Privacy Notice

Last updated: 19 October 2026

1. Who is responsible

Timberline Exchange LLC, 1403 New Abbey Avenue, Leesburg, FL 34788, USA, is the business responsible for the personal information collected through lulutoxstore.com (the "Website"). For visitors from the European Economic Area or the United Kingdom, we are the data controller. Questions and requests: support@lulutoxstore.com.

2. What we collect

• Information you give us: your name, e-mail address, phone number, shipping and billing address, the products you order, and the content of any message you send us. Payment details are entered into the form of our payment processor; we receive the payment method, the last four digits of a card and the result of the payment, never the full card number.
• Information collected automatically: your IP address, device and browser type, the pages you view, the site or advertisement that referred you (including campaign parameters in the link), approximate location derived from the IP address, and identifiers stored in cookies or similar technologies.
• Information from our service providers: delivery status from the carrier, the payment result and fraud-risk signals from the payment processor.

3. Why we use it

• To process and deliver your order, send order and shipping e-mails and handle returns and refunds (necessary to perform the contract with you).
• To answer your questions and provide customer service.
• To take payment, prevent fraud and handle chargebacks and disputes (our legitimate interest and legal obligations).
• To keep accounting and tax records (legal obligation).
• To measure how the Website and our advertising perform and to improve them (our legitimate interest; consent where the law requires it for cookies).
• To send you marketing e-mails only where you have agreed to receive them; you can unsubscribe at any time using the link in every e-mail.

4. Who we share it with

We share personal information only with service providers that act on our instructions and only as needed to run the Website and fulfil orders: payment processors and payment networks; the software we use to manage orders and customer service; the warehouse and the shipping carriers that deliver your parcel; the e-mail service that sends order and marketing e-mails; hosting, content-delivery and error-monitoring providers; analytics and advertising-measurement services; and fraud-prevention services. We may also disclose information to professional advisers, to authorities where the law requires it, or to a buyer if our business is sold. We do not sell personal information.

5. Cookies and similar technologies

The Website uses cookies and similar technologies that are needed for the checkout and for security, and, depending on your choices and applicable law, cookies used to measure traffic and advertising. You can delete or block cookies in your browser settings; the checkout may not work without the essential ones. Where the law requires it, we honour opt-out preference signals such as Global Privacy Control.

6. International transfers

We are based in the United States and process information there. Some of our service providers process information in other countries. Where information about visitors from the European Economic Area or the United Kingdom is transferred abroad, we rely on recognised safeguards such as standard contractual clauses.

7. How long we keep it

Order and payment records are kept for as long as tax and accounting rules require (normally up to seven years). Customer-service correspondence is kept for up to three years after the last contact. Marketing preferences are kept until you unsubscribe. Analytics data is kept for the retention period of the respective service.

8. Your rights

• Visitors from the European Economic Area and the United Kingdom may ask for access to, correction or deletion of their personal information, ask us to restrict processing, object to processing based on legitimate interest, receive their data in a portable format, and withdraw consent at any time. You may also complain to your local data-protection authority.
• California residents have the right to know what personal information we collect, use and disclose, to request deletion or correction, to opt out of the sale or sharing of personal information (we do not sell personal information), and not to be discriminated against for exercising these rights. Residents of other US states with privacy laws have similar rights.
• To exercise any of these rights, e-mail support@lulutoxstore.com from the address used for your order. We may ask you to confirm your identity. An authorised agent may act for you with your written permission.

9. Security

We protect personal information with encryption in transit (TLS), access controls and the security measures of our service providers. No method of transmission or storage is completely secure, but we work to protect your information appropriately.

10. Children

The Website is not directed at children and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

11. Changes

We may update this notice from time to time. The date at the top shows when it was last changed.

12. Contact

Timberline Exchange LLC · 1403 New Abbey Avenue, Leesburg, FL 34788, USA · support@lulutoxstore.com