Privacy Policy

Who this policy applies to

This policy applies to customers, prospective customers, vendors, vendor applicants, administrators, and visitors who use the Luxpaze website and related services.

Luxpaze acts as the data controller for information processed to operate the marketplace. Vendors may also have their own responsibilities when they receive customer information to fulfil an order.

Information we collect

The information collected depends on how you use the platform.

• Account details such as name, email address, telephone number, password hash, role, and verification status.
• Delivery details such as recipient name, address, region, city, and contact number.
• Order, cart, wishlist, voucher, review, return, dispute, and customer-support information.
• Vendor identity, business, compliance, payout, store, product, and application information.
• Support messages, notification preferences, and security/audit records.
• Technical information such as request identifiers, IP-derived security signals, browser information, timestamps, and service logs.

Why we use information

We use personal information only where it is relevant to operating and protecting the marketplace.

• Create and secure accounts, verify identity and email addresses, and manage permissions.
• Process carts, orders, delivery instructions, returns, disputes, and customer support.
• Enable customer support and operational notifications.
• Review vendors, prevent fraud and abuse, enforce marketplace rules, and maintain audit records.
• Meet legal, tax, accounting, security, and regulatory obligations.
• Improve reliability, performance, accessibility, and user experience using aggregated or appropriately controlled analytics.

Sharing and service providers

We share information only where needed to provide the service, comply with law, protect users, or complete a transaction.

• Vendors receive order and delivery information required to fulfil customer orders.
• Approved hosting and database providers process marketplace records under Luxpaze instructions.
• Approved object-storage, email, monitoring, payment, refund, payout, delivery, and support providers receive only the information needed for their service.
• When electronic payments are enabled, Paystack or another approved payment provider may process payment, settlement, refund, chargeback, fraud-prevention, and regulatory information under its own applicable terms and privacy notices.
• The current provider register is maintained internally and this policy will be updated when a provider materially changes how personal information is handled.

Retention and security

We retain information only as long as needed for account operation, order fulfilment, legal obligations, dispute handling, fraud prevention, and legitimate business records. The internal retention schedule defines the owner, retention period, and secure disposal method for each record class.

Security measures include access controls, signed HTTP-only cookies, password hashing, role and ownership checks, request validation, rate limiting, security headers, audit logging, encrypted provider connections, backups, and incident procedures. No system can guarantee absolute security.

Your choices and rights

Subject to applicable Ghanaian law, you may ask to access, correct, update, object to certain processing of, or request deletion of personal information. Some records may need to be retained for legal, accounting, security, fraud-prevention, or dispute purposes.

You can update certain account and notification information through your account. Other requests may be sent to the support contact below. We may need to verify your identity before acting on a request.

Account closure and deletion requests

Customers can start account closure from the Luxpaze mobile app, from the signed-in account area on the website, or from the public Close Account page at /close-account.

When a customer uses the secure self-service flow, Luxpaze shows the account email and asks for the signed-in account password first. The optional reason field and final DELETE confirmation are shown only after the password is verified.

If a customer can no longer access their account, they can email support from the public Close Account page. We may request additional verification before processing the request.

After account closure, eligible personal data is removed from active customer features. Certain transaction, dispute, refund, fraud-prevention, security, accounting, audit, and legal records may be retained where required.

Ghana data protection

Luxpaze processes personal data in line with Ghana's Data Protection Act, 2012 (Act 843). The operating company must complete Data Protection Commission registration and ongoing compliance before processing personal data in public production.