Privacy and Personal Data Protection Policy

The owner and operator of personal data is the sole proprietor Nuriyev Emil Fuad, trading as LOOT ROOM (VÖEN 1009700062). Privacy matters are handled by e-mail at support@lootroom.az and through the other channels shown on the Contacts page; enquiries are answered within 48 hours, usually within the first hours.

This policy applies to personal data processed when a person uses lootroom.az, creates an account, places an order or pre-order, pays online, receives delivery or handover, makes a return, or communicates with LOOT ROOM. Data is processed in accordance with the Law of the Republic of Azerbaijan on Personal Data and other applicable rules.

When an account is created, we collect the person's first and last name, e-mail address, delivery address, any contact number provided voluntarily, and identifiers necessary to manage the account. The Customer may view data stored in the account through the personal account area and correct it using the available features.

For an order, we retain the order number, selected products, quantity and price, pre-order status, delivery address and handover notes, payment status and payment reference, return information and order history. The transaction identifier received from the payment provider and transaction records required by law are also linked to the order.

Even if an order is placed without an account, the name, e-mail and handover details supplied to fulfil it are processed under this policy. If required fields are not provided, LOOT ROOM may be unable to create an account, accept the order or make delivery.

Messages, order agreements, complaints, photographs and support correspondence sent by e-mail, through website forms or in a messenger conversation started by the Customer may be retained to answer the request and evidence the order. Please do not send special-category data or other confidential information that is not necessary for an order.

For security and normal operation, the website may automatically record limited technical data such as IP address, access time, browser and device type, requested page, and error and security logs. This data is used to maintain sessions, security and technical troubleshooting, not to track the user for an advertising profile.

The website uses necessary cookies and browser local storage to maintain a session, recognise account login, provide security and remember products selected in the cart. These technologies may store a session identifier, cart contents, language choice and similar functional preferences.

When a visitor opens the website through a LOOT ROOM advertising link (an address of the form lootroom.az/go/…), two first-party cookies are set: a random visit identifier valid for 30 days and a random browser identifier valid for one year. While the visit cookie exists, the website records which pages and products that visit opened, how long the tab stayed visible, additions to the cart, the start of checkout and any order placed, and links them to the advertising campaign. These records contain no name, contact details or IP address, are not shared with advertising platforms or other third parties, and are used only to measure whether the campaign worked. Deleting the cookies ends the measurement; visitors who did not use such a link are not measured at all.

For visits through an advertising link the website also records which app or site the click came from, the device type and an approximate location (country and city) derived from the IP address; for that lookup the IP address is passed to a geolocation service (ipinfo.io) and is not stored. For general statistics the website may use Umami analytics hosted on LOOT ROOM's own server, which sets no cookies and does not identify the visitor.

A user may block necessary cookies, delete browser data or clear local storage, but doing so may sign the user out, clear the cart or prevent some website features from working. LOOT ROOM does not currently use cookies for behavioural advertising; if that changes, this policy will be updated and separate consent will be obtained where required by law.

Data is processed to create and protect an account, operate the cart and session, identify the Customer, accept an order or pre-order and confirm it by e-mail, reconcile payment with the order, reserve products and display order history. Address and handover notes are used to arrange courier delivery or an agreed handover in person.

Data is also processed to answer questions and complaints, manage exchanges and refunds, prevent fraud and unauthorised access, resolve technical errors, comply with accounting and tax obligations and defend legal claims.

Contact details are used for transactional notices about order status, the expected arrival and delay of a pre-order, payment, delivery, handover and returns. Advertising and promotion messages are sent only where there is a lawful basis and, where required, separate consent, which may be withdrawn.

LOOT ROOM processes data on the basis of consent and information supplied by the data subject, to enter into and perform the sale contract requested by the Customer, and to comply with tax, accounting, consumer-complaint and other legal obligations. Only data necessary and relevant to each purpose should be processed.

Where processing is based on consent, the Customer may withdraw that consent. Withdrawal does not invalidate lawful processing already carried out and may not stop processing that remains necessary on another ground to perform a contract, retain legally required records or defend a legal claim.

The primary database containing accounts, addresses and order history is stored on LOOT ROOM's own managed server. Access is granted only to authorised persons who need it for their work function.

Card payment transaction data is processed in the systems of the licensed payment provider (Epoint), e-mail correspondence in the systems of the e-mail service, and delivery data by the courier service. Those services' separate privacy terms and any cross-border processing rules apply to such data.

Account data is retained while the account is active and for a short period after deletion where necessary to complete open orders. If the Customer asks to delete an account, account access is closed, but order and transaction records that must be retained on a separate legal ground may be separated from the profile and preserved for the required period.

Order, payment, delivery, return and correspondence data is kept for as long as legally necessary for accounting, tax, consumer claims, contract and limitation periods. When the purpose and retention ground end, data is securely deleted, destroyed or anonymised so that the person can no longer be identified.

Session cookies are deleted when the session ends or their technical lifetime expires. Cart data and preferences may remain in local storage until the user clears them, the website removes them as stale, or browser settings remove the data.

LOOT ROOM does not sell, rent or provide personal data to data brokers. Data is disclosed only to the extent necessary to fulfil an order, to the courier service and to the payment provider (Epoint).

The courier receives the name, contact details, delivery address, handover note and necessary order identifier. The payment provider may receive the order number, amount, currency and payer information it requires to process the transaction and meet legal compliance obligations.

LOOT ROOM may disclose data where required by a court order, a lawful request from a competent public authority, a tax or accounting obligation, or where disclosure is legally necessary to protect rights and safety. In each case, disclosure is limited to what is necessary for the relevant purpose.

Transactional notices about an order — order confirmation, payment, the expected arrival of a pre-order, delivery, handover and returns — are sent to the e-mail address the Customer gave in the order and are visible in the personal account. These messages form part of order fulfilment and are not treated as marketing consent.

A messenger conversation takes place only where the Customer has started it or where the Seller later publishes a corresponding number on the website. When a messenger is used, the telephone number, profile data, message contents and technical metadata may be processed by that service, including outside the Republic of Azerbaijan; the Customer should review the chosen service's own privacy terms and avoid sending confidential information that is not necessary for the order.

Order payments are processed by a licensed payment provider (Epoint). Card details are entered directly on the provider's secure page or component; LOOT ROOM neither collects nor stores the full card number or security code.

The website receives from the provider only the payment status and reference data — transaction identifier, order number, amount, currency, time and outcome — and uses it to match payment to an order, issue refunds and maintain financial records. The provider's own privacy and security terms also apply to its processing.

The Customer may request information about whether data about them exists, its source, processing purpose and legal ground, and the persons to whom it has been disclosed, may review retained data and may require it to be corrected. Except where law provides otherwise, the Customer may object to processing, withdraw consent and request that processing stop and that data be deleted or destroyed.

A rights request may be sent by e-mail to support@lootroom.az; enquiries are answered within 48 hours, usually within the first hours. Before acting on a request, LOOT ROOM may reasonably verify the requester's identity and authority and, where required by law, ask for a written application or a request bearing an enhanced electronic signature.

Some data may not be deleted where it is needed to fulfil an open order, maintain mandatory accounting and tax records, investigate fraud or defend a legal claim. If the Customer believes their rights have been violated, they may complain to the competent public authority or a court.

LOOT ROOM applies technical and organisational measures appropriate to the nature of the data to protect personal data from unauthorised access, alteration, disclosure, loss and destruction. These measures may include restricted access rights, authentication, system updates, protected backups and confidentiality duties for staff.

No internet or storage system can guarantee absolute security. The Customer should protect account access and their device and immediately report suspicious activity or a possible data leak to support@lootroom.az.

LOOT ROOM does not knowingly collect personal data from minors that is unnecessary for an order. If a person is not legally capable of giving consent or entering into a contract alone, they must create an account and place an order with the consent and supervision of a parent or other legal representative.

A parent or legal representative who believes a minor's data was supplied without the necessary consent may write to support@lootroom.az. LOOT ROOM will investigate and delete data that is not required to be retained by law.

LOOT ROOM may update this policy when the law, website functions, payment and delivery methods or data processing changes. A new version is published on the website with its update date, and material changes may also be communicated through an appropriate additional notice.

Details for a privacy question, withdrawal of consent or a rights request: sole proprietor Nuriyev Emil Fuad, VÖEN 1009700062, address: AZ1130, Baku, Binagadi district, e-mail support@lootroom.az. The full registered address is stated in the order documents and provided on request.