Privacy policy

This notice explains what personal data LULU & HUNQ collects when you shop on luluandhunq.com or talk to us, why, how long we keep it, and what you can do about it. It follows India’s Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.

Who we are

LULU & HUNQ is run by Whitefield Trends LLP, a limited liability partnership, Ground Floor, Backside Portion, House No. 72, Block WZ, Village Todapur, New Delhi, Delhi 110012. For any question about your personal data, contact our grievance officer, Lakshay Kataria (Founder), at care@luluandhunq.com or +91 98107 03672.

What we collect, why, and for how long

• Your order: name, phone, email, delivery address, what you bought and what you paid. Why: to deliver your order, send order and delivery updates, confirm cash-on-delivery orders on WhatsApp, ask you once for a review after delivery, issue your GST invoice, and handle returns and refunds. Kept: as long as tax and accounting laws require, usually 6 to 8 years.
• Your account (optional): your email, and your name if you sign in with Google. Why: to sign you in, show your orders and fill in your details at checkout. Kept: until you ask us to close it (your orders are kept as tax law requires).
• Payment details: the payment method, and Razorpay’s payment reference and status. Why: to confirm your payment and make refunds. Your full card number, CVV and UPI PIN go straight to Razorpay; we never see them. Kept: as for your order.
• An unfinished checkout: the details and items you entered before leaving without paying. Why: to send you one reminder about your bag. Kept: 30 days.
• Messages to us: emails, calls, WhatsApp chats and the chat on our website (your messages, our replies and automatic answers, the chat’s conversation ID, the name, email and phone you give there, the page you started it on, and your account if you’re signed in). Why: to answer you and fix problems. Kept: 2 years after the last message.
• Reviews: the name you give, your stars, words and photos. Why: to show them on our website, where they’re public. Kept: until you ask us to remove them.
• Newsletter: your email, only if you tick the box. Why: to tell you about new scents, limited editions and offers. Kept: until you unsubscribe.
• Device and usage data: IP address, browser, pages visited. Why: to keep the site secure and working. Kept: up to one year.
• Analytics and ad cookies, only if you accept them: Google Analytics, Google Ads, the Meta Pixel and Microsoft Clarity (which records how pages are used, such as clicks and scrolls). Why: to see what works on the site and measure our ads. Kept: as set by each tool; the cookies last up to 2 years. If you accept, we also send Google and Meta a scrambled (hashed) copy of your email and phone when you order, so they can tell us which ads led to a sale.

Who we share it with

Only what each one needs, only to run your order or our site:

• Razorpay: payments and refunds.
• Our courier (Shiprocket and the courier company it assigns to your parcel): your name, phone and address, to deliver.
• Cloudflare and Supabase: host our website and its database.
• Google: our email, Google sign-in if you choose it, plus Google Analytics and Google Ads if you accept cookies.
• Meta: WhatsApp messages, plus the Meta Pixel if you accept cookies.
• Microsoft: Clarity, if you accept cookies.
• Our email-sending service: order emails.
• The team that builds and maintains our website: to keep orders and the site running.
• Government or law enforcement: only when the law requires it.

We don’t sell your personal data. Some of these companies store data outside India; we use them only where Indian law allows it.

Your rights

Under the Digital Personal Data Protection Act, 2023, you can:

• Know what personal data we hold about you, what we do with it and who we’ve shared it with.
• Correct, complete or update it.
• Erase it, unless the law requires us to keep it (invoices, for example).
• Withdraw your consent at any time, as easily as you gave it. This doesn’t undo what we did before, or remove order records we must keep by law.
• Nominate someone to use these rights for you if you die or can’t act for yourself.
• Complain to us, and if you’re not happy with our answer, to the Data Protection Board of India.

To use any of these, email care@luluandhunq.com with the subject “My data”, from the email you shopped with or with your order number and phone number, so we can check it’s you. We acknowledge within 48 hours and respond within 30 days. You can also ask for this notice in Hindi or another language listed in the Eighth Schedule of the Constitution.

How to withdraw consent

• Newsletter: tap “unsubscribe” in any of our emails.
• WhatsApp: reply STOP.
• Cookies: open “Cookie settings” at the bottom of any page.
• Anything else: email us.

Cookies

Essential cookies and storage keep your bag and checkout working, so they’re always on. Analytics and ad tools load only after you tap “Accept” on our cookie banner; “Decline” keeps them off.

Children

Our site is for adults. If you’re under 18, please ask a parent or guardian to order for you. We don’t knowingly collect children’s data, and we never target ads at children.

Keeping it safe

Everything travels over an encrypted (HTTPS) connection, only the people who need your order details can see them, and payment details stay with Razorpay. If a data breach affects you, we’ll tell you and the Data Protection Board of India, as the law requires.

Changes

When we change this notice, we update the date at the top. For important changes, we’ll also email you if we have your email.

Contact

Lakshay Kataria (Founder, grievance officer), LULU & HUNQ, Ground Floor, Backside Portion, House No. 72, Block WZ, Village Todapur, New Delhi, Delhi 110012 · care@luluandhunq.com · +91 98107 03672. Complaints: our grievance officer.