Privacy Policy

At Luxe Haven ("we," "us," or "our"), we are deeply committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, place an order, or interact with our services. We urge you to read this policy carefully so you can make informed decisions about sharing your personal information with us.

1. Information We Collect

Personal Information You Provide

When you interact with Luxe Haven, we may collect personal information that you voluntarily provide, including but not limited to:

• Identity Data: Full name, date of birth, gender, and profile photographs
• Contact Data: Email address, phone number, billing address, and shipping address
• Financial Data: Payment card details, bank account information (processed securely through our PCI-DSS compliant payment processors — we do not store full card numbers on our servers)
• Transaction Data: Details about purchases, order history, returns, and payment records
• Account Data: Username, password (stored in hashed format), account preferences, and wishlist items
• Communication Data: Customer service correspondence, product reviews, survey responses, and newsletter preferences

Automatically Collected Information

When you visit our website, we automatically collect certain technical data, including:

• Device Information: IP address, browser type and version, operating system, device type, screen resolution, and unique device identifiers
• Usage Data: Pages visited, time spent on pages, click patterns, referral sources, search queries, and browsing behavior
• Location Data: General geographic location derived from your IP address (we do not collect precise GPS data)
• Cookie Data: Information collected through cookies, pixels, and similar tracking technologies (see our Cookie Policy for details)

2. How We Use Your Information

We use the collected information for the following purposes:

• Order Fulfillment: Processing and shipping your purchases, managing returns and exchanges, and sending order confirmations and tracking updates
• Customer Service: Responding to inquiries, resolving disputes, and providing personalized support through our concierge team
• Personalization: Tailoring product recommendations, displaying relevant content, and customizing your browsing experience based on your preferences and history
• Marketing Communications: Sending newsletters, promotional offers, new collection announcements, and exclusive member benefits (only with your explicit consent)
• Security & Fraud Prevention: Monitoring transactions for suspicious activity, preventing unauthorized access, and protecting against fraudulent orders
• Legal Compliance: Meeting our obligations under applicable laws, regulations, and legal proceedings
• Analytics & Improvement: Analyzing website performance, understanding user behavior, improving our products and services, and conducting market research

3. Legal Basis for Processing (GDPR)

For customers in the European Economic Area (EEA), United Kingdom, and Switzerland, we process your personal data based on the following legal grounds:

• Contractual Necessity: Processing required to fulfill your orders and provide our services
• Legitimate Interests: Processing necessary for our legitimate business interests, such as fraud prevention, security, and service improvement
• Consent: Processing based on your explicit consent, such as marketing communications and non-essential cookies
• Legal Obligation: Processing required to comply with applicable laws and regulations

4. Data Sharing & Third Parties

We do not sell your personal information. We may share your data with the following categories of trusted third parties:

• Payment Processors: Stripe, PayPal, and Apple Pay for secure transaction processing
• Shipping Partners: DHL, FedEx, and UPS for order delivery and tracking
• Analytics Providers: Google Analytics (with IP anonymization enabled) for website performance analysis
• Email Service Providers: For transactional emails and marketing communications
• Cloud Infrastructure: Amazon Web Services (AWS) for secure data hosting
• Legal Authorities: When required by law, court order, or governmental regulation

All third-party partners are contractually bound to protect your data and use it only for the specified purposes. We conduct regular data processing impact assessments to ensure compliance.

5. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy:

• Account Data: Retained for the duration of your account plus 2 years after deletion request
• Transaction Records: Retained for 7 years as required by tax and accounting regulations
• Marketing Preferences: Retained until you withdraw consent or unsubscribe
• Analytics Data: Retained for 26 months in anonymized form
• Customer Service Records: Retained for 3 years after the last interaction

6. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

• Right to Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing: Request limitation of how we process your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or for direct marketing
• Right to Withdraw Consent: Withdraw consent at any time for consent-based processing

To exercise any of these rights, please contact us at privacy@luxehaven.com. We will respond within 30 days of receiving your verifiable request.

7. Data Security

We implement industry-standard security measures to protect your personal data, including:

• 256-bit SSL/TLS encryption for all data transmitted between your browser and our servers
• PCI-DSS Level 1 compliance for payment card processing
• Regular penetration testing and vulnerability assessments
• Multi-factor authentication for administrative access
• Encrypted data storage at rest using AES-256 encryption
• Regular employee training on data protection best practices

8. International Data Transfers

As a global business, your data may be transferred to and processed in countries outside your jurisdiction. For transfers from the EEA/UK, we rely on EU-approved Standard Contractual Clauses (SCCs) and ensure that recipient countries provide adequate data protection. We participate in the EU-US Data Privacy Framework where applicable.

9. Children's Privacy

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that a child under 16 has provided us with personal data, we will promptly delete such information from our records.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by posting a prominent notice on our website or by sending you a direct communication. Your continued use of our services after such changes constitutes acceptance of the updated policy.

11. Contact Us

For questions, concerns, or requests related to this Privacy Policy or our data practices, please contact our Data Protection Officer:

Luxe Haven — Privacy Team
Email: privacy@luxehaven.com
Phone: +1 (800) 555-LUXE
Address: 245 West 35th Street, 12th Floor, New York, NY 10001
EU Representative: Luxe Haven EU Ltd., Prinsengracht 263, 1016 GV Amsterdam, Netherlands