Privacy Policy

Last updated: 27 October 2026

This privacy policy explains what personal data Serene Spa collects when you use this online shop, why we use it, who we share it with and the choices you have.

It completes our terms and conditions.

1. Who is responsible for your data

Serene Spa is responsible for your personal data.

The shop runs on an e-commerce platform that stores and processes data on our behalf, under our instructions and with the same protections.

2. The data we collect

Account and contact details: name, phone number, email address and password (stored only as a secure hash).
Orders: products, delivery addresses, chosen delivery and payment method, order history and invoices.
Verification: the phone number or email a one-time code is sent to, and whether it was confirmed.
Messages: what you send us through the contact form, and our replies.
Technical data: IP address, browser and device type, and security logs (for example sign-in attempts), used to keep the shop safe.

3. Why we use your data

To process and deliver your orders, run your account and send order updates. This is needed to carry out our contract with you.
To protect you and us against fraud: verification codes, checks on unusual orders and blocking abuse. This is our legitimate interest.
To meet legal duties, such as keeping invoices for tax and accounting purposes.
To send offers and news, only if you agreed. You can unsubscribe at any time from the message itself or your account.
To answer your questions and handle complaints and returns.

4. Who we share it with

We share only what each provider needs to do its job:

delivery companies (name, phone number and delivery address);
SMS, WhatsApp and email providers that deliver verification codes and order updates;
the hosting and platform providers that run the shop;
public authorities, when the law requires it.

We never sell your personal data. Some providers may store data outside Lebanon; we only use providers that protect it at least as well as we do.

5. Cookies

The shop uses only the cookies it needs to work: keeping you signed in, remembering your cart, language and currency, and protecting forms against abuse. A bot-check service may run when you request a verification code. We do not use advertising or analytics trackers.

6. Security and how long we keep data

Personal data is sent over encrypted connections and stored encrypted. Access is limited to the staff who need it, and sensitive actions are logged.

Account data is kept while your account is open.
Orders and invoices are kept for as long as Lebanese tax and accounting rules require, even after an account is deleted.
Verification codes expire after a few minutes; security logs are kept for a limited time.
Contact messages are kept while we handle your request and then for a reasonable period.

7. Your rights

Under Lebanese Law No. 81 of 2018 on Electronic Transactions and Personal Data, and wherever other data protection laws (such as the GDPR) apply to you, you can ask to:

see the personal data we hold about you;
correct data that is wrong or incomplete;
delete your data, unless we must keep it by law;
object to a use of your data or withdraw a consent you gave.

You can delete your account yourself from your account profile. For any other request, contact us using the details on this page. We answer within 30 days and may ask you to confirm your identity first.

8. Children

The shop is not meant for children under 16 to use on their own. We do not knowingly collect their data; if you think a child has given us personal data, contact us and we will delete it.

9. Changes to this policy

We may update this policy when our services, our providers or the law change. The date at the top of this page shows the latest version. If a change is important, we will tell you on the shop or by message.

10. Contact us

Questions about your data or this policy? Write to us from the contact page.