Privacy policy

This Privacy Policy explains what information we collect, why we collect it, how we use it, and the choices available to you.

Information you provide to us. When you create an account, place an order, or contact us, you may provide:

• Full name
• Phone number
• Email address
• Delivery and billing address
• Account login information
• Order and purchase details
• Product preferences
• Information you provide when contacting us

We only request information that is reasonably necessary to provide our services.

What stays on your device. Your shopping bag and wishlist are stored by your own browser, under the keys kc-cart-v1 and kc-wishlist-v1. While you are signed out, that information is not sent to us at all. Clearing your browser data erases it and we cannot recover it for you. If you sign in, your wishlist is also saved to your account so it follows you between devices; your bag is not.

Prices. The amount recorded against an order is recalculated on our server when the order is placed, rather than taken from your browser, so the figure stored against your order is always the real one.

Payment information. If you make a payment through an online payment provider, your payment information may be processed directly by the relevant payment service provider. Khawaja Collection does not need to store your complete debit or credit card number or card security code.

We may use your information to:

• Process and deliver your orders
• Confirm orders and payments
• Contact you about your order
• Handle returns, exchanges, refunds, and complaints
• Create and manage your customer account
• Provide customer support
• Improve our website, products, and services
• Understand website usage and performance
• Prevent fraud, abuse, or unauthorised activity
• Maintain business, accounting, and tax records
• Comply with applicable legal and regulatory requirements

We do not sell your personal information to third parties.

We use Google Analytics to understand how visitors use our website. This may include information such as:

• Pages visited
• Approximate location
• Device and browser information
• Traffic source
• Time spent on the website
• General website interaction data

Analytics information helps us understand website performance and improve the shopping experience.

The audiences Google Analytics builds from these visits are also shared with Google Ads, so you may later see our ads on Google or on sites that carry its advertising. That is based on the pages you looked at, never on anything you typed into a form. There is no Meta Pixel and no other advertising network on this website. You can turn personalised ads off at Google’s My Ad Center (opens in a new tab), and you can stop the measurement itself with Google’s opt-out add-on (opens in a new tab).

Our website may also use cookies and similar technologies for essential website functionality, account features, shopping-cart functionality, analytics, and other website operations. You can control or disable cookies through your browser settings. Some website features may not function correctly if essential cookies are disabled.

We may share limited personal information with trusted service providers when necessary to operate our business. These may include:

• Google Analytics for website measurement and analytics.
• Google Ads for the advertising audiences built from that measurement.
• Supabase for database, account, and authentication services.
• Our hosting provider for hosting and delivering the website.
• Courier and delivery partners to deliver your order. They may receive your name, phone number, and delivery address.
• Payment providers, where applicable, to process payments securely.
• Other service providers where necessary to provide a service you have requested or where disclosure is required by law.

We only provide service providers with information reasonably necessary for them to perform their services.

We take reasonable technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. However, no internet transmission or electronic storage system can be guaranteed to be completely secure.

Two specifics worth naming. Your password is stored by Supabase Auth as a hash — we never see it, and nobody with access to our database can read it.

Order records are not readable by the website running in anyone’s browser; the database refuses those requests outright. Reading an order requires either being signed in as the account that placed it, or knowing both the order number and the phone number on that order. A wrong pairing returns the same “not found” as an order number that does not exist, so the tracking page cannot be used to discover which orders exist.

You should also protect your account password and avoid sharing it with others.

We keep personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy.

Order and transaction records may be retained for up to six years where necessary for accounting, tax, legal, dispute-resolution, and business-record requirements. FBR currently states that certain sales-tax records and documents must be retained for six years after the relevant tax period.

Some information may be retained for longer where required by law, necessary for an ongoing dispute, or needed to establish, exercise, or defend legal claims. Account information may be deleted when you request deletion, subject to information that we are legally required or reasonably entitled to retain.

You may contact us to:

• Ask what personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your account and personal information
• Ask about how your information is being used
• Request assistance with your personal information

Please understand that deleting an account does not necessarily require us to delete transaction records that we are legally required to retain. To make a request, contact us using the details below.

Our website is not intended to knowingly collect personal information from children without appropriate parental or guardian involvement. If you believe a child has provided personal information to us, please contact us so that we can review and, where appropriate, remove the information.

Our website may contain links to third-party websites or services. We are not responsible for the privacy practices, security, or content of third-party websites. We recommend reviewing the privacy policy of any third-party service before providing it with personal information.

We may update this Privacy Policy from time to time to reflect changes to our website, services, technology, or legal requirements. When we make changes, we will update the “Last updated” date at the top of this page.

If you have questions about this Privacy Policy, or want to request access, correction, or deletion of your personal information, please contact us.