Privacy & Data Protection Policy

LuxeCard Limited is the data controller (and, for certain processing, the data processor) for the purposes described below. Contact: sales@luxecard.co.ke.

• Identity: name, job title, company, photo, professional info
• Contact: phone, email, WhatsApp, delivery address
• Digital profile content: anything you choose to publish — bio, links, photos, videos, business details
• Transaction data: orders, payment status, invoices, delivery info (we do not store full card details — these are handled by our payment provider)
• Technical data: IP address, browser/device info, pages visited, referring URLs, and similar data from website use

Directly from you — when you order, build a profile, contact us, or use our website/WhatsApp — and via cookies, analytics, or authorised partners where the law permits.

To process orders and payments, manufacture customised products, build and host digital profiles, deliver goods, provide support, prevent fraud, maintain security and records, meet legal obligations, and — where you've consented or it's otherwise permitted — send marketing.

Depending on the activity: performance of a contract, pre-contractual steps at your request, your consent, a legal obligation, or our legitimate interests where these don't override your rights.

Anything you publish on your LuxeCard profile is visible to anyone who scans your card/QR code or opens your link. Don't publish sensitive personal data you don't want public.

We'll only send marketing where you've consented (e.g. the checkout marketing checkbox) or another lawful basis applies; you can opt out anytime. Transactional messages (order confirmations, delivery updates) continue regardless, as they're necessary to provide the service.

Our site uses cookies for core functionality, preferences, usage analytics, and security. We'll seek your consent before using non-essential cookies, as required by law.

We use cookieless analytics (Vercel Web Analytics) to see how many people visit our website, without storing anything on your device.

We share data with service providers where necessary — payment processors, hosting/cloud, CRM, analytics, delivery, and professional advisers — and with regulators or law enforcement where legally required. We do not sell your data for third parties' own marketing.

Some providers process data outside Kenya. Where this happens, we rely on one of the mechanisms permitted under section 48 of the Data Protection Act, 2019 — an adequacy finding, appropriate contractual safeguards, your consent, or ODPC approval.

We use reasonable technical and organisational measures to protect your data against unauthorised access, loss, or misuse, though no online system is completely secure.

We keep personal data only as long as reasonably necessary for the purpose collected, dispute resolution, or legal compliance, then delete, anonymise, or securely dispose of it.

Subject to the DPA, you may request access, correction, deletion, restriction, or portability of your data, object to certain processing, and withdraw consent at any time. Contact sales@luxecard.co.ke — we may verify your identity before acting on a request.

Contact us first so we can investigate. You may also lodge a complaint with the Office of the Data Protection Commissioner (ODPC).

Our services are intended for adults and businesses. We do not knowingly collect data from a child (under 18, per the Children Act) without a parent's or guardian's consent. Contact us if you believe this has happened.

Our site may link to third-party sites; we're not responsible for their privacy practices.

We may update this policy; the current version and effective date are always on our website.