Privacy policy | LULU & HUNQ

This notice explains what personal data LULU & HUNQ collects when you shop on luluandhunq.com or talk to us, why, how long we keep it, and what you can do about it. It follows India’s Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.

Who we are

LULU & HUNQ is run by Whitefield Trends LLP, a limited liability partnership, Ground Floor, Backside Portion, House No. 72, Block WZ, Village Todapur, New Delhi, Delhi 110012. For any question about your personal data, contact our grievance officer, Lakshay Kataria (Founder), at care@luluandhunq.com or +91 98107 03672.

What we collect, why, and for how long

Your order: name, phone, email, delivery address, what you bought and what you paid. Why: to deliver your order, send order and delivery updates, confirm cash-on-delivery orders on WhatsApp, ask you once for a review after delivery, issue your GST invoice, and handle returns and refunds. Kept: as long as tax and accounting laws require, usually 6 to 8 years.
Your account (optional): your email, your name if you sign in with Google, and the delivery addresses you order to while signed in. Why: to sign you in, show your orders and fill in your details and addresses at checkout. Kept: until you ask us to close it (your orders are kept as tax law requires); you can remove a saved address on your account page at any time.
Details remembered on your device (optional): if you leave “Remember my details on this device” ticked at checkout, your name, phone, email and address stay in your own browser, not on our servers, to fill in your next checkout. Never card or UPI details. Kept: until you untick the box or clear your browser’s data for our site.
Payment details: the payment method, and Razorpay’s payment reference and status. Why: to confirm your payment and make refunds. Your full card number, CVV and UPI PIN go straight to Razorpay; we never see them. Kept: as for your order.
An unfinished checkout: the details and items you entered before leaving without paying. Why: to send you one reminder about your bag. Kept: 30 days.
Messages to us: emails, calls, WhatsApp chats and the chat on our website (your messages, our replies and automatic answers, the chat’s conversation ID, the name, email and phone you give there, the page you started it on, and your account if you’re signed in). When you write to our shop number on WhatsApp, your messages, your WhatsApp name and number, and the replies we send from the shop’s phone are saved in our order desk, so anyone on our team can answer you; for a photo, voice note or file we keep only what kind it was and its caption (the file itself stays in WhatsApp). Why: to answer you and fix problems. Kept: 2 years after the last message.
Reviews: the name you give, your stars, words and photos. Why: to show them on our website, where they’re public. Kept: until you ask us to remove them.
Newsletter: your email, only if you tick the box. Why: to tell you about new scents, limited editions and offers. Kept: until you unsubscribe.
Device and usage data: IP address, browser, pages visited. Why: to keep the site secure and working. Kept: up to one year.
Analytics and advertising (on unless you switch it off): the Meta Pixel, Google Analytics, Google Ads and Microsoft Clarity (which records how pages are used, such as clicks and scrolls; it does not record your order or account pages), plus Microsoft Advertising if we run ads there. They use cookies and similar storage on your device. They see the pages you visit, the products you look at, what you put in your bag, the steps of your checkout, your orders (what and how much), sign-ups and newsletter sign-ups, and when you contact us on WhatsApp or hand a website chat to our team. Our own server also sends Meta the same events directly (Meta’s Conversions API) with your IP address, browser details and Meta’s cookie IDs, so they are counted even when a browser blocks the Pixel. When you type your details at checkout, sign up, join the newsletter or order, we also send Meta and Google a scrambled (hashed) copy of your email, phone, name, city, state and pincode, and if you’re signed in, a scrambled code for your account; Google also receives your pincode and country as they are. Scrambled means the details are turned into a code that can’t be read back; Meta and Google can only match it to details they already hold. Why: to see what works on the site, to measure and improve our ads, and to show our ads to people likely to be interested. Kept: as set by each company; their cookies last up to 2 years. To switch all of this off for your browser, see “Cookies” below.

Only what each one needs, only to run your order or our site:

Razorpay: payments and refunds.
Our courier (Shiprocket and the courier company it assigns to your parcel): your name, phone and address, to deliver.
Cloudflare and Supabase: host our website and its database.
Google: our email, Google sign-in if you choose it, plus Google Analytics and Google Ads (enhanced conversions with your hashed email and phone) and Search Console, unless you switch measurement off.
Meta: WhatsApp messages, plus the Meta Pixel and Meta’s Conversions API (your activity on our site and your hashed contact details), unless you switch measurement off.
Microsoft: Clarity, and Microsoft Advertising (Bing) if we run ads there, unless you switch measurement off.
Our email-sending service: order emails.
The team that builds and maintains our website: to keep orders and the site running.
Government or law enforcement: only when the law requires it.

We don’t sell your personal data. Some of these companies store data outside India; we use them only where Indian law allows it.

Your rights

Under the Digital Personal Data Protection Act, 2023, you can:

Know what personal data we hold about you, what we do with it and who we’ve shared it with.
Correct, complete or update it.
Erase it, unless the law requires us to keep it (invoices, for example).
Withdraw your consent at any time, as easily as you gave it. This doesn’t undo what we did before, or remove order records we must keep by law.
Nominate someone to use these rights for you if you die or can’t act for yourself.
Complain to us, and if you’re not happy with our answer, to the Data Protection Board of India.

To use any of these, email care@luluandhunq.com with the subject “My data”, from the email you shopped with or with your order number and phone number, so we can check it’s you. We acknowledge within 48 hours and respond within 30 days. You can also ask for this notice in Hindi or another language listed in the Eighth Schedule of the Constitution.

Newsletter: tap “unsubscribe” in any of our emails.
WhatsApp: reply STOP.
Analytics and advertising: open “Privacy choices” at the bottom of any page and switch it off.
Anything else: email us.

Cookies

Essential cookies and storage keep your bag, checkout and account working, so they’re always on. Analytics and advertising (the Meta Pixel, Google Analytics, Google Ads, Microsoft Clarity and, if we use it, Microsoft Advertising, plus the copies our server sends Meta) are on by default. To switch them off for your browser, open “Privacy choices” at the bottom of any page and choose “Switch it off”: the tags stop loading, our server stops sending your activity to Meta and Google, the details we kept in your browser are cleared, and orders you place from that browser are not reported to them. Your choice is kept in your browser (clearing your cookies or using another browser or device resets it). If your browser sends a Global Privacy Control signal, we treat it as the same choice.

Children

Our site is for adults. If you’re under 18, please ask a parent or guardian to order for you. We don’t knowingly collect children’s data, and we never target ads at children.

Keeping it safe

Everything travels over an encrypted (HTTPS) connection, only the people who need your order details can see them, and payment details stay with Razorpay. If a data breach affects you, we’ll tell you and the Data Protection Board of India, as the law requires.

Changes

When we change this notice, we update the date at the top. For important changes, we’ll also email you if we have your email.

Contact

Lakshay Kataria (Founder, grievance officer), LULU & HUNQ, Ground Floor, Backside Portion, House No. 72, Block WZ, Village Todapur, New Delhi, Delhi 110012 · care@luluandhunq.com · +91 98107 03672. Complaints: our grievance officer.