Privacy Policy

1. Data Controller

Your personal data is controlled by Lyxtherocrghim, registered in New Zealand, with its principal place of business at Level 1/262 Lambton Quay, Wellington Central, Wellington 6011, New Zealand.

Contact: clients-askinfo@lyxtherocrghim.world | Phone: +64 4 974 4169

2. What Data We Collect

We collect and process the following categories of personal data:

• Identity data: your name as provided in order and contact forms.
• Contact data: email address and phone number.
• Order data: details of products ordered and any notes provided.
• Technical data: IP address, browser type and version, time zone, operating system, and other technology on the devices you use to access this website.
• Usage data: information about how you use our website, including pages visited and interaction patterns.
• Cookie data: as described in our Cookie Policy.

We do not collect special category data (such as health, biometric, or genetic data) through this website.

3. How We Collect Data

We collect personal data through:

• Direct interactions when you complete our order or contact form.
• Automated technical means such as cookies, server logs, and similar technologies as you browse our website.

4. Purposes and Legal Basis for Processing

We process your personal data for the following purposes:

• To fulfil your order: Legal basis — performance of a contract (Article 6(1)(b) GDPR / Privacy Act 2020 principle).
• To respond to enquiries: Legal basis — legitimate interests in providing customer service.
• To comply with legal obligations: Legal basis — legal obligation (Article 6(1)(c) GDPR).
• To improve our website and services: Legal basis — legitimate interests in operating and improving our business.
• To send marketing communications (only where consent is given): Legal basis — consent (Article 6(1)(a) GDPR).

5. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this policy:

• Order and customer data: retained for a minimum of 7 years to comply with New Zealand tax and commercial record-keeping obligations.
• Marketing preferences and consent records: retained until you withdraw consent or for 3 years of inactivity, whichever comes first.
• Website technical logs: retained for a maximum of 12 months.

6. Data Sharing and Disclosure

We do not sell your personal data. We may share your data with:

• Service providers: including payment processors, delivery providers, and IT service operators, who process data on our behalf under data processing agreements.
• Legal authorities: where required by law, court order, or regulatory requirement in New Zealand or under applicable international agreements.

Any third-party providers we engage are required to maintain appropriate security measures and may only process your data on our documented instructions.

7. International Data Transfers

Some of our service providers may process data in countries outside New Zealand or the European Economic Area. Where such transfers occur, we ensure they are conducted under appropriate safeguards such as standard contractual clauses or adequacy decisions recognised under applicable law.

8. Data Security

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include encrypted data transmission (HTTPS), access controls, and regular security assessments.

Despite these measures, no method of internet transmission or electronic storage is 100% secure. If you believe your data security has been compromised, please contact us immediately.

9. Your Rights

Depending on applicable law, you may have the following rights regarding your personal data:

• Right of access: to request a copy of the personal data we hold about you.
• Right to rectification: to request correction of inaccurate or incomplete data.
• Right to erasure: to request deletion of your data in certain circumstances.
• Right to restriction: to request that we limit the processing of your data in certain circumstances.
• Right to data portability: to receive your data in a structured, machine-readable format (where processing is based on consent or contract).
• Right to object: to object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us using the details in Section 1. We will respond within 30 days. You also have the right to lodge a complaint with the New Zealand Privacy Commissioner (www.privacy.org.nz) or the relevant data protection authority in your jurisdiction.

10. Cookies

Our use of cookies is described in our Cookie Policy, which forms part of this Privacy Policy.

11. Children

Our website is not directed at persons under the age of 18. We do not knowingly collect personal data from minors. If you become aware that a minor has provided us with personal information, please contact us so we can delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The current version will always be published on this page with the date of last update. For significant changes, we will make reasonable efforts to notify you directly where we hold your contact information.