Privacy Policy

1. Who We Are

Mills Luxury Bags ("we", "us", or "our") operates the website at https://www.millsluxurybags.com. We are an online retail business registered in Ghana that sells premium bags including travel luggage, backpacks and school bags.

We are the data controller responsible for your personal data. If you have any questions about this policy, please contact us at blackmills02@gmail.com.

2. Information We Collect

Information you give us directly

• Account registration — your first name, last name, email address and password when you create an account.
• Orders — your name, phone number, delivery address and city/region when you place an order.
• Reviews — any text you submit when leaving a product review.
• Newsletter — your email address if you subscribe to our newsletter.
• Communications — any messages you send us by email or through our contact channels.

Information collected automatically

• Usage data — pages visited, time spent, links clicked and referring URLs.
• Device data — browser type, operating system and IP address.
• Session data — a session cookie to keep you logged in and maintain your cart.

Information from third parties

• Paystack — when you pay, Paystack shares a transaction reference, payment status and channel with us. We do not receive your full card number or mobile money PIN.

3. How We Use Your Information

• Fulfilling your orders — processing purchases, arranging delivery and sending order confirmations.
• Account management — creating and maintaining your account and enabling you to view your order history.
• Customer support — responding to your questions, complaints and returns requests.
• Payment processing — passing necessary details to Paystack to complete transactions securely.
• Marketing — sending promotional emails only if you have subscribed. You can unsubscribe at any time.
• Improving our service — analysing how customers use our website to make it better.
• Legal compliance — maintaining records as required by Ghanaian law.
• Security — detecting and preventing fraud, abuse and unauthorised access.

4. Sharing Your Information

We do not sell, rent or trade your personal data. We only share it in these limited circumstances:

• Delivery partners — your name, phone number and delivery address to fulfil your order.
• Paystack — your email address and order amount to process payment. Paystack's own privacy policy applies to their data handling.
• Legal requirements — if required by law, court order or a government authority in Ghana.
• Business transfer — if we are acquired or merge with another business. We will notify you beforehand.

5. Payment Data

All payments are processed by Paystack, a PCI-DSS compliant payment gateway. We do not store your full card number, card CVV or mobile money PIN on our servers. When you pay you are redirected to Paystack's secure hosted payment page.

For more information read the Paystack Privacy Policy.

6. Cookies

We use two types of cookies:

• Session cookie — keeps you logged in and maintains your shopping cart. Deleted when you close your browser or log out.
• Security cookie — stores a CSRF token to protect your account from unauthorised form submissions.

We do not use third-party tracking or advertising cookies. Disabling cookies will prevent you from logging in or completing a purchase.

7. Data Retention

• Account data — retained while your account is active. Deleted within 30 days of an account deletion request, except where legally required.
• Order records — retained for a minimum of 5 years for financial and legal compliance.
• Newsletter subscriptions — retained until you unsubscribe.
• Support communications — retained for 2 years from the last communication.

8. Your Rights

• Access — request a copy of the personal data we hold about you.
• Correction — update your name, phone and address from your account page at any time.
• Deletion — request deletion of your account and personal data, subject to legal retention requirements.
• Objection — opt out of marketing emails by clicking unsubscribe in any email we send.
• Portability — request a copy of your data in a portable format.

To exercise these rights email blackmills02@gmail.com. We will respond within 30 days.

9. Security

• All passwords are hashed using bcrypt — we cannot see your password in plain text.
• CSRF tokens protect all forms from cross-site request forgery attacks.
• Session cookies are set with HTTP-only and SameSite flags to prevent theft by malicious scripts.
• Security headers including Content Security Policy and X-Frame-Options are applied on every page.
• Rate limiting protects login and registration from brute-force attacks.

If you discover a security vulnerability, please report it to blackmills02@gmail.com.

10. Children's Privacy

Our website is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has provided us with personal information, contact us at blackmills02@gmail.com and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will update the "Last updated" date and, where appropriate, notify you by email. Your continued use of our website after any changes means you accept the updated policy.

12. Contact Us

If you have any questions about this Privacy Policy, please contact us: