Privacy Notice

Effective date: September 17, 2026

1. Who is responsible

[COMPANY NAME] LIMITED, [REGISTERED OFFICE ADDRESS], Hong Kong, a company incorporated in Hong Kong SAR, is the business responsible for the personal information collected through lulutoxhq.com (the "Website"). For the purposes of the Hong Kong Personal Data (Privacy) Ordinance we are the data user; for visitors from the European Economic Area or the United Kingdom we are the data controller. Questions and requests: support@lulutoxhq.com or +1 (225) 314-7447.

2. What we collect

• Information you give us: your name, e-mail address, phone number, shipping and billing address, the products you order, and the content of any message you send us. Payment details are entered into the form of our payment processor; we receive the payment method, the last four digits of a card and the result of the payment, never the full card number.
• Information collected automatically: your IP address, device and browser type, the pages you view, the site or advertisement that referred you (including campaign parameters in the link), approximate location derived from the IP address, and identifiers stored in cookies or similar technologies.
• Information from our service providers: delivery status from the carrier, the payment result and fraud-risk signals from the payment processor.

3. Why we use it

• To process and deliver your order, send order and shipping e-mails and handle returns and refunds (necessary to perform the contract with you).
• To answer your questions and provide customer service.
• To take payment, prevent fraud and handle chargebacks and disputes (our legitimate interest and legal obligations).
• To keep accounting and tax records (legal obligation).
• To measure how the Website performs and to improve it (our legitimate interest; consent where the law requires it for cookies).
• To send you marketing e-mails only where you have agreed to receive them; you can unsubscribe at any time using the link in every e-mail.

4. Who we share it with

We share personal information only with service providers that act on our instructions and only as needed to run the Website and fulfil orders: payment processors and payment networks; the software we use to manage orders and customer service; the warehouse and the shipping carriers that deliver your parcel; the e-mail service that sends order and marketing e-mails; hosting, content-delivery and error-monitoring providers; and fraud-prevention services. We may also disclose information to professional advisers, to authorities where the law requires it, or to a buyer if our business is sold. We do not sell personal information.

5. Cookies and similar technologies

The Website uses cookies and similar technologies that are needed for the checkout and for security. This Website does not load third-party advertising or analytics tags. You can delete or block cookies in your browser settings; the checkout may not work without the essential ones. Where the law requires it, we honour opt-out preference signals such as Global Privacy Control.

6. International transfers

We are based in Hong Kong SAR. Our service providers process information in the United States and in other countries, and your information may be stored and processed there. Where information about visitors from the European Economic Area or the United Kingdom is transferred abroad, we rely on recognised safeguards such as standard contractual clauses. Where required by Hong Kong law, we take reasonable steps to ensure that information transferred outside Hong Kong is handled with a comparable level of protection.

7. How long we keep it

Order and payment records are kept for as long as tax and accounting rules require (normally up to seven years). Customer-service correspondence is kept for up to three years after the last contact. Marketing preferences are kept until you unsubscribe. Personal data is not kept longer than is necessary for the purpose for which it was collected.

8. Your rights

• Hong Kong Personal Data (Privacy) Ordinance (PDPO): you may request access to the personal data we hold about you and ask us to correct it; we may charge a reasonable fee for complying with an access request. You may at any time, free of charge, require us to stop using your personal data for direct marketing. You may also complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong.
• Visitors from the European Economic Area and the United Kingdom may ask for access to, correction or deletion of their personal information, ask us to restrict processing, object to processing based on legitimate interest, receive their data in a portable format, and withdraw consent at any time. You may also complain to your local data-protection authority.
• California residents have the right to know what personal information we collect, use and disclose, to request deletion or correction, to opt out of the sale or sharing of personal information (we do not sell personal information), and not to be discriminated against for exercising these rights. Residents of other US states with privacy laws have similar rights.
• To exercise any of these rights, e-mail support@lulutoxhq.com from the address used for your order. We may ask you to confirm your identity. An authorised agent may act for you with your written permission.

9. Security

We protect personal information with encryption in transit (TLS), access controls and the security measures of our service providers. No method of transmission or storage is completely secure, but we work to protect your information appropriately.

10. Children

The Website is not directed at children and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

11. Changes

We may update this notice from time to time. The date at the top shows when it was last changed.

12. Contact

[COMPANY NAME] LIMITED · [REGISTERED OFFICE ADDRESS], Hong Kong · support@lulutoxhq.com · +1 (225) 314-7447