Privacy Policy

Hacllun (“we”, “us”, “our”) is committed to protecting the privacy of everyone who
visits hacllun.com or purchases our products. This policy describes the categories of
personal data we collect, the purposes for which we process it, the legal bases on
which we rely, and the rights available to you. It applies to our website, our
customer service channels and any related communications.

1. Information We Collect

We collect only the information necessary to operate the store, fulfil orders and
support our customers.

Information you provide directly. Name, billing and shipping address,
email address, telephone number, order contents and any correspondence you send us.
Payment information. Payments are processed by PCI-DSS compliant payment
providers. Card numbers are transmitted directly to the payment processor and are
never stored on our servers; we retain only a tokenised reference and the last four
digits for reconciliation and refunds.
Information collected automatically. IP address, browser and device type,
operating system, referring URL, pages viewed and session duration, collected through
server logs and cookies.
Marketing preferences. Records of your consent or objection to marketing
communications, together with the email address used to subscribe.

We do not knowingly collect data from children under 16, and we do not offer our
products to them.

2. How We Use Your Information

Processing and delivering orders, issuing invoices and handling payments.
Providing customer support, answering enquiries and resolving complaints.
Sending transactional messages such as order confirmations and shipping notices.
Sending marketing communications where you have opted in, and honouring your
preferences and opt-outs.
Detecting and preventing fraud, misuse and unauthorised transactions.
Meeting legal, accounting and regulatory obligations, including tax and
consumer-protection requirements.
Analysing aggregate usage patterns to improve the site, our product pages and our
service quality.

3. Legal Bases for Processing

Where the GDPR or comparable legislation applies, we process personal data on the
following bases:

Contract — to process and deliver an order you have placed.
Legal obligation — to retain transaction records for tax and
accounting purposes.
Legitimate interests — to prevent fraud, secure our systems and
improve our services, balanced against your rights and expectations.
Consent — for marketing emails and non-essential cookies. Consent
may be withdrawn at any time without affecting the lawfulness of prior processing.

4. Sharing Your Information

We do not sell, rent or trade personal data. We share it only with service
providers who help us operate the store, and only to the extent required for them to
perform their function:

Payment processors — to authorise and settle transactions.
Shipping carriers and fulfilment partners — to deliver your order and
provide tracking.
Email and communication providers — to send transactional and, where
consented, marketing messages.
Hosting, analytics and security providers — to operate the site and
protect it from abuse.
Professional advisers and authorities — where disclosure is required by
law, court order or to establish, exercise or defend legal claims.

Processors act on our documented instructions and are bound by contracts
containing confidentiality and data-protection obligations. Where data is
transferred outside the EEA or UK, we rely on appropriate safeguards such as the
Standard Contractual Clauses or an adequacy decision.

5. Cookies and Similar Technologies

Strictly necessary cookies support core functions such as keeping items in your
cart, remembering your session and preserving security settings. These cannot be
disabled without breaking the store. Optional analytics and marketing cookies are
used only with your consent, and you may withdraw it at any time through your
browser settings or the cookie controls on this site. Disabling cookies may affect
functionality but does not prevent you from making a purchase.

6. Data Retention

Order and transaction records are retained for the period required by tax and
accounting law, typically seven years from the end of the relevant
financial year. Customer service correspondence is retained for up to
three years to resolve follow-up enquiries. Marketing contact details are
retained until you unsubscribe, after which a suppression record is kept to ensure
we do not contact you again. Server logs are retained for up to
twelve months. Data that is no longer required is securely deleted or
anonymised.

7. Security

The site is served over TLS and payment details are handled exclusively by
PCI-DSS compliant providers. Access to customer data is restricted to personnel who
require it to perform their role, and administrative accounts are protected by
strong authentication. We monitor our systems for unauthorised access and review our
safeguards regularly. No method of transmission or storage is completely secure, so
while we take these measures seriously, we cannot guarantee absolute security.

8. Your Rights

Subject to your jurisdiction and to certain legal exemptions, you may have the
right to:

Access the personal data we hold about you.
Correct inaccurate or incomplete data.
Erase data where there is no continuing lawful reason for us to keep it.
Restrict or object to processing based on legitimate interests.
Port data you provided to us to another provider in a machine-readable format.
Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, email
[email protected]. We will verify your
identity, respond within the period required by applicable law (generally 30 days)
and will not charge a fee except where a request is manifestly unfounded or
excessive.

9. California Residents (CCPA/CPRA)

California residents may request to know the categories and specific pieces of
personal information we have collected, the sources of that information, our
business purposes for collecting it, and the categories of third parties with whom
it is shared. You also have the right to request deletion, to correct inaccurate
information, and to opt out of the “sale” or “sharing” of personal information.
We do not sell personal information, and we do not share it for cross-context
behavioural advertising. We will not discriminate against you for exercising
any privacy right. Requests may be submitted to
[email protected].

10. Third-Party Links

Our site may link to third-party websites. We are not responsible for their
content or privacy practices, and we encourage you to review the privacy policy of
any site you visit through such a link.

11. Changes to This Policy

We may update this policy to reflect changes in our practices, technology or legal
requirements. Material changes will be announced on this page with a revised
effective date, and where required by law we will seek your consent before applying
them. Continued use of the site after an update constitutes acceptance of the
revised policy.

12. Contact Us

For privacy questions, data-subject requests or concerns about how we handle your
information, contact our privacy team at
[email protected] or use our
contact form. If you are in the EEA or UK and are
dissatisfied with our response, you have the right to lodge a complaint with your
local supervisory authority.

Last updated: October 2026