Privacy Policy

Last updated: 1 June 2026  ·  Effective: 1 June 2026  ·  Controller: Star Styles Uganda

1. Who We Are

Star Styles Uganda ("we", "us", "our") is a fashion retail business operating at:

Ham Shopping Grounds, Block U, Level 1, Shop no. U076-77, Kampala, Uganda
Email: info@starstylesworldwide.com
Phone: +256 757 650 533
Website: starstylesug.com

We are the data controller for personal data collected through this website.

2. What Data We Collect

When you place an order:

• Name, email address, phone number
• Delivery address (street, city, ZIP/postcode, country)
• Order details (items, quantities, sizes, colours)
• Payment method (we do not store card numbers — payments are processed by our payment provider)

When you create an account:

• Name and email address
• Hashed password (we never store plain-text passwords)

Automatically collected:

• IP address (for fraud/security purposes only)
• Browser type and device information
• Pages visited and time on site (analytics)

We do NOT collect: race, religion, health data, political opinions, or any special-category data.

3. Why We Collect It (Legal Basis under GDPR Art. 6)

• Contract performance (Art. 6(1)(b)): To process and deliver your order.
• Legitimate interests (Art. 6(1)(f)): To prevent fraud, secure our platform, and improve our services.
• Legal obligation (Art. 6(1)(c)): To comply with tax and accounting requirements.
• Consent (Art. 6(1)(a)): For marketing communications — only if you explicitly opt in.

4. How We Use Your Data

• Process, fulfil and ship your orders
• Send order confirmation and shipping updates
• Handle returns and customer service enquiries
• Detect and prevent fraud and security incidents
• Comply with legal and tax obligations
• Send promotional emails — only with your consent, and you can unsubscribe anytime

5. Who We Share Data With

We only share your data where necessary:

• Shipping partners — to deliver your order (name and address only)
• Payment processor — Flutterwave / Stripe (they handle card data under PCI-DSS; we never see your full card number)
• Hosting provider — Hostinger (servers in EU/US; GDPR-compliant)
• Legal authorities — only when required by law

We never sell, rent, or trade your personal data to third parties for marketing.

6. How Long We Keep It

• Order data: 7 years (Ugandan tax law requirement)
• Account data: Until you delete your account or request erasure
• Session tokens: 8 hours (auto-expired)
• Security logs (IP/rate-limit): 15 minutes, then auto-deleted
• Marketing consent: Until you withdraw consent

7. Your Rights (GDPR)

If you are in the EU, UK, or a jurisdiction with equivalent laws, you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure ("right to be forgotten") — request deletion of your data
• Restriction — limit how we process your data
• Portability — receive your data in a machine-readable format
• Object — opt out of processing based on legitimate interests or direct marketing
• Withdraw consent — at any time, for consent-based processing
• Lodge a complaint — with your local data protection authority

To exercise any right, email info@starstylesworldwide.com with "Data Request" in the subject. We will respond within 30 days.

8. Cookies

We use the following cookies:

• ss_cust_token — keeps you logged in (session, HTTP-only, expires in 8 hours)
• ss_admin_token — admin session (HTTP-only, expires in 4 hours)
• Theme preference — stores dark/light mode choice (localStorage, not a cookie)

We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

9. Security

• All passwords hashed using bcrypt (industry standard)
• All connections encrypted via HTTPS (TLS 1.2+)
• Session tokens are cryptographically random (64-byte hex)
• Rate limiting: 3 attempts per 15 minutes to prevent brute-force attacks
• All database inputs are parameterised (SQL injection prevention)
• All output is sanitised (XSS prevention)
• HTTP security headers (X-Content-Type-Options, X-Frame-Options, etc.)

No security system is perfect. If you discover a vulnerability, please email info@starstylesworldwide.com responsibly.

10. Children's Privacy

Our services are not directed at children under 16. We do not knowingly collect data from children. If you believe we have collected data from a child, please contact us immediately for deletion.

11. International Transfers

Your data is stored on Hostinger servers. When data is transferred outside Uganda or the EEA, we ensure adequate safeguards are in place (Standard Contractual Clauses or equivalent). Payment data processed by Flutterwave or Stripe is subject to their own GDPR/privacy commitments.

12. Changes to This Policy

We may update this policy. When we do, we will update the "Last updated" date at the top and, for material changes, notify you by email or a banner on the website.

13. Contact Us

For any privacy questions or data requests:

Star Styles Uganda
Ham Shopping Grounds, Block U, Level 1, Shop no. U076-77
Kampala, Uganda
info@starstylesworldwide.com
+256 757 650 533
WhatsApp