PRIVACY POLICY

Last updated: August 15, 2026

1. ABOUT THIS PRIVACY POLICY

This Privacy Policy explains how DEBORAH & L.F., operated by XIRON AREA ("DEBORAH & L.F.", "we", "us" or "our"), collects, uses, stores and shares personal information when you visit deborahandlf.com, make a purchase, contact us or otherwise interact with our online store.

This Policy should be read together with our Terms of Service and other applicable policies.

2. PERSONAL INFORMATION WE COLLECT

Depending on how you interact with our store, we may collect:

• Contact information, such as your name, email address, billing address, shipping address and phone number where provided.

• Order information, including products purchased, order history, delivery details and transaction information.

• Payment-related information. Payments are processed by Shopify and/or third-party payment providers. We do not normally receive or store your full payment card details.

• Customer service information, including messages, enquiries, return requests and information you provide when contacting us.

• Device and usage information, such as IP address, browser type, device information, time zone, pages viewed and interactions with our website.

• Cookie and similar technology information used to operate, secure and improve the website and, where enabled and permitted, for analytics or advertising purposes.

3. HOW WE USE PERSONAL INFORMATION

We may use personal information to:

• process, fulfil and deliver your orders;

• process payments, refunds and returns;

• communicate with you about your order or enquiry;

• provide customer support;

• prevent fraud, abuse and other security risks;

• maintain and improve our website, products and services;

• comply with legal, tax, accounting and regulatory obligations;

• send marketing communications where you have requested them or where otherwise permitted by applicable law; and

• carry out analytics or advertising activities where permitted and, where required, with your consent.

4. LEGAL BASES FOR PROCESSING

Where laws such as the GDPR or UK GDPR apply, we process personal information on one or more of the following legal bases:

• performance of a contract, including processing and delivering your order;

• compliance with legal obligations;

• our legitimate interests, where those interests are not overridden by your rights and interests; and

• your consent, where consent is required, including for certain cookies or marketing activities.

Where processing is based on consent, you may withdraw your consent at any time, subject to applicable law.

5. COOKIES AND SIMILAR TECHNOLOGIES

Our store and service providers, including Shopify, use cookies and similar technologies to operate and secure the website and remember certain preferences.

Where enabled, analytics and advertising technologies may also be used. In locations where consent is required, non-essential technologies will be used in accordance with the choices you make through our cookie or privacy controls.

You may be able to manage your privacy choices through the cookie banner or other privacy controls available on our website.

6. HOW WE SHARE PERSONAL INFORMATION

We may share personal information with service providers where reasonably necessary to operate our business, including:

• Shopify, which provides our ecommerce platform;

• payment processors;

• shipping, fulfilment and logistics providers;

• technology, hosting, security and customer-support providers;

• analytics or advertising providers where used and permitted; and

• professional advisers or government authorities where required by law.

We may also disclose information where reasonably necessary to comply with applicable law, respond to lawful requests, prevent fraud or protect our legal rights.

We do not disclose personal information simply for unrelated purposes without an appropriate legal basis.

7. INTERNATIONAL DATA TRANSFERS

Because we operate from Hong Kong and use international service providers, your personal information may be processed or stored outside the country where you live.

Where applicable data protection law requires safeguards for international transfers, we and our service providers will use appropriate transfer mechanisms or safeguards required by law.

8. DATA RETENTION

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including fulfilling orders, providing customer support, maintaining business and transaction records, preventing fraud and meeting legal, tax, accounting or regulatory requirements.

Retention periods may therefore vary depending on the type of information and the reason it is retained.

9. YOUR PRIVACY RIGHTS

Depending on where you live and the laws that apply, you may have rights concerning your personal information, including the right to:

• request access to personal information we hold about you;

• request correction of inaccurate information;

• request deletion of certain information;

• object to or restrict certain processing;

• request portability of certain information;

• withdraw consent where processing is based on consent; and

• opt out of certain targeted advertising, sale or sharing of personal information where applicable law provides such a right.

These rights may be subject to legal limitations or exceptions.

To exercise an applicable privacy right, please contact us at deborahandlf@gmail.com.

We may need to verify your identity before completing certain requests.

10. MARKETING COMMUNICATIONS

If you subscribe to marketing communications, you may unsubscribe at any time by using the unsubscribe link provided in the communication or by contacting us.

Unsubscribing from marketing communications will not prevent us from sending transactional or service-related messages about your orders.

11. THIRD-PARTY SERVICES AND LINKS

Our website may contain links to third-party websites or use services provided by third parties.

Their privacy practices are governed by their own policies, and we are not responsible for the privacy practices of websites or services that we do not control.

12. CHILDREN'S PRIVACY

Our online store is not intended for children to provide personal information independently where prohibited by applicable law.

If you believe that a child has provided personal information to us in circumstances where parental or guardian consent was required, please contact us.

13. SECURITY

We use reasonable administrative, technical and organisational measures designed to protect personal information.

However, no method of transmission over the internet or electronic storage can be guaranteed to be completely secure.

14. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes to our business practices, technology, legal requirements or other operational reasons.

The updated version will be posted on this page with a revised "Last updated" date.

15. CONTACT US

For questions about this Privacy Policy or to exercise an applicable privacy right, please contact:

DEBORAH & L.F.

Operated by: XIRON AREA

Business location: Tai Po, Hong Kong

Email: deborahandlf@gmail.com