Last updated: 3 October 2026
1. Who we are
Lalkil (https://lalkil.com) is operated by Lalkil. We are the data controller for the personal data described in this policy. You can reach us by the contact form at https://lalkil.com/contact.
This policy applies to the website, the mobile app and the emails we send. It is written to comply with Lebanon's Law No. 81/2018 on Electronic Transactions and Personal Data and, where you are located in the European Economic Area or the United Kingdom, with the GDPR and UK GDPR.
2. What we collect and why
- Account: first name, last name, email address, a securely hashed password (never the password itself), an optional phone number and your saved delivery addresses. Used to run your account and fulfil orders (performance of a contract).
- Sign in with Google, Microsoft or Apple: the provider sends us your name, email address and a provider user ID. We do not receive your password. Used to create or sign you in to your account.
- Orders: the items you buy, the delivery address and phone number, the payment method and order notes. Used to deliver your order and keep the accounting records the law requires.
- Guest checkout: your email, name and delivery details for that order only.
- Contact requests: your name, email, optional phone, subject and message. Used to answer you (our legitimate interest in responding to enquiries).
- Newsletter: your email address, confirmed by a link we send you (double opt-in). Used only with your consent, which you can withdraw at any time with the unsubscribe link in every email.
- Product alerts: when you ask to be notified about a price drop or a restock, we store that request against your account until you turn it off.
- Reviews: your name and the review text are published on the product page after moderation. Guest reviews require a name and an email address that is not published.
- Wishlist and recently viewed products: stored with your account (or only in your browser when you are not signed in) so you can find items again.
- Security data: when you register, sign in, place an order, send a message or post a review, we record your IP address and the approximate country and city reported by our hosting provider. Used to prevent fraud, abuse and automated attacks (legitimate interest). IP addresses are removed from these records after 90 days.
- Cookies and similar technologies: see our Cookie Policy. Analytics and advertising tools run only after you accept them in the cookie banner.
3. What we do not do
- We do not sell or rent your personal data.
- We do not process card or bank details on this website. Payment is cash on delivery, or a Whish Money transfer you make from your own Whish account when that option is offered.
- We do not use your data for automated decisions that have legal or similarly significant effects on you.
- We do not knowingly collect data from children under 18. The store is intended for adults.
4. Who we share data with
We share personal data only with providers that help us run the store, and only what they need:
- Hosting and infrastructure (Vercel Inc., USA) and our content and order database (Sanity AS, Norway, with servers in the EU/US). They store data on our behalf under data-processing terms.
- Delivery partners inside Lebanon receive your name, address and phone number to deliver your order.
- Our email delivery provider receives your email address and the content of transactional and newsletter emails.
- Google LLC, Microsoft Corporation or Apple Inc. when you choose to sign in with their accounts.
- Analytics and advertising providers (Google Analytics and Google Tag Manager, Microsoft Clarity, Meta) only after you accept optional cookies. Each of them processes data under its own privacy policy.
- Authorities, courts or professional advisers when the law requires it or to defend our legal rights.
5. International transfers
Some of the providers above are located outside Lebanon, including in the United States and the European Union. Where required, transfers are covered by standard contractual clauses or equivalent safeguards offered by those providers.
6. How long we keep data
- Account data: until you delete your account or after a long period of inactivity.
- Orders and invoices: for as long as accounting and tax law requires. When you delete your account, orders are kept but your name, email and phone number are removed from them.
- Contact requests: up to 24 months after we answer you.
- Newsletter: until you unsubscribe; unsubscribed addresses are kept only to make sure we do not email you again.
- Security logs: 12 months. IP addresses in other records: 90 days.
- Reviews: while the product is listed; deleted accounts have their name replaced by "Former customer".
7. Your rights
You can access, correct, download and delete your data yourself from My Account → Privacy & Data (website) or Account → Privacy & data (app). You can also ask us to restrict or object to processing, withdraw consent at any time, and lodge a complaint with your data-protection authority. In Lebanon, requests are handled under Law No. 81/2018; the Ministry of Economy and Trade supervises personal-data matters.
To exercise a right by email, contact us by the contact form at https://lalkil.com/contact. We answer within 30 days.
8. Security
All traffic to the website and app is encrypted with HTTPS. Passwords are stored as salted hashes. Access to customer data in our administration panel is limited to staff who need it, protected by two-factor authentication and recorded in an audit log. No system is perfectly secure; if a breach affects your data we will inform you and the authorities as the law requires.
9. Changes to this policy
We may update this policy when our services or the law change. The date at the top shows the current version. Material changes are announced on the website before they take effect.