LetayJao (“we”, “us”, “our”) operates the website https://letayjao.com and the mobile application “LetayJao” (together, the “Services”). We are committed to protecting the privacy of visitors and customers who purchase wellness and adult products from our Services. This Privacy Policy explains what information we collect, how we use it, and the rights you have in relation to it.

1. SCOPE
   This Policy applies to all personal data collected through our website, mobile app, telephone, WhatsApp, email, social media or any other channel.

2. INFORMATION WE COLLECT
   2.1 Information you provide voluntarily

• Name, billing/shipping address, phone number, email address

• Date of birth (age verification ≥ 18)

• CNIC or passport number (required for high-value orders & KYC)

• Payment details (credit/debit card number, JazzCash/EasyPaisa mobile account) – tokenised; we never store full card data

• Order history, product preferences, reviews, support tickets

• Uploaded files (CNIC images, selfies, product reviews with photos)

2.2 Information collected automatically

• Device identifiers, IP address, browser type, operating system

• Referring URLs, pages viewed, time spent, clickstream data

• Cookies and similar tracking technologies (see Section 7)

2.3 Sensitive data
Because we sell adult wellness products we may infer your sexual health interests. We treat this as sensitive personal data under applicable law and apply stricter safeguards.

3. PURPOSES & LEGAL BASES
   We process personal data only when we have a legal basis:

• Contract: to process and deliver your order, take payment, issue refunds or warranties

• Legal obligation: to maintain accounting records, perform age verification, comply with anti-money-laundering rules

• Legitimate interests: fraud prevention, network security, improving products, marketing similar items to existing customers (you may opt-out)

• Consent: for sending promotional newsletters, placing optional cookies, collecting location data

4. DISCRETE SHIPPING & COMMUNICATION
   Packages are sent in plain, unbranded wrapping; sender name shown as “LJ Logistics”.
   SMS/email notifications use neutral language e.g. “Your package is out for delivery”.

5. SHARING & DISCLOSURE
   We do NOT sell your data. We share only:

• Payment gateways (JazzCash, EasyPaisa, Stripe, etc.) – minimal data required to complete transaction

• Courier partners (TCS, Leopards, etc.) – name, address, phone number

• Government bodies when legally obliged (court order, tax audit)

• Service providers under contract (hosting, email, analytics) bound by confidentiality

6. INTERNATIONAL TRANSFERS
   Data is stored on servers located in Pakistan and Singapore. Where we transfer data outside Pakistan we ensure adequate protection via Standard Contractual Clauses or recognised adequacy decisions.

7. COOKIES & TRACKING
   We use essential cookies (cart, login) and optional analytics cookies (Google Analytics, Facebook Pixel). You can refuse optional cookies via the banner; essential cookies cannot be disabled.

8. DATA RETENTION

• Order records: 5 years (tax law)

• Payment tokens: until expiry of charge-back period (180 days)

• Marketing consent: until you unsubscribe

• Cookies: up to 12 months, or until cleared

9. SECURITY MEASURES

• 256-bit SSL encryption in transit

• PCI-DSS compliant payment processing

• Database encrypted at rest (AES-256)

• Role-based access, two-factor authentication for staff

• Regular penetration testing and vulnerability scanning

10. YOUR RIGHTS
    Under Pakistan’s Personal Data Protection Bill, 2023 and GDPR (for EU visitors) you may:

• Access: receive a copy of your personal data

• Rectify: correct inaccurate data

• Erase: request deletion (subject to legal retention)

• Restrict/object: to certain processing activities

• Portability: receive data in machine-readable format

• Withdraw consent: at any time (marketing emails include unsubscribe link)
  Requests can be sent to privacy@letayjao.com; we respond within 30 days.

11. CHILDREN’S PRIVACY
    Services are intended for individuals aged 18 or older. We do not knowingly collect data from minors. If you believe a minor has provided us data, contact us immediately; we will delete such information.

12. CHANGES TO THIS POLICY
    We may update this Policy from time to time. Material changes will be posted on this page with a new “Effective date” and, where appropriate, notified via email.

13. CONTACT DETAILS
    Data Controller: LetayJao (Private) Limited
    Email: privacy@letayjao.com | WhatsApp: +92-319-7359435
    Postal: Office 3XX, Pearl Tower, Lahore, Pakistan

If you have any questions about this Privacy Policy or our data practices, please contact us.