At Luxury Time Namibia, we are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or make a purchase.
1. Information We Collect
We collect information that you provide directly to us, including:
- Personal Identification Information: Name, email address, phone number, and postal address when you create an account, make a purchase, or contact us.
- Payment Information: Credit card details and billing information processed securely through our payment providers.
- Transaction Data: Details about purchases, including watch models, prices, and transaction history.
- Communication Records: Records of correspondence when you contact our customer service team.
- Account Information: Username, password (encrypted), and account preferences.
2. Automatically Collected Information
When you visit our website, we automatically collect certain information:
- Device information (browser type, operating system, device type)
- IP address and general location data
- Pages visited and time spent on our site
- Referring website or source
- Click patterns and navigation paths
3. How We Use Your Information
We use the collected information for the following purposes:
- Order Processing: To process and fulfill your orders, including shipping, payment processing, and sending order confirmations.
- Customer Service: To respond to your inquiries, provide support, and address any issues with your purchases.
- Authentication: To verify the authenticity of luxury timepieces and provide certificates of authenticity.
- Marketing Communications: To send you promotional materials, new arrivals, and special offers (with your consent).
- Website Improvement: To analyze usage patterns and improve our website functionality and user experience.
- Legal Compliance: To comply with applicable laws, regulations, and legal processes.
4. Information Sharing and Disclosure
We do not sell your personal information. We share data with a small, named set of processors required to run the site:
- DigitalOcean (Frankfurt, Germany) — hosts the website and database. Acts as a processor under EU adequacy rules. Their DPA →
- Resend(Delaware, USA) — sends transactional emails (enquiry confirmation, password reset, listing-decision notifications). Email content transits Resend’s infrastructure. Their DPA →
- Shipping partners(couriers DHL/FedEx/local) — for delivery of purchases. Provided your name, address, and phone only as needed for the courier waybill.
- Authentication partners— independent watchmakers we consult to verify a piece’s provenance. They receive watch details and seller-supplied images, not your contact information.
- Legal authorities— when required by law, court order, or to protect our rights and the safety of users.
We do not work with advertising networks, data brokers, or analytics third parties. We do not share data outside the processors named above.
5. Data Security
We implement strong security measures to protect your personal information:
- SSL/TLS encryption for all data transmission
- Secure payment processing through PCI-DSS compliant providers
- Regular security audits and vulnerability assessments
- Access controls limiting data access to authorized personnel only
- Encrypted storage of sensitive information
6. Cookies and Tracking Technologies
We keep cookies to the minimum needed to make the site work. We do not use third-party advertising cookies, social tracking pixels, or cross-site identifiers.
- Essential cookies: a small set of cookies required for authentication (so administrators stay signed in) and for the maintenance-mode banner. These are first-party, HTTP-only, and set the
Secure flag in production. - No analytics cookies. Our analytics (described in the next section) works without cookies and without storing your identity.
- No advertising cookies. We do not run ads on this site and do not share visitor data with advertising networks.
You can clear or block cookies in your browser at any time. Doing so will sign you out if you were signed in, but otherwise won’t affect your browsing.
6a. Site Analytics
To understand which pages are useful and how visitors find us, we collect limited, cookieless, first-partyanalytics on each page view. We process this data ourselves on our own server — nothing is sent to Google Analytics, Meta, or any other third party.
What we record per page view:
- The path of the page visited (e.g.
/collection) — never query strings. - The hostname of the referring site, if any (e.g.
google.com). - A coarse location: country and city, derived from your IP via a local GeoLite2 lookup. We do not store the IP itself.
- Your device class (mobile, tablet, desktop), browser name, and operating-system name — derived from the standard
User-Agent header. - A daily-rotating, salted, one-way hash of
(IP + User-Agent) so we can count unique visitors and sessions without being able to identify them. - The timestamp of the visit.
What we do NOT record: your IP address, your name, your email, any cookie identifier, any cross-site identifier, scroll position, mouse movements, screen recordings, or anything else that could be used to single you out.
Retention: aggregate page-view records are retained for up to 90 days, after which they are deleted or further aggregated into anonymous totals that cannot be linked back to a session.
Your control: we honour the browser’s Do Not Tracksignal — if your browser sends it, no analytics record is written for your visit. Pages inside /admin are not tracked at all.
7. Your Rights
Under applicable Namibian data protection laws, you have the right to:
- Access the personal information we hold about you
- Request correction of inaccurate information
- Request deletion of your personal data
- Opt-out of marketing communications
- Withdraw consent for data processing
- Lodge a complaint with relevant authorities
8. Data Retention
Concrete retention timeframes for each data category we hold:
- Analytics page-view records: 90 days, then deleted (see section 6a).
- Enquiries: retained for 12 months after the last status change, then deleted. Enquiries you mark as resolved with us may be kept longer if there is an open transaction.
- Submitted watch listings: approved listings remain while the watch is for sale. Rejected listings are deleted 90 days after rejection. Approved-then-sold records are retained for 7 years for tax/audit (see below).
- Transaction records (sales, invoices, payment confirmations): 7 years, for Namibian tax and accounting compliance.
- Account credentials (admin/staff): for the lifetime of the account; password-hash and tokens are deleted within 30 days of account closure.
- Password reset tokens: 1 hour from issue, single-use.
- Backups: rolling 4-week backups of the database and uploaded images, after which older backups are deleted.
If you ask us to delete your personal information sooner under section 7, we will do so unless we are required by law to keep it (e.g. an active transaction or tax record).
9. International Transfers
The website and database are hosted in Frankfurt, Germany, which the European Commission considers to provide an adequate level of data protection. Transactional emails are sent through Resend, which operates from the United States under Standard Contractual Clauses for transfers from the EU/SA. No personal data is transferred to jurisdictions outside these adequacy frameworks.
10. Children's Privacy
Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children.
11. Changes to This Policy
We may update this Privacy Policy periodically. We will notify you of any material changes by posting the new policy on this page and updating the “Last Updated” date.
12. Contact Us & Data Subject Requests
Questions about this Privacy Policy, or to exercise any of the rights in section 7 (access, correction, deletion, objection, portability) — you have two paths:
- Self-service: visit /dsar, enter your email, and we’ll send you a verification link. From there you can view everything we hold and request immediate deletion.
- Or email Paulo directly using the details below. We respond within 30 days as required by POPIA and GDPR.
13. Lodging a Complaint
If you are not satisfied with how we have handled your personal information, you may complain to the relevant regulator:
- Namibia / South Africa (POPIA):Information Regulator of South Africa — inforegulator.org.za
- European Union (GDPR):your national data protection authority. A directory is maintained at the European Data Protection Board — edpb.europa.eu