Privacy Policy

Brea Elixir Atelier ("we", "us") is a skincare retailer based in Kampala, Uganda. We are responsible for the personal information described in this policy (the "data controller"). We handle it in line with the Data Protection and Privacy Act, 2019 of Uganda.

Questions about your data? Email info@breaelixiratelier.com or WhatsApp +256762589278.

• Order details: your name, phone number, email address (optional), delivery address and landmark, delivery date, time and notes, and the items you order. If your area is not listed, or you are outside Uganda, this also includes the place or country you type or choose. We use your phone number to call or message you to arrange delivery.
• Walk-in purchases: if you buy in our shop, we may record your name and phone number on the sales record and receipt, only when you give them.
• Account details (only if you create an account): your name, phone number, optional email, saved delivery details, and a password, which we store only in scrambled (hashed) form. We cannot read your password.
• Payment details: the mobile money number you pay with, and the status of the payment. We never see or store your card number or mobile money PIN; payments are processed by our payment provider.
• Wholesale enquiries: if you use the wholesale form, your business name, contact person, phone number, optional email, location, business type, estimated order size and message, which we use only to reply to you and manage your enquiry.
• Newsletter: your email address and the date you agreed, if you sign up in the footer.
• Technical data: your IP address and basic request information (such as browser type), used to keep the site secure, limit abuse and fix errors.
• Messages and calls with us by email, WhatsApp, phone or the contact page, which we keep to deal with your order or question.

• To fulfil your order (contract): process payment, prepare and deliver your products, send payment updates and receipts, and handle returns.
• To run your account (contract): let you sign in with your email or phone number and see your orders, receipts and saved details.
• To keep the site and your account secure (legitimate interest): detect fraud, limit sign-in attempts, block abuse and keep security records.
• To meet legal duties (legal obligation): keep accounting, tax and transaction records.
• To send you offers and restock news (consent): only if you ticked the box on the newsletter form. You can withdraw consent at any time.

We do not sell your personal information, and we do not use it for automated decisions that significantly affect you.

When you create an account you can sign in with either your phone number or your email address. Orders you place while signed in are saved to your account, and you can open or download your receipt for each paid order from My account, whether or not you gave us an email address. You can also add an earlier guest order to your account if you know its order number and the phone number used.

If you do not give us an email address we cannot email you receipts or password reset links; your receipts stay available in your account, and our team can help you recover access (see Your rights below). Please keep your password private and sign out on shared computers.

Only with those who help us serve you, and only what they need:

• Our payment provider (Relworx) and the mobile money and card networks, to collect and confirm your payment.
• Delivery staff, couriers and postal services, who receive your name, phone number, address and order contents so they can reach you. For orders outside Uganda this includes international carriers and, where required, customs authorities in the destination country.
• WhatsApp (Meta), if you message us or we message you there, under their own terms.
• Email and hosting providers, who deliver our messages and host this website and its database on our behalf.
• Authorities, courts or regulators, where the law requires it.

These providers may process data outside Uganda, and if you order from another country your details go to that country so the parcel can reach you. Where we choose the provider, we expect it to protect your data to a standard comparable to Ugandan law.

We use only what the site needs to work. We do not use advertising, analytics or cross-site tracking cookies, so there is no cookie banner. If we ever add them, we will ask for your consent first and update this page.

The site also loads a few things from other companies, which can see your IP address and browser details when your browser fetches them:

• Google Fonts (Google): the typefaces we use.
• Tailwind CSS (its content delivery network): part of the page styling.
• Cloudflare Turnstile: an anti-bot check on some forms, which may set its own temporary cookie or storage item to do its job.

These providers have their own privacy policies. If you block cookies you will not be able to sign in or check out.

• Order and payment records: as long as needed for accounting, tax and dispute purposes (generally up to 7 years).
• Account details: until you ask us to delete your account.
• Newsletter: until you unsubscribe (we then keep a minimal record that you did).
• Security logs and sign-in attempt records: a short period, then deleted automatically or on a regular clean-up.

We use industry-standard measures: passwords are hashed with a strong algorithm and common or easily guessed passwords are rejected; forms are protected against forgery and automated abuse (hidden anti-bot checks, limits on repeated attempts, and, on some forms, Cloudflare Turnstile, which looks at technical signals such as your IP address and browser to tell people from bots, under Cloudflare privacy terms); repeated failed sign-ins are blocked; changing or resetting a password signs your account out on other devices; password reset links are single-use and expire; and the site is served over an encrypted (HTTPS) connection. No system is perfectly secure. If a breach affecting your personal data occurs, we will take steps to contain it and notify you and the Personal Data Protection Office as the law requires.

You must be at least 18 to create an account or place an order, and our website is intended for adults. If you are younger, please ask a parent or guardian to order for you. We do not knowingly collect personal information from children under 18. If you believe a child has given us their information, contact us and we will delete it.

You have the right to:

• ask what personal information we hold about you and get a copy;
• correct information that is wrong (you can edit your saved details yourself in My account);
• ask us to delete your information or your account, subject to records we must legally keep (for example order and tax records);
• object to or withdraw consent for marketing at any time, using the unsubscribe link in any newsletter;
• complain to the Personal Data Protection Office of Uganda if you think we have mishandled your data.

To use these rights, or if you have no email on your account and need help getting back in, Email info@breaelixiratelier.com or WhatsApp +256762589278. We may need to confirm who you are before we act, to protect your information.

Our site may link to other websites (for example WhatsApp, maps or social media). They have their own privacy practices and we are not responsible for them.

We may update this policy from time to time. The date at the top shows when it last changed. If we make a significant change we will say so on this page.

Email info@breaelixiratelier.com or WhatsApp +256762589278.