Privacy and Personal Data Protection Policy

The owner and operator of personal data is [Company name / TIN], trading as LOOT ROOM and having its registered address at [registered address]. Privacy contact details are [telephone / WhatsApp number] and [email address].

This policy applies to personal data processed when a person uses [website domain], creates an account, places an order or pre-order, receives delivery or pickup, makes a payment or return, or communicates with LOOT ROOM. Data is processed in accordance with the Law of the Republic of Azerbaijan on Personal Data and other applicable rules.

When an account is created, we collect the person's first and last name, email address, telephone number, delivery address and identifiers necessary to manage the account. The Customer may view data stored in the account through the personal account area and correct it using the available features.

For an order, we retain the order number, selected products, quantity and price, pre-order status, delivery or pickup choice, address and handover notes, payment method and status, return information and order history. For a bank transfer, payment confirmation and transaction records required by law may also be linked to the order.

Even if an order is placed without an account, the name, telephone number, email and handover details supplied to fulfil it are processed under this policy. If required fields are not provided, LOOT ROOM may be unable to create an account, confirm the order or make delivery.

Messages, order agreements, complaints, photographs and support correspondence sent through WhatsApp, email, telephone or website forms may be retained to answer the request and evidence the order. Please do not send special-category data or other confidential information that is not necessary for an order.

For security and normal operation, the website may automatically record limited technical data such as IP address, access time, browser and device type, requested page, and error and security logs. This data is used to maintain sessions, security and technical troubleshooting, not to track the user for an advertising profile.

The website uses necessary cookies and browser local storage to maintain a session, recognise account login, provide security and remember products selected in the cart. These technologies may store a session identifier, cart contents, language choice and similar functional preferences.

A user may block necessary cookies, delete browser data or clear local storage, but doing so may sign the user out, clear the cart or prevent some website features from working. LOOT ROOM does not currently use cookies for behavioural advertising; if that changes, this policy will be updated and separate consent will be obtained where required by law.

Data is processed to create and protect an account, operate the cart and session, identify the Customer, check and confirm an order or pre-order in WhatsApp, reconcile payment, reserve products and display order history. Address, telephone number and handover notes are used to arrange courier delivery or free pickup.

Data is also processed to answer questions and complaints, manage exchanges and refunds, prevent fraud and unauthorised access, resolve technical errors, comply with accounting and tax obligations and defend legal claims.

Contact details are used for transactional notices about order status, pre-order pricing and delay, payment, delivery, pickup and returns. Advertising and promotion messages are sent only where there is a lawful basis and, where required, separate consent, which may be withdrawn.

LOOT ROOM processes data on the basis of consent and information supplied by the data subject, to enter into and perform the sale contract requested by the Customer, and to comply with tax, accounting, consumer-complaint and other legal obligations. Only data necessary and relevant to each purpose should be processed.

Where processing is based on consent, the Customer may withdraw that consent. Withdrawal does not invalidate lawful processing already carried out and may not stop processing that remains necessary on another ground to perform a contract, retain legally required records or defend a legal claim.

The primary database containing accounts, addresses and order history is stored on LOOT ROOM's own managed server. Access is granted only to authorised persons who need it for their work function.

WhatsApp correspondence and transaction data for future card payments may also be processed in the systems of the relevant WhatsApp and payment providers. Those services' separate privacy terms and any cross-border processing rules apply to such data.

Account data is retained while the account is active and for a short period after deletion where necessary to complete open orders. If the Customer asks to delete an account, account access is closed, but order and transaction records that must be retained on a separate legal ground may be separated from the profile and preserved for the required period.

Order, payment, delivery, return and correspondence data is kept for as long as legally necessary for accounting, tax, consumer claims, contract and limitation periods. When the purpose and retention ground end, data is securely deleted, destroyed or anonymised so that the person can no longer be identified.

Session cookies are deleted when the session ends or their technical lifetime expires. Cart data and preferences may remain in local storage until the user clears them, the website removes them as stale, or browser settings remove the data.

LOOT ROOM does not sell, rent or provide personal data to data brokers. Data may be disclosed only to the extent necessary to fulfil an order to a courier and, once online card payment is launched, to the payment provider.

The courier receives the name, telephone number, delivery address, handover note and necessary order identifier. The payment provider may receive the order number, amount, currency, payment status and payer information it requires to process the transaction and meet legal compliance obligations.

LOOT ROOM may disclose data where required by a court order, a lawful request from a competent public authority, a tax or accounting obligation, or where disclosure is legally necessary to protect rights and safety. In each case, disclosure is limited to what is necessary for the relevant purpose.

Because orders are confirmed through WhatsApp, the telephone number supplied by the Customer receives transactional messages about product availability, final price, pre-order, payment, delivery and returns. These messages form part of order fulfilment and are not treated as marketing consent.

When WhatsApp is used, the telephone number, profile data, message contents and technical metadata may be processed by WhatsApp and its related services, including outside the Republic of Azerbaijan. The Customer should review WhatsApp's own privacy terms and avoid sending confidential information that is not necessary for the order.

When the local payment gateway is activated, card details will be entered directly on a secure page or component of the licensed payment provider. LOOT ROOM does not collect or store the full card number or security code on its own server.

To match payment to an order, issue refunds and maintain financial records, LOOT ROOM may receive limited data from the provider, such as a transaction identifier, masked card details, payer name, amount, time and outcome. The provider's own privacy and security terms also apply to its processing.

The Customer may request information about whether data about them exists, its source, processing purpose and legal ground, and the persons to whom it has been disclosed, may review retained data and may require it to be corrected. Except where law provides otherwise, the Customer may object to processing, withdraw consent and request that processing stop and that data be deleted or destroyed.

A rights request may be sent through [email address] or to [registered address]. Before acting on a request, LOOT ROOM may reasonably verify the requester's identity and authority and, where required by law, ask for a written application or a request bearing an enhanced electronic signature.

Some data may not be deleted where it is needed to fulfil an open order, maintain mandatory accounting and tax records, investigate fraud or defend a legal claim. If the Customer believes their rights have been violated, they may complain to the competent public authority or a court.

LOOT ROOM applies technical and organisational measures appropriate to the nature of the data to protect personal data from unauthorised access, alteration, disclosure, loss and destruction. These measures may include restricted access rights, authentication, system updates, protected backups and confidentiality duties for staff.

No internet or storage system can guarantee absolute security. The Customer should protect account access and their device and immediately report suspicious activity or a possible data leak through [email address].

LOOT ROOM does not knowingly collect personal data from minors that is unnecessary for an order. If a person is not legally capable of giving consent or entering into a contract alone, they must create an account and place an order with the consent and supervision of a parent or other legal representative.

A parent or legal representative who believes a minor's data was supplied without the necessary consent may contact [email address]. LOOT ROOM will investigate and delete data that is not required to be retained by law.

LOOT ROOM may update this policy when the law, website functions, payment and delivery methods or data processing changes. A new version is published on the website with its update date, and material changes may also be communicated through an appropriate additional notice.

A privacy question, withdrawal of consent or rights request may be sent to [Company name / TIN], [registered address], [telephone / WhatsApp number] and [email address].