Privacy policy
What we collect, why we collect it, who sees it, and how to get it changed or deleted. Written to meet Saudi Arabia's Personal Data Protection Law (Law No. 30 of 2018).
Last updated: 12 October 2026Who we are
This policy explains how LULU collects, uses, shares and protects personal data when you use our website and app. It is written to meet the Kingdom of Saudi Arabia's Personal Data Protection Law (PDPL) and its implementing regulations, overseen by the Personal Data Protection Authority.
For the purposes of the PDPL, LULU is the data controller — we decide what data is collected and why.
| Entity | LULU |
|---|---|
| Registered address | Building 1245, Road 4021, Block 340, Riyadh, Saudi Arabia, Riyadh, Kingdom of Saudi Arabia |
| Commercial Registration | 88451-2 |
| Privacy contact | privacy@lulu-hyper.app |
What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Identity | Name, date of birth where age matters | You, at sign-up |
| Contact | Delivery address, phone, email | You, at checkout |
| Order | Basket contents, order history, substitutions, returns | Generated as you shop |
| Payment | Card type, last four digits, transaction reference | Our payment processor — we never see or store your full card number |
| Location | Delivery coordinates, approximate device location if you allow it | You, or your device |
| Technical | Device type, operating system, IP address, app version | Collected automatically |
| Usage | Pages viewed, searches, items tapped, notification responses | Collected automatically |
| Communications | Support chats, emails, call notes, reviews | You, when you contact us |
We do not knowingly collect data from children under 18. Accounts and orders require an adult. If you believe a child has given us personal data, write to privacy@lulu-hyper.app and we will delete it.
Why we use it, and our legal basis
| Purpose | Legal basis under PDPL |
|---|---|
| Taking payment and delivering your order | Performance of a contract with you |
| Customer support, refunds and returns | Performance of a contract with you |
| Fraud prevention and account security | Legitimate interests |
| Tax, accounting and regulatory records | Legal obligation |
| Improving the app, ranking and stock decisions | Legitimate interests |
| Marketing emails, SMS and push notifications | Your consent |
| Personalised offers and recommendations | Your consent |
Where we rely on consent, you can withdraw it at any time without affecting anything we did before you withdrew it. Withdrawing marketing consent does not stop transactional messages such as order confirmations and delivery updates — those are part of fulfilling your order.
Who we share it with
We do not sell your personal data. We share it only where it is needed to run the service:
- Delivery partners — your name, address and phone, so the order can reach you.
- Payment processors — to take payment and issue refunds. They handle your card details; we do not.
- Technology providers — hosting, analytics, messaging and customer-support tools acting on our written instructions.
- Professional advisers — auditors and lawyers, bound by confidentiality.
- Authorities — where we are legally required to disclose, or to establish or defend legal claims.
Every processor is bound by a written agreement limiting them to our instructions and requiring them to protect the data to the standard set out in this policy.
Transfers outside Saudi Arabia
Some of our providers process data outside the Kingdom. Where that happens we transfer data only in line with PDPL requirements — to a country recognised as offering an adequate level of protection, or under approved safeguards, or where a specific exemption applies.
You can ask us which providers process data abroad and on what basis by writing to privacy@lulu-hyper.app.
How long we keep it
| Data | Retention period |
|---|---|
| Order and invoice records | 7 years — set by tax and commercial law |
| Account details | While your account is active, then 24 months of inactivity |
| Support conversations | 24 months |
| Marketing preferences | Until you withdraw consent, plus a record of the withdrawal |
| Technical and usage logs | 12 months |
When a period ends we delete the data or irreversibly anonymise it so it can no longer identify you.
Your rights
Under the PDPL you have the right to:
- Be informed about how your data is collected and used — this policy.
- Access the personal data we hold about you.
- Request a copy in a readable, commonly used format.
- Correct data that is inaccurate, incomplete or out of date.
- Request deletion where the data is no longer needed for the purpose it was collected for.
- Withdraw consent at any time where consent is the basis we rely on.
To exercise any of these, email privacy@lulu-hyper.app. We will respond within 30 days. We may ask you to verify your identity first — this stops someone else obtaining your data by pretending to be you.
Some rights have limits. We may not be able to delete records we are legally required to keep, such as tax invoices, but we will tell you when that is the case and why.
Cookies and similar technologies
We use cookies and similar identifiers to keep you signed in, remember your basket, measure how the site performs, and — where you have agreed — to measure advertising.
- Strictly necessary — sign-in, basket, security. These cannot be switched off; without them the site does not work.
- Analytics — how pages perform and where people get stuck.
- Marketing — measuring campaigns and limiting repeated ads. Only set with your consent.
You can clear or block cookies in your browser settings, and reset the advertising identifier on your phone. Blocking strictly necessary cookies will break checkout.
How we protect it
We use encryption in transit, access controls limiting staff to the data their role requires, logging of access to personal data, and regular review of our providers. Payment card details are handled entirely by PCI-DSS compliant processors and never stored on our systems.
No system is perfectly secure. If a breach occurs that is likely to cause you harm, we will notify you and the competent authority as required under the PDPL.
Changes to this policy
We update this policy when our practices or the law change. The date at the top of this page always shows the current version. Where a change materially affects your rights we will tell you directly — by email or an in-app notice — rather than relying on you to re-read the page.
Questions and complaints
Contact privacy@lulu-hyper.app first — most issues are resolved quickly. If you are not satisfied with our response, you may lodge a complaint with the Saudi Arabia's Personal Data Protection Authority (PDPA), the supervisory authority for personal data in the Kingdom.