Our Commitment to Discretion & Data Stewardship
At Luerist, discretion is an indivisible tenet of luxury. We treat your personal identity, delivery addresses, and skin health diagnostic answers with the strictest confidentiality.
We adhere to the European General Data Protection Regulation (GDPR), the UK Data Protection Act 2018, the California Consumer Privacy Act (CCPA as amended by CPRA), and international privacy best practices.
Information Categories We Collect
We collect only the essential data required to compound and deliver your skincare regimens:
Sensitive Health Data Protection
Skin questionnaire responses are categorized as sensitive personal information. They are isolated in encrypted databases and accessible only to certified Luerist dermatological advisors.
- Identity & Contact: Name, salutation, shipping address, billing address, email, telephone number.
- Skin Diagnostic Survey Data: Skin type, environmental climate, sensitivity triggers, lifestyle habits (collected exclusively when you opt into the Skin Regimen Quiz).
- Order & Transaction Telemetry: Order records, formulation preferences, refill frequencies, delivery timestamps.
- Technical Diagnostics: Browser fingerprints, operating system, IP address, session interaction telemetry (anonymized for server load management).
Purpose of Processing & Legal Foundations
Your data is processed strictly under lawful bases:
1. Contractual Necessity: Processing your transaction, compounding your formulation, and coordinating climate-controlled cold-chain delivery.
2. Legitimate Interest: Preventing payment fraud, verifying age compliance, and optimizing digital boutique speed.
3. Explicit Consent: Transmitting VIP harvest releases, newsletter insights, and tailored skincare routine reminders.
The Zero-Sale Pledge & Third-Party Custodians
Luerist does NOT sell, rent, lease, or barter your personal records to third-party data brokers, marketing aggregates, or unauthorized advertising networks. Ever.
We share data exclusively with trusted technical custodians operating under strict Data Processing Agreements (DPAs):
- Payment Processing: Razorpay and Stripe (Level 1 PCI-DSS certified tokenization).
- Cold-Chain Logistics: DHL Express, FedEx Priority, and climate-controlled specialty couriers.
- Cloud Infrastructure: Cloudflare, Neon PostgreSQL, and AWS (Encrypted within EU & US regions).
Your Global Statutory Rights (GDPR, CCPA & Beyond)
Regardless of geographical residency, all Luerist patrons enjoy comprehensive privacy autonomy:
- Right of Access: Request a machine-readable copy of all personal records we hold.
- Right to Rectification: Correct out-of-date addresses or skin preference diagnostics.
- Right to Erasure ('Right to be Forgotten'): Request total deletion of your profile and historical records.
- Right to Restrict or Object: Opt out of marketing intelligence or automated profile indexing.
Data Retention & Cryptographic Deletion
We retain client data only as long as necessary to maintain your VIP patronage account or satisfy statutory tax and commercial recordkeeping obligations (typically 7 years for financial records).
Upon receiving an erasure request, non-financial records are wiped using cryptographically secure disk overwrite protocols within thirty (30) calendar days.