Privacy Policy

01Who we are

LALI & CO ("LALI & CO", "we", "us" or "our") is a small online retailer of handbags and fashion accessories based in Lahore, Pakistan. We sell through our website at laliandcopk.com, through WhatsApp, and through the LALI & CO Android application.

For the purposes of this policy, LALI & CO is the data controller — the party responsible for deciding how your personal information is handled. You can reach us at any time using the details in section 18.

• Business name: LALI & CO
• Location: Lahore, Pakistan
• Privacy contact: hello@lalico.pk
• Phone / WhatsApp: +92 300 845 2716

02What this policy covers

This policy applies to personal information we handle when you:

• Browse laliandcopk.com or use the LALI & CO Android app.
• Submit our contact form, or message us on WhatsApp, by phone or by email.
• Place, receive, pay for, exchange or return an order.
• Ask to be told when a sold-out item is restocked.
• Send us a review or feedback about a purchase.

03Information we collect

We collect only what we need to answer your message and get your parcel to you. The table below lists every category of data we handle, why we handle it, and whether it leaves our hands.

We do not collect

• Card or bank credentials. We never see or store card numbers, CVVs, PINs or banking passwords. Payment is cash on delivery or a transfer you make yourself through your own bank.
• Precise GPS location. The app never requests fine or background location.
• Your contacts, photos, SMS, call logs, microphone or camera roll. The app does not request access to any of these, other than the camera when you actively choose to attach a photo of an item.
• Government identity numbers. We do not ask for your CNIC or passport number.
• Sensitive categories. We do not collect data about health, religion, politics, ethnicity, biometrics or sexual orientation.
• Social media accounts. LALI & CO does not operate social media pages and there are no social media trackers, share buttons or login integrations on our website or in our app.

04How we use your information

We use your personal information only for these purposes:

• To process and deliver orders — confirming items and totals, booking the parcel with a courier, and following up on delivery.
• To communicate with you — replying to your enquiry, sending your tracking number, and telling you about a delay or an out-of-stock item.
• To handle exchanges, returns and complaints — checking your order history so we can put a problem right.
• To tell you about a restock — but only for the specific item you asked about, and only once.
• To keep records required by law — sales and tax records we are obliged to retain.
• To keep the app and site working — diagnosing crashes and fixing faults using anonymous or aggregated technical data.
• To prevent fraud and abuse — for example identifying repeatedly refused cash-on-delivery parcels.

05Consent and legal basis

We rely on the following grounds for handling your data:

• Performance of a contract — we need your name, number and address to complete an order you asked for.
• Your consent — for optional things such as publishing your review, using your approximate location, or sending you marketing. You may withdraw consent at any time.
• Legitimate business interest — keeping our app stable, preventing fraud, and maintaining basic business records.
• Legal obligation — retaining sales records, or responding to a lawful request from a competent authority in Pakistan.

Where we ask for consent, refusing costs you nothing else — you can still order, and we will simply ask you to type your city instead.

06Who we share data with

We share the minimum necessary, only with the following categories of recipient, and only for the purpose described:

• Courier and logistics companies (for example TCS, Leopards Courier, M&P or a comparable Pakistani service). They receive your name, phone number, delivery address and — for cash on delivery — the amount to collect. They cannot use your details for their own marketing.
• WhatsApp / Meta Platforms — if you choose to contact us on WhatsApp, that conversation is carried over WhatsApp's infrastructure and is subject to WhatsApp's own privacy policy. We use a standard business number, not a hosted API with third-party analytics.
• Email and hosting providers — our email provider and our website host process data purely as service providers on our instruction.
• Google (Play Store and crash reporting) — if you install the Android app, Google processes install and crash data under its own policies.
• Banks and payment channels — if you pay by bank transfer or Easypaisa, your bank processes that transaction under its own terms.
• Professional advisers and authorities — our accountant for tax records, or a competent authority where we are legally required to disclose.

Every service provider we use is given access only to what they need to do their job, and is required to keep it confidential.

07What we never do

• We never sell your personal information to anyone, for any amount.
• We never rent, trade or licence customer lists to advertisers, data brokers or other retailers.
• We never use your data to build advertising profiles, and we do not run behavioural advertising.
• We never publish your full name, number, address or order history.
• We never transfer personal data to a third party for a purpose you have not been told about in this policy.

08App permissions

The LALI & CO Android app requests as few permissions as possible. Each one is requested in context, with an explanation, at the moment it is needed — and the app remains usable if you decline. You can revoke any permission at any time in Android Settings → Apps → LALI & CO → Permissions.

The app does not request contacts, SMS, call logs, precise location, background location, microphone, or access to installed apps.

09Cookies and analytics

Our website is a plain static site. It sets no advertising cookies, no tracking pixels and no social media trackers. There is no cross-site tracking and nothing is sold to advertisers.

• Essential storage — your browser may cache pages and images so the site loads faster next time. This is standard browser behaviour and holds no personal data.
• Web fonts — we load the Jost typeface from Google Fonts. Google receives your IP address as part of that request, as it would for any file fetched from another server. No cookie is set.
• App crash reporting — the Android app reports crashes so we can fix them. Reports contain device model, OS version and a technical stack trace. They do not contain your name, number or address.

You can clear cached data at any time through your browser or through Android Settings → Apps → LALI & CO → Storage → Clear cache.

10Google Play data safety summary

This section restates our practices in the terms used by the Google Play Data Safety form, so you can compare it directly with our store listing.

11How long we keep data

We keep personal information only as long as there is a reason to, then delete it. Our normal periods are:

• Enquiries with no order — up to 6 months, then deleted.
• Order and delivery records — 12 months after delivery, so we can honour exchanges and answer disputes.
• Sales and tax records — up to 6 years where required by Pakistani tax law. These are financial records; we minimise the personal detail held in them.
• WhatsApp conversations — up to 12 months, then older chats are cleared.
• Published reviews — until you ask us to remove them.
• Crash and diagnostic logs — up to 90 days.
• Restock notification requests — deleted as soon as we have notified you, or after 3 months.

12Your rights

Whatever country you are in, you may ask us to:

• Access the personal information we hold about you, and receive a copy of it.
• Correct anything that is wrong or out of date — a misspelled name or an old address.
• Delete your personal information, subject to records we must keep by law (see section 13).
• Withdraw consent you previously gave, such as for marketing, location or a published review.
• Object to or restrict a particular use of your data.
• Receive your data in a portable format — we will send a plain text or CSV file.
• Complain to us, and to a data protection authority in your jurisdiction if one has authority over your complaint.

Ask by emailing hello@lalico.pk or messaging +92 300 845 2716. We reply within 7 working days and complete the request within 30 days. We may ask you to confirm the phone number or email you originally ordered from, so we do not hand your details to someone else. We do not charge for this, and exercising any of these rights will never affect the service you receive from us.

13Deleting your data

You can ask us to erase your personal information at any time, and you do not need a reason. There are three ways to do it:

• In the app — open Menu → Privacy → Request data deletion and confirm. This submits the request straight to us.
• By email — send "Delete my data" to hello@lalico.pk from the address you contacted us with.
• On WhatsApp — message "Delete my data" to +92 300 845 2716 from your registered number.

What happens next

• We acknowledge your request within 7 working days.
• We erase your name, phone number, email, delivery address, messages and any published review within 30 days.
• Uninstalling the app also removes any data the app had stored locally on your device.
• We confirm in writing once the deletion is complete.

14How we protect data

We are a small team and we keep our security simple and practical rather than claiming more than we do:

• Encryption in transit — the website and app use HTTPS/TLS for every request.
• Access control — order records are reachable only by the two people who pack and dispatch orders, on password-protected, screen-locked devices.
• Two-factor authentication — enabled on our email, hosting and WhatsApp Business accounts.
• Data minimisation — we do not ask for information we have no use for, which is the most effective protection available to us.
• No card data — because we never handle payment credentials, there are none to lose.
• Disposal — printed delivery labels and packing slips are shredded once an order is closed.

No system is perfectly secure. If a breach ever affects your personal information, we will notify you and any relevant authority without undue delay, and tell you plainly what happened, what was exposed and what to do about it.

15Children's privacy

Our website, our app and our products are intended for adults. The LALI & CO app is not designed for or directed at children, is not listed in Google Play's Families programme, and contains no child-directed content or advertising.

We do not knowingly collect personal information from anyone under 18. If you are under 18, please ask a parent or guardian to place any order on your behalf. If we learn that we hold information belonging to a child, we delete it promptly.

If you are a parent or guardian and believe your child has sent us personal information, contact hello@lalico.pk and we will remove it and confirm once it is gone.

16International transfers

We operate from Pakistan and your data is normally handled here. Some of the service providers we depend on — our email provider, our website host, Google Play and WhatsApp — operate servers outside Pakistan, so limited data may be processed abroad.

Where that happens, we use established providers that publish their own data protection commitments and contractual safeguards. If you would rather we did not use WhatsApp for your enquiry, email or telephone us instead and we will keep the conversation there.

17Changes to this policy

We may update this policy when our practices, our app or the law changes. When we do, we will change the "last updated" date at the top of this page and increment the version number.

If a change materially affects how we use your personal information, we will give you clear advance notice — a notice on this website, an in-app message, and where appropriate a direct message to customers with an open order. We will never apply a materially different use to data we already hold without asking you first. Continuing to use our website or app after a change takes effect means you accept the updated policy.

Earlier versions are available on request from hello@lalico.pk.

18Contact us

Any question about this policy, your data, or a request to access or delete it goes to the same place — there is no separate department, you will be talking to the people who run the shop.

• Email: hello@lalico.pk
• Phone & WhatsApp: +92 300 845 2716
• Address: LALI & CO, Lahore, Pakistan
• Reply hours: Monday to Saturday, 10am – 8pm PKT
• Response time: within 7 working days for any privacy request

If you are not satisfied with how we have handled your request, tell us so directly and we will escalate it internally. You also retain the right to complain to a competent data protection or consumer authority in your jurisdiction.

Back to the shop →