Privacy Policy

Last updated: 17 September 2026

1. Who we are

Lobaba ("we", "us", "our") runs the online store at lobabahairclips.com. We are based in the United States and we sell hair clips and stick-on gem sheets to customers around the world. For people in the EU and the UK, we are the data controller for the information described here.

You can reach us any time at lobabashop@163.com.

2. What this policy covers

This explains what personal information we collect when you visit our store, buy something, sign up to our emails or contact us; why we collect it; who else sees it; and what you can ask us to do about it. It does not cover other companies' websites that we link to.

3. What we collect

Things you give us. Your name, email address, shipping and billing address, phone number if you give one, what you ordered, and anything you write to us in an email or a contact form. If you create an account, your login details. If you leave a review or send us a photo, that too.

Things collected automatically. Your IP address, rough location based on it, device and browser type, the pages you looked at, what you put in your cart, how you arrived at our site, and similar usage data. This comes from cookies and similar technologies.

Things we get from others. Order and delivery updates from our shipping carriers, fraud signals from payment and fraud-prevention providers, and aggregate performance data from advertising or analytics platforms where we use them.

We do not ask for and do not want sensitive information such as health data, government ID numbers, or racial, religious or political information. Please do not send it to us.

4. Why we use it

To take and fulfil your order, take payment, and tell you where your parcel is. To answer your questions and handle returns and refunds. To send you marketing emails if you asked for them. To understand which products and pages people like, so we can make the store better. To detect and prevent fraud and abuse. To meet our legal, tax and accounting obligations.

If you are in the EU or the UK, our legal bases are: performing our contract with you (orders and delivery); your consent (marketing emails, non-essential cookies), which you can withdraw at any time; our legitimate interests (keeping the store secure, preventing fraud, improving what we sell); and compliance with a legal obligation (tax and accounting records).

5. Payments

Payments are processed by Shopify and the payment providers it connects to. Your full card number goes to them, not to us — we never see or store it. We do see the last few digits, the card brand, and whether the payment succeeded, so that we can match a payment to your order and handle refunds.

6. Cookies and similar technologies

Cookies are small files stored by your browser. We use ones that are necessary for the store to work at all (keeping you logged in, remembering your cart, checkout security). We also use ones that help us understand how the store is used, and — where we advertise — ones that measure whether an ad led to a visit or a sale.

You can refuse or delete cookies in your browser settings, and where we show a cookie banner you can set your preferences there. Blocking the necessary ones will break parts of the store. Where the law requires it, we treat a Global Privacy Control signal from your browser as an opt-out of sharing your information for targeted advertising.

7. Who else sees your information

We share what is needed, with companies that work for us and are only allowed to use it to do that work:

• Shopify, which hosts this store and processes orders and payments
• Payment and fraud-prevention providers
• Shipping carriers and fulfilment partners, so your parcel can reach you
• Our email platform, if you are subscribed to marketing
• Analytics providers, and advertising platforms if and when we run ads
• Professional advisers such as accountants, where necessary

We also disclose information if the law requires it, to respond to a lawful request, to enforce our terms, or to protect someone's rights or safety. If our business is ever sold or reorganised, customer information may transfer as part of it.

We do not sell your personal information for money. Some advertising cookies may count as "sharing" or a "sale" under certain US state laws; see section 15 for how to opt out.

8. Shopify's own role

Shopify provides the platform this store runs on. For some of its features Shopify acts as an independent controller of the data it holds, under its own privacy policy, and not on our instructions. If you want to know how Shopify handles data, their policy is on shopify.com.

9. Marketing emails

We only send marketing emails to people who asked for them — by joining the Lobaba club or ticking the box at checkout. Every one of them has an unsubscribe link at the bottom, and unsubscribing takes effect straight away. We will still email you about orders you have placed, because that is part of the contract, not marketing.

10. Where your information goes

We are based in the United States, and our providers may be in the United States or elsewhere. If you are in the EU or the UK, that means your information may be transferred outside your country. When it is, we rely on the safeguards available to us, such as the European Commission's standard contractual clauses and the UK addendum, or a transfer to a country the authorities have decided offers adequate protection. Ask us and we will tell you which applies.

11. How long we keep it

Order and payment records: as long as our tax and accounting obligations require, which in most places is several years. Account details: while your account is open. Marketing contacts: until you unsubscribe, and then a minimal record so we do not email you again by mistake. Support emails: as long as needed to deal with the matter and any follow-up. After that we delete it or strip out anything that identifies you.

12. Security

We use the protections built into Shopify's platform, keep access to customer data limited to the people who need it, and rely on encrypted connections. No system is perfectly secure, and we cannot promise that nothing will ever go wrong. If a breach affects you and the law requires us to tell you, we will.

13. Your rights

Wherever you live, you can ask us to: tell you what information we hold about you; give you a copy; correct anything that is wrong; delete it; stop using it for marketing; or stop sharing it for targeted advertising. Email lobabashop@163.com and we will reply within the time the law allows, normally a month. We will not treat you worse for asking. We may need to check who you are before we act, so that we do not hand your information to someone else.

If we turn a request down, you can ask us to look at it again.

14. If you are in the EU or the UK

Under the GDPR and UK GDPR you also have the right to restrict how we use your information, to object to processing we base on legitimate interests, to receive your information in a portable format, and to withdraw consent at any time without affecting what we did before you withdrew it. You can complain to your national data protection authority, or in the UK to the Information Commissioner's Office.

15. If you are in California

Under the CCPA as amended by the CPRA you can ask us to disclose what we collected about you in the last 12 months, where it came from, why we collected it and who we shared it with; ask us to delete or correct it; and opt out of the "sale" or "sharing" of your personal information for cross-context behavioural advertising. We do not sell personal information for money, and we do not knowingly sell or share the information of anyone under 16. To opt out, email us or use the privacy controls shown on the site; we also honour Global Privacy Control signals. You may use an authorised agent, and we will not discriminate against you for exercising any of these rights.

16. If you are in another US state

Several states — including Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others — give residents rights to confirm whether we process their information, access it, correct it, delete it, receive a copy, and opt out of targeted advertising, sale, or profiling that has legal effects. The same email address handles all of these, and you can appeal a decision we make.

17. Children

Our store is meant for adults. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us their information, email us and we will delete it. Note that our gem sheets contain small parts and are not suitable for children under 3.

18. Other websites

Our site links to other places — social media, payment providers, carriers' tracking pages. Once you are there, their privacy policy applies, not ours. We are not responsible for what they do with your information.

19. Complaints

If you think we have handled your information badly, please email us first — we would rather fix it. You can also complain to the data protection authority where you live: the ICO in the UK, your national authority in the EU, or your state attorney general in the United States.

20. Changes to this policy

We may update this policy as the store changes or as the law does. The current version is always on this page, with the date it was last changed at the top. If a change is significant, we will do more than quietly update the date.

21. Contact us

Questions, requests, or anything that does not look right:

Lobaba
Email: lobabashop@163.com

We are based in the United States. If you need a postal address for a formal request, email us and we will provide one.