Privacy Policy
Privacy Policy
Last updated:
This policy explains how Casaluxy Limited handles personal information when you browse, buy from or contact CasaLuxy.
Who is responsible
Casaluxy Limited operates casaluxy.com and is responsible for the personal information described here. We are registered in Hong Kong. Our local business operations and supplier contracting in China are handled through Foshan Shangsa Trading Co., Ltd. Casaluxy Limited remains the seller and the company responsible for this privacy policy. Our Hong Kong business registration is No. 80952407. Our registered-office address and further company details are available in our Business Information.
For privacy questions or requests, email info@casaluxy.com with “Privacy request” in the subject. You do not need an account to contact us.
Information we collect
- Orders and delivery: your name, email, telephone number, billing and delivery addresses, ordered products, selected options, order value and delivery or return information.
- Accounts: the information you provide to create and use an account, order history and account preferences. Guest checkout is available.
- Payments: payment status, transaction references and limited payment-method information supplied by our payment providers. Stripe, PayPal and any other payment or wallet provider you select at checkout process information needed for that payment. The services are described below. A saved payment method uses a provider reference or token for later payments.
- Enquiries and support: your first and last name, email and message submitted through our contact form, plus information you provide about an order, return, defect or privacy request. Send only information relevant to the enquiry.
- Website activity: IP address, browser and device information, pages and products viewed, referral and campaign information, shopping events and cookie or similar identifiers, depending on the service used and your privacy choices.
- Privacy choices: consent preferences and records needed to apply or demonstrate those choices.
We receive information directly from you, from your browser and from providers involved in payment, delivery, fraud prevention and order support. Please do not send passwords, full card numbers or unnecessary identity documents in a message.
Why we use information
| Purpose | Basis where EEA or UK law applies |
|---|---|
| Answer a request before purchase, take payment, fulfil an order, arrange delivery, and provide contractual returns or support | Steps you request before a contract and performance of the contract |
| Keep accounting records, comply with legal duties and respond to valid requests from authorities | Legal obligation where the relevant law applies |
| Protect the store, investigate misuse or payment disputes, and establish or defend legal claims | Legitimate interests in secure trading and protecting legal rights, balanced against your rights; legal obligation where applicable |
| Operate optional analytics and advertising technologies | Consent where required; applicable opt-out rules in other locations |
| Remember and handle privacy choices or rights requests | Compliance with applicable privacy obligations and, where relevant, our legitimate interest in respecting your choices |
A purchase or support enquiry does not by itself subscribe you to marketing. If you separately agree to receive marketing, you can withdraw that choice through the message’s unsubscribe option or by contacting us. Withdrawing consent does not affect earlier lawful processing.
Services and recipients
Meta (Facebook and Instagram): our Meta for WooCommerce integration connects our product catalogue and advertising tools. Meta Pixel and, where enabled, the Conversions API can share website and shopping events with Meta to measure advertising, understand conversions and show relevant advertisements. Events can include page and product views, cart and checkout activity, purchases, product identifiers, order value and currency, event times, page URLs, IP address, browser or device information and cookie or advertising identifiers.
Where customer matching is enabled, contact details such as email address or phone number may be hashed before transmission. Hashing does not make this information anonymous. Meta may associate events with a Facebook or Instagram account and use them under its own privacy terms. Consent is required for optional advertising technologies where applicable; you can purchase without agreeing to optional advertising.
Use Your Privacy Choices for browser marketing preferences and applicable sale, sharing or targeted-advertising opt-outs. For a privacy request covering information already collected or server-side disclosures, email info@casaluxy.com. See Meta’s Privacy Policy and Cookies Policy. International processing may occur, including in the United States, as explained in our international-processing section.
Klaviyo, email and SMS marketing: we use Klaviyo as a customer-data and email-marketing service provider and, when our SMS program is enabled, to deliver text messages. Our WooCommerce integration can transfer customer contact and profile information, checkout activity, order history, purchased items, order values and status, and subscription preferences to Klaviyo. We use these records to manage customer profiles and consent, understand store activity, and prepare relevant communications. A purchase or a synced customer record does not by itself subscribe you to marketing.
Where Klaviyo website tracking is enabled, it can collect browser and device information, IP addresses, online identifiers, pages and products viewed, and cart or checkout events. Activity may be associated with a customer profile when the visitor is identified, for example through checkout, a signup or a tracked email link. Our Cookie Policy explains optional browser tracking and storage. Consent is required for optional tracking where applicable.
We send marketing emails only with your separate agreement. When we send them, tracking pixels and links may record message opens, clicks and related shopping activity to measure and improve communications. You can unsubscribe using the link in a marketing email or contact info@casaluxy.com. Cookie choices and email subscriptions are separate: changing one does not automatically change the other. Email signup does not constitute consent to SMS marketing.
SMS marketing
If you separately opt in to our SMS marketing program, we use your mobile number, subscription preferences and consent records to manage your subscription and send the messages described in our Mobile Messaging Terms of Service. Consent records can include when and how you signed up. Message delivery, link clicks and related shopping activity help us operate and measure the program. A purchase, email subscription or cookie preference does not by itself subscribe you to SMS marketing.
For abandoned-cart reminders, our WooCommerce integration and, where permitted, website cookies and similar tracking technologies provide cart and checkout activity that can be associated with your customer profile. When SMS reminders are enabled and you have separately consented to SMS marketing, we use this activity to identify an incomplete checkout and determine when to send a reminder. Optional browser tracking is subject to your choices and applicable consent requirements, as explained in our Cookie Policy.
We do not sell SMS opt-in data or consent status, or share them with third parties for their own marketing or purposes unrelated to providing our messaging program. We may share these records with Klaviyo, mobile carriers and service providers that help us operate and deliver the program.
You can withdraw SMS consent using the unsubscribe instructions in a message or by contacting info@casaluxy.com. Two-way sending numbers support STOP replies; one-way branded sender IDs cannot receive replies and include an unsubscribe link instead. Unsubscribing through Klaviyo removes consent for both promotional and transactional SMS in our Klaviyo messaging program. Necessary order-related information may still be sent by email. Email subscriptions and browser cookie preferences are managed separately.
Klaviyo may process information outside your country, including in the United States. The international-processing, retention and rights sections below also apply to information used with this service. See Klaviyo’s Privacy Center for its privacy information.
Pinterest: our Pinterest integration supports saving products, advertising and conversion measurement. Depending on the feature, your privacy choices and applicable requirements, browser tags or server-to-server conversion events may share online identifiers, IP address, browser/device information, page or product activity, and shopping events with Pinterest. Where configured, matching data may include hashed contact details or customer identifiers; hashing does not make this data anonymous. See Pinterest’s Privacy Policy. Use Your Privacy Choices to manage optional tracking and applicable advertising opt-outs.
- Stripe and PayPal: process payments and provide transaction, risk and dispute services. See Stripe’s privacy notice and PayPal’s privacy notice.
- Apple Pay and Google Pay: if you choose an eligible digital wallet at checkout, the wallet provider handles information needed to provide and authorize that payment under its own privacy terms. Payment and any billing, contact or delivery details you approve are used to complete your order through the selected payment service. See Apple Pay & Privacy and Google’s Privacy Policy.
- Manufacturing, fulfilment and delivery partners: receive information needed to prepare, dispatch and deliver orders from China, arrange appointments, or handle an agreed return. This can include the recipient’s name, delivery address, telephone number and order details.
- Microsoft Clarity: when statistics tracking is allowed, we use Clarity to understand website use through interaction analytics and session recordings. See Microsoft’s Privacy Statement. You can withdraw statistics consent through Your Privacy Choices.
- Google Analytics and Google advertising services: receive website and campaign information through enabled tags, subject to applicable privacy choices. Advertising measurement and personalization can involve disclosure of online identifiers and browsing or purchase events. See Google’s privacy policy.
- Website infrastructure: hosting, network, security, email and technical-support providers process information needed to operate and protect the store. Cloudflare services are present on our website; see Cloudflare’s privacy policy.
- Professional advisers and authorities: receive information where necessary for advice, a legal obligation, a valid legal request, or establishing and defending legal rights.
Our shop uses WordPress and WooCommerce, Contact Form 7 for enquiries, and WPConsent for browser privacy preferences. Using website software does not itself mean that its developer receives every order or message.
Cookies, advertising and your choices
Read the Cookie Policy for cookies and similar storage. Use Your Privacy Choices to manage optional categories and applicable advertising opt-outs. Necessary shopping or security functions may remain active.
Advertising disclosures may constitute “sharing” for cross-context behavioural advertising under California law even when no money is paid for the information. We therefore provide an advertising opt-out and do not describe the store as having no advertising-related disclosures.
International processing
Our company is registered in Hong Kong and our operations are managed in China. Order and support information can be accessed in those locations. Payment, advertising, infrastructure and delivery providers may also process information in other countries, including the United States and your delivery destination.
Privacy rules and available rights differ between countries. Contact info@casaluxy.com for information about the destinations and transfer protections relevant to a particular service, including how to obtain a copy of any applicable safeguard. Provider notices explain their own international processing. Your consent to optional cookies is not a general waiver of data-protection rights.
How long information is kept
| Record | Retention period or criterion |
|---|---|
| Completed and refunded order records in our store | Scheduled retention of up to seven years, subject to a relevant legal obligation, unresolved dispute or legal hold |
| Inactive customer accounts | Scheduled removal after two years of inactivity; legally required order records may be retained separately |
| Unpaid, failed or cancelled orders | Scheduled movement to the store’s trash after 30 days for pending or failed orders and 90 days for cancelled orders; movement to trash is not immediate permanent erasure |
| Support, return and privacy-request correspondence | For the time needed to resolve the request, administer related orders, meet legal duties and deal with a relevant claim; information no longer needed is removed or anonymized |
| Consent preferences and technology identifiers | According to their purpose and storage duration in the Cookie Policy; compliance records may be retained for the period needed to demonstrate applicable choices |
| Provider-held payment, analytics or advertising information | According to the applicable provider’s role, settings and legal obligations; clearing a browser cookie does not necessarily erase records already held by a provider |
Your rights and requests
Depending on your location and applicable law, you may request access, correction, deletion, portability or restriction, object to certain processing, withdraw consent, or opt out of sale, sharing or certain advertising. Some records must be retained to meet a legal duty or deal with a claim.
Email info@casaluxy.com. We use proportionate verification where needed for access or account-related requests. A normal sale or sharing opt-out does not require a new account or unnecessary identity documents. We respond within the applicable legal deadline and explain any permitted extension.
You may complain to your local privacy regulator. Additional information appears in our EEA & UK Privacy Information and California Privacy Notice.
Children, security and changes
Our shop is intended for people with legal capacity to purchase. We do not seek children’s information for marketing. Please contact us if you believe a child has provided information that should be removed.
No website can guarantee complete security. Use a strong, unique account password and avoid sending payment credentials by email. See our Security Information.
We update this policy when our practices change and revise the date above. Additional notice or consent is provided where required.
Additional information for California
This notice supplements our Privacy Policy where the California Consumer Privacy Act, as amended, applies to Casaluxy Limited’s processing.
Categories, sources and purposes
Our store processes the following categories in connection with browsing, purchases and enquiries. We receive information from you, your browser, and the providers involved in the relevant service.
| Category and examples | Purpose | Relevant recipients |
|---|---|---|
| Identifiers and customer records: name, contact details, address, account and online identifiers | Accounts, orders, delivery, support, security and privacy requests | Payment, fulfilment, delivery, infrastructure and support providers; advisers or authorities where necessary |
| Commercial information: products, orders, payment status, return and support history | Fulfil and support purchases, maintain records and resolve disputes | Payment and fulfilment providers, delivery partners and relevant advisers |
| Internet or network activity: device and browser details, referral data, views, shopping events and advertising identifiers | Website operation, analytics and advertising according to applicable choices | Infrastructure providers, Google analytics or advertising services, Meta, Pinterest and Klaviyo as applicable |
| Information voluntarily included in correspondence | Respond to the enquiry or request | Service providers or partners needed to resolve it |
Payment credentials and account credentials require particular protection. Provide payment details only through the checkout provider’s interface, and do not include passwords or full card numbers in a support message. The Privacy Policy gives retention periods and criteria for these records.
Advertising-related sale or sharing
Google, Meta and Pinterest advertising services, and Klaviyo marketing services, are enabled on the store. Disclosures of online identifiers and browsing or shopping activity for cross-context behavioural advertising may constitute “sharing,” and in some arrangements “sale,” even without payment for the information.
You may opt out using Your Privacy Choices. Turning off marketing tracking does not prevent a purchase. We do not require an account or identity document for an ordinary sale or sharing opt-out. Our store is not directed to children.
Your applicable rights
Subject to the law’s conditions and exceptions, you may request to know or access personal information, correct it, delete it, opt out of sale or sharing, and limit certain uses of sensitive personal information where that right applies. You may use an authorized agent. We do not discriminate against you for exercising protected rights.
Submit a request
Email info@casaluxy.com or use Your Privacy Choices. For access, correction or deletion, we use proportionate verification and may request evidence of an agent’s authority where required. We do not require a new account.
We generally respond to verified access, correction and deletion requests within 45 calendar days, explaining any lawful extension. Sale or sharing opt-outs are handled within their separate applicable deadline and are not delayed until an access-request deadline.
Browser signals
Global Privacy Control is a browser signal used to communicate an opt-out preference. Our consent tool is configured to respect Global Privacy Control for browser tracking choices. Use the privacy controls to review the choices available for this browser, and contact us if a signal appears not to have been applied. Your statutory opt-out rights are not limited by the availability of a particular button.
Additional information for the EEA and UK
Information for people whose personal data is protected by EEA or UK data-protection law.
Controller and contact
Casaluxy Limited is the controller for our store’s processing described in the Privacy Policy. Our company is registered in Hong Kong, and our operations are managed from Foshan, China. Contact info@casaluxy.com; our registered-office address appears below.
Purposes, legal bases and recipients
The main Privacy Policy explains the information used for orders, payment, delivery, support, legal records, website security and optional analytics or advertising. It identifies the applicable contract, legal-obligation, legitimate-interest and consent bases, as well as recipients and retention periods or criteria.
Order contact, delivery and payment information is needed to process a purchase. Optional analytics or advertising consent is not a condition of buying. If required order information is missing, we may be unable to fulfil the order.
International processing
Our Hong Kong company, operations in China and international service providers may process information outside the EEA or UK. Applicable transfer requirements depend on the recipient, location and processing arrangement. The main Privacy Policy identifies relevant processing locations.
Email info@casaluxy.com to request information about the transfer mechanism and any safeguards applicable to your information, or a copy where available. Optional cookie consent does not remove your rights concerning international transfers.
Your rights
- Request access to your information and a copy.
- Ask us to correct inaccurate or incomplete information.
- Request erasure or restriction where the legal conditions are met.
- Receive eligible information in a portable format.
- Object to processing based on legitimate interests, and object to direct marketing at any time.
- Withdraw consent for future processing without affecting earlier lawful use.
Rights have conditions and exceptions, including retention needed for a legal duty or legal claim. We explain an applicable exception when responding.
Make a request
Email info@casaluxy.com with enough information to understand your request. We may reasonably verify identity for access or account-related requests, but do not ask for unnecessary sensitive documents. We normally respond within one month; if a lawful extension is needed, we explain it within that period.
Payments, advertising and automated tools
Payment providers can use automated authorization and fraud-prevention tools, and advertising services can select or measure advertisements using identifiers and activity information. Their notices explain those services. If a decision affecting an order concerns you, contact us for an explanation and review, and to exercise any applicable right concerning solely automated decisions with legal or similarly significant effects.
Complaints
You can raise a concern with us or complain to your competent data-protection authority, including in your place of residence, work or the alleged infringement. UK residents can contact the Information Commissioner’s Office. You do not have to contact us first to use a legal complaint route.
