What we collect, and why.

PLACEHOLDER. Name the legal entity operating this store, its registered address, its company registration number, and — where one is required — the data protection officer or regional representative. Until this is filled in, this policy does not identify a controller and is not fit to publish.

This is what the store handles today:

• Account details — your name, email address, and a hashed password. Passwords are never stored in readable form.
• Order details— the items you bought, the amount charged, your shipping address, and the order’s status and tracking number.
• Payment details— handled by our payment providers. Card numbers never reach our servers; we keep only the provider’s reference to the payment and whether it succeeded.
• Marketing — your email address, if you subscribe to the newsletter.
• Technical data — a session cookie that keeps you signed in, and server logs containing IP addresses, used to rate-limit abuse and diagnose faults.

• To take payment, fulfil your order, and email you a confirmation.
• To let you sign in and see your order history, wishlist, and saved addresses.
• To answer support requests.
• To protect the store from fraud and automated abuse.
• To send marketing email — only if you asked for it, and you can stop at any time.

PLACEHOLDER. If your customers are covered by the UK or EU GDPR, state the lawful basis for each purpose above. Take advice rather than copying a list.

We do not sell personal data. We share only what a provider needs to do its job, and only with these categories of processor:

• Our payment providers, to take and confirm payment.
• Our email provider, to send order confirmations and newsletters.
• Our hosting and database providers, which store the data described above.
• Our delivery partners, to get the parcel to you.

PLACEHOLDER.Name each provider and the country it processes data in, and note the safeguard used where data leaves your customers’ region.

Order and payment records are kept for as long as tax and accounting law requires. Account data is kept until you ask us to delete the account. Newsletter subscriptions are kept until you unsubscribe.

PLACEHOLDER. Confirm the exact retention periods your jurisdiction requires and state them here.

You can ask us for a copy of your data, ask us to correct or delete it, or object to how we use it. You can unsubscribe from marketing email from any newsletter we send.

PLACEHOLDER. The exact rights you have, and the regulator you can complain to, depend on where you live. State the rights and supervisory authority that apply to your customers rather than promising a generic set.

This store sets one essential cookie, which keeps you signed in. It is required for the account and checkout areas to work.

PLACEHOLDER. If analytics or advertising tags are added later they are not essential, and will need a consent banner and a fuller cookie table here.

If this policy changes materially we will say so on this page and, where the change affects you, by email.

Privacy questions and data requests: support@lucoreskin.pk. See also our Terms of Sale and Shipping & Returns policy.