Who we are
This site is operated by Premium Pakistani Dresses(“we”). For anything in this policy, use our contact form and we will route your request to the right person.
What we collect
When you order
- Your name, email address and, if you give one, a phone number.
- Delivery and billing addresses.
- What you ordered, the stitching option, the price paid, the delivery method and the order status history.
- For made-to-measure pieces: the body measurements you submit, your preferred fit, any written instructions and any reference photograph you upload. Reference images are held in a private storage bucket and are not publicly reachable.
When you create an account
- Your email address and a password. Passwords are handled by our authentication provider and stored only as a cryptographic hash — nobody at this business can read your password.
- Saved addresses and saved measurement sets, which exist only because you chose to save them and can be deleted at any time from your account.
When you contact us
- Your name, email address, any phone number you give, and the content of your message.
- A hashed form of your IP address, used to rate limit the form against abuse. We store the hash, not the address itself.
When you browse
- A cart identifier so your bag survives a page reload. For guests this is a random token in an httpOnly cookie — it is not linked to you as a person.
- Standard server request data such as the pages requested and the time of the request.
- Analytics data, only if you consent to it. See cookies and analytics below.
Why we use it
- To perform our contract with you — taking the order, cutting the garment to your measurements, arranging delivery, handling returns and answering support requests.
- To meet legal obligations — keeping transaction and tax records for the period the law requires.
- For our legitimate interests — preventing fraud and abuse, rate-limiting public forms, maintaining an audit trail of administrative actions, and improving the service.
- With your consent — marketing email and analytics. Both are opt-in and both can be withdrawn at any time, marketing via the unsubscribe link in every marketing email.
We do not sell personal data, we do not share it with data brokers, and we do not build advertising profiles from it.
Payments
Card payments are processed by Stripe. Your card number, expiry date and security code are entered on Stripe’s own payment page and never reach our servers. We cannot see them, we do not store them, and we cannot charge your card without you starting a new payment.
What we do store is what we need to run the order: the payment status, the amount, the currency and the reference the payment provider gives us. Stripe processes your payment data as an independent controller under its own privacy policy.
Who else processes it
We keep this list short on purpose. Each of these providers processes data on our instructions, for the stated purpose only.
- Supabase — database, authentication and file storage. It holds your account, orders, addresses and measurement data.
- Stripe — card payments and payment status.
- Our email provider — transactional email such as order confirmations, dispatch notices and password resets. Where no provider is configured, email is logged rather than sent, and nothing leaves our systems.
- Couriers — the name, address and phone number needed to deliver your parcel and to contact you about the delivery.
- Analytics providers — only where you have consented, and only the providers named in the consent banner.
Cookies and analytics
Essential cookies keep your session and your bag working. They cannot be switched off without breaking the site, and they are not used for advertising.
- Session cookies — keep you signed in and refresh your session securely.
- Guest cart token — an httpOnly cookie holding a random identifier so your bag is still there when you come back.
- Consent preference — records the choice you made in the cookie banner, so we do not ask again.
Analytics scripts load only after you accept them in the banner. If you decline, or ignore the banner, no analytics or advertising script is loaded at all. You can change your mind at any time from the banner control.
How long we keep it
- Orders and invoices — for as long as applicable tax and accounting law requires.
- Account data — until you ask us to delete the account. Orders already placed are retained under the line above, with the account link removed where possible.
- Saved measurements and addresses — until you delete them, or until your account is deleted.
- Contact enquiries — for no longer than necessary after the enquiry is closed.
- Marketing subscriptions — until you unsubscribe, plus a suppression record so we do not email you again by accident.
- Hashed IP addresses — kept only as long as the abuse-prevention purpose requires.
How it is protected
- All traffic is served over HTTPS.
- Database access is governed by row-level security, so a signed-in customer can only read their own orders, addresses and measurements.
- Administrative access is restricted by role, and administrative actions are recorded in an audit log.
- Public forms are rate limited and carry spam protection.
- Uploaded reference images are stored in a private bucket, never a public one.
No system is perfect. If we ever become aware of a breach affecting your data, we will tell you and the relevant authority as the law requires.
Your rights
Depending on where you live, you can ask us to:
- give you a copy of the personal data we hold about you;
- correct anything that is wrong;
- delete data we no longer need to keep;
- restrict or object to a particular use;
- provide your data in a portable format;
- withdraw consent you previously gave, at any time.
Use our contact form. We will ask you to confirm your identity — usually by replying from the email address on the account — and we will respond within the period the law that applies to you allows. If you are not satisfied with our answer, you can complain to your national data protection authority.
International transfers
We ship worldwide and our providers operate internationally, so your data may be processed in a country other than your own. Where that happens we rely on the transfer safeguards offered by those providers, such as standard contractual clauses.
Children
This store is intended for adults. We do not knowingly collect data from children. If you believe a child has given us personal data, tell us and we will remove it.
Changes to this policy
If we change how we handle personal data, we will update this page and change the date at the top. Material changes will be communicated to account holders by email. Using the site after a change means the updated policy applies to you.
