Patron Privacy & Data Sovereignty

1.1 Identity & Atelier Profile: When creating a patron account or placing an authenticated reservation, we collect your designated legal name, email address, telephone number, and delivery coordinates across Sri Lanka or authorized international regions.

1.2 Financial & Transactional Data: Order receipts, item silhouettes acquired, bespoke tailoring measurements, and currency preferences. Payment card details are tokenized directly via Stripe PCI-DSS Level 1 vaults—LUXE never stores or views raw card numbers or CVV security codes.

1.3 Technical Telemetry & Device Signatures: Non-intrusive operational signals including IP address, browser type, language preferences, session duration, and referral paths necessary to maintain platform defense, prevent fraud, and optimize render latency.

1.4 Salon & Concierge Communications: Inquiries made via client concierge channels, sizing consultations, and wishlist curations saved within your patron portal.

2.1 Contractual Fulfilment: Processing your acquisitions, managing inventory reservations with artisan houses, conducting white-glove courier dispatches, and providing real-time tracking manifests.

2.2 Fraud Deterrence & Account Security: Performing automated 3D-Secure 2.0 fraud checks to protect patrons against unauthorized credit card utilization and account takeovers.

2.3 Client Experience Refinement: Retaining shopping bag contents across visits, remembering localized currency preferences (LKR), and delivering contextual styling suggestions based on explicit browsing history.

2.4 Regulatory Compliance: Fulfilling statutory accounting, taxation, and invoice preservation requirements established by the Inland Revenue Department of Sri Lanka and applicable commercial authorities.

3.1 Never Sold or Rented: LUXE maintains an unconditional pledge: we never sell, monetize, license, or trade your patron profile, contact coordinates, or purchase history to third-party data aggregators, advertising syndicates, or commercial brokers.

3.2 Zero Cross-Web Retargeting: We do not deploy invasive cross-site behavioral tracking scripts that follow you across the internet. Our analytics remain strictly bounded to your interactions within the LUXE boutique ecosystem.

3.3 Discreet Packaging & Communications: All physical parcels are dispatched in unbranded, discreet exterior security packaging to ensure total privacy upon arrival.

Personal data is shared only with strictly vetted infrastructure providers necessary to operate the platform under strict Data Processing Agreements (DPAs):

• Stripe Inc. — PCI-DSS Level 1 compliant payment orchestration, tokenization, and anti-fraud radar screening.
• Supabase Inc. (AWS VPC) — Secure cloud relational database with Row-Level Security (RLS) policies encrypting patron records.
• Cloudflare Inc. — Content delivery network, TLS 1.3 cryptographic handshakes, and distributed denial-of-service mitigation.
• Insured Courier Partners — Islandwide and global logistics partners receiving strictly the recipient name, delivery address, and contact number for physical transit.

5.1 Cryptographic Architecture: All database records are safeguarded using AES-256 bit encryption at rest. All network communications are mandated over TLS 1.3 encryption with Perfect Forward Secrecy.

5.2 Least Privilege Access: Access to patron identifiers is restricted exclusively to authorized atelier concierges on a strict need-to-know basis, protected by hardware-backed multi-factor authentication (MFA).

5.3 Retention Timelines: Patron account records are preserved for the active lifetime of your salon membership. Inactive accounts and guest order records are retained only as long as required by Sri Lankan fiscal and statutory audit statutes (maximum 7 years).

Regardless of your geographical domicile, LUXE accords you complete legal sovereignty over your personal data:

• Right of Access & Portability: Request a complete JSON or PDF export of all dossiers, acquisition logs, and telemetry stored under your identity.
• Right to Rectification: Update and rectify inaccurate personal profiles directly in your Account Settings.
• Right to Erasure ("Right to be Forgotten"): Request the permanent purge and deletion of your patron profile and non-statutory records.
• Right to Restrict & Opt Out: Modify your analytical and marketing preferences at any time via our Cookie & Telemetry Preference Center.

7.1 Data Protection Officer: LUXE Atelier has designated a dedicated Data Protection Officer (DPO) overseeing regulatory adherence under the Sri Lanka Personal Data Protection Act (PDPA) No. 9 of 2022.

7.2 Submitting Formal Inquiries: You may submit formal privacy inquiries, verification claims, or Subject Access Requests (SAR) via email to privacy@luxe.lk. We provide written verification within forty-eight (48) hours and complete fulfillment within thirty (30) calendar days.

7.3 Corporate Domicile: LUXE Atelier (Pvt) Ltd, Colombo 04, Sri Lanka.