request a copy of your personal data
  • Rectification: correct inaccurate or incomplete data
  • Erasure: request deletion of your data, subject to legal retention obligations
  • Data portability: request a machine-readable copy of your data for transfer
  • Opt out of targeted advertising: via our opt-out page: https://clauzzetlux.com/pages/data-sharing-opt-out

10.2 EEA and UK residents

Additional rights under applicable data protection law:

  • Right to object: object to processing based on our legitimate interests
  • Right to restrict processing: request limitation of processing in specified circumstances
  • Right to withdraw consent: withdraw consent at any time; withdrawal does not affect prior lawful processing

If you are dissatisfied with our response, you may complain to your local data protection authority. EEA authority list: https://edpb.europa.eu/about-edpb/about-edpb/members

10.3 U.S. state residents

If you reside in California, Colorado, Connecticut, Virginia, Utah or other U.S. state with applicable privacy law, you may have:

  • The right to know categories of data we collect, use and disclose
  • The right to request deletion of your data
  • The right to opt out of “sale” or “sharing” of data for targeted advertising
  • The right to non-discrimination for exercising your privacy rights

California residents may request details of third-party direct marketing disclosures under California Civil Code Section 1798.83. Contact us via the details below.

10.4 Hong Kong residents

We process personal data in compliance with the Personal Data (Privacy) Ordinance (PDPO). You have the right to:

  • Access and correct your personal data
  • Request erasure of your data, subject to legal obligations
  • Opt out of direct marketing use of your data, free of charge

11. Global Privacy Control and Do Not Track

If you enable the Global Privacy Control (GPC) signal in your browser, we will treat it as a valid opt-out request for sale/sharing of data for targeted advertising, as required by applicable U.S. state law, for the relevant browser and device.

We do not recognise generic “Do Not Track” signals, as there is no uniform industry standard.

12. Children’s Privacy

The Services are not intended for children under 13. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has provided data, please contact us for deletion.

We do not knowingly sell or share personal data of individuals under 16.

13. Third-Party Websites

The Services may contain links to external websites and platforms. We do not control or take responsibility for third-party privacy practices. Please review the privacy policy of each site you visit.

14. Policy Updates

We may revise this policy from time to time to reflect changes in practice or legal requirements. The updated version will be posted on this page with a revised “Last updated” date. Material changes will be notified as required by law.

15. Contact Us

For questions, complaints or privacy rights requests, contact us:

Email: info@clauzzetlux.com

Address: 760 Cheung Sha Wan Road, D38, 4/F, Cheung Sha Wan, Kowloon, Hong Kong SAR

CLAUZZET.LUX is the data controller for the purposes of applicable data protection laws.

EEA/UK users: Contact us by email to obtain details of our designated EU/UK GDPR representative.